Post

Practical takeaway for app teams, whatever one thinks of the politics: recent Bundler can record checksums in the lockfile (bundle lock --add-checksums) so a swapped gem fails to install, and a bundler-audit step in CI catches advisories. An afternoon of work that closes most of the exposure.

Out of curiosity, was this reported to the FBI for the computer fraud / abuse act? And if so, was there any follow up? I'm pretty curious if anyone can be held liable for the actions of an agent 👀

so have you reported OpenAI to the FBI for hacking you? or is that an honor reserved only for former employees who *checks notes* didn't hack you

Hi @rubycentral.org — I sent 2 brief questions to oss@rubycentral.org for Colby Swandale about the disclosure timeline for the May RubyGems/OpenAI-agent incident. I'm writing about AI monitoring and accountability for Democrats Abroad France Brittany. Want to make sure they reach the right person.