It wouldn't help much. Why would you install a gem other than to run it? And if you run it, it can execute arbitary code.
What we need is actually sandboxed dev environments.
It wouldn't help much. Why would you install a gem other than to run it? And if you run it, it can execute arbitary code.
What we need is actually sandboxed dev environments.
Many gems are used as imports by another program and are not directly run.
I am not sure why the norm for scripted gems/packages seems to be running code on install but it’s very insecure as a way to distribute dev dependencies.