Hacker Timesnew | past | comments | ask | show | jobs | submitlogin

It is possible for the publisher to sign the gems [1], but it's not common.

If rubygems.org is keeping fingerprints of each gem, then it still isn't sufficient, since those could have been compromised as well. If there's no other trustworthy source of fingerprints, then maybe we need to crowdsource it. Built a tool that will md5sum all the .gem files in your local cache directory, so that we can look for any files that were changed on rubygems.org

[1] http://docs.rubygems.org/read/chapter/21



Sounds like a good reason to switch to "everything must be signed"


Just to reiterate the parent: This is only valuable if we trust the signatures - which I wouldn't if they were, say, just held along side the "hacked" gems server.


I'm talking g about developers signing the archive on their local machine. Private key would be stored on developers laptop


You still need the public key to validate the signature. If the attacker can change the public key, he can change the signature without you knowing - unless you explicitly want to trust each and every key for every gem you install.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: