News for hackers. Stuff that matters.

A comment on Exploitation of an old Rails vulnerability. Parent comment

Re:Exploitation of an old Rails vulnerability by tomfakes on Monday May 27, 2013 @06:35PM (#5776975)
On exactly this subject, I'm in the process of building a SaaS app that will alert you of security vulnerabilities in Gems in your Rails and other Ruby apps.

Sign up at my landing page to here more when I'm closer to launch

http://www.rubyaudit.com

[ Parent | on HN ]
Re:Exploitation of an old Rails vulnerability by trustfundbaby on Tuesday May 28, 2013 @12:58AM (#5778166)
You should know that New Relic is already doing this with Rails versions right now
[ Parent | on HN ]
Re:Exploitation of an old Rails vulnerability by Hates_ on Monday May 27, 2013 @06:36PM (#5776979)
Doesn't seem to be anywhere to sign up.
[ Parent | on HN ]
Re:Exploitation of an old Rails vulnerability by tomfakes on Monday May 27, 2013 @06:48PM (#5777019)
Doh! I just got the landing page setup, and the signup configured, but never pushed it out.

Try it now.

Thanks

[ Parent | on HN ]
Re:Exploitation of an old Rails vulnerability by piggity on Monday May 27, 2013 @10:23PM (#5777665)
Interesting idea, it looks like you scan the Gemfile.lock (or equivalent) at "deploy" time.

My preference would be to upload that Gemfile.lock to a location, and then it could be scanned as and when new vulnerabilities were detected.

[ Parent | on HN ]
Re:Exploitation of an old Rails vulnerability by tomfakes on Monday May 27, 2013 @10:48PM (#5777744)
The problem with an upload is that you rely on someone to re-upload when they change their Gems. Changing the locked Gems means a re-check is needed, as they might have switched to bad versions.

Making this automatic is the key part - if you don't get burned very often, you'll eventually forget to do the right thing manually and open yourselves to badness.

[ Parent | on HN ]