TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Ruby Security Have You Not

96 点作者 vasinov大约 11 年前

15 条评论

phillmv大约 11 年前
Hey!<p>I&#x27;m one of the maintainers behind the Ruby advisory database: <a href="https://github.com/rubysec/ruby-advisory-db" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;rubysec&#x2F;ruby-advisory-db</a><p>We&#x27;re trying to build a common database for people building these tools; at the moment, trawling through CVE disclosures and various mailing lists is a largely manual process that we can reap economies of scale by pooling our efforts together.<p>It&#x27;s free and volunteer run. I would like to encourage you and anyone else reading this who is interested in bolstering the security ecosystem to consider using and contributing to the advisory database.<p>It&#x27;s the database that powers <a href="http://github.com/rubysec/bundler-audit" rel="nofollow">http:&#x2F;&#x2F;github.com&#x2F;rubysec&#x2F;bundler-audit</a> and (disclaimer: I made this) <a href="https://gemcanary.com" rel="nofollow">https:&#x2F;&#x2F;gemcanary.com</a> and the more people contributing the more we can all benefit from improving the ways we can notify end users of their vulnerable dependencies.<p>Thanks,
评论 #7642195 未加载
评论 #7642264 未加载
chc大约 11 年前
I can&#x27;t help but feel that this could also be written as &quot;How secure are Ruby and Rails apps? About as secure as all other apps.&quot;<p>In my experience, vulnerabilities are pretty much endemic to software that has not been hardened by experts.
评论 #7642205 未加载
评论 #7642077 未加载
enraged_camel大约 11 年前
This doesn&#x27;t surprise me, and I&#x27;m not even an experienced Rails developer.<p>I think a big part of the problem is that there are a ton of gems that are simply hobby projects that gained traction and became popular. They were originally architected by enthusiasts, rather than experts. Some of these projects may also have been abandoned by their authors, but still in use because they may be the only way to accomplish a complex task or integration. You can&#x27;t expect stuff like that to be very secure. You just have to think carefully about whether the risks of using them are worth the gains made from not having to implement the functionality yourself.
评论 #7642172 未加载
midas007大约 11 年前
Generally: don&#x27;t trust anything from the outside world or anything that can transit untrusted infrastructure, that means check types and sanitize values before passing along. Break loudly and quickly to get attention for a fix. Keep the codebase as tiny as possible too.<p>Ruby: recompile with minimized OpenSSL 1.0.1+ (LibreSSL when possible) and with patches that improve Ruby&#x27;s default OpenSSL security.<p><a href="https://gist.github.com/steakknife/8228264" rel="nofollow">https:&#x2F;&#x2F;gist.github.com&#x2F;steakknife&#x2F;8228264</a><p><a href="https://gist.github.com/steakknife/10092587" rel="nofollow">https:&#x2F;&#x2F;gist.github.com&#x2F;steakknife&#x2F;10092587</a><p><a href="https://gist.github.com/steakknife/10096008" rel="nofollow">https:&#x2F;&#x2F;gist.github.com&#x2F;steakknife&#x2F;10096008</a><p>For Rails apps: use brakeman as one part of security audit strategy<p>For gem authors, sign them (please!): I wrote waxseal to make it dead simple<p><pre><code> [sudo] gem cert --add &lt;(curl -L https:&#x2F;&#x2F;gist.github.com&#x2F;steakknife&#x2F;5333881&#x2F;raw&#x2F;gem-public_cert.pem) # adds my cert (do once) [sudo] gem install waxseal --trust-policy HighSecurity </code></pre> For gem users, find which aren&#x27;t signed<p><pre><code> Add this to ~&#x2F;.gemrc gem line: --trust-policy MediumSecurity or just if there&#x27;s no gem: .... already: gem: --trust-policy MediumSecurity </code></pre> For anyone using git, sign your tags (git tag -s ...) and commits (git commit -S ...) por favor
评论 #7676803 未加载
jusob大约 11 年前
More alarming than vulnerable gems is the the number oh high severity vulnerability found in Rails itself: <a href="http://www.cvedetails.com/product/22568/Rubyonrails-Ruby-On-Rails.html?vendor_id=12043" rel="nofollow">http:&#x2F;&#x2F;www.cvedetails.com&#x2F;product&#x2F;22568&#x2F;Rubyonrails-Ruby-On-...</a>. Compare this to Django (<a href="http://www.cvedetails.com/vulnerability-list/vendor_id-10199/product_id-18211/year-2013/Djangoproject-Django.html" rel="nofollow">http:&#x2F;&#x2F;www.cvedetails.com&#x2F;vulnerability-list&#x2F;vendor_id-10199...</a>) per year.
评论 #7647441 未加载
molf大约 11 年前
The graphs of Gem distribution and Vulnerability distribution are utter nonsense. You can&#x27;t just measure your mean and standard deviation and expect a bell curve that fits those two parameters to correspond to your distribution. <i>Especially</i> if you cut off one of the tails.
评论 #7642126 未加载
unreal37大约 11 年前
I am not a ruby developer, but it does seem shocking that 66% of all gemfiles contain a known previously-disclosed 5+ exploit. Yes, most software is flawed, but you would think once it&#x27;s been reported, it would be fixed.
评论 #7642038 未加载
评论 #7642492 未加载
评论 #7642010 未加载
steveklabnik大约 11 年前
It&#x27;s possible some of these are false positives, at least with regards to Rails, as most of the recent vulnerabilities I can remember come with workarounds and patch files. Some people need to stay on a specific Rails version, but may have fixed the problem.<p>I&#x27;m not ready to speculate which is more probable.
评论 #7642288 未加载
thesp0nge大约 11 年前
Hi there I&#x27;m the man behind the codesake-dawn security scanner for ruby code. It will be great having some of you comparing the results obtainw with haikiri or other scanner and mine. Just for sake to reach an enterprise level tool.<p>Regard paolo@armoredcode.com
Glyptodon大约 11 年前
This article kind of confuses me - what does it mean for a gem do be &#x27;secure&#x27; ? The idea of many gems being &#x27;secure&#x27; or &#x27;non-secure&#x27; is a non-sequitur. Obviously for some projects, like Rails, it&#x27;s fairly clear what is meant when someone talks about a vulnerability - that you can hacked somehow. However, if someone wrote a gem to wrap eval into a command line tool so they can use some random ruby commands or libraries from their shell, well, secure would be a non-sequitur, but also beside the point.
crazydoggers大约 11 年前
Unpatched Rails apps are found vulnerable until patched... news at 11.
评论 #7641866 未加载
mratzloff大约 11 年前
This doesn&#x27;t surprise me in the least, but the increase in 2013 is obviously due to increased security scrutiny, which is good so long as people act on that information.<p>As a side note, I&#x27;d be interested to see a similar analysis of popular Java projects.
tkellogg大约 11 年前
It&#x27;s neat (if not alarming) to see security metrics visualized like this. Nice work!
fuj大约 11 年前
STOP LYING! Everyone knows the only security issues nowadays are caused by developing in PHP, that&#x27;s why we bash it every day, right guys?!
hawleyal大约 11 年前
Nice graphs. Meaningless, but nice.