[#39260] RubySpec vs CRuby's test/... — Marc-Andre Lafortune <ruby-core-mailing-list@...>

Before the release of Ruby 1.9.2 it was decided that Ruby releases

59 messages 2011/09/04
[#39276] Re: RubySpec vs CRuby's test/... — "NARUSE, Yui" <naruse@...> 2011/09/05

2011/9/5 Marc-Andre Lafortune <[email protected]>:

[#39325] Re: RubySpec vs CRuby's test/... — Charles Oliver Nutter <headius@...> 2011/09/07

I'll jump in with some context from the JRuby perspective.

[#39335] Re: RubySpec vs CRuby's test/... — "NARUSE, Yui" <naruse@...> 2011/09/07

2011/9/7 Charles Oliver Nutter <[email protected]>:

[#39365] Re: RubySpec vs CRuby's test/... — Charles Oliver Nutter <headius@...> 2011/09/08

On Wed, Sep 7, 2011 at 4:17 AM, NARUSE, Yui <[email protected]> wrote:

[#39366] Re: RubySpec vs CRuby's test/... — Yukihiro Matsumoto <matz@...> 2011/09/08

Hi,

[#39370] Re: RubySpec vs CRuby's test/... — Michael Klishin <michael.s.klishin@...> 2011/09/08

Yukihiro Matsumoto:

[#39374] Re: RubySpec vs CRuby's test/... — "NARUSE, Yui" <naruse@...> 2011/09/08

(2011/09/09 1:29), Michael Klishin wrote:

[#39376] Re: RubySpec vs CRuby's test/... — Luis Lavena <luislavena@...> 2011/09/08

On Thu, Sep 8, 2011 at 4:19 PM, NARUSE, Yui <[email protected]> wrote:

[#39379] Re: RubySpec vs CRuby's test/... — Masaya TARUI <tarui@...> 2011/09/08

Hello Luis,

[#39382] Re: RubySpec vs CRuby's test/... — Luis Lavena <luislavena@...> 2011/09/08

On Thu, Sep 8, 2011 at 5:34 PM, Masaya TARUI <[email protected]> wrote:

[#39386] Re: RubySpec vs CRuby's test/... — Charles Oliver Nutter <headius@...> 2011/09/08

On Thu, Sep 8, 2011 at 3:57 PM, Luis Lavena <[email protected]> wrote:

[#39267] [Ruby 1.9 - Bug #5273][Open] Float#round returns the wrong floats for higher precision — Marc-Andre Lafortune <ruby-core@...>

14 messages 2011/09/04

[#39435] [Ruby 1.9 - Bug #5306][Open] Application Hangs Due to Recent rb_thread_select Changes — Charlie Savage <cfis@...>

27 messages 2011/09/09

[#39498] [Ruby 1.9 - Feature #5310][Open] Integral objects — Kenta Murata <muraken@...>

13 messages 2011/09/13

[#39539] [Ruby 1.9 - Feature #5321][Open] Introducing Numeric#exact? and Numeric#inexact? — Kenta Murata <muraken@...>

26 messages 2011/09/14

[#39629] [Ruby 1.9 - Feature #5341][Open] Add SSL session reuse to Net::HTTP — Eric Hodel <[email protected]>

18 messages 2011/09/19

[#39634] [Ruby 1.9 - Bug #5343][Open] Unexpected blocking behavior when interrupt Socket#accept — Tomoyuki Chikanaga <nagachika00@...>

10 messages 2011/09/20

[#39673] [Ruby 1.9 - Bug #5353][Open] TLS v1.0 and less - Attack on CBC mode — Martin Bosslet <Martin.Bosslet@...>

13 messages 2011/09/22

[#39700] [Ruby 1.9 - Feature #5364][Open] How about new syntax: "object.\method" returns a Method instance? — Joey Zhou <yimutang@...>

20 messages 2011/09/25

[#39740] [Ruby 1.9 - Feature #5372][Open] Promote blank? to a core protocol — Alex Young <alex@...>

18 messages 2011/09/27
[#39743] Re: [Ruby 1.9 - Feature #5372][Open] Promote blank? to a core protocol — Aaron Patterson <aaron@...> 2011/09/27

On Tue, Sep 27, 2011 at 06:18:19PM +0900, Alex Young wrote:

[#39754] Re: [Ruby 1.9 - Feature #5372][Open] Promote blank? to a core protocol — Alex Young <alex@...> 2011/09/27

On 27/09/2011 19:46, Aaron Patterson wrote:

[#39807] Re: [Ruby 1.9 - Feature #5372][Open] Promote blank? to a core protocol — Eric Hodel <[email protected]> 2011/10/01

On Sep 27, 2011, at 6:52 PM, Alex Young wrote:

[#39751] [Ruby 1.9 - Bug #5375][Open] [mingw32] segfault on WinXP SP3 with 1.9.3dev@33347 — Jon Forums <redmine@...>

26 messages 2011/09/27

[#39772] ObjectSpace.reference_form(obj) #=> references_array — SASADA Koichi <ko1@...>

Hi,

13 messages 2011/09/29
[#39774] Re: ObjectSpace.reference_form(obj) #=> references_array — Nobuyoshi Nakada <nobu@...> 2011/09/29

Hi,

[#39796] [Ruby 1.9 - Bug #5384][Open] Ruby 1.9.3-RC1 Fails to Compile on Solaris — Cyrus Lopez <cyrus@...>

11 messages 2011/09/30

[ruby-core:39727] Re: [Ruby 1.9 - Bug #5353] TLS v1.0 and less - Attack on CBC mode

From: Hiroshi Nakamura <nakahiro@...>
Date: 2011-09-26 07:51:38 UTC
List: ruby-core #39727
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 09/24/2011 08:44 PM, Martin Bosslet wrote:
> http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html
> http://www.imperialviolet.org/2011/09/23/chromeandbeast.html
> 
> From what I understand this is really sweet, instead of trying to guess a
> whole block at a time they play with block boundaries so that they effectively
> only have to guess one byte at a time instead of let's say 16.

Agreed. Wise and pragmatic :)

> And it looks like turning off SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS really does
> prevent this kind of attack, too. But then again, as nahi already hinted at,
> mounting this kind of attack requires quite some sophistication, usually there
> are often easier ways for an attacker.

Some fix needed especially for clients but for now it should be fixed at
client side, and we should wait how OpenSSL treats this issue.

I would say that it's not a blocker for 1.9.3.

> An interesting approach that wouldn't break compatibility seems to be what
> is currently investigated for Chrome:
> 
> http://codereview.chromium.org/7621002
> 
> Instead of sending a totally empty first record they send one with exactly one
> byte to get the same effect of randomizing the IV.

Yeah, if I understand the attack correctly, with this vulnerability, an
attacker can try to guess a plain text only as the first block of CBC
chain. And the above NSS patch reduces the range to 1 byte, and
OpenSSL's empty fragment patch reduces it to 0 byte. It's wise and
pragmatic, too. :) I wish the 1-byte patch is proven to be safe from
compatibility point of view...

// NaHi
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQEcBAEBAgAGBQJOgC8DAAoJEC7N6P3yLbI2Du8H/A88MBS3BCdDFjDzWtWgfntY
5keNOMZZ+Z5syTKURtCLRqRHrMfvqizdfB83oSVsDXnkwTSacGW2OYKX59z6HezO
Hf7rap9oznlFmXjUw0YsJOVuNOL3NYbKzeK/O8Ycn//YeIw7ZQNPsB0vg4vgzwaZ
RVaEpss13WWRl3M0IfQ+wl9vHbCnL1kgJmc+Q+vYQ/cUW0k4RBEWrXZ9IQUk97+8
42GS/ZRWl8nRK0VEVAYBY/zdD9oukdbwhW+cxol5Sx4blRgVyB6uoqpevd8rXliU
h8jo7NEDx6o/HxgT4Jy/20CD5aHrT7N42ZumE8P0jgM0m5IiR+6++IYfcMvznWg=
=84SS
-----END PGP SIGNATURE-----

In This Thread