[#51792] [ruby-trunk - Bug #7768][Open] Inherited Array class missing — "england (Roman Ivanilov)" <englandpost@...>

14 messages 2013/02/01

[#51834] [ruby-trunk - Bug #7780][Open] Marshal & YAML should deserialize only basic types by default. — "marcandre (Marc-Andre Lafortune)" <ruby-core@...>

19 messages 2013/02/04

[#51897] [ruby-trunk - Feature #7791][Open] Let symbols be garbage collected — "rosenfeld (Rodrigo Rosenfeld Rosas)" <rr.rosas@...>

64 messages 2013/02/06
[#51899] [ruby-trunk - Feature #7791][Feedback] Let symbols be garbage collected — "shyouhei (Shyouhei Urabe)" <shyouhei@...> 2013/02/06

[#51909] Re: [ruby-trunk - Feature #7791][Feedback] Let symbols be garbage collected — SASADA Koichi <ko1@...> 2013/02/06

(2013/02/06 22:50), shyouhei (Shyouhei Urabe) wrote:

[#51898] [ruby-trunk - Feature #7792][Open] Make symbols and strings the same thing — "rosenfeld (Rodrigo Rosenfeld Rosas)" <rr.rosas@...>

86 messages 2013/02/06
[#51914] [ruby-trunk - Feature #7792] Make symbols and strings the same thing — "rosenfeld (Rodrigo Rosenfeld Rosas)" <rr.rosas@...> 2013/02/06

[#51916] Re: [ruby-trunk - Feature #7792] Make symbols and strings the same thing — Yorick Peterse <yorickpeterse@...> 2013/02/06

You don't need to hijack any code for it, you'd just use it as

[#51933] [ruby-trunk - Feature #7793][Open] New methods on Hash — "dsisnero (Dominic Sisneros)" <dsisnero@...>

20 messages 2013/02/06

[#51965] [ruby-trunk - Feature #7795][Open] Symbol.defined? and/or to_existing_symbol — "Student (Nathan Zook)" <blogger@...>

13 messages 2013/02/07

[#51977] [ruby-trunk - Feature #7797][Open] Hash should be renamed to StrictHash and a new Hash should be created to behave like AS HashWithIndifferentAccess — "rosenfeld (Rodrigo Rosenfeld Rosas)" <rr.rosas@...>

22 messages 2013/02/07

[#52042] [ruby-trunk - Bug #7805][Open] ruby 2.0rc2 core on solaris — "groenveld@... (John Groenveld)" <groenveld@...>

23 messages 2013/02/08

[#52049] [ruby-trunk - Bug #7807][Open] [PATCH] Remove duplicated load paths when empty version string is configured — "vo.x (Vit Ondruch)" <v.ondruch@...>

9 messages 2013/02/08

[#52075] [ruby-trunk - Feature #7816][Open] Don't invalidate method caches when defining a new method on a class without subclasses — "charliesome (Charlie Somerville)" <charlie@...>

17 messages 2013/02/09

[#52077] [ruby-trunk - Bug #7817][Open] (Unable to compile Ruby 2.0.0-rc2 on OSX (clang version 2.1) — "injekt (Lee Jarvis)" <ljjarvis@...>

10 messages 2013/02/09

[#52087] [ruby-trunk - Bug #7820][Assigned] Let's decide Ruby 2.0 supported platform list — "mame (Yusuke Endoh)" <mame@...>

15 messages 2013/02/10

[#52130] [ruby-trunk - Bug #7829][Open] Rounding error in Ruby Time — "loirotte (Philippe Dosch)" <loirotte@...>

25 messages 2013/02/11
[#52579] [ruby-trunk - Bug #7829] Rounding error in Ruby Time — "loirotte (Philippe Dosch)" <loirotte@...> 2013/02/20

[#52586] Re: [ruby-trunk - Bug #7829] Rounding error in Ruby Time — David MacMahon <davidm@...> 2013/02/20

[#52131] [ruby-trunk - Bug #7830][Open] Ruby packages should not build with -Werror when distributed — "kremenek (Ted Kremenek)" <kremenek@...>

21 messages 2013/02/11

[#52134] [ruby-trunk - Bug #7831][Open] Net::HTTP does not allow users to handle Content-Encoding in responses like 1.x — "drbrain (Eric Hodel)" <drbrain@...7.net>

10 messages 2013/02/11

[#52160] [ruby-trunk - Feature #7836][Open] Need a way to get Method and UnboundMethod objects to methods overridden by prepended modules — "banister (john mair)" <jrmair@...>

12 messages 2013/02/12

[#52165] [ruby-trunk - Feature #7839][Open] Symbol.freeze_symbols — "tenderlovemaking (Aaron Patterson)" <aaron@...>

23 messages 2013/02/12

[#52206] [ruby-trunk - Bug #7842][Assigned] An alias of a "prepend"ed method skips the original method when calling super — "mame (Yusuke Endoh)" <mame@...>

15 messages 2013/02/13

[#52215] [ruby-trunk - Bug #7845][Open] Strip doesn't handle unicode space characters in ruby 1.9.2 & 1.9.3 (does in 1.9.1) — "timothyg56 (Timothy Garnett)" <timothyg@...>

18 messages 2013/02/13

[#52267] [ruby-trunk - Feature #7854][Open] New method Symbol[string] — "Student (Nathan Zook)" <blogger@...>

22 messages 2013/02/14

[#52296] [ruby-trunk - Bug #7860][Open] Passing --libdir to ./configure causes Gem.ruby to point to an incorrect ruby interpreter path — "cwgem (Chris White)" <cwprogram@...>

11 messages 2013/02/15

[#52395] [ruby-trunk - Bug #7874][Open] multiarch support enhancements — "terceiro (Antonio Terceiro)" <terceiro@...>

16 messages 2013/02/17

[#52513] [ruby-trunk - Feature #7882][Open] Allow rescue/else/ensure in do..end — "charliesome (Charlie Somerville)" <charlie@...>

11 messages 2013/02/19

[#52514] [ruby-trunk - Feature #7883][Open] Add Regex#to_proc — "rklemme (Robert Klemme)" <shortcutter@...>

15 messages 2013/02/19

[#52537] [ruby-trunk - Bug #7886][Open] Not recognizing unix group permissions for Mac OS X (Mountain Lion) Active Directory (AD) mobile accounts — "afazio (Alfred Fazio)" <alfred.fazio@...>

12 messages 2013/02/19

[#52596] [CommonRuby - Feature #7895][Open] Exception#backtrace_locations to go with Thread#backtrace_locations and Kernel#caller_locations — "headius (Charles Nutter)" <headius@...>

18 messages 2013/02/20

[#52614] [ruby-trunk - Bug #7897][Open] rubygems 2.0 has an incompatibility about installation of extension libraries if gem package does not contain lib directory — "mrkn (Kenta Murata)" <muraken@...>

8 messages 2013/02/21

[#52727] [ruby-trunk - Feature #7918][Open] Create Signal.in_trap?() — "kosaki (Motohiro KOSAKI)" <kosaki.motohiro@...>

10 messages 2013/02/23

[#52742] [ruby-trunk - Bug #7921][Assigned] Cross-compiling ruby_2_0_0 to Windows is failing (rb_w32_pow) — "luislavena (Luis Lavena)" <luislavena@...>

19 messages 2013/02/23

[#52875] [ruby-trunk - Bug #7956][Open] Install fail with RVM — Sega100500 (Сергей Е) <Sergey.V.Ezhov@...>

14 messages 2013/02/25

[#52877] Any documentation about debugging in Ruby 2.0.0 — Rodrigo Rosenfeld Rosas <rr.rosas@...>

Hi, I couldn't find how to debug Ruby 2.0.0 programs, but only a few

14 messages 2013/02/25
[#52880] Re: Any documentation about debugging in Ruby 2.0.0 — Jeremy Kemper <jeremy@...> 2013/02/25

On Monday, February 25, 2013, Rodrigo Rosenfeld Rosas wrote:

[#52883] Re: Any documentation about debugging in Ruby 2.0.0 — Rodrigo Rosenfeld Rosas <rr.rosas@...> 2013/02/25

Em 25-02-2013 10:47, Jeremy Kemper escreveu:

[#52886] Re: Any documentation about debugging in Ruby 2.0.0 — SASADA Koichi <ko1@...> 2013/02/25

(2013/02/26 0:22), Rodrigo Rosenfeld Rosas wrote:

[#52890] [ruby-trunk - Bug #7958][Open] include FileUtils::Verbose gives NoMethodError when installing files with a different mode — "drbrain (Eric Hodel)" <drbrain@...7.net>

12 messages 2013/02/25

[#52893] [ruby-trunk - Bug #7959][Open] configure contains non-portable shell code — "jeremyevans0 (Jeremy Evans)" <merch-redmine@...>

12 messages 2013/02/25

[#52936] [ruby-trunk - Bug #7968][Open] Poor UDPSocket#send performance in ruby 2.0.0 on windows — "cs96and (Alan Davies)" <alan.n.davies@...>

10 messages 2013/02/26

[#52997] [ruby-trunk - Feature #7978][Open] boolean to_i — "alexeymuranov (Alexey Muranov)" <redmine@...>

14 messages 2013/02/27

[#53017] [ruby-trunk - Bug #7982][Open] rb_raise segfaults on %lli format with (0xffffffff + 1) — "erik.s.chang (Erik Chang)" <erik.s.chang@...>

10 messages 2013/02/28

[#53025] [Backport 200 - Backport #7984][Open] Severe speed issues in 2.0.0 compiled with Clang — "jcole1989 (James Coleman)" <jtc331@...>

13 messages 2013/02/28

[ruby-core:52390] Re: p385 breaks bakward compatibility

From: Jeremy Evans <code@...>
Date: 2013-02-17 16:33:51 UTC
List: ruby-core #52390
On 02/17 06:23, V?t Ondruch wrote:
> Dne 17.2.2013 1:44, Jeremy Evans napsal(a):
> >>So what worked before update does not work now. This issue was introduced
> >>by rev39101 and there is another similar breakage rev39218 in the queue for
> >>release. Yes, this might be wrong design of Bundler, but considering how
> >>wide is adoption of Bundler, Ruby releases should respect it.
> >I'm the packager of ruby for OpenBSD, and I disagree with this. The
> >included gems that ship with Ruby releases (including patch releases)
> >should have versions that match the versions of the external gems with
> >the same content.
> 
> Actually I agree with you on this. But even more important is to not
> break existing applications. Breaking application will result in
> lost of trust and therefore not updating, keeping security issues
> unfixed.
 
When ruby gems such as rack release new versions with security fixes,
what do you do?  Do you just keep the version the same and apply a
patch, or do you bump the version?

The problem with not updating the version is that you risk hiding
security vulnerabilities.  Let's say you have a project using Bundler
where Gemfile.lock contains a vulnerable gem version.  Trying to
silently fix the vulnerability without changing the version only makes
it more likely that the vulnerable version will stay in Gemfile.lock,
which means that other people using the project (on other operating
systems or non-system ruby installations that don't monkey with the
gem version numbers) will still be using vulnerable code.

IMO, it's better to break the app, alerting the operator to the security
vulnerability in their Gemfile.lock, so they can fix the actual problem.

Bundler's use of Gemfile.lock is similar to statically compiling a C
program, and has the same issues in regards to not automatically picking
up security/bug fixes in libraries.

Jeremy

In This Thread