From: Daniel Sheppard <daniels@...>
Date: 2005-11-02T13:35:13+09:00
Subject: Re: [ANN] urirequire: I got yer Web 2.0 right here

Could security be as easy as:

require 'urirequire'
uri_require
'http://fhwang.net/urirequire_test','SHA1:413ABF4Dxxxxxxxxxxx'

go to the internet, grab that code, trust it only if it's the same as
when I said to get it.

Gems - fah! For suckers. Just send me that .rb file, chock full of
uri's, and be done with it.

> -----Original Message-----
> From: Francis Hwang [mailto:sera@fhwang.net] 
> Sent: Wednesday, 2 November 2005 2:22 PM
> To: ruby-talk ML
> Subject: [ANN] urirequire: I got yer Web 2.0 right here
> 
> Fellow Rubyists! How many times have you thought to yourself: 
> "If only there was a more elegant way to download and execute 
> code from all over the internets!" Well, urirequire is the 
> lib for you. By hijacking Kernel.require, urirequire makes it 
> a snap to include code from anywhere on the World Wide 
> Whatever. Sure, eval'ing code that you don't own might be 
> dangerous; for all you know, that remote Ruby file could be 
> undefining Class or emailing your ex-girlfriends. But I say 
> it's time to get with the bleeding edge! Control of your own 
> code is so February 2005.
> 
> http://rubyforge.org/projects/urirequire/
> 
> == EXAMPLE 1: THE ABSURDLY RISKY 'HELLO WORLD' ==
> 
> require 'urirequire'
> require 'http://fhwang.net/urirequire_test'
> 
> Run this, if you feel lucky. Do ya, punk?
> 
> == EXAMPLE 2: INSTALL HOBIX IN SEVEN LESS KEYSTROKES ==
> 
> ruby -rurirequire -e "require 'http://go.hobix.com/'"
> 
> This installs Hobix, that fantabulous blahhg engine by your 
> friend and mine, why the lucky stiff. Sure, it looks like 
> there's a lot of code at that URI, but if you can't trust 
> _why, who can you trust? I mean, you trust your mom, and she 
> couldn't draw a cartoon fox if her life depended on it.
> 
> == TAGLINES WHICH WILL PROBABLY MAKE NOBODY DOWNLOAD MY LIB 
> BUT I THINK ARE FUNNY ANYWAY ==
> 
> urirequire: The network Pwns the computer!
> 
> urirequire: Now I'll never get that job working for Bruce Schneier.
> 
> urirequire: It's not just a solution looking for a problem. 
> It's a solution looking for a victim.
> 
> 
> 
> 
#####################################################################################
This email has been scanned by MailMarshal, an email content filter.
#####################################################################################