News for hackers. Stuff that matters.

A comment on Rails 3.2.18, 4.0.5 and 4.1.1 have been released.

Re:Rails 3.2.18, 4.0.5 and 4.1.1 have been released by atonse on Tuesday May 06, 2014 @01:56PM (#7706046)
Tangential security nitpick - doesn't it defeat the purpose to display SHA or MD5 sums for downloads over a non-ssl page?

A bad actor could easily modify these in a proxy etc when serving the page.

Edit: Unless the purpose isn't to prevent tampering, but for error-correction.

[ Parent | on HN ]
Re:Rails 3.2.18, 4.0.5 and 4.1.1 have been released by stronglikedan on Tuesday May 06, 2014 @06:09PM (#7707406)
An attacker would have to modify the actual gem files in a way that would yield the same checksums, since the hashing is one way only.
[ Parent | on HN ]
Re:Rails 3.2.18, 4.0.5 and 4.1.1 have been released by rst on Tuesday May 06, 2014 @06:31PM (#7707536)
The attack scenario is that the man-in-the-middle alters the checksums in the page to match the checksums of his backdoored version.
[ Parent | on HN ]