From: Phillip Gawlowski <cmdjackryan@...>
Date: 2008-05-15T09:22:27+09:00
Subject: Re: Can platform agnosticism be achieved?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Luis Lavena wrote:
| User perform some apt-get (ubuntu) tasks that requires sudo. He enters
| his password to confirm the operation.
| Under the same session, a few minutes later, he fires a rake task that
| uses sudo, by mistake or because is not clearly advertised what It
| does, he ends up messing with his gem repository, removing gems maybe
| he
| is using for other projects.
|
| So, these rake tasks are doing more than they should, taking
| privileges out of user hand and automating them, hiding the problem
| when looking answer to "what happened?".

In short: Merb is a security risk (as any other script that uses such a
technique). You should log a bug.

Everybody else: Proceed with caution.

And no, that it is OSS, is *not* an excuse. See the OpenSSL bruhaha in
Debian and Ubuntu at the moment.

- --
Phillip Gawlowski
Twitter: twitter.com/cynicalryan
Blog: http://justarubyist.blogspot.com

~ - You know you've been hacking too long when...
...the message `New mail in /usr/spool/mail/foo' becomes an NMI.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkgrgk4ACgkQbtAgaoJTgL//6gCff/nqOcmKJ4kLWriZlHlHqLjA
h8YAoIRs7GMfbFEakZFpqKPXBdg91isp
=BG2I
-----END PGP SIGNATURE-----