This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig1CC0E9DF9DB0FE303A6B5EA6
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Here's my 2 yen.

> 1. Would you agree that we need this functionality?

Good to have, but it would be hard to use properly.

> 2. Where would we ideally place it? I'm not sure whether
>    String is the perfect place, but on the other hand, String
>    is the only place where we have access to the implementation
>    details.
> 3. Are there better alternative ways how we could achieve this?

I think you're going to adopt opt-in way, so library/application
developers must add String#clear call after using the password, right?

If it's opt-in, new specific class would be enough I think.  In this
way, we can control the memory copy (part-of, of course) and eventually
we might be able to split buffers into multiple parts that have
different addresses.

class SecureByteBuffer
  def =3D=3D(rhs)
    raise unless rhs.is_a?(SecureByteBuffer)
    ...
  end

  def clear
    ...
  end
end

But the most hard part I think is how we construct this Object...

Martin, do you have concrete examples which needs secure erasure of
passwords?  Only I can think of now is ossl_pem_passwd_cb in
ext/openssl.  It gets password as a String from a callback block but it
would be good to add a feature to read from STDIN directly, without
creating the String object.

Best regards,
// NaHi


--------------enig1CC0E9DF9DB0FE303A6B5EA6
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (Cygwin)

iQEcBAEBAgAGBQJO7tA7AAoJEC7N6P3yLbI2FsMH/2MKISjy2/VClriFeMa6ubsB
UFt0mkHgYivPi3rwp+dM/k7YwLMstZZDubjTIagscEzhnffMgLVFRhcj06ZVSf70
ugM1c6CMYDfUAmdao96rAKRtaRfMaEIXxSMKwHAhI288xQYQfMoLKWaK3RtCmi3e
tGZ53M+yof8/HkcS1B9beGL3Jl1PUL8vz6i5S2AiUdbvo2i8CHNMPwHS5t5wpwj2
ZukC/8ZWYtZ3TWgm9mzoNq7bn9lbBKy06U4oaepBkC+8W167uAPDpEGZ5px612m8
LPz0E6vHVwB9PPLKJIdKY7mBcVYIaff3MmIZnJKeEmaoJovVESsFowVGuAQYctc=
=FDtw
-----END PGP SIGNATURE-----

--------------enig1CC0E9DF9DB0FE303A6B5EA6--