Re:Rubygems.org AWS Root Access Event – September 2025
by JoshTriplett on Friday October 10, 2025 @02:57AM
(#45536054)
Update: https://andre.arko.net/2025/10/09/the-rubygems-security-inci... is pretty much exactly the kind of thing I expected here. Person with legitimate access doing their job, organization flailing around in the process of kicking people out that should never have been kicked out in the first place.
[ Parent
| on HN ]
Re:Rubygems.org AWS Root Access Event – September 2025
by tptacek on Friday October 10, 2025 @09:05AM
(#45538551)
He changed the AWS root account password; RC implies they had to go through a reset flow to recover the account. This apparently went on for more than a week. I don't know how to reconcile what Arko is claiming with what RC is claiming.
Re:Rubygems.org AWS Root Access Event – September 2025
by sylens on Friday October 10, 2025 @06:45PM
(#45544699)
Arko believed he was in the right to do so, and while he probably should've reached out sooner to notify them of the "precaution" he was taking, the fact that they didn't notice for almost two weeks shows how unserious they are about security