I discuss how to keep up to date on the security disclosures for Ruby and frameworks such as Rails and Sinatra. I cover all the different places to receive notifications for all of the services in my application stack.

1. Ruby & Framework
Security
Creston Jamison
Ruby Tree Software, Inc.

2. Security???
 Heartbleed
 Shellshock
 Poodle
 Drupal SQL injection vulnerability –
compromised within hours
 Next?

3. Up to date on your stack?
 OS + services?
 Database?
 Web server?
 Ruby?
 Rails / Sinatra?
 Gems?

4. Example Stack
 Ubuntu:
https://lists.ubuntu.com/mailman/listinfo/ubuntu
-security-announce
 Ruby:
https://groups.google.com/forum/#!forum/ruby-security-
ann
 Rails:
https://groups.google.com/forum/#!forum/ruby
onrails-security
 Nginx: http://forum.nginx.org/list.php?27
 Postgres:
http://www.postgresql.org/support/security/

5. Gems?
 Check them all?
 Use ‘gem outdated’
 Discussion on signing but no notification:
http://guides.rubygems.org/security/
 http://www.rubysec.com/
 https://gemcanary.com/

6. What about your code?
 Brakeman: http://brakemanscanner.org/

7. Questions?
Creston Jamison
@crestonjamison
creston.jamison@rubytreesoftware.com