I'm on an iPhone and going to dinner in a second, but can someone tell them that Gem::Requirements line is a pretty dead ringer for the YAML exploits from January? Servers that haven't been owned yet should update Rails, see my article from January. Owned servers need to get rebuilt from metal, as per usual.
It's surprising how often people rely on their own obscurity when they hear about security vulnerabilities. Sure, I could go upgrade Rails, but why bother? I'm only using it for a personal project.
The reality is that bad actors scan the pubic Internet for exploitable servers all the time. It's easy, it's cheap, and it's a very effective way to grow your botnet. If you're on the Internet, it doesn't matter how obscure you are: someone will eventually probe you.
Every time I touch a new project it's in need of security updates. Any time a site gets owned, there's no accountability or logging or anything. Any time a security issue does manage to get found it's as if it's a rare new thing. "Wow, who would have thought that could happen." Well, let's see, the developers of the software you're using, and anyone that pays attention to them.
We also have a mailing list we regularly send out updates to that we set up after the Rails vuln fiasco - you can sign up for it here, if interested: https://www.tinfoilsecurity.com/railscheck
Also http://getshrubbery.com/home which is free, but seemed mildly broken when I tried it (it seemed to forget some of my actually outdated packages when I tried it).
Comments
I'm on an iPhone and going to dinner in a second, but can someone tell them that Gem::Requirements line is a pretty dead ringer for the YAML exploits from January? Servers that haven't been owned yet should update Rails, see my article from January. Owned servers need to get rebuilt from metal, as per usual.
It's surprising how often people rely on their own obscurity when they hear about security vulnerabilities. Sure, I could go upgrade Rails, but why bother? I'm only using it for a personal project.
The reality is that bad actors scan the pubic Internet for exploitable servers all the time. It's easy, it's cheap, and it's a very effective way to grow your botnet. If you're on the Internet, it doesn't matter how obscure you are: someone will eventually probe you.
Seriously, these guys have been completely out of the loop.
> I think we have to warm all RoR developers...
These are the average developer.
Every time I touch a new project it's in need of security updates. Any time a site gets owned, there's no accountability or logging or anything. Any time a security issue does manage to get found it's as if it's a rare new thing. "Wow, who would have thought that could happen." Well, let's see, the developers of the software you're using, and anyone that pays attention to them.
Thus, if you don't know what you're doing, subscribe to a service like Gem Canary (http://gemcanary.com/) so you get alerts.
We also have a mailing list we regularly send out updates to that we set up after the Rails vuln fiasco - you can sign up for it here, if interested: https://www.tinfoilsecurity.com/railscheck
I like this. Is there anything comparable for Python or Node.js?
Yes, try https://bundlescout.com/
Also http://getshrubbery.com/home which is free, but seemed mildly broken when I tried it (it seemed to forget some of my actually outdated packages when I tried it).
Try https://david-dm.org/ for node.js.
Article: "What The Rails Security Issue Means For Your Startup"
http://www.kalzumeus.com/2013/01/31/what-the-rails-security-...
Pssst, patio11 wrote that.
Regardless, it's an absolute must read for anyone even thinking about using rails.