4 ms·
on a southwest flight and any website I visit that is not under https, has dozens of add on advertisements... makes me wish more of the web was secured... visi
by taf2 14y ago
on a southwest flight and any website I visit that is not under https, has dozens of add on advertisements... makes me wish more of the web was secured... visiting the site above for security patches and seeing the hashes for those released files, reminds me that because that site isn't https someone could modify those hashes... tried downloading the files and southwest modified the binaries corrupting them... anyways good to see security releases being pushed out just wish we had better security on the delivery...
- kgo 14y agoThe emails are actually signed with Aaron's PGP key.
- tenderlove 14y agoMy announcement emails contain the hashes and I sign the emails. If you don't trust the blog, you can verify my signature against the announcement emails: http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-talk/405934 http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-talk/...
- marshray 14y agoSome of these patches involve dates that are quite old. For example, https://rubyonrails-security.googlegroups.com/attach/6c2482d4ed1545e6/3-0-jdom.patch?view=1&part=3 https://rubyonrails-security.googlegroups.com/attach/6c2482d... bears a timestamp of Fri, 8 Feb 2013 02:48:22 +0000. Is this indicative of the time the vulnerability was reported? Is it normal procedure for a patch for a security vulnerability to delayed for 36 days?