Tag Info

As the author of the Ruby AEAD library, I can assure you that OpenSSL does support GCM on 1.0.1c. ~ $ /usr/local/bin/openssl version OpenSSL 1.0.1c 10 May 2012 ~ $ /usr/local/bin/openssl enc -help 2>&1 | grep gcm -aes-128-gcm -aes-192-gcm -aes-256-gcm If it is unavailable on your platform (OpenSSL added GCM support in 1.0.1, I believe), I have ...

Yes. You want Brakeman, a tool that scans your RoR code for security vulnerabilities I recommend reading the OWASP Ruby on Rails Security Guide. You could also try any web pen-testing tool; they are not language-specific. There are many of them. They only find low-hanging fruit, not all security problems, but it can't hurt to use them just in case they ...

As announced on openwall, this bug was related to non-ASCII characters with the 8th bit set: What's worse, in some cases (but not in all) one, two, or three characters immediately preceding the 8-bit characters were ignored by the password hash computation. Thus, many passwords containing characters with the 8th bit set are significantly easier to ...

The code you refer to has been corrected. If you check out the source on Github vs the posted diff fix by Solar Designer, you can see that the sign-extension has been noted and corrected (lines 553 through 556). Keep in mind that even though prefix $2a$ is not recommended, neither is $2x$ which simply states that the buggy implementation is being used -- ...

Model Binding is quite a nice feature and may add a plus to the overall security if it is properly used. Here is how it works (the code and the features apply to ASP.NET MVC but may be the same in Ruby): Suppose you have a form in a web page: <form action="/SendData"> Email: <input type="text" name="email" id="email"><br> ...

OpenSSL has support for GCM; see for instance this answer. Since GCM has nothing to do with SHA-384, I suppose that you are actually asking about support for AES-256/GCM in the context of a SSL/TLS session. This is supported only with TLS 1.2, so you need client and server to support that version.

If I wanted to avoid such risks, would it be safer to clone the git repository of the source code for the gem, and build the gem myself? Probably not. More effort is likely to go into releasing (and potentially approving) a gem for inclusion onto rubygems than you will go to when cloning the source, especially for popular gems. Furthermore, there ...

The risks are the same as with other language-specific package management systems (npm for node.js, pypi for python, CRAN for R, CPAN for perl etc.) Yet, it is very often prudent to install this stuff without superuser's privileges, or at least have the chance to review what is being installed. To do the review one may use an utility like fpm to roll up an ...

As an update to Dinu's comments, the models in many PHP frameworks suffer from this same kind of thing. There's very few that offer "restricted properties" that cannot be set from the load. Most of them just assume you know what you're doing when you "load()" the values into them and assign the properties accordingly - again, sloppy coding practices. ...