From: Eric Hodel <drbrain@...7.net>
Date: 2006-06-01T14:26:11+09:00
Subject: Re: Ruby security question

On May 31, 2006, at 9:34 PM, Jeff Pritchard wrote:

> I work for a fortune 100 company in the telecom space.  They are
> absolutely dirtying their shorts over security concerns.
>
> Having witnessed several such 1 to 3 day tirades on how to write  
> safer C
> code, I think I can summate 99% of the issue as:
> "make sure you don't over-run any buffers".
>
> I've been thinking it over, and I can't for the life of me think of a
> way to over-run a buffer in Ruby.

The equivalent in ruby is "Never trust tainted data".

Setting $SAFE appropriately for your application will cause  
exceptions to be thrown when you try to work with tainted data.  By  
default this protection is off.

See:

http://www.rubycentral.com/book/taint.html

-- 
Eric Hodel - drbrain@segment7.net - http://blog.segment7.net
This implementation is HODEL-HASH-9600 compliant

http://trackmap.robotcoop.com