
Security News
NIST Under Federal Audit for NVD Processing Backlog and Delays
As vulnerability data bottlenecks grow, the federal government is formally investigating NIST’s handling of the National Vulnerability Database.
net/http is pretty much not good. Additionally, DNS behavior in ruby changes quite frequently.
I primarily want two things in both client and server operations:
Desired features:
For reference:
Reference: {FTW::Agent}
agent = FTW::Agent.new
request = agent.get("http://www.google.com/")
response = request.execute
puts response.body.read
# Simpler
response = agent.get!("http://www.google.com/").read
puts response.body.read
SPDY should automatically be attempted. The caller should be unaware.
I do not plan on exposing any direct means for invoking SPDY.
# 'http(s)' or 'ws(s)' urls are valid here. They will mean the same thing.
websocket = agent.websocket!("http://somehost/endpoint")
websocket.publish("Hello world")
websocket.each do |message|
puts :received => message
end
I have implemented a rack server, Rack::Handler::FTW. It does not comply fully with the Rack spec. See 'Rack Compliance Issues' below.
Under the FTW rack handler, there is an environment variable added, "ftw.connection". This will be a FTW::Connection you can use for CONNECT, Upgrades, etc.
There's also a websockets wrapper, FTW::WebSockets::Rack, that will help you specifically with websocket requests and such.
Due to some awkward and bad requirements - specifically those around the specified behavior of 'rack.input' - I can't support the rack specification fully.
The 'rack.input' must be an IO-like object supporting #rewind which rewinds to the beginning of the request.
For high-data connections (like uploads, HTTP CONNECT, and HTTP Upgrade), it's not practical to hold the entire history of time in a buffer. We'll run out of memory, you crazy fools!
Details here: https://github.com/rack/rack/issues/347
Here are some related projects that I have no affiliation with:
Given some of the above (especially the server-side stuff), I'm likely try and integrate with those projects. For example, writing a Faye handler that uses the FTW server, if the FTW web server even stays around.
FAQs
Unknown package
We found that ftw demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
As vulnerability data bottlenecks grow, the federal government is formally investigating NIST’s handling of the National Vulnerability Database.
Research
Security News
Socket’s Threat Research Team has uncovered 60 npm packages using post-install scripts to silently exfiltrate hostnames, IP addresses, DNS servers, and user directories to a Discord-controlled endpoint.
Security News
TypeScript Native Previews offers a 10x faster Go-based compiler, now available on npm for public testing with early editor and language support.