[#59462] [ruby-trunk - Bug #9342][Open] [PATCH] SizedQueue#clear does not notify waiting threads in Ruby 1.9.3 — "jsc (Justin Collins)" <redmine@...>

9 messages 2014/01/02

[#59466] [ruby-trunk - Bug #9343][Open] [PATCH] SizedQueue#max= wakes up waiters properly — "normalperson (Eric Wong)" <normalperson@...>

11 messages 2014/01/02

[#59498] [ruby-trunk - Bug #9352][Open] [BUG] rb_sys_fail_str(connect(2) for [fe80::1%lo0]:3000) - errno == 0 — "kain (Claudio Poli)" <claudio@...>

10 messages 2014/01/03

[#59516] [ruby-trunk - Bug #9356][Open] TCPSocket.new does not seem to handle INTR — "charliesome (Charlie Somerville)" <charliesome@...>

48 messages 2014/01/03

[#59538] [ruby-trunk - Feature #9362][Assigned] Minimize cache misshit to gain optimal speed — "shyouhei (Shyouhei Urabe)" <shyouhei@...>

33 messages 2014/01/03
[#59541] Re: [ruby-trunk - Feature #9362][Assigned] Minimize cache misshit to gain optimal speed — Eric Wong <normalperson@...> 2014/01/04

Hi, I noticed a trivial typo in array.c, and it fails building struct.c

[#59582] Re: [ruby-trunk - Feature #9362][Assigned] Minimize cache misshit to gain optimal speed — SASADA Koichi <ko1@...> 2014/01/06

Intersting challenge.

[#59583] [ruby-trunk - Bug #9367][Open] REXML::XmlDecl doesn't use user specified quotes — "bearmini (Takashi Oguma)" <bear.mini@...>

12 messages 2014/01/06

[#59642] [ruby-trunk - Bug #9384][Open] Segfault in ruby 2.1.0p0 — "cbliard (Christophe Bliard)" <christophe.bliard@...>

11 messages 2014/01/08

[#59791] About unmarshallable DRb objects life-time — Rodrigo Rosenfeld Rosas <rr.rosas@...>

A while ago I created a proof-of-concept that I intended to use in my

16 messages 2014/01/15
[#59794] Re: About unmarshallable DRb objects life-time — Eric Hodel <[email protected]> 2014/01/15

On 15 Jan 2014, at 11:58, Rodrigo Rosenfeld Rosas <[email protected]> =

[#59808] Re: About unmarshallable DRb objects life-time — Rodrigo Rosenfeld Rosas <rr.rosas@...> 2014/01/16

Em 15-01-2014 19:42, Eric Hodel escreveu:

[#59810] Re: About unmarshallable DRb objects life-time — Eric Hodel <[email protected]> 2014/01/16

On 16 Jan 2014, at 02:15, Rodrigo Rosenfeld Rosas <[email protected]> =

[#59826] Re: About unmarshallable DRb objects life-time — Rodrigo Rosenfeld Rosas <rr.rosas@...> 2014/01/17

Em 16-01-2014 19:43, Eric Hodel escreveu:

[#59832] Re: About unmarshallable DRb objects life-time — Eric Hodel <[email protected]> 2014/01/17

On 17 Jan 2014, at 04:22, Rodrigo Rosenfeld Rosas <[email protected]> =

[ruby-core:60148] Re: [ruby-trunk - Bug #9424] ruby 1.9 & 2.x has insecure SSL/TLS client defaults

From: KOSAKI Motohiro <kosaki.motohiro@...>
Date: 2014-01-27 23:57:54 UTC
List: ruby-core #60148
On Sun, Jan 26, 2014 at 10:44 PM,  <[email protected]> wrote:
> Issue #9424 has been updated by Yusuke Endoh.
>
>
> Martin Bosslet wrote:
>> a) I want to apologize for overlooking this
>
> Ah, you don't need to apologize at all!  I just wanted to clarify what is=
 relieved and what is not.
>
>
>> Like @shyouhei, I still believe the best solution would be asking OpenSS=
L to fix this for all of us.
>
> Me too, but I'm curious about the reason why OpenSSL people don't "improv=
e" the defaults.
> (OT: insecure default is not a bug itself; I'd like to use "improve" rath=
er than "fix".)
>
> One possible answer: They are simply unable, due to various reasons such =
as compatibility, lack of resource, etc.  They have intention of doing that=
 in the future.  There is no problem in this case.
>
> Another answer: Their goal is just to provide toolkit, and secure default=
s are out of scope.  In this case, they won't improve it.  (I have no inten=
tion of blaming them.  Deciding secure defaults is a hard task.  Effort all=
ocation looks quite reasonable to me.)  Anyway, I'm afraid if just waiting =
will not solve our issue in this case.
>

I'm afraid I'm missing something. But I'd like to ask first. Why do
nobody ask OpenSSL first?
They only can answer their intension. I don't think debate a guess on
this list is a good idea.
I believe the best way is a fixing by OpenSSL because, as you pointed
out, either Ruby and
OpenSSL can not make secure Ruby + old OpenSSL case. Therefore, to
workaround for old
OpenSSL is a pointless.

I agree security is important and Ruby sometimes accepted a workaround
patch and should
do in the future too, if we really need to do.
But I disagree just to continue a guess talk. Fixing right place is
always better than a workaround.

I hope my stand point is close to yours.

In This Thread

Prev Next