TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Mining for Malicious Ruby Gems

14 pointsby afrcncabout 5 years ago

3 comments

bhaakabout 5 years ago
&gt; The perfect candidate to succumb to this type of “spray-and-pray” supply chain attack is a Ruby developer whose environment of choice is a Windows system that’s also periodically being used to make BitCoin transactions. A rare breed indeed.<p>Very rare indeed. I suppose every package had their own BTC address. I wonder how much they got away with.<p>But I thought rubygems does a similarity check for names and reject or flag them for manual verification if the name is too similar to an existing one?
评论 #22907768 未加载
queseraabout 5 years ago
I would support a Great Renaming, wherein underscores and dashes are considered equivalent and insignificant:<p><pre><code> action-mailer_cache_delivery action-mailer-cache-delivery actionmailercachedelivery act-ion-ma-iler_c-ache-deli_very </code></pre> Should resolve to the same entry in RubyGems.<p>I would also support this usage in `require` lines.<p>The &quot;experts-exchange&quot; (or &quot;pen-is-mightier&quot;) problem is tiny compared to the frustration and security risk of the present policy.
lonelappdeabout 5 years ago
Free software projects need to converge on standard platforms and tools. On the modern complex world, it&#x27;s bad enough that they can&#x27;t keep with proprietary software features and polish. But they can&#x27;t keep up with the black hat industry either.