From: Dave Thomas <dave@...>
Date: 2004-08-13T21:05:15+09:00
Subject: Re: RubyForge project and gem distriubtion


On Aug 12, 2004, at 23:31, David Ross wrote:

> Heh, I didn't say I was going to do it. I was thinking
> what happened with ruby-lang.org being hacked. What
> really stops someone from violently attacking more
> than just one computer? :)

There are a fair number of people with commit access to ruby-lang. I, 
for example, could add a trojan to the latest version of RDoc that 
would rewrite the source code to every Ruby program it documented.

When was the last time you studied all the source code for RDoc to 
ensure it is safe?

If you want safety, then you probably shouldn't be downloading stuff 
off the web and running it, at least until it has been verified by a 
professional team of QA folks. Microsoft software, for example, must be 
secure for that reason.

OpenSource software has operated this way for years. Taking that fact 
and labeling RubyGems as flawed because of it is remarkably 
irresponsible. What were your motives?



Dave