Jared sits down with Trail of Bits security engineer Matt Schwager to discuss the persistent security risks of Ruby’s Marshal library. Matt explains that while Marshal (and Python’s Pickle) makes serialization simple and fast for tasks like caching, its “serialize anything” design has led to over a decade of recurring vulnerabilities. Despite repeated patches, new bugs and exploitation gadgets keep surfacing, often hidden in defaults or legacy code, as seen in Rails caching and RubyGems.org. Matt argues that this reflects a fundamental trade-off between ergonomics and security, suggesting alternatives like JSON are safer, though less convenient. He highlights mitigation strategies such as documentation, static analysis, and fuzzing with his tool Ruzzy, while also pointing to broader Ruby risks like eval misuse, SSRF, and supply chain issues. Jared reflects on the cultural tension in Ruby between ease of use and security, wondering if safer defaults could help developers avoid these common pitfalls.Links:Trail of Bits BlogRuby Marshal documentationPython Pickle documentationJSONYAMLTOMLMessagePackRails Caching GuideRubyGems.orgRubyGems source on GitHubRuzzy on GitHubAFL on GitHubSemgrep RegistryBlack Hat USA 2017 TalkDead Code Podcast Links:MastodonXJared’s Links:MastodonXtwitch.tv/jardonamronJared’s Newsletter & WebsiteEpisode Transcript Hosted on Acast. See acast.com/privacy for more information.

Ver todos los episodios