fowlduck

I'll transcode the vid and set up videojs properly, if it'll help

These graphs are meaningless without methodology.

It is the same vulnerability at a fundamental level (it's virtually the same code), but it isn't exploitable out of the box in the same way Rails was, at least not on its own. However, there is a web framework, Grape, that was exploitable in exactly the same way that Rails was due to MultiXml's vulnerability.

And, really, technically, it was ActiveSupport that had this vulnerability. Even outside of Rails, had you used Hash.from_xml on untrusted user input you would have run into exactly the same issues.

A version of multi_xml with this fix has been pushed:

https://rubygems.org/gems/multi_xml/versions/0.5.2

Grape is also affected:

https://groups.google.com/forum/?fromgroups=#!topic/ruby-gra...

YAML can still be loaded from XML response bodies, it just doesn't parse response bodies that are pure YAML anymore. Something like <tag type="yaml">yaml here</tag>.

The routing mesh is less discriminating than you might think. There is no "global queue".

We autoscale very, very quickly to serve all the jobs in our system. The only limitations we place are on test jobs, where they execute sequentially per account and only 100 can be processing or waiting.

What? No ZenVDN? http://zenvdn.com

Lame indeed, but maybe next round.