News for hackers. Stuff that matters.

A comment on Exploitation of an old Rails vulnerability. Parent comment

Re:Exploitation of an old Rails vulnerability by Hates_ on Monday May 27, 2013 @06:36PM (#5776979)
Doesn't seem to be anywhere to sign up.
[ Parent | on HN ]
Re:Exploitation of an old Rails vulnerability by tomfakes on Monday May 27, 2013 @06:48PM (#5777019)
Doh! I just got the landing page setup, and the signup configured, but never pushed it out.

Try it now.

Thanks

[ Parent | on HN ]
Re:Exploitation of an old Rails vulnerability by piggity on Monday May 27, 2013 @10:23PM (#5777665)
Interesting idea, it looks like you scan the Gemfile.lock (or equivalent) at "deploy" time.

My preference would be to upload that Gemfile.lock to a location, and then it could be scanned as and when new vulnerabilities were detected.

[ Parent | on HN ]
Re:Exploitation of an old Rails vulnerability by tomfakes on Monday May 27, 2013 @10:48PM (#5777744)
The problem with an upload is that you rely on someone to re-upload when they change their Gems. Changing the locked Gems means a re-check is needed, as they might have switched to bad versions.

Making this automatic is the key part - if you don't get burned very often, you'll eventually forget to do the right thing manually and open yourselves to badness.

[ Parent | on HN ]