From: mathew <meta@...>
Date: 2005-09-23T23:21:47+09:00
Subject: Re: RubyGems in Ruby HEAD

Pascal Terjan wrote:

>On 9/22/05, mathew <meta@pobox.com> wrote:
>  
>
>>Why not? Many Ruby libraries have no non-Ruby code, so there's no
>>difference between a 'binary' and a 'source' version of them. Plus,
>>surely it's possible to mark that (say) openssl-ruby depends on having a
>>C compiler and openssl-dev?  If necessary for policy reasons, mark it as
>>a 'source' rather than a 'binary' package.
>>    
>>
>
>And then people will install a compiler on their server to ease
>exploits ? or remove the compiler after each install ?
>

I'm fascinated by the idea that a C compiler is a uniquely dangerous 
vector for exploits.

If you have Ruby and Perl on a system, you already have everything you 
need to carry out most exploits. And if the hacker really needs a C 
compiler--I dunno, maybe there are lots of hackers out there who don't 
have C compilers on their machines--he can simply download one.


mathew