ruby-advisory-db

Hey! I'm one of the maintainers behind the Ruby advisory database: https://github.com/rubysec/ruby-advisory-db We're trying to build a common database for people building these tools; at the moment, trawling through CVE disclosures and various mailing lists is a largely manual process that we can reap economies of scale by pooling our efforts together. It's free and volunteer run. I would like to encourage you and anyone else reading this who is interested in bolstering the security ecosystem to consider using and contributing to the advisory database. It's the database that powers http://github.com/rubysec/bundler-audit and (disclaimer: I made this) https://gemcanary.com and the more people contributing the more we can all benefit from improving the ways we can notify end users of their vulnerable dependencies. Thanks,

So, all software has two problems. First one is finding, reporting and getting vulnerabilities. Most people don't perform security audits. Most vendors take forever to reply back to security reports. Infuriatingly, many vendors will roll security fixes into the next major release instead of backporting patches and minor versions. The second one is about finding out about disclosed and patched vulnerabilities. Outside of larger institutions where you have someone whose job it is to worry over configuration management and subscribe to every mailing list, the ecosystem for disseminating this information is broken. That's why we've started the https://github.com/rubysec/ruby-advisory-db, at least for the Ruby ecosystem.