RubyFlow The Ruby and Rails community linklog

×

The Ruby and Rails community linklog

Made a library? Written a blog post? Found a useful tutorial? Share it with the Ruby community here or just enjoy what everyone else has found!

Submit a post

You can use basic HTML markup (e.g. <a>) or Markdown.
Note that your post may be edited to suit the format of the site.

As you are not logged in, you will be
directed via GitHub to signup or sign in

Post Preview

Note: Only the first pargraph is shown on the front page and overly long paragraphs may be broken up.

rubygems-pwn: A Vulnerability in RubyGems (currently being fixed)

If you’ve seen people saying to run gem install rubygems-pwn on Twitter (which I don’t advise!), it’s because it’s a proof of concept for a vulnerabilty in RubyGems. The rubygems-pwn project on GitHub has more information about it, but essentially you can push arbitrary Ruby code into gemspec parameters which will then be executed later on. The vulnerability has been discussed in the rubygems repo where a fix has already been made but, hopefully, more general fixes should be made available soon. (If you want to see the direct example of a malicious gemspec, look here.) [more inside]

Glade to see this finally getting some much needed attention. Three things t…
The problem there is a lot of people deliberately use old versions of RubyGems …
@peterc Has the Ruby Security team sent an Advisory out yet? I can’t find anyth…
SlimGems will be releasing a backport fix for this issue in the 1.3.x line, so …

Webmachine v0.1.0 released

I just released the first version of Webmachine (gem) (code) in advance of my RubyConf talk. Webmachine is an HTTP toolkit that lets you focus on building resources declaratively, while transparently handling the hard parts of content-negotiation, conditional requests, and proper response codes.

Raad 0.3.1 released

I just released version 0.3.1 of Raad - Ruby as a daemon lightweight service wrapper. Raad is a non-intrusive, lightweight, simple Ruby daemon wrapper. Basically a simple class which implements the start and stop methods, can be used seamlessly as a daemon or a normal console app.

Filet 0.2.1 just released

I just released version 0.2.1 of Filet. Filet is a small DSL on top of test unit to help you write acceptance tests, similar to Steak. It also supports some nice features as nested contexts and setup methods and works with several ruby implementations.

Loading older posts