mala

Rails の CVE-2019-5418 は RCE (Remote code execution) です

2019-03-23 更新

• Remote Code Executionとして、Advisoryが更新された。
• https://groups.google.com/d/msg/rubyonrails-security/zRNVOUhKHrg/GmmcVXcmAAAJ
• Thanks to @sorah @tenderlove

前置き

seraphr

val dockerPublish = taskKey[Unit]("ダミーのタスク。本来sbt-native-packagerのやつ")
lazy val commonSettings = Def.settings(
  dockerPublish := {
    import java.time.LocalTime

    println(s"${LocalTime.now()} ${name.value} のpublish開始")
    // 並列で実行されるのがわかりやすいように、途中sleepする
    Thread.sleep(3000)
    println(s"${LocalTime.now()} ${name.value} のpublish終了")
  }

joyrexus

collapsible markdown?

CLICK ME

yes, even hidden code blocks!

print("hello world!")

taichi

コードレビューの基本

---

一番大事な事

ソースコードはプロジェクトの共同所有物である

• 誰かだけが触れるコードを無くす

djspiewak

Explaining Miles's Magic

Miles Sabin recently opened a pull request fixing the infamous SI-2712. First off, this is remarkable and, if merged, will make everyone's life enormously easier. This is a bug that a lot of people hit often without even realizing it, and they just assume that either they did something wrong or the compiler is broken in some weird way. It is especially common for users of scalaz or cats.

But that's not what I wanted to write about. What I want to write about is the exact semantics of Miles's fix, because it does impose some very specific assumptions about the way that type constructors work, and understanding those assumptions is the key to getting the most of it his fix.

For starters, here is the sort of thing that SI-2712 affects:

def foo[F[_], A](fa: F[A]): String = fa.toString

dekosuke

#!/usr/bin/env python
# coding:utf-8

population = 10000
num_round = 10000

ranks = ["C-","C", "C+", "B-", "B", "B+", "A-", "A", "A+", "S", "S+"]
reward_win  = [20, 15, 12, 12, 10, 10, 10, 10, 10, 5, 3]
reward_lose = [10, 10, 10, 10, 10, 10, 10, 10, 10, 5, 6]
num_ranks = len(ranks)

exoego

制度

• 有休…
• 病休…
• 育休…
• 年収（月給、賞与など）…
• 残業代…
• 早朝/深夜手当…
• 休出手当…
• 住宅補助…

yogsototh

cabal-dev install                
Resolving dependencies...
cabal: Could not resolve dependencies:
trying: inmanis-0.0.0 (user goal)
trying: http-conduit-1.4.1.10 (dependency of inmanis-0.0.0)
trying: base64-bytestring-0.1.2.0 (dependency of http-conduit-1.4.1.10)
trying: attoparsec-0.10.2.0 (dependency of http-conduit-1.4.1.10)
trying: yesod-test-0.2.1 (dependency of inmanis-0.0.0)
trying: HUnit-1.2.4.2/installed-6a8... (dependency of yesod-test-0.2.1)
next goal: yesod-platform (dependency of inmanis-0.0.0)

jboner

Latency Comparison Numbers (~2012)
----------------------------------
L1 cache reference                           0.5 ns
Branch mispredict                            5   ns
L2 cache reference                           7   ns                      14x L1 cache
Mutex lock/unlock                           25   ns
Main memory reference                      100   ns                      20x L2 cache, 200x L1 cache
Compress 1K bytes with Zippy             3,000   ns        3 us
Send 1K bytes over 1 Gbps network       10,000   ns       10 us
Read 4K randomly from SSD*             150,000   ns      150 us          ~1GB/sec SSD

nog

#with rails server
echo "STDOUT.sync = true" >> config/environments/development.rb
rails s | grep --line-buffered -vE '(Started GET "/assets/|Served asset|^$)' -A 1

#with tail -f
tail -f log/development.log | grep --line-buffered -vE '(Started GET "/assets/|Served asset|^$)' -A 1