From: Igal Koshevoy Date: 2008-06-25T08:41:07+09:00 Subject: Re: Ruby 1.9.0/1.8.7/1.8.6/1.8.5 new releases (Security Fix) Robert Thau wrote: > Well, if we want the Japanese team to be more rigorous in applying test > suites in testing their stuff... we've got the test suites too. People have reported that the current versions are broken on every imaginable Ruby-related site and list for the last four days, so we as users have done our part in pointing out the problem. What can we do to lobby the Ruby maintainers to prevent a repeat of this in the future? How do we get a "red telephone" or something so we can contact them about critical errors? How do we convince them to respond back to the community in a timely manner about stuff like this? And how do we convince them to at least run the RubySpec, Rails and RSpec test suites before shipping an official version to avoid such a problem in the future? > really understanding this code requires > a fairly deep grounding in the internal data structures of MRI Unfortunately, I don't have the expertise to make sense of that code and can only recognize that something is obviously wrong and try to contact people that may be able to do something. If ruby-talk and ruby-core aren't the right places, where do we find someone with this expertise? > the silence is somewhat troublesome to me too. I've contacted other lists and blogs I mentioned earlier, sent out a broadcast to ruby-core, sent emails, submitted a RubyForge ticket, and even tried the #ruby IRC channel. I don't know what else I can do at this point. The maintainers published the code for the security patches on the 18th, thus giving crackers almost a week head start in finding an exploit in older versions. They then shipped broken releases on the 20th, making it impossible for anyone to upgrade to an official version. And we haven't heard anything since. What's going on? How do we get a hold of the official maintainers? -igal -- Posted via http://www.ruby-forum.com/.