Hacker GitHub

← All repos

ruby/psych

View on GitHub ↗ ★ 596 Ruby

A libyaml wrapper for Ruby

9 mentions on Hacker News by 6 people: 0 stories, 9 comments · first 2013-01-30 · latest 2014-05-23

Mentions per year 9 mentions · busiest year 2013 (8)
20082026
AllStoriesComments NewestTopOldest
  1. It also links to this terrifying class: https://github.com/tenderlove/psych/blob/b6e8b10c83720fe73ab...
    comment by lylo · 2014-05-23 · in Upgrading to Ruby 2.1 (and why complex regexes will inevitably hurt you)
  2. …into coming versions of Ruby. So I don't really see the parallel with what you describe... [1] https://github.com/tenderlove/psych/issues/119
    comment by thibaut_barrere · 2013-02-03 · in On Python security amidst recent Rails/YAML vulnerabilities
  3. …disk, shared as well between production and non-regularly updated staging servers etc!) [1] https://github.com/tenderlove/psych/issues/119
    comment by thibaut_barrere · 2013-02-03 · in On Python security amidst recent Rails/YAML vulnerabilities
  4. This is currently being discussed on https://github.com/tenderlove/psych/issues/119 There is also https://github.com/dtao/safe_yaml (hat tip @patio11, who also points out that this has not been audited for completeness/correctness)
    comment by trapexit · 2013-01-31 · in What The Rails Security Issue Means For Your Startup
  5. …is not. > Do you have a citation for this? What particular bug in the parser are you referring to? http://github.com/tenderlove/psych/issues/119
    comment by pifflesnort · 2013-01-31 · in What The Rails Security Issue Means For Your Startup
  6. > Is that seriously what happened? Surprisingly, yes: https://github.com/tenderlove/psych/issues/119 And the RubyGems folks are trying to handle this with whitelisting specific classes that the YAML parsing will still be allowed to…
    comment by pifflesnort · 2013-01-31 · in What The Rails Security Issue Means For Your Startup
  7. …wondering. Are there adults in the Ruby community? The vulnerability itself is simply ridiculous: https://github.com/tenderlove/psych/issues/119 The response from the Gem folks has betrayed a serious lack of experience. Has Rails been such…
    comment by pifflesnort · 2013-01-31 · in Rubygems.org compromised
  8. Short timeline: - 1 week ago: blambeau reported the issue to the rubygems people: https://github.com/tenderlove/psych/issues/119#issuecomment-... - Postmodern wrote a PoC - https://gist.github.com/4674219 - Postmodern: "I posted it in a…
    comment by judofyr · 2013-01-30 · in Rubygems.org compromised
  9. https://github.com/tenderlove/psych/issues/119#issuecomment-...
    comment by benmmurphy · 2013-01-30 · in Rubygems.org compromised