The ruby tag has no wiki summary.
1
vote
2answers
87 views
What risks are involved with installing gems from rubygems.org? Are alternatives safer?
Normally, when installing a Ruby gem, I'd ask my system admin to do
sudo gem install gemname
However, there was recently a security breach with the source of gems, http://rubygems.org , and I'm ...
7
votes
2answers
247 views
What unique risks does MVC model binding bring to a website? What additional vigilance is needed?
From what I understand, "model binding" is where a website based on ASP.NET MVC or Ruby on Rails (there are others...) takes parameters in HTTP's GET statement and passes them as variables to code ...
0
votes
2answers
523 views
Why does OpenSSL not include AES-256-GCM? [closed]
I'm trying to implement AES-256-GCM in Ruby.
Ruby's OpenSSL wrapper library and aead library both clearly seem to believe that OpenSSL itself supports this.
However, neither 0.9.8r (which I had ...
0
votes
1answer
94 views
How do I prevent my Rails application from attack? [closed]
My website is being nuked by new signups and new posts some of which don't even have user.id associated with.
How do I solve this? What code should I add to the user#new page and/or post#new page.
...
4
votes
1answer
176 views
Can anybody recommend any gems for checking security vulnerabilities?
I want to check one of my RoR projects for security vulnerabilities.
So can anybody recommend any gems for my needs?
4
votes
2answers
309 views
Could the bcrypt-ruby binding be vulnerable?
While developing a Ruby on Rails application using a commonly used authentication library named devise, I noticed from the prefix $2a$ of the produced password hashes in the application database that ...
