News for hackers. Stuff that matters.

A comment on Rubygems.org compromised. Parent comment

Re:Rubygems.org compromised by benmmurphy on Wednesday January 30, 2013 @09:46AM (#5139661)
it looks like someone has tried to steal rubygems.org db and other credentials. bundle update is now dangerous because you might get trojaned files.
[ Parent | on HN ]
Re:Rubygems.org compromised by benmanns on Wednesday January 30, 2013 @10:14AM (#5139790)
But don't applications have to explicitly install this gem? If not, then I am incorrect.
[ Parent | on HN ]
Re:Rubygems.org compromised by bittersweet on Wednesday January 30, 2013 @11:02AM (#5140025)
Qrush, one of the guys behind Rubygems tweeted that the credentials of every yml file ended up on pastie: https://twitter.com/qrush/status/296638346283868160

> Someone posted http://rubygems.org 's config/*.yml to pastie. Didn't include the S3 bucket secret key, but going to reset everything anyway.

[ Parent | on HN ]
Re:Rubygems.org compromised by bradleyland on Wednesday January 30, 2013 @10:46AM (#5139931)
We don't know the extent to which Rubygems was compromised yet. In a scenario like this, it's best to err on the safe side and avoid trusting the source for the time being.
[ Parent | on HN ]