Normally, when installing a Ruby gem, I'd ask my system admin to do
sudo gem install gemname
However, there was recently a security breach with the source of gems, http://rubygems.org , and I'm wondering how safe this is, and whether alternatives are safer.
Would the major risks involved with installing from rubygems.org be that
- rubygems.org, or one of its mirrors, got hacked, and supplied me with a malicious package instead of the one I wanted.
- Someone successfully impersonated a gem author, and uploaded a malicious package.
If I wanted to avoid such risks, would it be safer to clone the git repository of the source code for the gem, and build the gem myself?
One problem with this approach is I'm not that confident about the security of Github, the main source of git repositories for Ruby related projects. Github uses Ruby on Rails, and Github's security record hasn't been flawless - Egor Homakov was able to hack the website and commit to a project without proper credentials.
Would using code from github have less risk than using a gem from rubygems.org?
Also, would not using
sudo while installing Ruby gems reduce my risk?
I use Ruby merely for a command line application that analyses data. I don't use Rails or any of its gems, I'm not building a web application, and my application doesn't need to access the internet.