[#48729] [ANN] ruby 2.0.0-preview1 released — Yusuke Endoh <mame@...>
Japanese later; 日本語はあとで
Hi,
Hello Vit,
2012/11/6 Yusuke Endoh <mame@tsg.ne.jp>
[#48745] [ruby-trunk - Bug #7267][Open] Dir.glob on Mac OS X returns unexpected string encodings for unicode file names — "kennygrant (Kenny Grant)" <kennygrant@...>
[#48773] [ruby-trunk - Bug #7269][Open] Refinement doesn't work if using locate after method — "ko1 (Koichi Sasada)" <redmine@...>
(2012/11/03 10:11), headius (Charles Nutter) wrote:
(2012/11/03 10:36), SASADA Koichi wrote:
[#48774] [ruby-trunk - Feature #4085] Refinements and nested methods — "shugo (Shugo Maeda)" <redmine@...>
[#48819] [ruby-trunk - Feature #4085] Refinements and nested methods — "headius (Charles Nutter)" <headius@...>
[#48820] [ruby-trunk - Bug #7271][Assigned] Refinement doesn't seem lexical — "ko1 (Koichi Sasada)" <redmine@...>
[#48847] [ruby-trunk - Bug #7274][Open] UnboundMethods should be bindable to any object that is_a?(owner of the UnboundMethod) — "rits (First Last)" <redmine@...>
[#48882] [ruby-trunk - Feature #4085] Refinements and nested methods — "headius (Charles Nutter)" <headius@...>
[#48964] [Backport93 - Backport #7285][Assigned] some failures on RubyInstaller CI — "usa (Usaku NAKAMURA)" <usa@...>
[#48988] [ruby-trunk - Feature #7292][Open] Enumerable#to_h — "marcandre (Marc-Andre Lafortune)" <ruby-core@...>
[#48997] [ruby-trunk - Feature #7297][Open] map_to alias for each_with_object — "nathan.f77 (Nathan Broadbent)" <nathan.f77@...>
[#49018] [ruby-trunk - Feature #7299][Open] Ruby should not completely ignore blocks. — "marcandre (Marc-Andre Lafortune)" <ruby-core@...>
[#49078] Re: [ruby-cvs:44714] marcandre:r37544 (ruby_1_9_3): merge revisions r33453, r37542: — "U.Nakamura" <usa@...>
Hello,
[#49119] ID_ALLOCATOR ? — Roger Pack <rogerdpack2@...>
Hello.
Can I see ruby-prof code?
On Fri, Nov 9, 2012 at 11:14 AM, SASADA Koichi <ko1@atdot.net> wrote:
[#49196] [ruby-trunk - Feature #7322][Open] Add a new operator name #>< for bit-wise "exclusive or" — "alexeymuranov (Alexey Muranov)" <redmine@...>
[#49211] [ruby-trunk - Feature #7328][Open] Move ** operator precedence under unary + and - — "boris_stitnicky (Boris Stitnicky)" <boris@...>
[#49256] [ruby-trunk - Feature #7336][Open] Flexiable OPerator Precedence — "trans (Thomas Sawyer)" <transfire@...>
[#49267] [ruby-trunk - Feature #7340][Open] 'each_with' or 'into' alias for 'each_with_object' — "nathan.f77 (Nathan Broadbent)" <nathan.f77@...>
[#49268] [ruby-trunk - Feature #7341][Open] Enumerable#associate — "nathan.f77 (Nathan Broadbent)" <nathan.f77@...>
[#49282] Re: [ruby-cvs:44801] tenderlove:r37631 (trunk): * probes.d: add DTrace probe declarations. — "U.Nakamura" <usa@...>
Hello,
Hello,
2012/11/13 U.Nakamura <usa@garbagecollect.jp>:
[#49298] [ruby-trunk - Feature #7346][Open] object(...) as syntax sugar for object.call(...) — "rosenfeld (Rodrigo Rosenfeld Rosas)" <rr.rosas@...>
[#49320] [ruby-trunk - Feature #4085] Refinements and nested methods — "headius (Charles Nutter)" <headius@...>
[#49328] [ruby-trunk - Bug #7349][Open] Struct#inspect needs more meaningful output — "postmodern (Hal Brodigan)" <postmodern.mod3@...>
[#49340] bugs.ruby-lang.org - 500 error — Luis Lavena <luislavena@...>
Hello,
I've been unable to access it since morning EET (about 6 hours now).
It's almost 3am in Japan now, don't forget.
On Wed, Nov 14, 2012 at 2:46 PM, Zachary Scott <zachary@zacharyscott.net> wrote:
[#49354] review open pull requests on github — Zachary Scott <zachary@...>
Could we get a review on any open pull requests on github before the
2012/11/15 Zachary Scott <zachary@zacharyscott.net>:
Ok, I was hoping one of the maintainers might want to.
I could add my eyes to monitor the github issues/pull requests, if only to
On Thu, Nov 15, 2012 at 2:11 PM, Marc-Andre Lafortune
On Thu, Nov 15, 2012 at 1:01 PM, Luis Lavena <luislavena@gmail.com> wrote:
On Thu, Nov 15, 2012 at 1:06 PM, Zachary Scott <zachary@zacharyscott.net>
[#49370] [ruby-trunk - Bug #7358][Open] Wrong fd redirection on fork — "felipec (Felipe Contreras)" <felipe.contreras@...>
[#49416] make check: missing psych — Ramkumar Ramachandra <artagnon@...>
Hi,
On Fri, Nov 16, 2012 at 9:58 AM, Ramkumar Ramachandra
Luis Lavena wrote:
[#49463] [ruby-trunk - Feature #7375][Open] embedding libyaml in psych for Ruby 2.0 — "tenderlovemaking (Aaron Patterson)" <aaron@...>
On Sun, Nov 18, 2012 at 03:05:50AM +0900, vo.x (Vit Ondruch) wrote:
Dne 17.11.2012 21:19, Aaron Patterson napsal(a):
On 17 November 2012 21:34, V咜 Ondruch <v.ondruch@gmail.com> wrote:
Hello,
[#49468] [ruby-trunk - Feature #7378][Open] Adding Pathname#write — "aef (Alexander E. Fischer)" <aef@...>
[#49479] [ruby-trunk - Bug #7379][Open] Unexpected result of Kernel#gets on Windows 8 — "phasis68 (Heesob Park)" <phasis@...>
[#49518] [ruby-trunk - Bug #7383][Open] Use stricter cache check in load.c — "funny_falcon (Yura Sokolov)" <funny.falcon@...>
[#49536] [ruby-trunk - Feature #7388][Open] Object#embed — "zzak (Zachary Scott)" <zachary@...>
[#49543] [ruby-trunk - Feature #7390][Open] Funny Falcon Threads — "zzak (Zachary Scott)" <zachary@...>
[#49558] [ruby-trunk - Bug #7395][Open] Negative numbers can't be primes by definition — "zzak (Zachary Scott)" <zachary@...>
[#49868] How to stop spam from ruby-core — Heesob Park <phasis@...>
Hi,
[#49949] [ruby-trunk - Feature #7426][Assigned] Update Rdoc — "mame (Yusuke Endoh)" <mame@...>
(2012/11/27 13:33), drbrain (Eric Hodel) wrote:
On Tue, Nov 27, 2012 at 12:57 AM, SASADA Koichi <ko1@atdot.net> wrote:
On Nov 26, 2012, at 10:09 PM, Luis Lavena <luislavena@gmail.com> wrote:
[#50092] [ruby-trunk - Feature #7434][Open] Allow caller_locations and backtrace_locations to receive negative params — "sam.saffron (Sam Saffron)" <sam.saffron@...>
[#50264] [ruby-trunk - Feature #7457][Open] GC.stat to return "allocated object count" and "freed object count" — "ko1 (Koichi Sasada)" <redmine@...>
[#50306] Towards a better process for changing Ruby — Magnus Holm <judofyr@...>
Hey folks,
What I'd like to see is primarily better communication and release
Hello Magnus,
Endoh-san,
[#50312] How to stop spam message from redmine.ruby-lang.org — Heesob Park <phasis@...>
HI,
Hi,
[#50372] [ruby-trunk - Bug #7476][Open] missing "IP_TRANSPARENT" constant for IP sockets. — "elico (Eliezer Croitoru)" <eliezer@...>
2013/2/24 ko1 (Koichi Sasada) <redmine@ruby-lang.org>:
[ruby-core:49981] [ruby-trunk - Feature #5741] Secure Erasure of Passwords
Issue #5741 has been updated by mame (Yusuke Endoh). Target version changed from 2.0.0 to next minor ---------------------------------------- Feature #5741: Secure Erasure of Passwords https://bugs.ruby-lang.org/issues/5741#change-33748 Author: MartinBosslet (Martin Bosslet) Status: Assigned Priority: Normal Assignee: matz (Yukihiro Matsumoto) Category: Target version: next minor In other languages it is considered good practice to securely erase passwords immediately after they were used. Imagine authentication in a web app - ultimately a String containing the password arrives at the server, where it will be processed and compared to some previously stored value. After this is done, there is no need to store these password Strings any longer, so they should be discarded right away (more on why later). In C, you would simply overwrite the array of bytes with zeroes or random values. In Java, Strings are immutable, that's why there it is common practice to use char[] for all things password and overwrite them when done. Currently, there is no way in Ruby to overwrite the memory that was used by a String. String#clear and String#replace both use str_discard internally, which only frees the underlying pointer without overwriting it. The problem with not erasing passwords is this: the contents of the String stay in memory until they are finally GC'ed. But even then only the pointer will be freed, leaving the contents mostly intact until the memory is reclaimed and overwritten later on. This could be exploited if an attacker had access to the memory of the server. This could happen in many ways: a core dump after a crash, access to the host if the server runs in a VM, or even by deep-freezing the DRAM :) [1] It could be argued that given the examples above, much more devastating attacks would be possible since in all of those cases you more or less have physical access to the machine. But I would still consider this to be a valid concern, if not only for the reason of never opening additional attack surfaces if they can be avoided relatively easily. I also found [2], which seems to show that Python deals with similar problems and it also contains more background info. Eric Hodel and I discussed this yesterday and Eric came up with a C extension that can be used to illustrate the problem (attached). If you inspect the resulting core dump, you will find the following: - the untouched String remains in memory fully intact - the String#clear'ed String remains to a large extent, typically the first character is missing - so if you typed "PASSWORD", search for "ASSWORD" (unintentional pun) instead - The String#clear_secure'ed will have been completely erased, no traces remain My questions: 1. Would you agree that we need this functionality? 2. Where would we ideally place it? I'm not sure whether String is the perfect place, but on the other hand, String is the only place where we have access to the implementation details. 3. Are there better alternative ways how we could achieve this? [1] http://www.schneier.com/blog/archives/2008/02/cold_boot_attac.html [2] http://stackoverflow.com/questions/728164/securely-erasing-password-in-memory-python -- http://bugs.ruby-lang.org/