News for hackers. Stuff that matters.

A comment on What The Rails Security Issue Means For Your Startup. Parent comment

Re:What The Rails Security Issue Means For Your Startup by purephase on Thursday January 31, 2013 @11:27AM (#5145709)
Pretty good breakdown going on here [1]. To be honest, while the chosen tool to provide the update is odd, it is one of the best post-mordems that I've seen and applaud the volunteers for taking it so seriously.

1. I wouldn't say so. Not until they're all the way through.

2. Not at the moment, but general guidance is that we should all have local gem repos that we maintain ourselves and only rely on external sources when needed. It is something I'm going to look into ASAP.

[1] https://docs.google.com/document/d/10tuM51VKRcSHJtUZotraMlrM...

[ Parent | on HN ]
Re:What The Rails Security Issue Means For Your Startup by josephlord on Thursday January 31, 2013 @02:17PM (#5146759)
It is extensive and up to date but it is lacking a brief status of the current situation and whether the site is safe to download from. The answer is currently "no", 90% safe is unsafe.

It's a shame that they seem to have put the service back up in an unsafe mode, I would have hoped that they could have quarantined the unverified Gems.

Edit: Looking at the status page the API is down so it can't be accessed from Bundler so they are doing it the good/safe way.

[ Parent | on HN ]