rabbit-slide-zundan-rubykaigi2015-lt 1.0.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 48b804f10b65db3a5097ef5f35cc4a713d9bc80d
+  data.tar.gz: 994cb1571fc743c965a63bfc7c4bffed64677496
+SHA512:
+  metadata.gz: 7a4f59ce560b480c0db2e5379dffd53f2b62c9825d7e013059b504224f7f70faeb9f13bffff9a3e7010f0fe5271fba21fb6090ed3d9561ad8fb7aaa608f2d923
+  data.tar.gz: 7a251c6f183d9a06f990553db82f1960be4f277fd8bfb048af44149adf8cee7eda4ff5a6b91a7b4968daab2fc79f9cafbc17196976cd2d3c5659b8a6f9910ca7

data/.rabbit

@@ -0,0 +1 @@
+cert-in-gems.rab --paper-size=792,612

data/README.md

@@ -0,0 +1,16 @@
+Do you trust that certificate?
+------------------------------
+A [rabbit](http://rabbit-shocker.org/) presentation presented as a [Lighting Talk at RubyKaigi 2015](http://rubykaigi.org/2015/presentations/lt).
+
+I hope to communicate to developers of web apps, especially of those handles payment information, that they should be aware of what they trust when developing an app. This should make the app more secure and make the developers aware of when to update gems or certs.
+
+## Usage
+Install rabbit and run `rake` 
+
+## Abstract
+Some developers don't seem to take too much care of which CA certificates they trust when connecting to external services from their web apps. Certificates may come with the OS the app is running on or Ruby gems the app depends upon. This is not secure nor good for continued operation of the app. I will try to let the listeners know this fact and request to think the best way to maintain certificates depending upon the needs of their apps.
+
+## License
+[CC BY-ND 4.0](https://creativecommons.org/licenses/by-nd/4.0/)
+
+Copyright 2015 by zunda <zundan at gmail.com>

data/Rakefile

@@ -0,0 +1,17 @@
+require "rabbit/task/slide"
+
+# Edit ./config.yaml to customize meta data
+
+spec = nil
+Rabbit::Task::Slide.new do |task|
+  spec = task.spec
+  # spec.files += Dir.glob("doc/**/*.*")
+  # spec.files -= Dir.glob("private/**/*.*")
+  spec.add_runtime_dependency("lightning-talk-with-code.rb")
+end
+
+desc "Tag #{spec.version}"
+task :tag do
+  sh("git", "tag", "-a", spec.version.to_s, "-m", "Publish #{spec.version}")
+  sh("git", "push", "--tags")
+end

data/cert-in-gems.rab

@@ -0,0 +1,250 @@
+= Do you trust that certificate?
+# : subtitle
+#    SUBTITLE
+#: author
+#   zunda
+#: institution
+#   Heroku/Support
+# : content-source
+#    RubyKaigi 2015
+#: date
+#   2015-12-12
+: allotted-time
+   5m
+: theme
+   lightning-talk-with-code
+
+= @zundan
+  # image
+  # src = anmitsu.jpg
+  # relative_height = 100
+= @zundan
+  # image
+  # src = 2015sf_Heroku_logo_RGB.png
+  # relative_width = 100
+= @zundan
+  # image
+  # src = heroku-logotype-horizontal-purple.png
+  # relative_width = 100
+
+= Important!
+  # image
+  # src = hyuki-cr3.jpg
+  # relative_width = 100
+= Introduction to modern cryptography
+= www.hyuki.com/cr/
+  # image
+  # src = hyuki-cr3.jpg
+  # relative_width = 100
+
+= Transport Layer Security
+= Secure Socket Layer
+= TLS/SSL
+= https://
+
+= A web application
+= Receives requests
+= Calls external resources
+= That handles secret information
+
+= How does app trust them?
+= PKI
+= Public-key infrastructure
+= Server certificate
+= Signed by Certificate Authority
+= Certificate chain
+ ssl.zunda.ninja:443
+  |
+ COMODO RSA Validation Secure Server CA
+  |
+ COMODO RSA Certification Authority
+  |
+  |
+ AddTrust External CA Root
+
+= One day
+= Error
+= Error
+ # blockquote
+ SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify
+
+= I did not change anything!
+= but
+= Something outside has changed
+= Error
+ # blockquote
+ SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify
+
+= Certificate chain
+ ssl.zunda.ninja:443
+  |
+ [NEW] Some Server CA
+  |
+ [NEW] Some Certification Authority
+  |
+  |
+ [NEW] Unknown CA Root
+
+= 2014-09 1024 bit hash
+= 2015-09 SHA-1
+= Replace with new certs
+= On new CA certs
+= That app does not know
+= Certificate chain
+ ssl.zunda.ninja:443
+  |
+ [NEW] Some Server CA
+  |
+ [NEW] Some Certification Authority
+  |
+  |
+ [????]
+
+= Error
+ # blockquote
+ SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify
+
+= So ...
+= $ bundle update
+= well ...
+= Include new CA cert in app
+= Monkey patch to use it
+= Net::HTTP
+ # enscript ruby
+ module Net
+   class HTTP
+     alias_method :original_use_ssl=, :use_ssl=
+ 
+     def use_ssl=(flag)
+       self.ca_file     = File.dirname(__FILE__) + \
+         '/../../certs/cacert.pem'
+       self.verify_mode = OpenSSL::SSL::VERIFY_PEER
+       self.original_use_ssl = flag
+     end
+   end
+ end
+
+= ActiveMerchant
+ # enscript ruby
+ module ActiveMerchant
+   class Connection
+     def configure_ssl(http)
+       return unless endpoint.scheme == "https"
+       http.use_ssl = true
+       if verify_peer
+         http.verify_mode = OpenSSL::SSL::VERIFY_PEER
+         http.ca_file     = File.dirname(__FILE__) + \
+           '/../../certs/cacert.pem'
+       else
+         http.verify_mode = OpenSSL::SSL::VERIFY_NONE
+       end
+     end
+   end
+ end
+
+= System's CA certs
+= Where are they?
+= System's certs
+ # enscript sh
+ $ openssl version -d
+ OPENSSLDIR: "/usr/lib/ssl"
+
+ $ ls /usr/lib/ssl
+ certs@  misc/  openssl.cnf@  private@
+
+ $ ls -l /usr/lib/ssl/certs
+ ... /usr/lib/ssl/certs -> /etc/ssl/certs/
+
+= openssl/ssl.rb
+ # blockquote
+ If the verify_mode is not VERIFY_NONE and ca_file, ca_path and 
+ cert_store are not set then the system default certificate store is 
+ used.
+
+= openssl/ssl.rb
+ # enscript ruby
+ module OpenSSL
+   module SSL
+     class SSLContext
+       def set_params(params={})
+         # snip
+         if self.verify_mode != OpenSSL::SSL::VERIFY_NONE
+           unless self.ca_file or self.ca_path or self.cert_store
+             self.cert_store = OpenSSL::X509::Store.new
+           end
+         end
+         return params
+       end
+     end
+   end
+ end
+
+= System's certs
+ # enscript ruby
+ module ActiveMerchant
+   class Connection
+     def configure_ssl(http)
+       return unless endpoint.scheme == "https"
+       http.use_ssl = true
+       if verify_peer
+         http.verify_mode = OpenSSL::SSL::VERIFY_PEER
+         http.ca_path = nil
+         http.ca_file = nil
+       else
+         http.verify_mode = OpenSSL::SSL::VERIFY_NONE
+       end
+     end
+   end
+ end
+
+= Anyway
+= Remember what we trust
+
+= What are coming?
+= 2016-06-01
+= Symantec certs on Google products?
+
+= Will there be updates?
+= On Ubuntu
+* :
+* 2013-01-19
+* 2013-06-10
+* 2013-09-06
+* 2014-03-25
+* 2014-10-19
+* 2015-04-26 ((-((<launchpad - ca-certificates|URL:https://launchpad.net/ubuntu/+source/ca-certificates/+changelog>))-))
+
+= On ActiveMerchant
+* 2007-03-03
+* 2011-09-15
+* 2015-01-16 ((-((<activemerchant - active_merchant|URL:https://github.com/activemerchant/active_merchant/commits/master/lib/certs/cacert.pem>))-))
+
+= Remember and be prepared!
+
+= Once more
+= www.hyuki.com/cr/
+  # image
+  # src = hyuki-cr3.jpg
+  # relative_width = 100
+
+= CRL
+= Certificate Revocation List
+= How are we updating this?
+
+= SSL and TLS1.0 will be disabled
+= PCI Compliance
+= Payment Card Industry
+
+= Remember what we trust
+
+= URLs
+* ((<暗号技術入門|URL:https:/www.hyuki.com/cr/>))
+* ((<Phasing out Certificates with 1024-bit RSA Keys|URL:https://blog.mozilla.org/security/2014/09/08/phasing-out-certificates-with-1024-bit-rsa-keys/>))
+* ((<SHA-1|URL:https://ja.wikipedia.org/wiki/SHA-1>))
+* ((<AWS to Switch to SHA256 Hash Algorithm for SSL Certificates|URL:https://aws.amazon.com/security/security-bulletins/aws-to-switch-to-sha256-hash-algorithm-for-ssl-certificates/>))
+* ((<Sustaining Digital Certificate Security|URL:https://googleonlinesecurity.blogspot.com/2015/10/sustaining-digital-certificate-security.html>))
+
+= CC BY-ND 4.0
+Presented as a lightning talk in RubyKaigi 2015 on 2015-12-12
+
+Copyright 2015 by zunda <zundan@gmail.com>

data/config.yaml

@@ -0,0 +1,19 @@
+---
+id: rubykaigi2015-lt
+base_name: cert-in-gems
+tags: []
+presentation_date: 
+version: 1.0.0
+licenses: []
+slideshare_id: rubykaigi2015-lt
+speaker_deck_id: 
+ustream_id: 
+vimeo_id: 
+youtube_id: 
+author:
+  markup_language: :rd
+  name: zunda
+  email: zundan@gmail.com
+  rubygems_user: zundan
+  slideshare_user: zunda
+  speaker_deck_user: 

metadata

@@ -0,0 +1,86 @@
+--- !ruby/object:Gem::Specification
+name: rabbit-slide-zundan-rubykaigi2015-lt
+version: !ruby/object:Gem::Version
+  version: 1.0.0
+platform: ruby
+authors:
+- zunda
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2015-12-17 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rabbit
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.0.2
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.0.2
+- !ruby/object:Gem::Dependency
+  name: lightning-talk-with-code.rb
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: I hope to communicate to developers of web apps, especially of those
+  handles payment information, that they should be aware of what they trust when developing
+  an app. This should make the app more secure and make the developers aware of when
+  to update gems or certs.
+email:
+- zundan@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".rabbit"
+- 2015sf_Heroku_logo_RGB.png
+- Do you trust that certificate?.pdf
+- README.md
+- Rakefile
+- anmitsu.jpg
+- cert-in-gems.rab
+- config.yaml
+- heroku-logotype-horizontal-purple.png
+- hyuki-cr3.jpg
+- pdf/rubykaigi2015-lt-cert-in-gems.pdf
+homepage: http://slide.rabbit-shocker.org/authors/zundan/rubykaigi2015-lt/
+licenses: []
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.2.2
+signing_key: 
+specification_version: 4
+summary: Do you trust that certificate? ------------------------------ A [rabbit](http://rabbit-shocker.org/)
+  presentation presented as a [Lighting Talk at RubyKaigi 2015](http://rubykaigi.org/2015/presentations/lt).
+test_files: []