On: Strong_password Rubygem hijacked

[chupasaurus]

My bet goes to #3. After [0]this commit, everything is possible in Ruby world.

[0]https://github.com/rails/rails/commit/b83965785db1eec019edf1...

[jrochkind1 → chupasaurus]

That seems to demonstrate a github vulnerability, rather than anything ruby-specific?

[heartbreak → jrochkind1]

It was a Rails vulnerability (mass assignment) that the attacker used to accomplish this. It’s long since been fixed and doesn’t demonstrate an inherent security flaw with the “ruby world.”

https://gist.github.com/peternixey/1978249