On: OpenAI bots knew about the RubyGems caching vulnerability

[SchemaLoad]

It wouldn't help much. Why would you install a gem other than to run it? And if you run it, it can execute arbitary code.

What we need is actually sandboxed dev environments.

[grey-area → SchemaLoad]

Many gems are used as imports by another program and are not directly run.

I am not sure why the norm for scripted gems/packages seems to be running code on install but it’s very insecure as a way to distribute dev dependencies.