From: John Lam <drjflam@...>
Date: 2006-03-31T05:03:54+09:00
Subject: Re: Digital signing of Ruby scripts

------=_Part_9734_32024280.1143749032184
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

I was thinking about something a bit more onerous - allowing administrators
to define machine-wide policies for execution of Ruby scripts. It's either
that or the guidance must be "write your app in such a way that you assume
that all clients are compromised". But then again, that's the HTML model so
folks are pretty used to that.

-John
http://www.iunknown.com




John,
>
> One solution may be to compile a small app that takes an MD5, SHA, or
> some other checksum of the ruby code and only executes it if it is in an
> internal hash of allowed files. You could have user-based hashes of
> allowed files based on who is logged in. Of course you will have to
> rebuild this app every time you change the ruby code but that could be
> automated. But a user could run the ruby code directly unless you build
> in some dependency to the compiled app. If they can see the source code,
> they can copy it, tamper with it, and run it.
>
> Dan
>
>
>

------=_Part_9734_32024280.1143749032184--