Hacker News Reader

> Surely they can’t review every gem change by hand?

Given the nature of the vulnerability, they only have to audit yanks of gems with a dash in the name that were either not updated in the 100 days prior to the yank or created 30 or fewer days before the yank, which is a much smaller universe than “all gem changes”.

That is why many companies forbid installing packages from the Internet, they have to be reviewed, accepted by the legal team, made available into the internal package server, and only then you can make use of them on the respective application.

An update triggers the whole process again.

Yes, it is a pain to deal with, and the only way to make sure 3rd party dependencies are actually valid, and also keep working no matter what happens to upstream.

From what I understand, they only have to review/audit the times a gem was yanked, to see if it was a legitimate action. I reckon there is a lot less occurrences