Ruby & You
summary
A heap overflow in floating point parsing CVE-2013-4164 forces a decision: Heroku backports and ships security patches for Ruby 1.8.7 and 1.9.2, tests them, and pushes commits upstream to Subversion branches rather than issuing tarball releases. The workflow uses svn/git-svn, Redmine issues, the ruby-core and security mailing lists, and a reproducible exploit from Metasploit. Ongoing debates include whitelisting OpenSSL ciphers, how to maintain legacy releases, and a planned migration from Subversion to Git to improve onboarding and transparency.
AI-written summary · about
chapters (6)
- 0:00Introduction and welcome
- 5:13From vulnerability to Ruby core
- 18:56How to contribute to Ruby
- 30:55Ruby issue tracker and processes
- 41:49Future goals for Ruby community
- 47:43Closing and Q&A
related talks
32mHow We Distribute Ruby to the World
36mSecurity is hard, but we can't go shopping
31mA survey of recent RubyGems CVEs
54mRuby Committers vs the World
40mSecurity Is Hard, But We Can't Go Shopping
36mUsing Ruby In Security Critical Applications
38mUpgrading GitHub to Ruby 2.7
36mFrom massive pull requests to trunk-based development with Ruby