Rails Vulnerability Compilation(blog.tinfoilsecurity.com)
blog.tinfoilsecurity.com
Rails Vulnerability Compilation
http://blog.tinfoilsecurity.com/recent-rails-vulnerabilities
3 comments
No problem at all! We may very well start crawling your advisory DB for our own mailing list, which isn't limited to just Ruby, to be fair. ;)
It's always good to have more eyes on security issues - Ruby or not - and keeping the community informed. Feel free to get in touch with us at [email protected] - we'd love to chat about any ways we can work together.
It's always good to have more eyes on security issues - Ruby or not - and keeping the community informed. Feel free to get in touch with us at [email protected] - we'd love to chat about any ways we can work together.
I'm one of the guys who uses gemcanary for one (open source) repo and so far I have to say I'm impressed, was informed some time last night about the new vulnerabilities and already updated the project. Thank you for the service!
Its quite interesting that even customers start asking now "oh its rails, that is so insecure". Sign, quite alot of media hysteria going on.
This was a good write up.
We maintain a freely available advisory database https://github.com/rubysec/ruby-advisory-db/ designed to be easily machine readable.
We also maintain a free ruby-wide security announcement mailing list: https://groups.google.com/forum/?fromgroups#!forum/rubysec-a...
The rubysec-advisory-db is meant to power discovery tools such as https://github.com/postmodern/bundler-audit (from which it was originally extracted) or https://gemcanary.com (it bears mentioning that my company made it). I'm pretty sure it will be used in codeclimate's upcoming security monitor https://codeclimate.com/security-monitor given that Bryan is a regular contributor.
If you're interested in security, please consider checking us out. Most of rubysec is composed of security professionals, and we're all interested in improving the ecosystem-at-large. Submit issues against the advisory or simply fork it https://github.com/rubysec/ruby-advisory-db/
Regards and apologies for slightly hijacking the thread.