News for hackers. Stuff that matters.

A comment on Rubygems.org compromised. Parent comment

Re:Rubygems.org compromised by benmanns on Wednesday January 30, 2013 @10:14AM (#5139790)
But don't applications have to explicitly install this gem? If not, then I am incorrect.
[ Parent | on HN ]
Re:Rubygems.org compromised by bittersweet on Wednesday January 30, 2013 @11:02AM (#5140025)
Qrush, one of the guys behind Rubygems tweeted that the credentials of every yml file ended up on pastie: https://twitter.com/qrush/status/296638346283868160

> Someone posted http://rubygems.org 's config/*.yml to pastie. Didn't include the S3 bucket secret key, but going to reset everything anyway.

[ Parent | on HN ]
Re:Rubygems.org compromised by bradleyland on Wednesday January 30, 2013 @10:46AM (#5139931)
We don't know the extent to which Rubygems was compromised yet. In a scenario like this, it's best to err on the safe side and avoid trusting the source for the time being.
[ Parent | on HN ]