tenderlove has quit [Read error: Connection reset by peer]
eighthbit has quit [Read error: Connection reset by peer]
eighthbit_ has joined #rubygems
bradland has joined #rubygems
tcopeland has joined #rubygems
gcoderre has joined #rubygems
johndouthat has quit [Quit: johndouthat]
krohrbaugh has joined #rubygems
AntiTyping has joined #rubygems
BigFatFatty has left #rubygems ["Leaving"]
linguini has joined #rubygems
stevenharman has joined #rubygems
gcoderre has quit [Quit: gcoderre]
gcoderre has joined #rubygems
<mehwork>
lmarburger: things that only i need, such as pry-rails
teancom has quit [Remote host closed the connection]
Cakey has joined #rubygems
DonOtreply has quit [Quit: Computer has gone to sleep.]
andrewsfreeman has quit [Remote host closed the connection]
gcoderre has quit [Quit: gcoderre]
terceiro_ has quit [Ping timeout: 272 seconds]
vertis has quit [Quit: vertis]
alexkira has quit [Read error: Connection reset by peer]
alexkira has joined #rubygems
terceiro_ has joined #rubygems
tenderlove has joined #rubygems
peregrine81 has quit [Ping timeout: 276 seconds]
the_mentat has quit [Quit: Computer has gone to sleep.]
peregrine81 has joined #rubygems
sbeam has joined #rubygems
the_mentat has joined #rubygems
ckrailo has quit [Quit: Computer has gone to sleep.]
markstarkman has joined #rubygems
imajes has quit [Excess Flood]
imajes has joined #rubygems
peregrine81 has quit [Quit: Goodbye.]
teancom has joined #rubygems
markstarkman has quit [Ping timeout: 248 seconds]
havenwood has quit [Ping timeout: 276 seconds]
mando has quit [Remote host closed the connection]
_br_ has quit [Excess Flood]
_br_ has joined #rubygems
johndouthat has joined #rubygems
_br_ has quit [Excess Flood]
_br_ has joined #rubygems
vertis has joined #rubygems
Emily is now known as EmilyAFK
<devn>
everyone needs pry, they just don't know how bad they need it
envygeeks has quit [Quit: Bye]
<mehwork>
truer words were spoken
<mehwork>
but that's true enough
<devn>
a large portion of the tests of I've written while adhering to the biblical "omg test everything" mentality would not exist if pry were around "back in the day"
<mehwork>
maybe you should 'pry' into those devs and ask them why they're not using it
<devn>
"agile" or "scrum" or whatever all are about tight feedback loops
<devn>
saving a file and autotesting is decent, but it's slower than immediate REPL feedback
baphled has joined #rubygems
<devn>
you can try something 10 different ways before Joe NoPry runs it 3 times by saving his files and autorunning his tests with a watchr script
dentarg has quit [Ping timeout: 248 seconds]
<devn>
but it's hard to convince dudes and ladies who have drunk the kool aid that there's something better than writing endless tests to verify behavior you may or may not want in version 0.1.1
EmilyAFK is now known as Emily
<devn>
tests are silly if you can reliably write good software without them. that being said, sure I write tests, but I've backed off a lot. I sampled a lot of different flavors and took it to its extreme on numerous occasions. All it did was make me feel that people who are dogmatic about testing everything and "mocking this" and "stubbing that" are at the core, jerks with a book for sale.
<mehwork>
tests aren't just for writing software, they're for ensuring it maintains its integrity after the fact
<mehwork>
promoting testing and promoting heavy mocking and stubbing are two diff things
mockra has quit [Remote host closed the connection]
<mehwork>
and i have no books
<teancom>
i have no bananas
Emily is now known as EmilyAFK
onemanjujitsu has quit [Quit: onemanjujitsu]
ssd7 has quit [Ping timeout: 256 seconds]
andrewhubbs has quit [Quit: Leaving.]
drbrain has quit [Remote host closed the connection]
onemanjujitsu has joined #rubygems
markstarkman has joined #rubygems
twoism has quit [Remote host closed the connection]
revans has quit [Quit: revans]
the_mentat has quit [Quit: Computer has gone to sleep.]
havenwood has joined #rubygems
dentarg has quit [Ping timeout: 264 seconds]
markstarkman has quit [Ping timeout: 248 seconds]
the_mentat has joined #rubygems
alindeman has quit [Ping timeout: 245 seconds]
dentarg has joined #rubygems
krohrbaugh has quit [Quit: Leaving.]
onemanjujitsu has quit [Quit: onemanjujitsu]
sn0wb1rd has joined #rubygems
imajes has quit [Excess Flood]
alindeman has joined #rubygems
imajes has joined #rubygems
havenwood has quit [Remote host closed the connection]
alindeman has quit [Ping timeout: 245 seconds]
hahuang65 has quit [Quit: Computer has gone to sleep.]
adf has quit [Ping timeout: 264 seconds]
dentarg has quit [Ping timeout: 252 seconds]
baphled has quit [Ping timeout: 240 seconds]
kgrz has quit [Ping timeout: 264 seconds]
alindeman has joined #rubygems
andrewhubbs has joined #rubygems
baburdick has quit [Read error: Connection reset by peer]
baburdick has joined #rubygems
drbrain has joined #rubygems
drbrain has quit [Remote host closed the connection]
drbrain has joined #rubygems
andrewhubbs has quit [Ping timeout: 276 seconds]
dentarg has joined #rubygems
the_mentat has quit [Quit: Computer has gone to sleep.]
the_mentat has joined #rubygems
ssd7 has joined #rubygems
onemanjujitsu has joined #rubygems
baburdick has quit [Read error: Connection reset by peer]
baburdick has joined #rubygems
linguini has quit [Quit: ERC Version 5.3 (IRC client for Emacs)]
DonOtreply has joined #rubygems
sbeam has quit [Ping timeout: 264 seconds]
adf has joined #rubygems
onemanjujitsu has quit [Quit: onemanjujitsu]
mockra has joined #rubygems
imajes has quit [Excess Flood]
nateberkopec has quit [Quit: Leaving...]
imajes has joined #rubygems
mando has joined #rubygems
the_mentat has quit [Quit: Computer has gone to sleep.]
the_mentat has joined #rubygems
andrewhubbs has joined #rubygems
mando has quit [Remote host closed the connection]
markstarkman has joined #rubygems
dwradcliffe is now known as dwradcliffe_zzz
havenwood has joined #rubygems
mockra has quit [Remote host closed the connection]
markstarkman has quit [Ping timeout: 256 seconds]
krohrbaugh has joined #rubygems
nateberkopec has joined #rubygems
mockra has joined #rubygems
nateberkopec has quit [Client Quit]
andrewhubbs1 has joined #rubygems
andrewhubbs has quit [Read error: Connection reset by peer]
alindeman has quit [Ping timeout: 245 seconds]
andrewhubbs1 has quit [Quit: Leaving.]
DonOtreply has quit []
havenwood has quit [Remote host closed the connection]
ckelly has quit [Quit: Leaving...]
sferik has quit [Quit: Computer has gone to sleep.]
ckelly has joined #rubygems
the_mentat has quit [Quit: Computer has gone to sleep.]
the_mentat has joined #rubygems
werdnativ_ has joined #rubygems
werdnativ has quit [Ping timeout: 245 seconds]
werdnativ_ has quit [Ping timeout: 264 seconds]
funcuddles has joined #rubygems
mephux has quit [Excess Flood]
mephux has joined #rubygems
the_mentat has quit [Quit: Computer has gone to sleep.]
indirect_ has joined #rubygems
indirect has quit [Ping timeout: 264 seconds]
indirect_ is now known as indirect
mikewintermute has joined #rubygems
gcoderre has joined #rubygems
ckelly has quit [Quit: Leaving...]
gcoderre has quit [Quit: gcoderre]
markstarkman has joined #rubygems
markstarkman has quit [Ping timeout: 256 seconds]
werdnativ has joined #rubygems
funcuddles has quit [Ping timeout: 255 seconds]
werdnativ has quit [Quit: werdnativ]
ddd has quit [Ping timeout: 260 seconds]
ddd has joined #rubygems
huoxito has quit [Ping timeout: 245 seconds]
webdestroya has quit [Read error: Connection reset by peer]
webdestroya has joined #rubygems
noyb has joined #rubygems
mephux has quit [Excess Flood]
mephux has joined #rubygems
werdnativ has joined #rubygems
vertis has quit [Ping timeout: 244 seconds]
funcuddles has joined #rubygems
ckrailo has joined #rubygems
<kseifried>
tests are silly if you can reliably write good software without them.
<ddd>
prove it
<kseifried>
no ... I'm... amazed....
<kseifried>
that sentence...
<kseifried>
ok as a defense mechanism to keep my sanity I have decided to laugh (instead of say, crying).
<ddd>
hehe
<kseifried>
see. much better then hiding in the bathroom and crying
baburdick has quit [Quit: Leaving.]
<ddd>
i'm crying. i've had to step away from writing ruby to write java (for my college courses) and I'm having a hard time remembering all the syntax for java (public void main(String[] args) vs. def main) and the correct import lines for various parts of the JDK.. I miss my ruby
<ddd>
so much simpler
<kseifried>
at least most universities dropped pascal
dwradcliffe has joined #rubygems
<kseifried>
that would... be not much fun I suspect
<ddd>
mine just updated the course (major revamp of just about every CIS/CIT/IT course they offer) which now covers Java 1.7 (from 1.5) and stuff
<ddd>
i just hate that its taking away so much of my time from ruby. but, hey, at least its getting me a degree I can add to my business's credibility. so i guess thats a good thing.
dwradcliffe_zzz has quit [Ping timeout: 245 seconds]
<ddd>
taking a double minor. Computer Programming and 3D Modeling. so at least I also get to do some fun stuff. Maya's a handful (so many command sets!) but man can you make some beautiful stuff in it!
<kseifried>
stupid Q but can you plug maya files into 3d printers yet?
<kseifried>
that would be cool. model a scene and hit "print"
<ddd>
hehe, not that i know of. my school just got a 3d printer for their shop courses.
<ddd>
would love to play with that!
EmilyAFK is now known as Emily
<kseifried>
makerbot, dual head, assembled, just a hair over 2k now. sadly not as open source anymore
sc_raptor has quit [Read error: Connection reset by peer]
rossta has joined #rubygems
cbetta_afk is now known as cbetta
eighthbit has quit [Quit: eighthbit]
bfleischer has joined #rubygems
cbetta is now known as cbetta_afk
cbetta_afk is now known as cbetta
cbetta is now known as cbetta_afk
ckelly has joined #rubygems
mockra has joined #rubygems
mockra has quit [Remote host closed the connection]
mockra has joined #rubygems
mockra has quit [Ping timeout: 260 seconds]
rossta has quit [Quit: rossta]
nateberkopec has joined #rubygems
eighthbit has joined #rubygems
baphled has joined #rubygems
mikewintermute has quit [Quit: mikewintermute]
imajes has quit [Excess Flood]
imajes has joined #rubygems
baphled has quit [Ping timeout: 246 seconds]
rajiv has left #rubygems [#rubygems]
the_mentat has joined #rubygems
imajes has quit [Excess Flood]
Hypn has quit [Remote host closed the connection]
imajes has joined #rubygems
mephux has quit [Excess Flood]
mephux has joined #rubygems
mephux has quit [Changing host]
mephux has joined #rubygems
ssd7 has quit [Ping timeout: 276 seconds]
yerhot_ has joined #rubygems
yerhot has quit [Read error: Connection reset by peer]
johndouthat has joined #rubygems
mando has joined #rubygems
dvu has quit [Remote host closed the connection]
purp has joined #rubygems
Cakey has joined #rubygems
cbetta_afk is now known as cbetta
theRoUS has joined #rubygems
<theRoUS>
geminabox is great for serving gems, but it doesn't include serving their documentation (like the 'Documentation' links on rubygems.org gem pages).
<theRoUS>
what's a recommended way to serve gems *and* their documentation?
cbetta has left #rubygems [#rubygems]
qmx|away is now known as qmx
fromonesrc has quit [Quit: fromonesrc]
<indirect>
theRoUS: not sure if you noticed, but rubygems.org doesn't host that documentation. the links all go to rubydoc.info
<theRoUS>
yeah, i know. had a brain fart. what i'm trying to figure out now is if there's a way to point 'gem server --dir' to geminabox's gems..
pignata has quit [Ping timeout: 255 seconds]
pignata has joined #rubygems
purp has quit [Read error: Connection reset by peer]
purp has joined #rubygems
ssd7 has joined #rubygems
mikewintermute has joined #rubygems
sn0wb1rd has quit [Quit: sn0wb1rd]
dvu has joined #rubygems
fromonesrc has joined #rubygems
theRoUS has left #rubygems ["Off to another part of the maze of twisty little passages"]
Elhu has quit [Quit: Computer has gone to sleep.]
dbussink has quit [Excess Flood]
fromonesrc has quit [Quit: fromonesrc]
dvu has quit [Remote host closed the connection]
dvu has joined #rubygems
terceiro has quit [Ping timeout: 248 seconds]
terceiro has joined #rubygems
justincampbell has joined #rubygems
pgmcgee has quit [Ping timeout: 244 seconds]
bfleischer has quit [Quit: bfleischer]
adf has quit [Quit: Computer has gone to sleep.]
pgmcgee has joined #rubygems
boffbowsh has quit [Read error: Connection reset by peer]
_br_ has quit [Excess Flood]
boffbowsh has joined #rubygems
_br_ has joined #rubygems
_br_ has quit [Excess Flood]
_br_ has joined #rubygems
Cakey has quit [Ping timeout: 244 seconds]
krohrbaugh has quit [Quit: Leaving.]
sn0wb1rd has joined #rubygems
dvu has quit [Remote host closed the connection]
markstar_ has quit [Remote host closed the connection]
twoism has joined #rubygems
qmx is now known as qmx|away
teancom has quit [Ping timeout: 248 seconds]
teancom_ has joined #rubygems
dvu has joined #rubygems
fromonesrc has joined #rubygems
adf has joined #rubygems
werdnativ has joined #rubygems
bfleischer has joined #rubygems
adf_ has joined #rubygems
adf has quit [Ping timeout: 255 seconds]
adf_ is now known as adf
EmilyAFK is now known as Emily
mikewintermute has quit [Quit: mikewintermute]
pignata has quit [Ping timeout: 264 seconds]
pignata has joined #rubygems
krohrbaugh has joined #rubygems
vertis has joined #rubygems
qmx|away is now known as qmx
krohrbaugh1 has joined #rubygems
imajes has quit [Excess Flood]
krohrbaugh has quit [Read error: Connection reset by peer]
imajes has joined #rubygems
markstarkman has joined #rubygems
rubygems has joined #rubygems
billyoc has joined #rubygems
BigFatFatty has joined #rubygems
havenwood has joined #rubygems
billyoc has quit [Ping timeout: 248 seconds]
drbrain has quit [Remote host closed the connection]
havenwood has quit [Remote host closed the connection]
<indirect>
evan: raggi: drbrain: ping me when you've got a second? I have interesting results from adding signing to bundler.
<evan>
sup
<raggi>
indirect: hey
<indirect>
oh hey
<indirect>
afaict, rubygems 2/master doesn't support building signed gems anymore?
<indirect>
at least, not the way that has been working up until now :/
<raggi>
in a meeting with kurt, brb - gimme 5-10
<indirect>
np
<evan>
indirect: drbrain changed it I believe.
<indirect>
evan: yeah, it's a completely different class to build gems now
<evan>
k, I need to grab some lunch
<evan>
sounds like your question is better answered by drbrain
ckrailo has joined #rubygems
_maes_ has joined #rubygems
<indirect>
I'll try to ping him when he shows up, then
_br_ has quit [Excess Flood]
_br_ has joined #rubygems
_br_ has quit [Excess Flood]
_br_ has joined #rubygems
<raggi>
indirect: going to grab lunch too, but will be back in <30 mins
fromonesrc has quit [Quit: fromonesrc]
<raggi>
indirect: not meaning to sound like a dick, given all the noise happening right now
<raggi>
indirect: but the current signing system is totally useless without a distribution channel and a revocation system
ssd7_ has joined #rubygems
jstr has joined #rubygems
krohrbaugh1 has quit [Quit: Leaving.]
<raggi>
i mean, if the creds get stolen, you now have multiple things you have to do:
<raggi>
1. yank the gem (same as now)
ssd7 has quit [Ping timeout: 244 seconds]
<raggi>
2. get the new key (but you've been compromised already, so where do you trust?)
<raggi>
3. distribute the new key everywhere you had the old one
fromonesrc has joined #rubygems
<raggi>
4. remove the old one
<raggi>
now what happens if
<raggi>
the old one is still used for signing old, valid gems?
<raggi>
you leave the old one, so the stolen creds are still valid?
<raggi>
i mean seriously
<raggi>
the vectors it prevents against an attacker that has *any* clue
<raggi>
are totally minimal
<raggi>
all it will do is fool people into thinking that gem signatures add some security
<raggi>
it's like the TSA scanners, really
imajes has quit [Excess Flood]
<raggi>
our revocation platform is going to need a time based component - and that really sucks, it's open to many exploits - i'm still trying to think through how we might be able to overcome that problem
<raggi>
distribution countersigning is the first important step
imajes has joined #rubygems
<raggi>
but that's still open to combination vectors, such as dev keys being stolen at the same time as the distribution platform being attacked
<raggi>
this is why the whole concept of "time to known good" and incident response processes are far far more important
qmx is now known as qmx|away
<raggi>
the problem is not the same as connection oriented authorization - because connections are inherently temporal, in a way that cannot be faked - they "happen", gems on the other hand don't happen, they "are"
<benchMark>
Also should totally take Thomas Ptacek and Matasano up on their offer to help with RubyGems security.
<raggi>
yes
<raggi>
absolutely
<raggi>
and many others
qmx|away is now known as qmx
tenderlove has quit [Remote host closed the connection]
<jjarmoc>
+1 Matasano is good people...
mando has quit [Remote host closed the connection]
<indirect>
raggi: so it's probably counterproductive to provide signing support in bundler, due to a false sense of security?
<indirect>
(fwiw, my issue appears to be that RG2 can't build signed gems. so. heh.)
<theartisan>
its probably premature to look at bundler right? not knowing how the signing of gems will work?
<theartisan>
if you add support and everything changes...
<indirect>
theartisan: there's already a patch that simply does the exact same thing that gem install -P does now
<indirect>
not sure how that's premature or how everything changes
<indirect>
but it certainly looks like it's not well-tested if it doesn't work after the rg2 refactor stuff
<theartisan>
i said "if"
<indirect>
oh, I see what you mean
<indirect>
depends on how the rubygems APIs change, I guess
<theartisan>
wondering what the human implications of announcing bundler has signing support, then announcing it has different signing support a couple of months later would be.
* theartisan
is just an over worked developer so is not to be taken as being in any way knowledgeable in dealing with communities
Elhu has joined #rubygems
baphled has joined #rubygems
voodoofish has quit [Ping timeout: 245 seconds]
<raggi>
indirect: sorry, actually had a catch up wiht tptacek on the whole things
<raggi>
he's going to ask a few things to some crypto friends this evening about the revocation stuff, but not expecting particularly groundbreaking answers
<indirect>
raggi: yeah, makes sense
Elhu has quit [Quit: Computer has gone to sleep.]
<raggi>
i asked a lot of general questions, and specifically what he'd advise
<raggi>
and his answer was much as the rest of us
<indirect>
figures
<indirect>
heh :)
<raggi>
we need a CA of some kind, and we need to make that trustworthy, and offline
<raggi>
when i talked about revocation model stuff, his answer was basically "it's not well solved, and it's hard, keep it simple"
<raggi>
so, if i don't see a good proposal for this, or we hear something back from good crypto folks about it, then we're going to have to ignore that part of the problem spec
<raggi>
WRT what tools to use, as per many of the rest of us, ofc, he's saying "just use x509 PKI"
<raggi>
because it's there, ready to use, and well understood
<raggi>
essentially, our current system isn't completely outside of recovery for this use case
<raggi>
all we need is to tune it up to be more useful
voodoofish has joined #rubygems
<raggi>
1, implement a central counter signing solution, not completely tied to RG.org (at least from a threat model perspective) (in short: keep the main CA offline)
<raggi>
2, make it easier to sign than to not
<raggi>
3, figure out a good way to deal with the current corpus
<raggi>
indirect: what were you implementing thus far? just validation?
<indirect>
raggi: I merged and cleaned up a pull that implements the -P option that gem install supports
<indirect>
that's it
<indirect>
--trust-policy, iirc
<raggi>
it may be more possible to implement the ruby side interface to this stuff before we actually finish designs for other things
<raggi>
and maybe we could make that interface not error, until we have a full solution
<raggi>
evan: ^^^
<raggi>
at the end of the day, we'll have some kind of gem interface that takes a .gem file, and validates it against some internal process
rmartin has quit [Remote host closed the connection]
<raggi>
gem verify <gemfile> and maybe Gem.verify(name, version, platform) or something
<theartisan>
is there a point of an interface that doesn't do anything?
the_mentat has quit [Quit: Computer has gone to sleep.]
<raggi>
yes
<raggi>
it's called forward compatibility
<indirect>
raggi: that interface currently doesn't error at all -- rg2 changed the class that builds gems so that it errors out while trying to create a signed gem
<indirect>
so the error I'm seeing actually comes from the tests when they go to build a signed gem to test that option against
<indirect>
the option itself is still as functional as it's ever been
<raggi>
heh
<raggi>
indirect: so it's a rubygems bug, or RG is just ignoring the old spec fields?
<theartisan>
ah, you mean so third parties can build against it before its ready
<raggi>
theartisan: correct
<theartisan>
i got a bit lost there
<raggi>
indirect: sorry, i'm getting confused between what *is an error* and *things that changed*
<raggi>
:)
mephux has quit [Excess Flood]
<indirect>
haha sorry
<indirect>
things that changed: the class you call to build a gem
<indirect>
is an error: the exception that happens when you build a gem with signing_key and cert_chain set
<raggi>
doesn't look like the current repo version raises untyped errors
<raggi>
unless i'm blind
mephux has joined #rubygems
<indirect>
raggi: oh shit, I missed the actual exceptoin
<indirect>
er exception
<indirect>
it calls subject on nil
<raggi>
oh, this is bunder rewriting it
<raggi>
:-P
<indirect>
at line 196
<indirect>
raggi: bah, totally my fault… I was raising caller
<indirect>
lemme swap out the backtrace
<raggi>
hehe
<raggi>
indirect: no problem
<raggi>
indirect: i suspect this may just be a path problem
Emily is now known as EmilyAFK
EmilyAFK is now known as Emily
johndouthat has quit [Quit: johndouthat]
johndouthat has joined #rubygems
<indirect>
raggi: fixed the gist, I was fingering the entirely wrong code path
johndouthat has quit [Remote host closed the connection]
qmx is now known as qmx|away
vertis has quit [Quit: vertis]
qmx|away is now known as qmx
amerine has quit [Quit: leaving]
fromonesrc has quit [Quit: fromonesrc]
rubygems has left #rubygems [#rubygems]
<jjarmoc>
so, on the revocation front.. what about having an online lookup of the current cert for a given entity? Ie. check that it's currently a valid cert rather than that it's not an invalid cert
<jjarmoc>
no way to validate offline though
drbrain has joined #rubygems
<raggi>
OCSP or CRLs are both existing systems to do this
<raggi>
but yeah
<raggi>
OCSP requires online
<raggi>
CRLs have scaling problems
<jjarmoc>
well kinda.. OCSP typically fails open in browser implementations
<raggi>
plus, either way, you have an intermediate trust issue
<jjarmoc>
but I suppose a fail-closed OCSP system is close to what I'm stating
<raggi>
jjarmoc: what browsers do is irrelevant to us
<raggi>
jjarmoc: but also, we still ahve a different class of problem
<raggi>
if we don't want to rebuild every .gem file
<jjarmoc>
yah.. i'm just saying OCSP didn't really occur to me largely because the browser implementations suck :)
<raggi>
then you need to have revocations tied to a point in time
<jjarmoc>
right...
<raggi>
but time can be forged
<jjarmoc>
right..
<jjarmoc>
so you need some kind of signed time server too
<jjarmoc>
but then how do you validate that signature?
<jjarmoc>
and on and on..
tenderlove has joined #rubygems
dbussink has joined #rubygems
<raggi>
right
<raggi>
it's unresolvable
<raggi>
the only solution is a cryptographic ledger
<drbrain>
"trust" is not "guarantee"
<raggi>
right
<raggi>
well, trust is a belief, by definition
<raggi>
jjarmoc: but ledgers don't scale either
<raggi>
jjarmoc: it could be possible to do time<->block association, but that'll fail to scale eventually too
<raggi>
and simpler than implementing something liek bitcoin stuff, you'd just sign daily files or whatever
<jjarmoc>
yah, it's an interesting problem
<raggi>
but this is a digression, because it doens't really help
<raggi>
youd' still ahve to revoke those
<raggi>
so you havent' solved it
<raggi>
i joked that maybe we should just force all rg.org authors to buy yubikeys
<raggi>
:-P
<jjarmoc>
right, but in a ledger you could essentially revoke by removing the previous authorization, but that has issues too
<jjarmoc>
I bet yubikey would love that!
<raggi>
well, you can use their open source software keys too
<raggi>
but that's just as pwnable as creds
<raggi>
unless you use it in a strictly 2fa way
teancom_ has quit [Remote host closed the connection]
mando has joined #rubygems
<jjarmoc>
yah, but presumably not all stored centrally, etc..
<jjarmoc>
so I could pwn individual devs, but harder to pwn all devs at once
<raggi>
right
<raggi>
i see the need for author signing and rg.org signing
<raggi>
one re-identifies the gem author
<jjarmoc>
yah, that makes sense..
<raggi>
the other identifies the author had the right to publish within a namespace
<raggi>
the nicer thing about that
<raggi>
is that the revocation model simplifies to just issuing revocations for the double-signs
<raggi>
i.e. rg.org says "this author + rg.org combo is no longer valid"
<jjarmoc>
yah, but can an author also revoke independent of rubygems should they need to?
<raggi>
and other than that, rg.org can start to reject author keys taht the author says are no longer valid (through whatever mechanism is present today - i.e. user logins)
<raggi>
they should be able to, yes
<drbrain>
rubygems could revoke onyank
<jjarmoc>
I can't think of a use case, but it seems like it'd be useful
<drbrain>
on yank
<raggi>
for isolated end to end only
<raggi>
drbrain: right, exactly
<raggi>
drbrain: although we need to define yank better
<raggi>
drbrain: yank currently means "not in index" not "no longer valid for use"
<raggi>
drbrain: i think we need another definition for "removed"
<jjarmoc>
sounds like how to actually convey the revocation is the hard part
<raggi>
jjarmoc: honestly, i'd probably consider implementing both crls and ocsp
<raggi>
so that we have a solution for ease of use, and a solution for offline
<jjarmoc>
something like OCSP could convey the sig pairs that are revoked, but you still have the time issue
<raggi>
they shouldn't be orthogonal
<jjarmoc>
CRLs for caching and OCSP for online?
<raggi>
there may be ocsp services we can consume from elsewhere
<theartisan>
raggi: so under that system i would generate a certificate independent of rubygems or a central CA right?
<jjarmoc>
in a model like that, I'd like it to warn if CRL is of a certain age
<raggi>
rather than building / running our own
<theartisan>
and rubygems.org would just use its certs to sign off on things?
<jjarmoc>
ie 'this signature is valid as of 2 days ago' and maybe a hard fail after something more like 30 days
<raggi>
theartisan: your cert is countersigned at some point, by rg.org, to say "you're authorized to publish in this namespace"
* theartisan
likes that model
<raggi>
theartisan: the lcients need to know two things: 1. you are who you say you are, and 2. you are allowed to publish that gem name
<raggi>
theartisan: this could be as simple as, your cert has a CN field with the gemname in it
<theartisan>
you could effectively have a rubygems-audited cert for "someone on a trusted team checked this"
<jjarmoc>
.... at the time you published it
<theartisan>
and add that to teh other two certs
<raggi>
theartisan: the vouching is totally separate
<raggi>
but we have some ideas for that
fromonesrc has joined #rubygems
<raggi>
they're different htough
<theartisan>
you want a certificate per gem?
<raggi>
such a system could be very useful, for other reasons
<raggi>
theartisan: that's what the above described model suggests, yes
<raggi>
theartisan: there may be a way to make that less arduous
<jjarmoc>
per gem? not per author?
Emily is now known as EmilyAFK
<raggi>
jjarmoc: rg.org gives namespace authorizations to authors for time periods
<jjarmoc>
what's the harm in an author scoped cert if rg.org is asserting their authorization on the namespace?
<theartisan>
i keep reading author certs as "i am an author i have a cert" might need to claify that in any docs
<jjarmoc>
i just can't see authors of multiple gems wanting to maintain a huge certstore though.. y'know?
<raggi>
jjarmoc: probably not much, i may be overthinking or making mistakes, but this needs writing down to be meanigngful
<jjarmoc>
yah, this is definitely just kicking the can a bit..
<raggi>
jjarmoc: yep :)
<theartisan>
hows the doc defining the problem going?
<raggi>
generally good, i have a lot of content to add to it
<raggi>
deadline for having the problems space defined is EOW
<jjarmoc>
how open are you all planning to be on the process? I'd be interested in following along
<raggi>
i want ot open it back up to everyone
<raggi>
for many many reasons
<raggi>
i ahte doing anything in the dark
<jjarmoc>
well, ultimately everyone has a lot riding on it..
<theartisan>
but too much tail chaceing was happinging
<raggi>
but i had to /ignore so many people in #rubygems-trust
<raggi>
because they're just making unnecessary loops and noise
<jjarmoc>
that's the answer I had hoped for.. but you do have to get something concrete or community discussion devolves to chaos
<raggi>
it seemed more productive to start writing stuff with less distraction
<jjarmoc>
agreed.
<jjarmoc>
then open it up for a comment period, maybe a couple rounds of tweaking and move on to the next phase
<raggi>
i wanted to be further along, but i had several p0 and several p1's to deal with in my regular work
<raggi>
and then also some rack stuff - which i need to actually get back to asap, so we should close this discussion up
<raggi>
jjarmoc: right, that's kinda my intent, and i'm more interested in trying to find the right people to listen to quite honestly
<raggi>
jjarmoc: i'm not a crypto / CA guy at all
<raggi>
i ahve time to facilitate, and resources to implement, but i can't validate a proposal in full
<jjarmoc>
it's an interest of mine, but i wouldn't call myself an expert or anything...
<jjarmoc>
though I'm not sure I'd trust too many people who do call themselves experts when it comes to crypto systems :)
<raggi>
well
<raggi>
that's what i mean about finding the right people
<jjarmoc>
it sounds like you've got a solid understanding of the problem scope anyhow
<raggi>
there are people here at google i can talk to
<raggi>
and i want to get tony and tptaceks input too
<jjarmoc>
well, if you're in touch with Ptacek that can't hurt, he's pretty well connected in those circles
<raggi>
and kseifried has folks at redhat he can consult
<raggi>
right
<jjarmoc>
Adam Langley @ google might have some interest..
<jjarmoc>
since you mentioned GOOG
<raggi>
yeah
<raggi>
i am going to be speaking to some directors (via mine) to get both peoples input and hopefully their time too
<raggi>
(which is the main part of what this doc is for - to communicate the stuff to the unfamiliar)
<jjarmoc>
makes sense..
<qrush>
just a reminder! hangout at 6pm eastern (~1 hr from now)
<raggi>
qrush: ah, cool
<raggi>
right, i really have to go do these rack releases
<jjarmoc>
at least goog seems enlightened enough to understand the value of open source communities and resources like rg
<kseifried>
jjarmoc, : very few people think about large scale distribution/security, which is normal =)
<raggi>
jjarmoc: well, they acquired us (wildfire), and also have a lot of customers using gems
<jjarmoc>
alright, i'll shutup.. thanks for chatting with me :) I'll keep my eyes open as the process progresses
<kseifried>
jjarmoc, : no love for Red Hat? thanks ;P
<jjarmoc>
kseifried: yup
<jjarmoc>
hahah
<raggi>
lol
<jjarmoc>
sorry man, didn't mean to single anyone out :)
<jjarmoc>
it's kind of self evident that Red Hat groks OS :)
EmilyAFK is now known as Emily
<kseifried>
jjarmoc, : you'd be surprised, we get accused of a lot of weird stuff
<theartisan>
kseifried: im sure RHEL is the reason i could not find my keys this morning.
<drbrain>
indirect: ping
<drbrain>
indirect: can you update to latest and retry #445? I can't reproduce after last night's commits
vertis has joined #rubygems
vertis has quit [Client Quit]
<drbrain>
indirect: and according to your backtrace you're missing last night's commits
<theartisan>
im kinda jealous that RH and google are willing to let you work on this stuff on the job, i guess there are some benefits of perm employment if you find the right company
<jjarmoc>
kseifried: everyone has their conspiracy theories...
<drbrain>
there are conspiracy theories and then there's time cuby
<drbrain>
time cube
<drbrain>
dammit, time cube has been poisoned by redirects to adult sites
<kseifried>
dude if we (red hat) were any good at conspiracies we'd be a LOT richer (like you know... Google ;)
<theartisan>
but you are richer than the gentoo guys, so there must be a conspiracy, poor little penguins stuck compiling their packages….
<jjarmoc>
kseifried: LOL
tenderlove has quit [Read error: Connection reset by peer]
tenderlove has joined #rubygems
hone has quit [Ping timeout: 276 seconds]
ddd has quit [Ping timeout: 244 seconds]
vertis has joined #rubygems
hone has joined #rubygems
yerhot_ has quit [Remote host closed the connection]
aquaranto has quit []
<indirect>
drbrain: ugh, apparently I can't get ruby 2.0rc to load rubygems from master
yerhot has joined #rubygems
<drbrain>
ruby -I /path/to/rubygems/lib -S gem should do the trick
<zzak>
whens rc2 out?
<drbrain>
zzak: maybe late today
markstarkman has quit [Remote host closed the connection]
<drbrain>
last I heard friday JST
<zzak>
starbuckssslagg
<indirect>
drbrain: yeah, I can do it on the command line okay, it's the test subshell that runs bundler that seems to be whacking my rubyopt somewhere… grr
<drbrain>
that's good!
<drbrain>
at least it'll be fixed in 2.0.0.rc.2
hone has quit [Ping timeout: 255 seconds]
<zzak>
indirect: have you tried with trunk?
hone has joined #rubygems
<indirect>
zzak: not yet… was trying to work out the rubygems issues first. maybe trunk is a better bet.
mando has quit [Remote host closed the connection]
hone has quit [Ping timeout: 245 seconds]
teancom has joined #rubygems
<zzak>
indirect: testing release candidates is important too, thank you! dont be afraid to test on trunk too
<indirect>
zzak: oh, I'm not… I have travis set up to run against both the latest 2.0 rc and head :)
<zzak>
:D
<zzak>
gotta run, time to talk to newhavenrb about contributing to ruby :D
notnerb has quit [Quit: Leaving.]
notnerb has joined #rubygems
<indirect>
drbrain: oh god I was passing -I a relative path and the bundler tests change directories
hone has joined #rubygems
<indirect>
:P
<indirect>
drbrain: got it running against 4b1fb604
<indirect>
still doesn't work
qmx is now known as qmx|away
notnerb has quit [Ping timeout: 276 seconds]
<drbrain>
indirect: ok
<drbrain>
indirect: give me a minute
<indirect>
qrush: is the meeting still in 15 minutes?
<indirect>
drbrain: no rush
<qrush>
yes
<indirect>
cool
* qrush
pokes evan
* qrush
flicks lights
* evan
giggles
<drbrain>
indirect: well, I'm rushing, if it needs a commit I need to have it in in the next couple hours
<indirect>
drbrain: oh, I see
<indirect>
well, I'll be here if anything else from the repro case would help
yerhot has quit [Remote host closed the connection]