<story><title>Making popular Ruby packages more secure</title><url>https://blog.rubygems.org/2022/06/13/making-packages-more-secure.html</url></story><parent_chain></parent_chain><comment><author>ievans</author><text>This is great news! I like how the article cites evidence that MFA is disproportionately effective against account takeover.&lt;p&gt;If the rubygems devs are looking for other highly effective wins against supply chain attacks: I think the next thing is deeper support for lockfiles. Although Ruby has Gemfile.lock, it&amp;#x27;s not a true lockfile in the same way that package managers in the javascript&amp;#x2F;go&amp;#x2F;python ecosystems are. Specifically, locking versions is optional, there&amp;#x27;s no locking by hash (Github issue: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;rubygems&amp;#x2F;rubygems&amp;#x2F;issues&amp;#x2F;3379&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;rubygems&amp;#x2F;rubygems&amp;#x2F;issues&amp;#x2F;3379&lt;/a&gt;), and there&amp;#x27;s no capability to lock local or source-only dependencies by hash. By comparison: go modules, pipenv, npm, yarn, nuget, composer, and gradle already support locking by hash.</text></comment>
<story><title>Making popular Ruby packages more secure</title><url>https://blog.rubygems.org/2022/06/13/making-packages-more-secure.html</url></story><parent_chain></parent_chain><comment><author>kyrofa</author><text>I applaud the move in the right direction, but please add support for webauthn. OTPs are really inconvenient in comparison.&lt;p&gt;It looks like maybe it&amp;#x27;s been in flight for a while? &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;rubygems&amp;#x2F;rubygems.org&amp;#x2F;pull&amp;#x2F;2108&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;rubygems&amp;#x2F;rubygems.org&amp;#x2F;pull&amp;#x2F;2108&lt;/a&gt;</text></comment>