News for hackers. Stuff that matters.

A comment on Rails 3.2.18, 4.0.5 and 4.1.1 have been released. Parent comment

Re:Rails 3.2.18, 4.0.5 and 4.1.1 have been released by stronglikedan on Tuesday May 06, 2014 @06:09PM (#7707406)
An attacker would have to modify the actual gem files in a way that would yield the same checksums, since the hashing is one way only.
[ Parent | on HN ]
Re:Rails 3.2.18, 4.0.5 and 4.1.1 have been released by rst on Tuesday May 06, 2014 @06:31PM (#7707536)
The attack scenario is that the man-in-the-middle alters the checksums in the page to match the checksums of his backdoored version.
[ Parent | on HN ]