1. It's Ruby. Go write the exploit. If you think it's the patch to bignum (where the offset you're looking at only controls a load, not a store), write the testcase and prove it.
Why should he? He doesn't care, he doesn't use Ruby anymore. You can rest assured that someone else has already written the exploit, but is keeping it to himself. So you can either fix the bug, or hope that the person with the exploit doesn't use it on you.
Also, you should write correct code regardless of whether or not you think it's exploitable. Right!?
It's true. He doesn't claim to know anything about the code. He is just trying to expose the "secret fixes". His thesis (for all of his blog posts) is that the Ruby community sucks. He did all this digging in the name of "proving" that, not to help make Ruby better, nor to prove that he knows anything about security.
Read the last line -- "I guess we’ll find out after the Ruby guys passively aggressively kill me for looking at their open source and …. telling people things."
Comments
1. It's Ruby. Go write the exploit. If you think it's the patch to bignum (where the offset you're looking at only controls a load, not a store), write the testcase and prove it.
Why should he? He doesn't care, he doesn't use Ruby anymore. You can rest assured that someone else has already written the exploit, but is keeping it to himself. So you can either fix the bug, or hope that the person with the exploit doesn't use it on you.
Also, you should write correct code regardless of whether or not you think it's exploitable. Right!?
My point was that Zed doesn't seem to know what he's talking about. I'm not sure you just said anything at all.
It's true. He doesn't claim to know anything about the code. He is just trying to expose the "secret fixes". His thesis (for all of his blog posts) is that the Ruby community sucks. He did all this digging in the name of "proving" that, not to help make Ruby better, nor to prove that he knows anything about security.
Read the last line -- "I guess we’ll find out after the Ruby guys passively aggressively kill me for looking at their open source and …. telling people things."