[#390749] Why are there so many similar/identical methods in core classes — Kassym Dorsel <k.dorsel@...>

Let's look at the Array class and start with method aliases.

14 messages 2011/12/02

[#390755] Inverse Operation of Module#include — Su Zhang <su.comp.lang.ruby@...>

Hi list,

21 messages 2011/12/02
[#390759] Re: Inverse Operation of Module#include — Ryan Davis <ryand-ruby@...> 2011/12/02

[#390764] Re: Inverse Operation of Module#include — Isaac Sanders <isaacbfsanders@...> 2011/12/02

I would suggest an Adapter pattern use here. IF there is something that has

[#390795] Is there a better way to check this array? — Wayne Brissette <wbrisett@...>

I have an array which contains items that need to be renamed. Unfortunately the way things are changed are based on a comparison of if something else exists. For example in this simple array:

9 messages 2011/12/03

[#390876] black magical hash element vivification — Chad Perrin <code@...>

Ruby (1.9.3p0 to be precise, installed with RVM) is not behaving as I

12 messages 2011/12/05

[#390918] WEB SURVEY about Ruby Community — Intransition <transfire@...>

Did any one else get this survey request?

14 messages 2011/12/07

[#390972] Which is the best online document conversion site? — "Maria M." <mariamoore952@...>

Can anyone tell me that which is the best online document conversion

7 messages 2011/12/08

[#390976] Confusing results from string multiplication — Rob Marshall <robmarshall@...>

Hi,

19 messages 2011/12/08

[#391019] How can I do h["foo"] += "bar" if h["foo"] does not exist? — "Andrew S." <andrewinfosec@...>

Hi there,

13 messages 2011/12/09

[#391027] reading from file without end-of-lines — Janko Muzykant <umrzykus@...>

hi,

20 messages 2011/12/09
[#391028] Re: reading from file without end-of-lines — Gavin Sinclair <gsinclair@...> 2011/12/09

> i'm trying to read a few text values from single file:

[#391031] Re: reading from file without end-of-lines — Robert Klemme <shortcutter@...> 2011/12/09

On Fri, Dec 9, 2011 at 9:58 AM, Gavin Sinclair <gsinclair@gmail.com> wrote:

[#391042] Re: reading from file without end-of-lines — Gavin Sinclair <gsinclair@...> 2011/12/09

On Fri, Dec 9, 2011 at 8:18 PM, Robert Klemme

[#391135] I need advice on what to do next. — Nathan Kossaeth <system_freak_2004@...>

I am new to programming. I read the ebook "Learn to Program" by Chris

23 messages 2011/12/12

[#391216] perf optimization using profile results — Chuck Remes <cremes.devlist@...>

I need some help with optimizing a set of libraries that I use. They are ffi-rzmq, zmqmachine and rzmq_brokers (all up on github).

13 messages 2011/12/13
[#391218] Re: perf optimization using profile results — Chuck Remes <cremes.devlist@...> 2011/12/13

On Dec 13, 2011, at 9:57 AM, Chuck Remes wrote:

[#391234] Re: perf optimization using profile results — Charles Oliver Nutter <headius@...> 2011/12/14

A couple quick observations.

[#391238] Re: perf optimization using profile results — Chuck Remes <cremes.devlist@...> 2011/12/14

On Dec 13, 2011, at 7:03 PM, Charles Oliver Nutter wrote:

[#391324] ruby 1.9 threading performance goes non-linear — Joel VanderWerf <joelvanderwerf@...>

12 messages 2011/12/16
[#391325] Re: ruby 1.9 threading performance goes non-linear — Eric Wong <normalperson@...> 2011/12/16

Joel VanderWerf <joelvanderwerf@gmail.com> wrote:

[#391420] Accessing class instance variables from an instance? — "Shareef J." <shareef@...>

Hi there,

26 messages 2011/12/20
[#391454] Re: Accessing class instance variables from an instance? — Khat Harr <myphatproxy@...> 2011/12/21

Actually, now that I'm thinking about it the existing behavior sort of

[#391456] Re: Accessing class instance variables from an instance? — Josh Cheek <josh.cheek@...> 2011/12/21

On Tue, Dec 20, 2011 at 9:42 PM, Khat Harr <myphatproxy@hotmail.com> wrote:

[#391545] Kernel#exit raises an exception? — Khat Harr <myphatproxy@...>

While I was working on embedding an interpreter I wrote a function to

13 messages 2011/12/24

[#391618] rvmsh: An easy installer for RVM — Bryan Dunsmore <dunsmoreb@...>

I have recently begun work on a project called [rvmsh]

12 messages 2011/12/29

[#391783] Mailspam — Gunther Diemant <g.diemant@...>

Is there a way to stop this mailspam of Luca (Mail)?

12 messages 2011/12/29

[#391790] What’s the standard way of implementing #hash for value objects in Ruby? — Nikolai Weibull <now@...>

Hi!

23 messages 2011/12/29
[#391792] Re: What’s the standard way of implementing #hash for value objects in Ruby? — Gunther Diemant <g.diemant@...> 2011/12/29

I think you can't access instance variables from a class method, so

[#391793] Re: What’s the standard way of implementing #hash for value objects in Ruby? — Nikolai Weibull <now@...> 2011/12/29

On Thu, Dec 29, 2011 at 15:52, Gunther Diemant <g.diemant@gmx.net> wrote:

[#391811] Re: What’s the standard way of implementing #hash for value objects in Ruby? — Robert Klemme <shortcutter@...> 2011/12/29

On Thu, Dec 29, 2011 at 4:06 PM, Nikolai Weibull <now@bitwi.se> wrote:

[#391812] Re: What’s the standard way of implementing #hash for value objects in Ruby? — Nikolai Weibull <now@...> 2011/12/29

On Fri, Dec 30, 2011 at 00:26, Robert Klemme <shortcutter@googlemail.com> wrote:

[#391816] Re: What’s the standard way of implementing #hash for value objects in Ruby? — Josh Cheek <josh.cheek@...> 2011/12/30

On Thu, Dec 29, 2011 at 5:47 PM, Nikolai Weibull <now@bitwi.se> wrote:

[#391833] Re: What’s the standard way of implementing #hash for value objects in Ruby? — Robert Klemme <shortcutter@...> 2011/12/30

On Fri, Dec 30, 2011 at 12:47 AM, Nikolai Weibull <now@bitwi.se> wrote:

Re: Ruby, SAFE, method interception, and plugins

From: Garthy D <garthy_lmkltybr@...>
Date: 2011-12-19 01:13:42 UTC
List: ruby-talk #391370
Hi Gary,

On 19/12/11 10:31, Gary Wright wrote:
> I'm not sure that I would want to rely on any language enforced constraints for executing 'hostile' code within the same address space as my main application.  I think a better solution is to run the foreign code (that sounds nicer) in an external process or even on a completely separate system and then use some sort of communication scheme to interact with the foreign code. If the communication scheme is well defined it also means that the plugin doesn't have to even be in Ruby.
>
> If you want to run it on the same system but in a different process you can arrange for the process to be 'locked down' in a sandbox or other restricted environment.  The specifics on how to do this are going to be very dependent on your production environment but perhaps someone will pipe up with some specific suggestions



> if you tell us about your environment.

I'll give it a shot. :)

I am developing a cross-platform app, Linux and Windows initially. Using 
Ruby code for plugins is extremely desirable as much of the app itself 
is already written in Ruby, and I don't want the users to even have to 
consider the platform. Most users would only be using a single platform 
anyway, and many plugin authors would be new to Ruby.

 From the perspective of a potential plugin, I would be providing the 
entire interface- every call that they could need to interact with the 
app would be provided. As mentioned, it could be as simple as message 
passing between a couple of objects. In fact, I don't want the plugin to 
be able to communicate outside the app, except through the API provided 
by the app. This includes networking, filesystem access, and the like. I 
would most likely supply a "require" replacement as well, and RubyGems 
or existing libraries wouldn't be directly usable. I would like plugin 
authors to be able to use things such as strings, arrays, create an 
manage their own custom classes, so forth. I could potentially whitelist 
allowed things if I could hook into things at various points.

Plugin authors would *generally* not be deliberately malicious, because 
they won't be entirely anonymous (as per if it was a online web app, for 
example), but it could happen, so I'd like to minimise the interactions 
with the external environment as much as possible. Some authors will be 
genuinely curious and be looking to explore the rest of the Ruby code 
that is running. I specifically want to limit this. A determined 
attacker will of course eventually succeed, but I want to make it difficult.

The app users would be the ones running the plugins. Most wouldn't be 
able to write a line of Ruby to save their lives, let alone understand 
plugins as anything more than a magic file they download. Thus, if they 
enabled a plugin that executed 99999999**999999999, it might lock the 
app up, but they'll just kill it, restart it, and not use the dodgy 
plugin next time. If the plugin was capable of blasting files away from 
their filesystem, then there is a problem. Thus maliciousness that 
causes an app crash is only a minor problem, maliciousness that deletes 
files is a big problem.

As most of the interaction would be in the form of method calls (ie. 
plugin calls app, expects a return value, app call plugin, expects a 
return value), a separate process for the app would be cumbersome. A 
separate thread would be slightly annoying, and in the same thread would 
be fine. However, I realise that the closer the plugin gets to the app 
in this way, the harder it will be to sandbox. My gut feeling is that 
the solution would probably be provided at the (Ruby) thread level.

The current state of the code is that the app is still in development, 
but many of the basics are in there. No plugin infrastructure exists 
yet, as I'm just starting to explore the possibilities (hence the reason 
for my post- I'm trying to figure out the best place to begin). The app 
itself is a C++ and embedded Ruby mix, and I've worked with both for the 
last decade or so. Patching the version of Ruby I am using myself is a 
possibility if it helps, as I'm fine building Ruby and potentially 
making very small changes. I am using the 1.9 series.

I'm happy answer any questions on specifics if it helps.

Garth

In This Thread