RubyFlow The Ruby and Rails community linklog

×

The Ruby and Rails community linklog

Made a library? Written a blog post? Found a useful tutorial? Share it with the Ruby community here or just enjoy what everyone else has found!

Submit a post

You can use basic HTML markup (e.g. <a>) or Markdown.
Note that your post may be edited to suit the format of the site.

As you are not logged in, you will be
directed via GitHub to signup or sign in

Post Preview

Note: Only the first pargraph is shown on the front page and overly long paragraphs may be broken up.

Provisioning Servers with Sprinkle

Wrote up a detailed blog post explaining how to use Sprinkle to automate server provisioning and configuration. If you have a Rails application, and use Capistrano for deployment, then this will be especially relevant. Sprinkle is built right on Capistrano, has a lot of pre-made recipes and is extremely easy to setup and use. More importantly, unlike many other “simpler” solutions, Sprinkle recipes are idempotent, repeatable, and do not require prerequisites on the target server.

rubygems-pwn: A Vulnerability in RubyGems (currently being fixed)

If you’ve seen people saying to run gem install rubygems-pwn on Twitter (which I don’t advise!), it’s because it’s a proof of concept for a vulnerabilty in RubyGems. The rubygems-pwn project on GitHub has more information about it, but essentially you can push arbitrary Ruby code into gemspec parameters which will then be executed later on. The vulnerability has been discussed in the rubygems repo where a fix has already been made but, hopefully, more general fixes should be made available soon. (If you want to see the direct example of a malicious gemspec, look here.) [more inside]

Glade to see this finally getting some much needed attention. Three things t…
The problem there is a lot of people deliberately use old versions of RubyGems …
@peterc Has the Ruby Security team sent an Advisory out yet? I can’t find anyth…
SlimGems will be releasing a backport fix for this issue in the 1.3.x line, so …
Loading older posts