Hacker News Reader

it looks like someone has tried to steal rubygems.org db and other credentials. bundle update is now dangerous because you might get trojaned files.

View on HN

But don't applications have to explicitly install this gem? If not, then I am incorrect.

We don't know the extent to which Rubygems was compromised yet. In a scenario like this, it's best to err on the safe side and avoid trusting the source for the time being.

Qrush, one of the guys behind Rubygems tweeted that the credentials of every yml file ended up on pastie: https://twitter.com/qrush/status/296638346283868160

> Someone posted http://rubygems.org 's config/*.yml to pastie. Didn't include the S3 bucket secret key, but going to reset everything anyway.

Reply on news.ycombinator.com