[#36711] [Ruby 1.9 - Bug #4821][Open] Random Segfaults (in start_thread?) — Ivan Bortko <b2630639@...>

22 messages 2011/06/03

[#36730] [Ruby 1.9 - Feature #4824][Open] Provide method Kernel#executed? — Lazaridis Ilias <ilias@...>

56 messages 2011/06/04

[#36750] [Ruby 1.9 - Feature #4830][Open] Provide Default Variables for Array#each and other iterators — Lazaridis Ilias <ilias@...>

24 messages 2011/06/05

[#36785] [Ruby 1.9 - Feature #4840][Open] Allow returning from require — Rodrigo Rosenfeld Rosas <rr.rosas@...>

53 messages 2011/06/06
[#36811] Re: [Ruby 1.9 - Feature #4840][Open] Allow returning from require — Yusuke ENDOH <mame@...> 2011/06/07

Hello,

[#36799] [Ruby 1.9 - Feature #4845][Open] Provide Class#cb_object_instantiated_from_literal(object) — Lazaridis Ilias <ilias@...>

11 messages 2011/06/06

[#36834] [Ruby 1.9 - Feature #3905] rb_clear_cache_by_class() called often during GC for non-blocking I/O — Charles Nutter <headius@...>

10 messages 2011/06/08
[#36860] Re: [Ruby 1.9 - Feature #3905] rb_clear_cache_by_class() called often during GC for non-blocking I/O — Eric Wong <normalperson@...> 2011/06/08

Charles Nutter <headius@headius.com> wrote:

[#36863] Object#trust vs Object#taint — Aaron Patterson <aaron@...>

Hi,

16 messages 2011/06/08
[#36866] Re: Object#trust vs Object#taint — Yukihiro Matsumoto <matz@...> 2011/06/08

Hi,

[#36873] Re: Object#trust vs Object#taint — Aaron Patterson <aaron@...> 2011/06/09

On Thu, Jun 09, 2011 at 07:49:06AM +0900, Yukihiro Matsumoto wrote:

[#37071] [Ruby 1.9 - Feature #4877][Open] Unify Variable Expansion within Strings — Lazaridis Ilias <ilias@...>

12 messages 2011/06/12

[#37106] ruby core tutorials location — Roger Pack <rogerdpack2@...>

Hello all.

10 messages 2011/06/13
[#37107] Re: ruby core tutorials location — Jon <jon.forums@...> 2011/06/13

> Hello all.

[#37115] Re: ruby core tutorials location — Roger Pack <rogerdpack2@...> 2011/06/13

> Rather than adding links to source code, I would prefer the wikibooks link and others under a new Tutorials section of http://www.ruby-lang.org/en/documentation/ as well as adding http://ruby.runpaint.org/ to the existing Getting Started section.

[#37117] Re: ruby core tutorials location — Jon <jon.forums@...> 2011/06/13

> > Rather than adding links to source code, I would prefer the wikibooks link and others under a new Tutorials section of http://www.ruby-lang.org/en/documentation/ as well as adding http://ruby.runpaint.org/ to the existing Getting Started section.

[#37128] Re: ruby core tutorials location — Roger Pack <rogerdpack2@...> 2011/06/14

> I like what you're trying to do and see how great that tutorial connection from rdoc/yard could be, say, mixing with existing ruby-doc.org and rubydoc.info. ut I question embedding source links to info in which the info can easily grow outdated or abandoned as time passes. I also question the ongoing maintenance burdens.

[#37137] Re: ruby core tutorials location — Jon <jon.forums@...> 2011/06/14

> > I like what you're trying to do and see how great that tutorial connection from rdoc/yard could be, say, mixing with existing ruby-doc.org and rubydoc.info. ut I question embedding source links to info in which the info can easily grow outdated or abandoned as time passes. I also question the ongoing maintenance burdens.

[#37164] [Ruby 1.9 - Feature #4890][Open] Enumerable#lazy — Yutaka HARA <redmine@...>

30 messages 2011/06/16

[#37170] [Ruby 1.9 - Bug #4893][Open] Literal Instantiation breaks Object Model — Lazaridis Ilias <ilias@...>

61 messages 2011/06/16

[#37207] [Ruby 1.9 - Feature #4897][Open] Define Math::TAU and BigMath.TAU. The "true" circle constant, Tau=2*Pi. See http://tauday.com/ — Simon Baird <simon.baird@...>

43 messages 2011/06/17

[#37286] [Ruby 1.9 - Bug #4916][Open] [BUG] Segmentation fault - dyld: lazy symbol binding failed: Symbol not found: _ASN1_put_eoc — Hiroshi NAKAMURA <nakahiro@...>

9 messages 2011/06/22

[#37324] [Ruby 1.9 - Bug #4923][Open] [ext/openssl] test_ssl.rb: test_client_auth fails — Martin Bosslet <Martin.Bosslet@...>

19 messages 2011/06/23

[#37576] [Ruby 1.9 - Feature #4938][Open] Add Random.bytes [patch] — Marc-Andre Lafortune <ruby-core@...>

13 messages 2011/06/27

[#37612] [Ruby 1.9 - Bug #4941][Open] cannot load such file -- rubygems.rb (LoadError) — Lazaridis Ilias <ilias@...>

25 messages 2011/06/28

[ruby-core:37318] [Ruby 1.9 - Bug #4579] SecureRandom + OpenSSL may repeat with fork

From: Akira Tanaka <akr@...>
Date: 2011-06-23 10:55:43 UTC
List: ruby-core #37318
Issue #4579 has been updated by Akira Tanaka.


I don't understand why /dev/urandom fallback should be removed.

Is your reason the "theoretically vulnerable to a cryptographic attack on the algorithms used by the driver" (from Linux man page)?

----------------------------------------
Bug #4579: SecureRandom + OpenSSL may repeat with fork
http://redmine.ruby-lang.org/issues/4579

Author: Eric Wong
Status: Closed
Priority: Normal
Assignee: Akira Tanaka
Category: lib
Target version: 1.9.x
ruby -v: -


=begin
This could arguably be a bug in OpenSSL or the openssl extension, but
I think it's easier to fix in Ruby right now.

The PRNG in OpenSSL uses the PID to seed the PRNG.  Since PIDs get
recycled over time on Unix systems, this means independent processes
over a long time span will repeat random byte sequences.  This has
security implications, but fortunately very little software forks
very frequently.  I am not a security expert.

I am using OpenSSL 0.9.8g-15+lenny11 (Debian Lenny)

Attached is a script that reproduces the issue (takes a while to run).
It'll output two identical lines to illustrate the issue.

=end



-- 
http://redmine.ruby-lang.org

In This Thread

Prev Next