security

What The Rails Security Issue Means For Your Startup | Kalzumeus Software

kalzumeus.com 31 Jan '13, 3pm

security

Many Rails developers have not reacted to this news with the alacrity they should have. (See next question.) These applications may be compromised already . There are many Rails applications which were created years ago, which are not under active development any more, for whom no-one is responsible for applying security patches. Any of these applications which are publicly routable on the Internet will be compromised . There are many Rails applications which are installed by end users, some of whom do not have security expertise. For example, Redmine — an open source developer productivity tool — is commonly installed at individual companies. Every publicly accessible Redmine instance which is not patched will be compromised . Ruby on Rails lacks a CMS with the mindshare of, say, WordPress, which is good, because every unpatched Ruby on Rails CMS delivered to a non-techni...

Full article: http://www.kalzumeus.com/2013/01/31/what-the-rails-securi...

Tweets

@padraicb » 14 Feb '13, 6pm
Curious how remote code executions in Ruby/Rails get classified as recent research on the sidelines. [link]
@rmartini1982 » 12 Feb '13, 3am
RT @perliscopio: RT @mgomezch Un buen abreboca de seguridad informática motivado por la reciente debacle de Ruby on Rails: [link]
@ale7714 » 11 Feb '13, 1am
RT @mgomezch: Un buen abreboca de seguridad informática motivado por la reciente debacle de Ruby on Rails: [link]
@mgomezch » 11 Feb '13, 1am
Un buen abreboca de seguridad informática motivado por la reciente debacle de Ruby on Rails: [link]
@M3nt_Al » 10 Feb '13, 12pm
Worth reading: “@kixxauth: "How bad were those Ruby on Rails bugs? Severity: Apocalyptic." [link]”
@amzurtech » 08 Feb '13, 4pm
Here is an interesting article about the recently discovered Rails/ #Ruby security vulnerabilities [link]
@bencrowder » 07 Feb '13, 8pm
Running Ruby on Rails? Make sure you patch for the recent (massive) YAML security hole. [link]
@organicsabra » 06 Feb '13, 10pm
If your web site runs Ruby on Rails you need to read this: [link]
@cs615asa » 06 Feb '13, 2am
Summary of the Ruby security incident we noted in class: [link] (Also stresses the implied trust in software providers.)
@fijiaaron » 05 Feb '13, 5pm
What the Rails Security Exploit [link] means for ordinary people [link] & developers [link]
@dmi » 05 Feb '13, 12pm
RT @Benjie: The Ruby on Rails/YAML exploits affect everyone, not just Rails devs. If you don't believe me, read all of this: [link]
@Benjie » 05 Feb '13, 9am
The Ruby on Rails/YAML exploits affect everyone, not just Rails devs. If you don't believe me, read all of this: [link]
@harryyeh » 05 Feb '13, 4am
For all my friends and startups if you are using Ruby on Rails - patch to 3.2.11 if you haven't already [link]
@giefferre » 04 Feb '13, 5pm
Developers, please red this -> [link] #RoR #ruby #rails #security issue
@F30 » 04 Feb '13, 11am
Nice writeup on the perils of web application security against the background of the recent Ruby/Rails breaches: [link]
@hedley_smith » 04 Feb '13, 10am
Reading about the Ruby on Rails security issues, which are described as "Apocalyptic" [link]
@afroald » 04 Feb '13, 8am
Dit artikel over het beveiligingslek in Ruby on Rails zou je echt moeten lezen als je web developer bent. [link]
@inautilo » 04 Feb '13, 1am
Tech / What The Rails Security Issue Means For Your Startup [link] by @patio11. #startup #webdev #ruby #security #framework
@ejdraper » 03 Feb '13, 4pm
If you're in any doubt about how serious the YAML vulnerability is for Ruby and Rails apps, this is a great read [link]
@Githur » 03 Feb '13, 4pm
Ruby on Rails bug allows execution of arbitrary code. Its a few days old but if you use RoR, you should check this out. [link]
@mbn » 03 Feb '13, 12pm
Ruby on Rails fail: [link] via @mbanzon
@tetheredjink » 03 Feb '13, 7am
Do you have a Ruby On Rails site and haven’t patched the YAML vulnerabilities? You will be compromised. [link]
@thetictacaddict » 03 Feb '13, 6am
So basically, any server running unpatched Ruby on Rails is subject to being owned in an automated fashion? Dang. [link]
@charles_consult » 02 Feb '13, 1pm
“What The Rails Security Issue Means For Your Startup”, Two high-severity security bugs... [link] #security #Ruby
@atleastimtrying » 02 Feb '13, 9am
RT @martbrow: “@DamianEdwards: Told you web dev was hard [link]” <- serious ruby on rails vulnerability discovered.
@martbrow » 02 Feb '13, 9am
“@DamianEdwards: Told you web dev was hard [link]” <- serious ruby on rails vulnerability discovered.
@f_dion » 02 Feb '13, 4am
And you want my personal information?... JDK issue https://t.co/wxEemqv3, ruby on rails issue [link]
@chrominance » 02 Feb '13, 4am
Everyone using Ruby on Rails is fucked (and that probably means you). [link]
@showka » 02 Feb '13, 3am
RT @cp16net: Ruby on Rails will not affect you? Think again... [link]
@yukondude » 02 Feb '13, 3am
Well, this was a terrifying read, and I don't even run Ruby on Rails or deal with (known) RoR-based services. [link]
@mike3k » 02 Feb '13, 12am
Was twitter affected by the Ruby on Rails security issue? [link]
@goStormpath » 01 Feb '13, 11pm
2 major Ruby on Rails vulnerabilities have been discovered over the last month. What do they mean for your security? [link]
@daftviking » 01 Feb '13, 7pm
Great writeup on the recent RoR security bugs, and what it means to you (even if you're not a Ruby programmer): [link]
@znmeb » 01 Feb '13, 7pm
RT @ZeroStrategist: RT @markjaquith: What The Rails Security Issue Means For Your Startup [link] #ruby #security
@ZeroStrategist » 01 Feb '13, 7pm
RT @markjaquith: What The Rails Security Issue Means For Your Startup [link] #ruby #security
@JimSchuett » 01 Feb '13, 7pm
Wow! Hope all my friends using Ruby are good. RUBY ON RAILS SECURITY THREATS [link]
@zedejose » 01 Feb '13, 7pm
Conhecendo as nossas startups, é pouco provável que se mexam, mesmo depois de ler isto: [link] #ruby #rails #security
@johnpaulhayes » 01 Feb '13, 6pm
A concise and clear insight to the recent Ruby-on-Rails security issue [link] Is YAML deserialization safe in other languages?
@benhamill » 01 Feb '13, 5pm
[link] A co-worker showed me this blog post. It is epic. About recent Ruby security stuff. Read it.
@wkandek » 01 Feb '13, 5pm
Long and good read on the current Ruby (Rails, Gems) security issues, expecting more focus on Ruby in this month - [link]
@FinTechie » 01 Feb '13, 5pm
RT @jameslgb: is that app you use based on Ruby on Rails? Security Bug Severity: Apocalyptic @FinTechie @BillWinterberg [link]
@cp16net » 01 Feb '13, 5pm
Ruby on Rails will not affect you? Think again... [link]
@ahigherugliness » 01 Feb '13, 4pm
Must be fun to have your server running on Ruby On Rails these days [link]
@glorphindale » 01 Feb '13, 3pm
Подробно о том, чем грозят последние уязвимости в Ruby on Rails, полезно не только для рубистов: [link]
@fpg81 » 01 Feb '13, 3pm
RT @lantoli: "January has been a very bad month for Ruby on Rails developers..." [link]
@securityledger » 01 Feb '13, 3pm
RT @radar: "January has been a very bad month for Ruby on Rails devs" - What The Rails Security Issue Means For Your Startup [link]
@jameslgb » 01 Feb '13, 3pm
is that app you use based on Ruby on Rails? Security Bug Severity: Apocalyptic @FinTechie @BillWinterberg [link]
@radar » 01 Feb '13, 3pm
"January has been a very bad month for Ruby on Rails devs" - What The Rails Security Issue Means For Your Startup [link]
@benmarte » 01 Feb '13, 2pm
What The Rails Security Issue Means For Your Startup | Kalzumeus Software | [link] #Ruby #Rails
@lantoli » 01 Feb '13, 2pm
"January has been a very bad month for Ruby on Rails developers..." [link]