From: Jamis Buck <jgb3@...>
Date: 2004-08-28T13:54:50+09:00
Subject: Re: performance comparison

David Ross wrote:
> --- Jamis Buck <jgb3@email.byu.edu> wrote: 
> 
>>To clarify, then: David, you are talking about the C
>>'gets()' function, 
>>correct? I agree that it should be avoided at all
>>costs. However, Ruby's 
>>"gets()" function does not map directly to a C
>>"gets()" invocation -- it 
>>does a lot more work, including bounds checking. 
>>Thus, saying "gets() 
>>is unsafe in every language" is rather misleading. I
>>won't say it is 
>>"safe" in Ruby, since I'm not an expert in this
>>area, but it is 
>>certainly not as hazardous to use as in vanilla C
>>code.
>>
>>(Someone please flame me gently if I've mispoken
>>anything grossly 
>>regarging Ruby's internals...)
>>
>>- Jamis
>>
> 
> 
> hrm.. well I don't know for sure.. I was told on
> freenode #ruby-lang it was insecure when I asked about
> it. Though I never actually read through the code to
> see.

Well, there are lots of ways for something to be insecure. The data from 
gets is put into a string, which anyone with access to the executing 
interpreter could intercept and read/modify... I'm certainly no expert 
on security, but I wouldn't think Ruby should ever be suceptible to 
buffer overflows, at least. I mean, isn't that one of the nice things 
about interpreted languages? They kind of protect you from that kind of 
"low-level" memory management.

- Jamis

> 
> reading code... 
> 
> appendline(..) is restricted to 8192 bytes. :) Okay,
> so it does perform checking. A specification on ruby
> would really help :) Its really hard reading thousands
> of lines of code and trying to understand all of ruby.
> 
> Matz: *cough* *cough* you should write what is in your
> head and on paper for everybody :)
> 
> ..... <snip>
> int cnt = bp - buf;
> 
> if (cnt > 0) {
> ..... </snip>
> 
> ----------------------------------------
> -- Name: David Ross
> -- Phone: 8965.539.3798
> -- Email: drossruby [at] yahoo [dot] com
> ----------------------------------------
> 
> 
> 	
> 		
> __________________________________
> Do you Yahoo!?
> New and Improved Yahoo! Mail - 100MB free storage!
> http://promotions.yahoo.com/new_mail 
> 
> .
> 


-- 
Jamis Buck
jgb3@email.byu.edu
http://www.jamisbuck.org/jamis

"I use octal until I get to 8, and then I switch to decimal."