Hacker GitHub

← All repos

rubygems/rubygems.org

View on GitHub ↗ ★ 2,441 Ruby

The Ruby community's gem hosting service.

21 mentions on Hacker News by 19 people: 2 stories, 19 comments · first 2013-01-31 · latest 2025-09-20

Mentions per year 21 mentions · busiest year 2022 (10)
20082026
AllStoriesComments NewestTopOldest
  1. …I don't see a single commit from her handle on the 24 month view (below). Correct me if I'm wrong. https://github.com/rubygems/rubygems.org/graphs/contributors...
    comment by k33n · 2025-09-20 · in Ruby Central's Attack on RubyGems [pdf]
  2. Might be nothing. Just an accidental flag. Fingers crossed. https://github.com/rubygems/rubygems.org/issues/3791#issueco... and https://twitter.com/maciejmensfeld/status/165677067708781772... Edit: more official news…
    comment by nate · 2023-05-11 · in Rubygems.org Hacked?
  3. https://github.com/rubygems/rubygems.org/issues/3791
    comment by Lammy · 2023-05-11 · in Rubygems.org marked by Chrome as an “unsafe site”
  4. …to the rubygems.org project. The code is extremely clean and the project is very, very well run. https://github.com/rubygems/rubygems.org
    comment by bradly · 2022-08-16 · in Requiring MFA on popular gem maintainers
  5. …multiple hardware tokens or biometric devices to your account, so that you have backup options. [0] https://github.com/rubygems/rubygems.org/pull/2865
    comment by jacques_chester · 2022-08-16 · in Requiring MFA on popular gem maintainers
  6. ▲ 2
    Rubygems packages found carrying out dependency confusion research
    story by ashishbijlani · 2022-07-28 · 0 comments
  7. …and there are various efforts underway. Disclosure: I am involved with both of these. [0] https://github.com/rubygems/rubygems.org/pull/2944 [1] https://github.com/ossf/wg-securing-software-repos
    comment by jacques_chester · 2022-06-14 · in Making popular Ruby packages more secure
  8. …OTPs are really inconvenient in comparison. It looks like maybe it's been in flight for a while? https://github.com/rubygems/rubygems.org/pull/2108
    comment by kyrofa · 2022-06-13 · in Making popular Ruby packages more secure
  9. In fact, you can now scope API tokens per-gem as well: https://github.com/rubygems/rubygems.org/pull/2944
    comment by jacques_chester · 2022-06-13 · in Making popular Ruby packages more secure
  10. …for pragmatic solutions that measurably improve supply chain security. I just think changes like https://github.com/rubygems/rubygems.org/pull/2499 and https://github.com/rubygems/rubygems.org/pull/2242 which recognize the social aspect of…
    comment by semiquaver · 2022-05-08 · in Unauthorized gem takeover for some gems
  11. This test seems to be a good example of the vulnerability: https://github.com/rubygems/rubygems.org/commit/58c755a7a62a...
    comment by brasic · 2022-05-07 · in Unauthorized gem takeover for some gems
  12. ▲ 239
    Unauthorized gem takeover for some gems
    story by mooreds · 2022-05-07 · 76 comments
  13. See https://github.com/rubygems/rubygems.org/pull/2865 for the web part > From the replies it sounds like this is talking about client software? Yes the command line is a client to the rubygems server > An unattended client should not be…
    comment by dorianmariefr · 2022-03-05 · in Ask HN: How many 2FA tokens do you have?
  14. …were notified [0]. There were a few affected by this at the same time, not just rest-client. [0] https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-an...
    comment by shakna · 2019-08-20 · in Rest-client gem is hijacked
  15. Relevant links: - https://github.com/twbs/bootstrap-sass/issues/1195 - https://github.com/rubygems/rubygems.org/issues/1941
    comment by thibaut_barrere · 2019-04-04 · in Malicious remote code execution backdoor discovered bootstrap-sass Ruby gem
  16. …just isn't advertised yet. See this comment for instructions on how to enable it for your account: https://github.com/rubygems/rubygems.org/issues/1252#issueco...
    comment by ethagnawl · 2018-07-12 · in ESLint compromised, may have stolen your credentials
  17. There are also people requesting that this be changed: https://github.com/rubygems/rubygems.org/issues/1226
    comment by Footkerchief · 2018-01-06 · in Many packages suddenly disappeared
  18. The commit to fix this appears to be "validate Version full_name": https://github.com/rubygems/rubygems.org/commit/1067ab7e0871... Cause: a "full name" is a dash-seperated join of its components, yet those components may themselves contain…
    comment by zwp · 2016-04-07 · in RubyGems.org gem replacement security vulnerability and mitigation
  19. For those curious, the relevant PRs/issues appear to be: https://github.com/rubygems/rubygems.org/issues/1095 https://github.com/rubygems/rubygems.org/pull/1109
    comment by swanson · 2016-03-07 · in How Changing WebFonts Made Rubygems.org 10x Faster
  20. I will probably eventually submit a PR for this feature at https://github.com/rubygems/rubygems.org . If anyone else wants to get it started, I'd certainly help.
    comment by sqs · 2013-10-28 · in Ruby-FFI is no longer maintained
  21. …this with whitelisting specific classes that the YAML parsing will still be allowed to instantiate: https://github.com/rubygems/rubygems.org/pull/516/files
    comment by pifflesnort · 2013-01-31 · in What The Rails Security Issue Means For Your Startup