Ruby & You - RuLu 2014 - Speaker Deck

Slide 1

Slide 1 text

Ruby & You

Slide 2

Slide 2 text

@olivierlacan

Slide 3

Slide 3 text

We Made It \o/

Slide 4

Slide 4 text

Friday Hug!

Slide 5

Slide 5 text

Terence Lee @hone02

Slide 6

Slide 6 text

Austin, TX

Slide 7

Slide 7 text

Jacuzzi for your Hands

Slide 8

Slide 8 text

No content

Slide 9

Slide 9 text

#rubykaraoke ← @headius @plexus →

Slide 10

Slide 10 text

A Whole New World... #RubyNation @hone02 @kenichi_pdx

Slide 11

Slide 11 text

No content

Slide 12

Slide 12 text

No content

Slide 13

Slide 13 text

jobs.heroku.com We’re Hiring!

Slide 14

Slide 14 text

Ruby Task Force

Slide 15

Slide 15 text

Ruby Task Force Member

Slide 16

Slide 16 text

Matz’s Ruby Team

Slide 17

Slide 17 text

← Matz

Slide 18

Slide 18 text

← ko1

Slide 19

Slide 19 text

← ko1 Performance Prince

Slide 20

Slide 20 text

nobu →

Slide 21

Slide 21 text

nobu → Patch Monster

Slide 22

Slide 22 text

Top 5 Committers $ git shortlog -s --since=2012 | sort -rn | \ head -6 2739 nobu <--- 867 akr 710 svn 635 ko1 596 naruse 448 zzak

Slide 23

Slide 23 text

Top 5 (Human) Committers $ git shortlog -s --since=2012 | sort -rn | \ head -6 2739 nobu 867 akr 710 svn <--- 635 ko1 596 naruse 448 zzak

Slide 24

Slide 24 text

Top 5 (Human) Committers $ git shortlog -s --since=2012 | sort -rn | \ head -6 2739 nobu 867 akr 710 svn 635 ko1 596 naruse 448 zzak <---

Slide 25

Slide 25 text

zzak (@_zzak) sensei (せんせい)

Slide 26

Slide 26 text

zzak (@_zzak) for Ruby Hero

Slide 27

Slide 27 text

Agenda ● Story Time ● Working with Ruby ● A Potential Future

Slide 28

Slide 28 text

Story Time

Slide 29

Slide 29 text

CVE-2013-4164 November 22, 2013

Slide 30

Slide 30 text

Exploit

Slide 31

Slide 31 text

untrusted_data.to_f Vulnerable Code

Slide 32

Slide 32 text

Venue of Attack JSON.parse untrusted_data

Slide 33

Slide 33 text

Metasploit def digit_pattern @digit_pattern ||= rand(10_000).to_s end def multiplier (500_000 * (1.0/digit_pattern.size)).to_i end def evil_float_string [digit_pattern, digit_pattern * multiplier].join('.') end JSON.parse("[#{evil_float_string}]")

Slide 34

Slide 34 text

$ ruby repro.rb [BUG] Segmentation fault ruby 2.0.0p247 (2013-06-27 revision 41674) [x86_64-linux] -- C level backtrace information ---------------------- /../lib/libruby.so.2.0(+0x1ceaa8) [0x7f8787802aa8] /../rubies/ruby-2.0.0-p247/lib/libruby.so.2.0(+0x74e0a) /../lib/libruby.so.2.0(rb_bug+0xb3) [0x7f87876a9af3] /../lib/libruby.so.2.0(+0x14cf66) [0x7f8787780f66]

Slide 35

Slide 35 text

Affected Versions ● Ruby 1.8 after 1.8.6p230 ● Ruby 1.9 prior to 1.9.3p484 ● Ruby 2.0 prior to 2.0.0p353 ● Ruby 2.1 prior to 2.1.0 preview2 ● trunk prior to revision 43780

Slide 36

Slide 36 text

Solution... All users are recommended to upgrade to ● Ruby 1.9.3p484 ● Ruby 2.0.0p353 ● Ruby 2.1.0 preview2

Slide 37

Slide 37 text

What about Ruby 1.8.7? Please note that Ruby 1.8 series or any earlier releases are already obsoleted. There is no plan to release new FIXED versions for them.

Slide 38

Slide 38 text

Ruby 1.9.2?

Slide 39

Slide 39 text

Doubts 1. Don’t do anything 2. Patch just once 3. Maintain Ruby 1.8.7/1.9.2

Slide 40

Slide 40 text

A Patch in Time Heroku releases two unofficial rubies: 1. Ruby 1.9.2p321 2. Ruby 1.8.7p375 github.com/heroku/ruby

Slide 41

Slide 41 text

To: [email protected], [email protected], [email protected], [email protected], [email protected] At Heroku, we’re still maintaining security fixes for customers on 1.8.7 and 1.9.2 while we figure out our end of life process. After discussion on the security list, I’d like to apply these patches to the proper branches upstream so things don’t get out of sync. Here are the commits I’d like to apply: https://github.com/ruby/ruby/pull/457 https://github.com/ruby/ruby/pull/458 -Terence

Slide 42

Slide 42 text

No content

Slide 43

Slide 43 text

No content

Slide 44

Slide 44 text

Getting on Core ● Send enough patches ● port Ruby to non-POSIX platforms ● write library brought into stdilb ● security backporting

Slide 45

Slide 45 text

Friendly Reminder UPGRADE Your Rubies

Slide 46

Slide 46 text

PSA Ruby 1.8.7 / 1.9.2 Support Ends This Month

Slide 47

Slide 47 text

Ruby 1.9.3 support ends 2/23/2015

Slide 48

Slide 48 text

Working with Ruby

Slide 49

Slide 49 text

Why Should You Care?

Slide 50

Slide 50 text

Why Do I Care?

Slide 51

Slide 51 text

No content

Slide 52

Slide 52 text

No content

Slide 53

Slide 53 text

The people are the most important part.

Slide 54

Slide 54 text

Why Should You Care?

Slide 55

Slide 55 text

Getting the Source (SVN) Trunk: $ svn co http://svn.ruby-lang.org/repos/ruby/trunk ruby Branch: $ svn co \ http://svn.ruby-lang. org/repos/ruby/branches/ruby_2_0_0

Slide 56

Slide 56 text

Getting the Source (git-svn) $ git clone [email protected]:ruby/ruby.git $ cd ruby $ git svn init \ svn+ssh://[email protected] lang.org/ruby/trunk $ mv .git/refs/remotes/origin/trunk \ . git/refs/remotes/git-svn $ git svn rebase

Slide 57

Slide 57 text

Protips

Slide 58

Slide 58 text

Did you know... the patchlevel no. is incremented by hand

Slide 59

Slide 59 text

all dates are in JST (UTC +9) github.com/zzak/dotvim/blob/master/.vimrc#L12-L20

Slide 60

Slide 60 text

Top 5 (Human) Committers $ git shortlog -s --since=2012 | sort -rn | \ head -6 2739 nobu 867 akr 710 svn <--- 635 ko1 596 naruse 448 zzak

Slide 61

Slide 61 text

No content

Slide 62

Slide 62 text

Running Tests $ mkdir build $ autoconf $ cd build $ ./configure --prefix=~/tmp/xxx --enable-shared \ --with-openssl-dir=/path/to/openssl \ --with-readline-dir=/path/to/readline \ --with-zlib-dir=/path/to/zlib $ make test-all TESTS=-v

Slide 63

Slide 63 text

Running Individual Test Files $ make test-all TESTS=drb/test_drb.rb

Slide 64

Slide 64 text

Creating a Patch $ diff -pu original/ changed/ \ > ruby-changes.patch $ svn diff > ruby-changes.patch $ git diff > ruby-changes.patch

Slide 65

Slide 65 text

Communication

Slide 66

Slide 66 text

Mailing Lists (ruby-lang.org) →

Slide 67

Slide 67 text

● Ruby-Talk ● Ruby-Core ● Ruby-Doc ● Ruby-CVS

Slide 68

Slide 68 text

Twitter is not a bug tracker

Slide 69

Slide 69 text

Issue Tracker (bugs.ruby-lang.org)

Slide 70

Slide 70 text

Filing Issues ● Bugs are fixed on trunk first ● Can request backport once committed to trunk ● bugs.ruby-lang.org/projects/ruby-trunk/issues/new

Slide 71

Slide 71 text

Create an Account / Login →

Slide 72

Slide 72 text

Search for Existing Issues →

Slide 73

Slide 73 text

→

Slide 74

Slide 74 text

Issue List

Slide 75

Slide 75 text

→

Slide 76

Slide 76 text

No content

Slide 77

Slide 77 text

github.com/ruby/ruby/blob/trunk/doc/maintainers.rdoc Maintainer’s List

Slide 78

Slide 78 text

No content

Slide 79

Slide 79 text

No content

Slide 80

Slide 80 text

Security ● Email [email protected] ● Responsible Disclosure ● Vulnerability/Use cases ● Affected Rubies

Slide 81

Slide 81 text

Story: Insecure SSL Defaults ● Ruby get it’s default from OpenSSL ● Who’s responsibility is it?

Slide 82

Slide 82 text

No content

Slide 83

Slide 83 text

Ruby Core Developer Meetings ● Draft an agenda ● Pick a date (estimate) ● Ask Matz ● Ask ruby-core

Slide 84

Slide 84 text

No content

Slide 85

Slide 85 text

No content

Slide 86

Slide 86 text

More Protips...

Slide 87

Slide 87 text

English is not everyone’s primary language

Slide 88

Slide 88 text

People on Ruby Core speak Ruby

Slide 89

Slide 89 text

Issues are often consumed over e-mail

Slide 90

Slide 90 text

A Potential Future

Slide 91

Slide 91 text

Goals ● Trust ● Transparency ● Onboarding

Slide 92

Slide 92 text

No content

Slide 93

Slide 93 text

Moving to Git ● Backport Tools ● Redmine ● Version Log ● Others? ● Convince Core ● Profit…?