ainsleyb
Joined 16 years ago
Joined 16 years ago
It's always good to have more eyes on security issues - Ruby or not - and keeping the community informed. Feel free to get in touch with us at [email protected] - we'd love to chat about any ways we can work together.
How I look at the Sunday test is less of a "are they like me" and more of a "will I get along with them many hours a day"? We work anywhere from 7 hours a day, up to 18 (especially during major code pushes) - we try to avoid this as much as we can, but sometimes (for us at our stage), it's inevitable.
I do have to enjoy working with my colleagues, and someone for whom I won't be willing to come in on a Sunday has a higher chance of bringing me down on a regular basis. That doesn't mean we work Sundays (we're typically in the office M-F), but it's important to be able to get along with people and it's a good litmus test, imho.
Not to mention, he's gotten a lot of good press from other media sources since (as he points out in his blog post).
If you run a scan from our homepage, you're actually looking for a lot more than just the YAML vulnerability (XSS, Mixed Resource, etc.) as our product isn't limited to just the YAML vulnerability.
If you run the scan from https://www.tinfoilsecurity.com/railscheck, then you'll get a quick check for just the YAML vulnerability.
Does that clarify it a bit?
Thus, you might be running an old version, but still actually be safe by disabling the vulnerable bits.
Follow me at ainsleybraun.com