[#29932] Happy 2002! — "Rich Kilmer" <rich@...>

Happy New Year from Washington DC!

24 messages 2002/01/01
[#29938] RE: Happy 2002! — "James Britt (rubydev)" <james@...> 2002/01/01

>

[#29954] Re: Happy 2002! — Dinakar <Desai.Dinakar@...> 2002/01/01

"James Britt (rubydev)" wrote:

[#29991] Execing command with backquotes — mail02@... (Frank Benoit)

Hi

13 messages 2002/01/01

[#30101] Ruby Weekly News rdf feed now available — Dave Thomas <Dave@...>

12 messages 2002/01/03

[#30191] chomp for arrays? — dempsejn@...

Hi All,

25 messages 2002/01/04
[#30238] Re: chomp for arrays? — adamspitz@... (Adam Spitz) 2002/01/04

How about something like this?

[#30248] Re: chomp for arrays? — Massimiliano Mirra <list@...> 2002/01/05

On Sat, Jan 05, 2002 at 04:53:14AM +0900, Adam Spitz wrote:

[#30357] snippet exchange (was: Re: Re: chomp for arrays?) — David Alan Black <dblack@...> 2002/01/06

Hello --

[#30369] Re: snippet exchange (was: Re: Re: chomp for arrays?) — "Mark Hahn" <mchahn@...> 2002/01/06

A daydream of mine is a "super-require" that if the file was not found, the

[#30401] Re: snippet exchange (was: Re: Re: chomp for arrays?) — Dan Sugalski <dan@...> 2002/01/07

At 06:31 AM 1/7/2002 +0900, Mark Hahn wrote:

[#30195] should I use ruby instead of perl — vekkuli ketkutin <qvyht@...>

simple question...

25 messages 2002/01/04

[#30265] Structs and Marshalling — Albert Wagner <alwagner@...>

I keep getting myself tripped up when I Marshal Struct objects. I typically

18 messages 2002/01/05
[#30281] Re: Structs and Marshalling — ts <decoux@...> 2002/01/05

>>>>> "A" == Albert Wagner <alwagner@tcac.net> writes:

[#30334] Re: Structs and Marshalling — Albert Wagner <alwagner@...> 2002/01/06

On Saturday 05 January 2002 06:25 am, you wrote:

[#30473] Re: [ruby-talk:30334] Re: Structs and Marshalling — matz@... (Yukihiro Matsumoto) 2002/01/07

Hi,

[#30528] Possible bug with struct.c (Re: Re: Structs and Marshalling) — ts <decoux@...> 2002/01/07

>>>>> "Y" == Yukihiro Matsumoto <matz@ruby-lang.org> writes:

[#30546] Re: Possible bug with struct.c (Re: Re: Structs and Marshalling) — nobu.nokada@... 2002/01/07

At Tue, 8 Jan 2002 02:36:12 +0900,

[#30274] The Ruby Way — "Conrad Schneiker" <schneiker@...>

Hi,

31 messages 2002/01/05
[#30275] RE: The Ruby Way — "Curt Hibbs" <curt@...> 2002/01/05

> From: Conrad Schneiker [mailto:schneiker@jump.net]

[#30276] Re: The Ruby Way — "Curt Hibbs" <curt@...> 2002/01/05

That was supposed to say "how do I implement a hash with duplicate keys?"

[#30320] Sorting a Hash by value of integer stored in the Hash — Michael Joner <finalfrontier@...>

I have a program which creates a Hash array. The ultimate result is a

14 messages 2002/01/06

[#30327] one liner / overriden class repository — "Jack Dempsey" <dabigdemp@...>

Why aim if not high? :-)

15 messages 2002/01/06

[#30366] class name reported differently in different contexts — Joel VanderWerf <vjoel@...>

30 messages 2002/01/06
[#30380] Re: class name reported differently in different contexts — "Chr. Rippel" <chr_news@...> 2002/01/06

[#30496] Re: class name reported differently in different contexts — <ale@...> 2002/01/07

On Mon, 7 Jan 2002, Chr. Rippel wrote:

[#30372] [ANN] Invitation to join LotY (Language of the Year) project, 2002: learning Haskell — David Alan Black <dblack@...>

Dear fellow programmers,

10 messages 2002/01/06

[#30431] Re: snippet exchange (was: Re: Re: chomp for arrays?) — "Jack Dempsey" <dabigdemp@...>

The way i was thinking of this working would be this: someone has heard of a

14 messages 2002/01/07

[#30461] Re: the [ruby-talk] is gone? — "Jack Dempsey" <dabigdemp@...>

Hi Matz,

13 messages 2002/01/07

[#30494] Segfault with druby and fork — Michael Witrant <mike@...>

Hello,

24 messages 2002/01/07
[#30510] Re: Segfault with druby and fork — matz@... (Yukihiro Matsumoto) 2002/01/07

Hi,

[#30543] Re: Segfault with druby and fork — Michael Witrant <mike@...> 2002/01/07

On Tue, 8 Jan 2002 00:37:14 +0900

[#30640] Re: Segfault with druby and fork — matz@... (Yukihiro Matsumoto) 2002/01/08

Hi,

[#30644] An Update on the FreeRIDE Project — "Curt Hibbs" <curt@...> 2002/01/08

I wanted to give everyone an update on where we are with the FreeRIDE

[#30655] Re: An Update on the FreeRIDE Project — bobx@... (Bob) 2002/01/08

Documentation should also be a big(?) concern. I am new to Ruby as

[#30539] RDoc Alpha-6 available — Dave Thomas <Dave@...>

37 messages 2002/01/07

[#30737] rpkg 0.1 (long) — Massimiliano Mirra <list@...>

<yaaawn>

16 messages 2002/01/10

[#30866] Dir.entries have no home — Ron Jeffries <ronjeffries@...>

Chet and I were writing a little code manager yesterday and we wrote

38 messages 2002/01/11

[#30920] MetaRuby : RubySchema.rb howto? — Tobias Reif <tobiasreif@...>

Hi,

15 messages 2002/01/11
[#30953] Re: MetaRuby : RubySchema.rb howto? — Mathieu Bouchard <matju@...> 2002/01/12

[#30969] Re: MetaRuby : RubySchema.rb howto? — Tobias Reif <tobiasreif@...> 2002/01/12

Mathieu Bouchard wrote:

[#30949] Another suggestion for FreeRIDE — ptkwt@...1.aracnet.com (Phil Tomson)

Based on some discussions over at comp.lang.python...

13 messages 2002/01/12

[#31017] Why I think Ruby will eventually be more popular than Python — gandy@... (Thomas Gandy)

Ruby and Python both play in the same niche: they're both Object

9 messages 2002/01/12

[#31080] Best way for platf. independent compression? — Massimiliano Mirra <list@...>

Currently, rpkg builds packets by tar'ring and gzip'ping the source

25 messages 2002/01/13
[#31112] Re: Best way for platf. independent compression? — Chris Gehlker <gehlker@...> 2002/01/14

On 1/13/02 1:42 PM, "Massimiliano Mirra" <list@chromatic-harp.com> wrote:

[#31153] Re: Best way for platf. independent compression? — Massimiliano Mirra <list@...> 2002/01/14

On Mon, Jan 14, 2002 at 12:08:58PM +0900, Chris Gehlker wrote:

[#31085] Small Methods - a ramble — Ron Jeffries <ronjeffries@...>

I noticed in some code that Chet and I were writing that, as Smalltalkers, we tend to write really

45 messages 2002/01/13
[#31170] Re: Small Methods - a ramble — Brian Marick <marick@...> 2002/01/14

Ron Jeffries wrote:

[#31099] a wishlist for ruby 2.0 — Mathieu Bouchard <matju@...>

49 messages 2002/01/14
[#31237] Re: a wishlist for ruby 2.0 — matz@... (Yukihiro Matsumoto) 2002/01/15

Hi,

[#31276] Re: a wishlist for ruby 2.0 — Mathieu Bouchard <matju@...> 2002/01/15

[#31251] Swig Ruby documentation mods. — Hugh Sasse Staff Elec Eng <hgs@...>

I have been trying to use Swig Ruby recently, and in attempting to

10 messages 2002/01/15

[#31262] grabbing stuff from web pages — Ron Jeffries <ronjeffries@...>

Part of my web site has recommended books. I use the cover jpegs from

11 messages 2002/01/15

[#31275] how to get all the reserved words? — Tobias Reif <tobiasreif@...>

Hi;

16 messages 2002/01/15

[#31289] memory usage question — "Mark Hahn" <mchahn@...>

I need to write a script that will use a hash with 4 million strings of 16

30 messages 2002/01/15

[#31311] Vote for Windows Installer packages — Andrew Hunt <andy@...>

14 messages 2002/01/15

[#31404] Re: A question on Ruby Threads — "Tobias DiPasquale" <anany@...>

In article <a242re$gop@ftp.ee.vill.edu>, "Chris Gehlker"

15 messages 2002/01/16

[#31424] A few words on threads — "Avdi B. Grimm" <avdi@...>

Warning: many strong personal opinions and broad

14 messages 2002/01/16

[#31442] #59 Add fsync method to IO class — hensleyl@... (Leslie Hensley)

Adding fsync and fdatasync methods to the IO class will allow Ruby to

17 messages 2002/01/16

[#31512] Hello! Array sub classing? — Markt <markt@...>

Hello Ruby lovers!

23 messages 2002/01/17

[#31533] Possible bug in Mac version? — Dave Thomas <Dave@...>

16 messages 2002/01/17

[#31564] The first alternative RDoc template — Dave Thomas <Dave@...>

22 messages 2002/01/17

[#31658] dynamic method creation — "Albert L. Wagner" <alwagner@...>

I have a need to dynamically create methods with method names

16 messages 2002/01/18

[#31711] Re: zip on Linux — "Mirabai Neumann" <webmaster@...>

19 messages 2002/01/19

[#31727] Keeping track of multiple Ruby discussion sites. — "James Britt (rubydev)" <james@...>

Recently, Massimiliano Mirra wrote:

13 messages 2002/01/19

[#31735] installing mod_ruby --> seg fault in ruby-rdtool — craig@...

At least that's where core dumped. FreeBSD/Alpha (4.4-RELEASE). New to

16 messages 2002/01/19

[#31741] $_ as default parameter for a function — thomass@... (Thomas)

I'd like the fragment below to produce "blah blah", but it doesn't

15 messages 2002/01/19

[#31882] RANT: Ruby GUI API — Sean Russell <ser@...>

I started this rant in another thread, where it was way OT, so I'm moving

60 messages 2002/01/21

[#31937] Re: RANT: Ruby GUI API — Ben Crowell <crowell02@...>

M. Mirra wrote:

28 messages 2002/01/22
[#31948] Re: RANT: Ruby GUI API — John Carter <john.carter@...> 2002/01/22

On Tue, 22 Jan 2002, Ben Crowell wrote:

[#32056] Ruby Publishing Framework v0.5.0 — Bryan Murphy <bryan@...>

Ruby Publishing Framework

15 messages 2002/01/22

[#32106] about time for seperate lists? — "Tobias DiPasquale" <anany@...>

Hi all,

12 messages 2002/01/23

[#32121] : ruby-talk seperation — "Tobias DiPasquale" <anany@...>

Hi all,

19 messages 2002/01/23

[#32177] — Eugene Scripnik <Eugene.Scripnik@...>

I have a problem loading files from my script (I mean Kernel::load):

20 messages 2002/01/23
[#32187] — nobu.nokada@... 2002/01/23

Hi,

[#32722] Re: — Eugene Scripnik <Eugene.Scripnik@...> 2002/01/29

Hello nobu,

[#32728] Re: — nobu.nokada@... 2002/01/29

Hi,

[#32793] Re[2]: — Eugene Scripnik <Eugene.Scripnik@...> 2002/01/30

Tuesday, January 29, 2002, 5:05:05 PM, you wrote:

[#32799] $: in mod_ruby — nobu.nokada@... 2002/01/30

Hi,

[#32957] Re: $: in mod_ruby — Eugene Scripnik <Eugene.Scripnik@...> 2002/02/01

Wednesday, January 30, 2002, 4:55:23 PM, you wrote:

[#32233] Subclassing vs Subtyping (partly OOP vs FP) — Robert Feldt <feldt@...>

Hi,

16 messages 2002/01/24
[#33032] Re: Subclassing vs Subtyping (partly OOP vs FP) — Dave Thomas <Dave@...> 2002/02/03

Lewis Perin <perin@panix.com> writes:

[#32247] Array.last Weirdness — Jesse Jones <jesjones@...>

I'd expect the following code:

19 messages 2002/01/24

[#32312] Serious Array Bug in Ruby 1.6.6? — William Djaja Tjokroaminata <billtj@...>

Hi,

42 messages 2002/01/24
[#32315] Re: Serious Array Bug in Ruby 1.6.6? — David Alan Black <dblack@...> 2002/01/24

Hello --

[#32400] Re: Serious Array Bug in Ruby 1.6.6? — billtj@... (Bill Tj) 2002/01/25

Hi,

[#32404] Re: Serious Array Bug in Ruby 1.6.6? — David Alan Black <dblack@...> 2002/01/25

Hello --

[#32319] looking for an example problem to demonstrate TaskMaster — ptkwt@...1.aracnet.com (Phil Tomson)

I'm looking for suggestions here...

19 messages 2002/01/24

[#32355] RDoc learns to draw pictures... — Dave Thomas <Dave@...>

15 messages 2002/01/25
[#32377] Re: [ANN] RDoc learns to draw pictures... — "Pit Capitain" <pit@...> 2002/01/25

On 25 Jan 2002, at 9:34, Dave Thomas wrote:

[#32388] Ruby Developers Guide — Robert Feldt <feldt@...>

Hi,

16 messages 2002/01/25

[#32401] Sourcecode dump? — Olivier CARRERE <carrere@...>

Hello,

12 messages 2002/01/25

[#32417] Subrange of String subclass => invalid object — "Bob Alexander" <bobalex@...>

Given these conditions:

52 messages 2002/01/25

[#32445] "friend" alternative in Ruby? — kturing@... (kate turing)

I have a class "Foo". It has a method "doSecretStuff" that I want to

13 messages 2002/01/26

[#32465] rubyzip 0.3.1 — thomass@... (Thomas)

rubyzip 0.3.1 is out.

18 messages 2002/01/26

[#32593] OT: tools for creating documentation — ptkwt@...1.aracnet.com (Phil Tomson)

I'm going to be creating a good bit of documentation for TaskMaster and I

12 messages 2002/01/27

[#32646] popen3 and buffering — Paul Brannan <paul@...>

I have a program test.rb:

26 messages 2002/01/28

[ruby-talk:30437] Re: snippet exchange (was: Re: Re: chomp for arrays?)

From: Dan Sugalski <dan@...>
Date: 2002-01-07 05:08:29 UTC
List: ruby-talk #30437
At 01:25 PM 1/7/2002 +0900, Jack Dempsey wrote:
>My opinion is this: anything downloaded from anywhere is suspect if you
>really want to be extremely scrutinizing...what about rubycookbook? Are you
>going to carefully scrutinize every line of code to make sure there's
>nothign malicious in there? for small snippets sure, but as modules get
>bigger, no way...what about RAA? Don't people download code from there and
>use it daily?

Sure. That doesn't mean it's safe. But, more importantly, they have to 
actively do this.

>I agree that security is important, but bottom line, we're not seeking to do
>anything really different here...i understand there's inherent danger in
>autoloading something from the web and running it, but is it that different
>from downloading, moving to a directory, then using it if you're not going
>to scan through it? Security is certainly important but you'll never reach
>100% safety...

There is a qualitative difference here. When you explicitly fetch and 
install code, you at least have the opportunity to examine what you've 
gotten. (Whether you do or not is up to you--you can choose to take that 
risk) You only do it once. With a net-require, it happens multiple times, 
and at times that aren't under your control.

Here's a concrete scenario. Assume a CGI program uses this scheme to load 
in part of its code. It's something useful (guestbook, weblog, web service, 
or something of that sort). Someone wants to compromise your system? All 
they need to do is attack something that's outside your control--perhaps a 
router, or a DNS server--and then trigger off your program. It goes off to 
fetch its bits (because they aren't installed locally, and at best there's 
a local cache that can be poisoned) and you revector them to a place of 
your choosing. Poof, you load up their code, and you're hosed.

This also introduces a single point of failure into your system, and a 
point that's not under your control. Someone only needs to compromise that 
one point and you're compromised. Trojans have been inserted into 
supposedly secure repositories before and, while they're found, they're 
dangerous for the duration. This sort of setup, which requires periodic 
rather than one-off repository access, magnifies the vulnerabilities.

No, the internet is *not* a safe place. (Neither are intranets--this is as 
dangerous or more dangerous a setup inside a corporate or university 
firewall than outside one) It's important to be aware of the risks 
something like this presents before you implement or use it. ("But that 
method over there is as unsafe" isn't really a good argument. Increasing 
your exposure is rarely a good thing to do)

					Dan

--------------------------------------"it's like this"-------------------
Dan Sugalski                          even samurai
dan@sidhe.org                         have teddy bears and even
                                      teddy bears get drunk

In This Thread