Ruby & You - RubyNation 2014

Slide 1

Slide 1 text

Ruby & You

Slide 2

Slide 2 text

We Made It \o/

Slide 3

Slide 3 text

Friday Hug!

Slide 4

Slide 4 text

Terence Lee @hone02

Slide 5

Slide 5 text

No content

Slide 6

Slide 6 text

Austin, TX

Slide 7

Slide 7 text

Jacuzzi for your Hands

Slide 8

Slide 8 text

No content

Slide 9

Slide 9 text

#rubykaraoke

Slide 10

Slide 10 text

No content

Slide 11

Slide 11 text

jobs.heroku.com We’re Hiring!

Slide 12

Slide 12 text

Ruby Task Force

Slide 13

Slide 13 text

Ruby Task Force Member

Slide 14

Slide 14 text

Matz’s Ruby Team

Slide 15

Slide 15 text

← Matz

Slide 16

Slide 16 text

← ko1

Slide 17

Slide 17 text

← ko1 Performance Prince

Slide 18

Slide 18 text

nobu →

Slide 19

Slide 19 text

nobu → Patch Monster

Slide 20

Slide 20 text

Top 5 Committers $ git shortlog -s --since=2012 | sort -rn | head -6 2739 nobu <--- 867 akr 710 svn 635 ko1 596 naruse 448 zzak

Slide 21

Slide 21 text

Top 5 (Human) Committers $ git shortlog -s --since=2012 | sort -rn | head -6 2739 nobu 867 akr 710 svn <--- 635 ko1 596 naruse 448 zzak

Slide 22

Slide 22 text

Top 5 (Human) Committers $ git shortlog -s --since=2012 | sort -rn | head -6 2739 nobu 867 akr 710 svn 635 ko1 596 naruse 448 zzak <---

Slide 23

Slide 23 text

zzak (@_zzak) sensei (せんせい)

Slide 24

Slide 24 text

zzak (@_zzak) for Ruby Hero

Slide 25

Slide 25 text

Agenda ● Story Time ● Working with Ruby ● A Potential Future

Slide 26

Slide 26 text

Story Time

Slide 27

Slide 27 text

CVE-2013-4164 November 22, 2013

Slide 28

Slide 28 text

Exploit

Slide 29

Slide 29 text

Vulnerable Code untrusted_data.to_f

Slide 30

Slide 30 text

Venue of Attack JSON.parse untrusted_data

Slide 31

Slide 31 text

Metasploit def digit_pattern @digit_pattern ||= rand(10_000).to_s end def multiplier (500_000 * (1.0/digit_pattern.size)).to_i end def evil_float_string [digit_pattern, digit_pattern * multiplier].join('.') end JSON.parse("[#{evil_float_string}]")

Slide 32

Slide 32 text

$ ruby repro.rb [BUG] Segmentation fault ruby 2.0.0p247 (2013-06-27 revision 41674) [x86_64-linux] -- C level backtrace information ---------------------- /../lib/libruby.so.2.0(+0x1ceaa8) [0x7f8787802aa8] /../rubies/ruby-2.0.0-p247/lib/libruby.so.2.0(+0x74e0a) /../lib/libruby.so.2.0(rb_bug+0xb3) [0x7f87876a9af3] /../lib/libruby.so.2.0(+0x14cf66) [0x7f8787780f66]

Slide 33

Slide 33 text

Affected Versions ● Ruby 1.8 after 1.8.6p230 ● Ruby 1.9 prior to 1.9.3p484 ● Ruby 2.0 prior to 2.0.0p353 ● Ruby 2.1 prior to 2.1.0 preview2 ● trunk prior to revision 43780

Slide 34

Slide 34 text

Solution... All users are recommended to upgrade to ● Ruby 1.9.3p484 ● Ruby 2.0.0p353 ● Ruby 2.1.0 preview2

Slide 35

Slide 35 text

What about Ruby 1.8.7? Please note that Ruby 1.8 series or any earlier releases are already obsoleted. There is no plan to release new FIXED versions for them.

Slide 36

Slide 36 text

Ruby 1.9.2?

Slide 37

Slide 37 text

Doubts 1. Patch just once 2. Maintain Ruby 1.8.7/1.9.2 3. Don’t do anything

Slide 38

Slide 38 text

A Patch in Time Heroku releases two unofficial rubies: 1. Ruby 1.9.2p321 2. Ruby 1.8.7p375 https://github.com/heroku/ruby

Slide 39

Slide 39 text

To: cvs-admin@ruby-lang.org, shugo@ruby-lang.org, matz@ruby-lang.org, shyouhei@ruby-lang.org, zzak@ruby-lang.org At Heroku, we’re still maintaining security fixes for customers on 1.8.7 and 1.9.2 while we figure out our end of life process. After discussion on the security list, I’d like to apply these patches to the proper branches upstream so things don’t get out of sync. Here are the commits I’d like to apply: https://github.com/ruby/ruby/pull/457 https://github.com/ruby/ruby/pull/458 -Terence

Slide 40

Slide 40 text

No content

Slide 41

Slide 41 text

No content

Slide 42

Slide 42 text

Getting on Core ● Send enough patches ● port Ruby to non-POSIX platforms ● write library brought into stdilb ● security backporting

Slide 43

Slide 43 text

Friendly Reminder UPGRADE Your Rubies

Slide 44

Slide 44 text

PSA Ruby 1.8.7 / 1.9.2 Support Ends This Month

Slide 45

Slide 45 text

Ruby 1.9.3 support ends 2/23/2015

Slide 46

Slide 46 text

Working with Ruby

Slide 47

Slide 47 text

Why Should You Care?

Slide 48

Slide 48 text

Why Do I Care?

Slide 49

Slide 49 text

The people are the most important part.

Slide 50

Slide 50 text

No content

Slide 51

Slide 51 text

No content

Slide 52

Slide 52 text

Why Should You Care?

Slide 53

Slide 53 text

Getting the Source (SVN) Trunk: $ svn co http://svn.ruby-lang.org/repos/ruby/trunk ruby Branch: $ svn co \ http://svn.ruby-lang. org/repos/ruby/branches/ruby_2_0_0

Slide 54

Slide 54 text

Getting the Source (git-svn) $ git clone git@github.com:ruby/ruby.git $ cd ruby $ git svn init \ svn+ssh://svn@ci.ruby- lang.org/ruby/trunk $ mv .git/refs/remotes/origin/trunk \ . git/refs/remotes/git-svn $ git svn rebase

Slide 55

Slide 55 text

Protips

Slide 56

Slide 56 text

Did you know... the patchlevel no. is incremented by hand

Slide 57

Slide 57 text

all dates are in JST (UTC +9) https://github.com/zzak/dotvim/blob/master/. vimrc#L12-L20

Slide 58

Slide 58 text

Top 5 (Human) Committers $ git shortlog -s --since=2012 | sort -rn | head -6 2739 nobu 867 akr 710 svn <--- 635 ko1 596 naruse 448 zzak

Slide 59

Slide 59 text

No content

Slide 60

Slide 60 text

Running Tests $ mkdir build $ autoconf $ cd build $ ./configure --prefix=~/tmp/xxx --enable-shared \ --with-openssl-dir=/path/to/openssl \ --with-readline-dir=/path/to/readline \ --with-zlib-dir=/path/to/zlib $ make test-all TESTS=-v

Slide 61

Slide 61 text

Running Individual Test Files $ make test-all TESTS=drb/test_drb.rb

Slide 62

Slide 62 text

Creating a Patch $ diff -pu original/ changed/ \ > ruby-changes.patch $ svn diff > ruby-changes.patch $ git diff > ruby-changes.patch

Slide 63

Slide 63 text

Communication

Slide 64

Slide 64 text

Mailing Lists https://www.ruby-lang.org/en/community/mailing-lists/

Slide 65

Slide 65 text

Issue Tracker https://bugs.ruby-lang.org/

Slide 66

Slide 66 text

Twitter is not a bug tracker

Slide 67

Slide 67 text

No content

Slide 68

Slide 68 text

Filing Issues ● Bugs are fixed on trunk first ● Can request backport once committed to trunk ● http://bugs.ruby-lang.org/projects/ruby-trunk/issues/new

Slide 69

Slide 69 text

No content

Slide 70

Slide 70 text

Maintainer’s List https://github. com/ruby/ruby/blob/trunk/doc/maintainers. rdoc

Slide 71

Slide 71 text

No content

Slide 72

Slide 72 text

No content

Slide 73

Slide 73 text

Security ● Email security@ruby-lang.org ● Responsible Disclosure ● Vulnerability/Use cases ● Affected Rubies

Slide 74

Slide 74 text

Story: Insecure SSL Defaults ● Ruby get it’s default from OpenSSL ● Who’s responsibility is it?

Slide 75

Slide 75 text

No content

Slide 76

Slide 76 text

Ruby Core Developer Meetings ● Draft an agenda ● Pick a date (estimate) ● Ask Matz ● Ask ruby-core

Slide 77

Slide 77 text

No content

Slide 78

Slide 78 text

No content

Slide 79

Slide 79 text

More Protips...

Slide 80

Slide 80 text

English is not everyone’s primary language

Slide 81

Slide 81 text

People on Ruby Core speak Ruby

Slide 82

Slide 82 text

Issues are often consumed over e-mail

Slide 83

Slide 83 text

A Potential Future

Slide 84

Slide 84 text

Goals ● Trust ● Transparency ● Onboarding

Slide 85

Slide 85 text

No content

Slide 86

Slide 86 text

Moving to Git ● Backport Tools ● Redmine ● Version Log ● Others? ● Convince Core ● Profit…?

Slide 87

Slide 87 text

Supporting Legacy Rubies

Slide 88

Slide 88 text

Improve Onboarding Materials

Slide 89

Slide 89 text

Wrapup

Slide 90

Slide 90 text

Thank You ありがとがざいます @hone02 terence@heroku.com