Security Is Hard, But We Can't Go Shopping
summary
Counts a burst of releases and finds a surprising cluster of critical fixes across many gems over eight weeks including bundler rubygems rack json and others and shows that Ruby and Rails become a juicy target when several bugs appear fast. Explains CVE assignment by Mitre and treats updates as insurance, recommends responsible disclosure steps and timelines 30–90 days, demonstrates tools like bundle outdated and Brakeman and points to the ruby advisory database and a shared security mailing list.
AI-written summary · about
chapters (5)
related talks
36mSecurity is hard, but we can't go shopping
42mSecuring Your Rails App
31mA survey of recent RubyGems CVEs
29mGem install: What could go wrong?
36mUsing Ruby In Security Critical Applications
37mThe Evolution of Rails Security
54mSecure Programming with Ruby on Rails
35mMaking it on your own and the pitfalls of gem dependencies