Using Ruby In Security Critical Applications

on YouTube ↗36m

" summary

Shows concrete fixes and failures: improvements to MRI security, use of OS mandatory access controls and stack canaries, a simple non-bypassable router pattern that enforces read‑only DB flows, tooling like checksec.sh and the idea of a SECCOMP gem, and experiments with Rust/mRuby, Buildroot and Robusta for isolation. Examples include a practical semicolon‑filtering storage check, architecture patterns (separate/isolate/integrate) and tradeoffs that actually worked or broke.

AI-written summary · about

" chapters (16)

1. 0:00Intro
2. 0:45DISCLAIMER
3. 1:56Naval Research Lab?
4. 9:08Always Invoked
5. 9:48Tamper Evident
6. 10:38Checklist
7. 11:03Use Case: OS Controls Mandatory Access Controls (MAC)
8. 13:36Takeaways
9. 15:41Use Case: Services Security Framework
10. 17:02least privilege process separation
11. 18:05application pre/post processing
12. 18:42storage processing
13. 20:02Other Cool Techs ANTLR and Parselet
14. 22:41Next Steps
15. 23:36Use Case: Application XML Processing*** Application
16. 31:06Buying Penetration Testing

" related talks

• 36mSecurity is hard, but we can't go shoppingAndre Arko · RailsConf 2013
• 41mSandboxing Ruby Code - Lessons from the battlefieldTejas Dinkar, Jasmin A Basheer · RubyConf India 2012
• 40mSecurity Is Hard, But We Can't Go ShoppingAndre Arko · RedDotRuby 2015
• 44mRuby Web Application Security Defense in DepthJeremy Evans · RubyHACK 2018
• 42mSecuring Your Rails AppMike Nicholaides · Wicked Good Ruby 2013
• 36mSandboxing Ruby: The Good, the Bad, and the FuglyEric Allam · RubyConf 2011
• 42mThe Mechanics of RubyAdam Keys · LoneStarRuby Conf 2013
• 31mRails Application Security in PracticeBryan Helmkamp · Ruby Midwest 2013