[#42311] [ruby-trunk - Feature #5958][Open] ThreadGroup#join — Masaki Matsushita <glass.saga@...>
12 messages
2012/02/01
[#42329] [RFC/PATCH] reinit signal_thread_list_lock atfork — Eric Wong <normalperson@...>
This issue was found under Ruby 1.9.3 (-p0 presumably), but probably
8 messages
2012/02/02
[#42331] Re: [RFC/PATCH] reinit signal_thread_list_lock atfork
— KOSAKI Motohiro <kosaki.motohiro@...>
2012/02/02
> signal_thread_list_lock may be held in the timer thread during
[#42332] Re: [RFC/PATCH] reinit signal_thread_list_lock atfork
— Eric Wong <normalperson@...>
2012/02/02
KOSAKI Motohiro <[email protected]> wrote:
[#42333] Re: [RFC/PATCH] reinit signal_thread_list_lock atfork
— KOSAKI Motohiro <kosaki.motohiro@...>
2012/02/02
2012/2/2 Eric Wong <[email protected]>:
[#42344] [ruby-trunk - Feature #5964][Open] Make Symbols an Alternate Syntax for Strings — Tom Wardrop <tom@...>
23 messages
2012/02/03
[#42355] [ruby-trunk - Feature #5964] Make Symbols an Alternate Syntax for Strings
— Kurt Stephens <redmine@...>
2012/02/05
[#42361] 1.9.3's 1st patch release — "NARUSE, Yui" <naruse@...>
Hi,
7 messages
2012/02/05
[#42391] I'll reject stalled feature tickets — Yusuke Endoh <mame@...>
(Japaneser later; 日本語は後で)
4 messages
2012/02/07
[#42404] [ruby-trunk - Bug #5978][Open] YAML.load_stream should process documents as they are read — Thomas Sawyer <transfire@...>
6 messages
2012/02/07
[#42442] [ruby-trunk - Bug #5978] YAML.load_stream should process documents as they are read
— Thomas Sawyer <transfire@...>
2012/02/08
[#42443] [ruby-trunk - Bug #5985][Open] miniruby skews "make benchmark" results — Eric Wong <normalperson@...>
21 messages
2012/02/08
[#50155] [ruby-trunk - Bug #5985] miniruby skews "make benchmark" results
— "ko1 (Koichi Sasada)" <redmine@...>
2012/11/26
[#50180] Re: [ruby-trunk - Bug #5985] miniruby skews "make benchmark" results
— Eric Wong <normalperson@...>
2012/11/26
"ko1 (Koichi Sasada)" <[email protected]> wrote:
[#59871] [ruby-trunk - Bug #5985] miniruby skews "make benchmark" results
— normalperson@...
2014/01/19
Issue #5985 has been updated by Eric Wong.
[#42444] [ruby-trunk - Bug #5986][Open] Segmentation Fault — Luis Matta <levmatta@...>
16 messages
2012/02/08
[#42448] [ruby-trunk - Bug #5988][Open] Time class interprets "2012-02-30" as "2012-03-01" — Dylan Markow <dmarkow@...>
5 messages
2012/02/08
[#42471] [ruby-trunk - Feature #5995][Open] calling io_advise_internal() in read_all() — Masaki Matsushita <glass.saga@...>
20 messages
2012/02/10
[#42480] [ruby-trunk - Feature #5999][Open] Optimize for faster loading time and win32/file.c refactoring — Hiroshi Shirosaki <h.shirosaki@...>
6 messages
2012/02/10
[#42500] Question on getting the receiver class information from a RUBY_EVENT_CALL event hook (1.9.2) — Daniel Cadenas <dcadenas@...>
Hi all, I hope someone can help me with this problem I'm having on a
3 messages
2012/02/11
[#42523] [ruby-trunk - Bug #6008][Open] {a: 1}.hash not consistent over VM restarts — Jens Berlips <jens@...>
6 messages
2012/02/13
[#42550] [ruby-trunk - Feature #1400] Please add a method to enumerate fields in OpenStruct — Yusuke Endoh <mame@...>
4 messages
2012/02/13
[#42554] Re: [ruby-trunk - Feature #1400] Please add a method to enumerate fields in OpenStruct
— Peter Vandenabeele <peter@...>
2012/02/13
On Mon, Feb 13, 2012 at 4:08 PM, Yusuke Endoh <[email protected]> wrote:
[#42564] some questions about nesting/constants — Xavier Noria <fxn@...>
Hello,
1 message
2012/02/13
[#42579] [ruby-trunk - Bug #6012][Open] Proc#source_location also return the column — Roger Pack <rogerpack2005@...>
14 messages
2012/02/14
[#42607] [ruby-trunk - Bug #6020][Open] Unexpected is_a/kind_of behaviour — Alex N <masterlambaster@...>
7 messages
2012/02/14
[#42613] [ruby-trunk - Bug #6021][Open] TestDBM#test_aref test fails — Vit Ondruch <v.ondruch@...>
9 messages
2012/02/14
[#42630] [ruby-trunk - Feature #6023][Open] Add "a ?= 2" support for meaning "a = a.nil? ? 2 : a" — Rodrigo Rosenfeld Rosas <rr.rosas@...>
7 messages
2012/02/14
[#42672] strange 1.9.3 GC issue with Nokogiri — Eric Wong <normalperson@...>
Hello ruby-core,
6 messages
2012/02/16
[#42704] Re: strange 1.9.3 GC issue with Nokogiri
— Tim Elliott <tle@...>
2012/02/17
On Wed, Feb 15, 2012 at 4:39 PM, Eric Wong <[email protected]> wrote:
[#42682] Ruby 1.9.3 patchlevel 125 released — "NARUSE, Yui" <naruse@...>
-----BEGIN PGP SIGNED MESSAGE-----
6 messages
2012/02/16
[#42686] Re: Ruby 1.9.3 patchlevel 125 released
— Jon <jon.forums@...>
2012/02/16
> Ruby 1.9.3-p125 is released.
[#42712] Re: Ruby 1.9.3 patchlevel 125 released
— Charles Oliver Nutter <headius@...>
2012/02/17
On Thu, Feb 16, 2012 at 11:19 AM, Jon <[email protected]> wrote:
[#42685] [ruby-trunk - Bug #6036][Open] Test failures in Fedora Rawhide/17 — Bohuslav Kabrda <bkabrda@...>
14 messages
2012/02/16
[#42697] [ruby-trunk - Bug #6040][Open] Transcoding test failure: Big5 to UTF8 not defined (MinGW) — Luis Lavena <luislavena@...>
10 messages
2012/02/16
[#42722] [ruby-trunk - Bug #6040] Transcoding test failure: Big5 to UTF8 not defined (MinGW)
— Yui NARUSE <naruse@...>
2012/02/17
[#42723] Re: [ruby-trunk - Bug #6040] Transcoding test failure: Big5 to UTF8 not defined (MinGW)
— Luis Lavena <luislavena@...>
2012/02/17
On Fri, Feb 17, 2012 at 7:47 PM, Yui NARUSE <[email protected]> wrote:
[#42715] Classes as pure mixin conatiners — trans <transfire@...>
Some time ago, I suggested that it might be worth considering a design
3 messages
2012/02/17
[#42755] [ruby-trunk - Bug #6048][Open] {Unbound}Method#hash doesn't always return the right value — Marc-Andre Lafortune <ruby-core@...>
5 messages
2012/02/20
[#42777] 500 reputation stackoverflow question about Ruby GIL — Grigory Petrov <grigory.v.p@...>
Hello.
5 messages
2012/02/21
[#42797] Re: 500 reputation stackoverflow question about Ruby GIL
— KOSAKI Motohiro <kosaki.motohiro@...>
2012/02/22
2012/2/21 Grigory Petrov <[email protected]>:
[#42800] Re: 500 reputation stackoverflow question about Ruby GIL
— Grigory Petrov <grigory.v.p@...>
2012/02/22
No, it fails same way on all my OSX versions from 10.5 to 10.7
[#42789] [ruby-trunk - Bug #6057][Open] URI - Nonsensical Behavior — Scott Gonyea <scott@...>
9 messages
2012/02/22
[#42813] [ruby-trunk - Feature #6065][Open] Allow Bignum marshalling/unmarshalling from C API — Martin Bosslet <Martin.Bosslet@...>
22 messages
2012/02/23
[#42820] [ruby-trunk - Feature #6065] Allow Bignum marshalling/unmarshalling from C API
— Martin Bosslet <Martin.Bosslet@...>
2012/02/23
[#42869] [ruby-trunk - Feature #6065] Allow Bignum marshalling/unmarshalling from C API
— Martin Bosslet <Martin.Bosslet@...>
2012/02/24
[#42876] Re: [ruby-trunk - Feature #6065] Allow Bignum marshalling/unmarshalling from C API
— Yusuke Endoh <mame@...>
2012/02/25
Hello,
[#42843] [ruby-trunk - Feature #6070][Open] The scope of for loop variables — Shugo Maeda <redmine@...>
9 messages
2012/02/23
[#42857] [ruby-trunk - Feature #6074][Open] Allow alias arguments to have a comma — Thomas Sawyer <transfire@...>
20 messages
2012/02/24
[#42870] [ruby-trunk - Feature #6079][Open] Hash#each_sorted — Walter Urbaniak <mondgrav-ruby@...>
6 messages
2012/02/24
[#42891] [ruby-trunk - Feature #6083][Open] Hide a Bignum definition — Koichi Sasada <redmine@...>
23 messages
2012/02/25
[#48618] [ruby-trunk - Feature #6083] Hide a Bignum definition
— "matz (Yukihiro Matsumoto)" <matz@...>
2012/10/30
[#48640] Re: [ruby-trunk - Feature #6083] Hide a Bignum definition
— KOSAKI Motohiro <kosaki.motohiro@...>
2012/10/31
> Target version changed from 2.0.0 to next minor
[#42906] [ruby-trunk - Bug #6085][Open] Treatment of Wrong Number of Arguments — Marc-Andre Lafortune <ruby-core@...>
14 messages
2012/02/25
[#43253] [ruby-trunk - Bug #6085] Treatment of Wrong Number of Arguments
— Marc-Andre Lafortune <ruby-core@...>
2012/03/12
[#42972] 50$ for answering my stackoverflow question about Ruby GIL 500 reputation stackoverflow question about Ruby GIL 50$ for answering my stackoverflow question. — Grigory Petrov <grigory.v.p@...>
Hello.
3 messages
2012/02/27
[#42981] 50$ for answering my stackoverflow question about Ruby and GIL — Grigory Petrov <grigory.v.p@...>
Thanks.
7 messages
2012/02/27
[#42982] Re: 50$ for answering my stackoverflow question about Ruby and GIL
— Eric Hodel <[email protected]>
2012/02/27
On Feb 27, 2012, at 9:54 AM, Grigory Petrov wrote:
[#42983] Re: 50$ for answering my stackoverflow question about Ruby and GIL
— Grigory Petrov <grigory.v.p@...>
2012/02/27
I'm not so sure about that.
[#42985] Re: 50$ for answering my stackoverflow question about Ruby and GIL
— Eric Hodel <[email protected]>
2012/02/28
On Feb 27, 2012, at 12:10 PM, Grigory Petrov wrote:
[#42999] Re: 50$ for answering my stackoverflow question about Ruby and GIL
— Grigory Petrov <grigory.v.p@...>
2012/02/28
> This test code doesn't show switch time, it shows how fast two ruby threa=
[#42989] Re: [ruby-cvs:42007] nobu:r34829 (trunk): * ext/bigdecimal/bigdecimal.c (GetVpValueWithPrec): since methods — Eric Hodel <[email protected]>
On Feb 27, 2012, at 12:03 AM, [email protected] wrote:
4 messages
2012/02/28
[#43012] [ruby-trunk - Bug #6103][Open] Build failure on trunk 34850 with VC 2010 — Heesob Park <phasis@...>
5 messages
2012/02/29
[#43021] English instructions for setting up chkbuild? — Luis Lavena <luislavena@...>
Hello,
6 messages
2012/02/29
[#43030] return values of methods on String subclasses — Aaron Patterson <tenderlove@...>
It pains me to ask about this, but since Rails subclasses String, I need
10 messages
2012/02/29
[ruby-core:42479] [ruby-trunk - Bug #5353] TLS v1.0 and less - Attack on CBC mode
From:
Hiroshi Nakamura <nakahiro@...>
Date:
2012-02-10 13:13:47 UTC
List:
ruby-core #42479
Issue #5353 has been updated by Hiroshi Nakamura.
At first, I misunderstood the message from Martin that he just want to turn off the flag by default. I thought we can turn off the SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS flag if we want.
Based on Apple's report at January, I realized that we didn't offer the feature from the beginning (I confirmed it to Gotoyuzo, the author of original code.) So we added the feature. Please see the linked commit for more detail.
The original proposal from Martin, turning off the SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS bit by default, is still open.
----------------------------------------
Bug #5353: TLS v1.0 and less - Attack on CBC mode
https://bugs.ruby-lang.org/issues/5353
Author: Martin Bosslet
Status: Open
Priority: High
Assignee:
Category: ext
Target version: 2.0.0
ruby -v: -
A well-known vulnerability of TLS v1.0 and earlier has recently gained some attention:
http://www.theregister.co.uk/2011/09/19/beast_exploits_paypal_ssl/
Although this has been known for a long time (http://www.openssl.org/~bodo/tls-cbc.txt),
and a fix for this has been provided, in reality most applications seem to be working with
SSL_OP_ALL
which is a flag that enables some bug workarounds that were considered harmless.
We, too, use this in ossl_sslctx_s_alloc(VALUE klass) in ossl_ssl.c. Unfortunately,
this flag also includes
SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
which disables the fix for the "CBC vulnerability". Here is what a comment says
about the flag (OpenSSL 1.0.0d)
/* Disable SSL 3.0/TLS 1.0 CBC vulnerability workaround that was added
* in OpenSSL 0.9.6d. Usually (depending on the application protocol)
* the workaround is not needed. Unfortunately some broken SSL/TLS
* implementations cannot handle it at all, which is why we include
* it in SSL_OP_ALL. */
If I understand http://www.openssl.org/~bodo/tls-cbc.txt correctly, the most
notable implementation that does not play well with these empty fragments
was (is?) IE - I don't know how this has evolved over time, I would have to
research further.
An easy fix for the situation would be to discard SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS,
but this would risk affecting existing installations.
What do you propose? Should we solve this before the 1.9.3 release?
(PS: The actual attack and fix are outlined in
http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.61.5887&rep=rep1&type=pdf
The attack to be presented by Thai Duong and Juliano Rizzo at
http://ekoparty.org/cronograma.php (caution: currently the site is victim to the "reddit effect")
is very likely to be based on what was already known and should therefore hopefully
require no further fixes.)
--
http://bugs.ruby-lang.org/