Denial of service attack was found for Ruby's Hash algorithm (CVE-2011-4815)

Impact

This is something related to computational complexity. Specially crafted series of strings that intentionally collide their hash values each other was found. With such sequences an attacker can issue a denial of service attack by, for instance, giving them as POST parameters of HTTP requests for your Rails application.

Continue Reading…

Ruby 1.9.3 p0 is released

Ruby 1.9.3 p0 is released. This is the latest stable version of 1.9 series.

See ChangeLogs and NEWS for the descriptions.

Continue Reading…

Upcoming Ruby Programming Competitions with Matz - Grand Prize - 1,000,000 JPY!

Dear Ruby Enthusiasts:

The Government of Fukuoka, Japan together with "Matz" Matsumoto would like to invite you to enter the following Ruby competitions. If you have developed an interesting Ruby program, please be encouraged to apply.

  • Silicon Valley Competition (November 3, 2011 in Silicon Valley), Entry Deadline: October 17, 2011

Selected finalists will present their Ruby programs in front of Matz on November 3, 2011 in Silicon Valley (exact location to be announced later). Matz, together with a panel of judges, will select the winner. The winner will be invited to Fukuoka, Japan for an award ceremony to be held in March 2012 (hotel and airfare paid). If you enter the Silicon Valley competition, you will also be automatically entered in the Fukuoka competition described below.

  • Fukuoka Competition - Grand Prize - 1 Million Yen! (March 2012 in Fukuoka, Japan), Entry Deadline: November 15, 2011

You can enter the Fukuoka competition exclusively, or enter the above Silicon Valley Competition and be automatically entered in the Fukuoka Competition. Matz and a group of panelists will select the winners of the Fukuoka Competition. The grand prize winner will be invited to attend the award ceremony in Fukuoka, Japan in March 2012 (hotel and airfare paid). The grand prize for the Fukuoka Competition is 1 million yen(approximately $13,000!). Past grand prize winners include Rhomobile (USA) and APEC Climate Center (Korea).

Programs entered in these competitions do not have to be written entirely in Ruby but should take advantage of the unique characteristics of Ruby. Projects must have been developed or completed within the past 12 months to be eligible.

Please visit the following Fukuoka website for additional details or to enter:

http://www.myfukuoka.com/events/2012-fukuoka-ruby-award-competition

Cheers.

Plans for 1.8.7

Hello, and thank you for your getting into our community.

I know most of you more or less use version 1.8.7 of Ruby today. It was released in 2008 and was a state-of-art Ruby release back then. -- I am proud to say it is no longer. Ruby's core developers have been actively working on their new version, 1.9, and they are about to release new 1.9.3. I have been using 1.9 for years and now I cannot go back to the days without it. Rich features. Faster execution. Rubygems integrated. Rails works perfectly. I cannot but say it is totally wonderful. Everyone please, use 1.9.

But at the same time I know you cannot switch to 1.9 right now for various reasons. Maybe you have already deployed your application with 1.8.7. Maybe you use a 3rd party library and that is for 1.8.7 only. Or maybe your Linux distribution only supports 1.8.7. So I hereby announce you how long you can stick to it. It is OK if you are using 1.8.7 today but after a while, it will be shut down.

Please be ready.

Schedule:

  • We continue to provide normal maintenance for 1.8.7 as usual, until June 2012. You can safely assume we provide bugfixes and no incompatibility shall be introduced.

  • After that we stop bugfixes. We still provide security fixes until June 2013, in case you are still using 1.8.7.

  • We will no longer support 1.8.7 in all senses after June 2013.

Ruby 1.9.3 rc1 has been released

Ruby 1.9.3 rc1 has been released. This is a second preview of next version and there're still minor known issues. But it will be fixed in next release, ruby 1.9.3-p0.

See ChangeLogs and NEWS for the descriptions.

Continue Reading…

2011 Archives…