Introducing the Ruby Sec Field Guide

Summary: Trail of Bits published the RubySec Field Guide, which covers recent Ruby vulnerability classes and their root causes, including flaws that exploit serialization and deserialization of data in the YAML format. The guide states that nearly all large, tested and trusted open-source Ruby projects contain some of these vulnerabilities, and that few developers are aware of the risks.
Key Takeaway: The source says nearly every large, trusted open-source Ruby project carries these vulnerabilities, and the developers maintaining them largely do not know - so the code your applications depend on may already be exposed.

Read the original at Trail of Bits Blog ↗