Ruby & You - RubyConf India 2015

Transcript

1. Ruby & You
2. Today is not Friday...
3. But I believe in hugs everyday
4. RubyConf India in Review
5. @aspleenic
6. Even profiler has bugs. Always measure. Verify Results.
7. reading code is the most common task
8. Functional Programming makes code understandable by minimizing moving parts
9. If it's working for facebook it should react for everyone else
10. LOW CO$T SELF HEALING IMMUTABLE INFRASTRUCTURE
11. whatever styling you define in your shadow dom is not affected by any outside styling. Goodbye iframes.
12. live coding is tough
13. live coding git branch shifting is tough
14. require 'bliss'
15. There is no silver bullet
16. It's not for production
17. Cryptography is hard
18. Don't Cross the Streams
19. Beach Party
20. #rubykaraoke
21. it simulates motion, like ruby motion
22. So many queries. So many things. So many aggregations.
23. It works in theory, but not in production
24. Do not put your code to sleep
25. Fewer objects makes a faster Ruby
26. Profiling is not the same as benchmarking. You want to know the split up.
27. Terence Lee @hone02
28. Austin, TX
30. Matz’s Ruby Team
31. ← Matz
32. ← ko1
33. ← ko1 Performance Prince
34. nobu →
35. nobu → Patch Monster
36. Top 5 Committers $ git shortlog -s --since=2012 | sort -rn | \ head -6 2739 nobu <--- 867 akr 710 svn 635 ko1 596 naruse 448 zzak
37. Top 5 (Human) Committers $ git shortlog -s --since=2012 | sort -rn | \ head -6 2739 nobu 867 akr 710 svn <--- 635 ko1 596 naruse 448 zzak
38. Top 5 (Human) Committers $ git shortlog -s --since=2012 | sort -rn | \ head -6 2739 nobu 867 akr 710 svn 635 ko1 596 naruse 448 zzak <---
39. zzak (@_zzak) sensei (せんせい)
40. Agenda • Story Time • Working with Ruby • A Potential Future
41. Story Time
42. CVE-2013-4164 22 November 2013
43. Exploit
44. untrusted_data.to_f Vulnerable Code
45. Venue of Attack JSON.parse untrusted_data
46. Metasploit def digit_pattern @digit_pattern ||= rand(10_000).to_s end def multiplier (500_000 * (1.0/digit_pattern.size)).to_i end def evil_float_string [digit_pattern, digit_pattern * multiplier].join('.') end JSON.parse("[#{evil_float_string}]")
47. $ ruby repro.rb [BUG] Segmentation fault ruby 2.0.0p247 (2013-06-27 revision 41674) [x86_64-linux] -- C level backtrace information ---------------------- /../lib/libruby.so.2.0(+0x1ceaa8) [0x7f8787802aa8] /../rubies/ruby-2.0.0-p247/lib/libruby.so.2.0(+0x74e0a) /../lib/libruby.so.2.0(rb_bug+0xb3) [0x7f87876a9af3] /../lib/libruby.so.2.0(+0x14cf66) [0x7f8787780f66]
48. Affected Versions • Ruby 1.8 after 1.8.6p230 • Ruby 1.9 prior to 1.9.3p484 • Ruby 2.0 prior to 2.0.0p353 • Ruby 2.1 prior to 2.1.0 preview2 • trunk prior to revision 43780
49. Solution... All users are recommended to upgrade to • Ruby 1.9.3p484 • Ruby 2.0.0p353 • Ruby 2.1.0 preview2
50. What about Ruby 1.8.7? Please note that Ruby 1.8 series or any earlier releases are already obsoleted. There is no plan to release new FIXED versions for them.
51. Ruby 1.9.2?
52. Doubts 1. Don’t do anything 2. Patch just once 3. Maintain Ruby 1.8.7/1.9.2
53. A Patch in Time Heroku releases two unofficial rubies: 1. Ruby 1.9.2p321 2. Ruby 1.8.7p375 github.com/heroku/ruby
54. To: cvs-admin@ruby-lang.org, shugo@ruby-lang.org, matz@ruby-lang.org, shyouhei@ruby-lang.org, zzak@ruby-lang.org At Heroku, we’re still maintaining security fixes for customers on 1.8.7 and 1.9.2 while we figure out our end of life process. After discussion on the security list, I’d like to apply these patches to the proper branches upstream so things don’t get out of sync. Here are the commits I’d like to apply: https://github.com/ruby/ruby/pull/457 https://github.com/ruby/ruby/pull/458 -Terence
57. Getting on Core • Send enough patches • port Ruby to non-POSIX platforms • write library brought into stdlib • security backporting
58. Friendly Reminder UPGRADE Your Rubies!!!!!!!!!!!
59. PSA Ruby 1.8.7 / 1.9.2 Support Ended last August 2013
61. Ruby 1.9.3 support ended 23/2/2015
62. Ruby 2.0.0 support ends 24 Feb 2016
63. Working with Ruby
64. Why Should You Care?
65. Why Do I Care?
68. The people are the most important part.
69. Why Should You Care?
70. Getting the Source (SVN) Trunk: $ svn co http://svn.ruby-lang.org/repos/ruby/trunk ruby Branch: $ svn co \ http://svn.ruby-lang. org/repos/ruby/branches/ruby_2_0_0
71. Getting the Source (git-svn) $ git clone \ git://github.com/ruby/ruby. git $ cd ruby $ git svn init \ svn+ssh://svn@ci.ruby- lang.org/ruby/trunk $ mv .git/refs/remotes/origin/trunk \ . git/refs/remotes/git-svn $ git svn rebase
72. Protips
73. Did you know... the patchlevel no. is incremented by hand
74. all dates are in JST (UTC +9) github.com/zzak/dotvim/blob/master/.vimrc#L12-L20
75. Top 5 (Human) Committers $ git shortlog -s --since=2012 | sort -rn | \ head -6 2739 nobu 867 akr 710 svn <--- 635 ko1 596 naruse 448 zzak
77. Running Tests $ mkdir build $ autoconf $ cd build $ ./configure --prefix=~/tmp/xxx --enable-shared \ --with-openssl-dir=/path/to/openssl \ --with-readline-dir=/path/to/readline \ --with-zlib-dir=/path/to/zlib $ make test-all TESTS=-v
78. Running Individual Test Files $ make test-all TESTS=drb/test_drb.rb
79. Creating a Patch $ diff -pu original/ changed/ \ > ruby-changes.patch $ svn diff > ruby-changes.patch $ git diff > ruby-changes.patch
80. Communication
81. Mailing Lists (ruby-lang.org) →
82. • Ruby-Talk • Ruby-Core • Ruby-Doc • Ruby-CVS
83. Twitter is not a bug tracker
84. Issue Tracker (bugs.ruby-lang.org)
85. Filing Issues • Bugs are fixed on trunk first • Can request backport once committed to trunk • bugs.ruby-lang.org/projects/ruby-trunk/issues/new
86. Create an Account / Login →
87. Search for Existing Issues →
88. →
89. Issue List
90. →
92. github.com/ruby/ruby/blob/trunk/doc/maintainers.rdoc Maintainer’s List
95. Security • Email security@ruby-lang.org • Responsible Disclosure • Vulnerability/Use cases • Affected Rubies
96. Story: Insecure SSL Defaults • Ruby get it’s default from OpenSSL • Who’s responsibility is it?
98. Ruby Core Developer Meetings • Draft an agenda • Pick a date (estimate) • Ask Matz • Ask ruby-core
101. More Protips...
102. English is not everyone’s primary language
103. Nor is Japanese
104. People on Ruby Core speak Ruby
105. Issues are often consumed over e-mail
106. A Potential Future
107. Goals • Trust • Transparency • Onboarding
109. Moving to Git • Backport Tools • Redmine • Version Log • Others? • Convince Core • Profit…?
110. Supporting Legacy Rubies
111. Improve Onboarding Materials
112. Testing Ruby 2.1.x https://bugs.ruby-lang.org/issues/9607
115. Wrapup
116. Anybody can contribute to Ruby
117. There’s more to contribution than C code
118. Documentation?
119. Discussion?
120. Data?
121. May the Ruby be with you
122. Thank You ありがとがざいます @hone02 terence@heroku.com
123. Bonus Round
124. Ruby 3.0 http://brewhouse.io/blog/2014/09/19/ruby-kaigi-2014-day-2
125. Concurrency?
127. JIT Compiler?
128. RuJIT https://github.com/imasahiro/rujit
129. Static Typing?
131. Static Annotations def connect(r -> Stream, c -> Client) -> Fiber … end
132. Why Static Typing?
133. Why Static Typing? • Performance
134. Why Static Typing? • Performance • Compile Time Check
135. Why Static Typing? • Performance • Compile Time Check • Documentation
136. Why Not?
137. Why Not Static Typing? • It works™ without it
138. Why Not Static Typing? • It works™ without it • It is against duck typing
139. Why Not Static Typing? • It works™ without it • It is against duck typing • It will be optional
140. Why Not Static Typing? • It works™ without it • It is against duck typing • It will be optional • DRY