Comment on Introducing Pow, a zero-configuration Rack server for Mac OS XparentComments−FooBarWidget15yAnybody can also spoof DNS entries to point rubygems.org/debian.org/centos.org/redhat.com to a malicious place where the packages contain postinstall scripts that run 'rm -rf /'.−dpiddy15yMaybe for rubygems, not so easy for apt/rpm as they use gpg signing/verification of package indices.−FooBarWidget15yRubyGems also have signing facilities. Most authors don't bother signing however because generating a key is too much trouble.
Comments
Anybody can also spoof DNS entries to point rubygems.org/debian.org/centos.org/redhat.com to a malicious place where the packages contain postinstall scripts that run 'rm -rf /'.
Maybe for rubygems, not so easy for apt/rpm as they use gpg signing/verification of package indices.
RubyGems also have signing facilities. Most authors don't bother signing however because generating a key is too much trouble.