From: Gregory Brown <gregory.t.brown@...>
Date: 2006-01-08T16:37:19+09:00
Subject: Re: Ideas on "Why Living Dangerous can be A Good Thing" in Ruby?

On 1/8/06, gwtmp01@mac.com <gwtmp01@mac.com> wrote:

> It isn't like the code is *randomly* modifying code (like certain
> languages that allow pointers to any place in memory!).  The
> modifications are explicit and purposeful and so I think should
> be able to be tested as well as any other code.

I agree with this and actually am not one who has concerns at all
about ruby's security or lack thereof.  I am a major proponent of the
openness.

However, it's not random modification but the modification of library
A by library B (or the modification of something in the standard
library by Library C which could effect A, B, and C) that could be a
real concern.

But this is why rubygems allows you to run the unit tests for a
library BEFORE you install it, and if you've inspected these unit
tests, optionally adding in the potential edge cases you might expect
to encounter... this would solve a lot of issues.

So that's my suggestion as one potential 'solution' to the proposed 'problem'.
However, the issue is real and deserved to be addressed.  So is it the
consensus of the community that our tests are the core of our safety
net?   Or do we have / need extra precautions?

Would it be nice to have a sort of direct access to the standard
library and core units, as well as the units of all installed
libraries, so that these are called on install time or run time or
whenever you need it?  Would it be nice to know that library A broke
something in B that library C needed?  Or is the practical occurance
of this small enough due to responsible coding and a strong tendency
towards comprehensive testing that we needn't worry about it.

It's this i'm not fully sure of, neither in my own convictions nor in
what the community tends to believe.  Getting this out in the open
will be a good thing.

I'm a firm believer in Ruby's open design, I'm a strong proponent of
dynamic code, strongly tested but agile software, and pretty much all
things that are common in Ruby.  I'd love to have a definite answer
when the issue of security is brought up though.