On: Ruby Security Have You Not

[spatten]

The gems have probably been updated by the developers of the gem.

The data used in the article contains a list of the versions being used in production by real app, not the latest versions released by the gem developers.

[klochner → spatten]

Risk also depends on how you're using the gem.

If it's a bug in a YAML parser but you're not loading YAML from untrusted sources, then it would be a false positive.

[robotfelix → spatten]

Yes, after seeing many familiar gems in the graphic I was almost surprised to see that hakiri gave my Gemfile.lock an 'all clear'.

The should be able to calculate what percentage of these would still be vulnerable if fully updated - now that would be an interesting stat!

[vasinov → spatten]

I think unreal37 meant "once it's been reported, it would be fixed [in the app]." As in updated.

[unreal37 → spatten]

Ah, thanks for the clarification.