From: Dave Thomas <dave@...>
Date: 2004-08-13T21:23:00+09:00
Subject: Re: RubyForge project and gem distriubtion


On Aug 13, 2004, at 7:15, David Ross wrote:

>
> No motive. I for one don't want to run RubyGems as
> root on a server which has several customers with
> credit card numbers, and then get rooted just because
> someone releases a really bad gem.

Of course, but you'd be irresponsible to run _any_ open source 
installed as root on such a box. I hope that you don't.
>
> Also, there is limited access to who has a commit bit
> to the ruby-lang cvs. We are talking about RubyForge
> here. The tought did not occur to me until someone
> mentioned how gems automatically get put in the
> repository automatically, this is a bad thing.

All Gems does is remove one step from downloading the library and 
saying "ruby install.rb" Gems isn't anything to do with your worries. 
The installation of open source software (any software) is inherently 
dangerous, and there's ultimately no solution apart from community 
vigilance.

I'm surprised by people here claiming to be concerned about security 
who have their Ruby installation in /usr/local. If you are concerned 
about root installs, RUBY SHOULD NOT BE IN A ROOT-ONLY WRITABLE 
DIRECTORY. That's just common sense (and again is nothing to do with 
Gems). Move your Ruby to a directory tree writable by you, and you'll 
no longer need to be root to install any Ruby code: Gem, RPA, or random 
download.


Cheers

Dave