From: Clifford Heath <no@...>
Date: 2008-05-07T15:50:05+09:00
Subject: Re: In order to cross platform, Ruby is designed to be interpreted in  runtime, so Ruby code is exposed on the server. This brings a security danger  which is not acceptable.

Phillip Gawlowski wrote:
> 2) If the security of your application hinges on somebody not getting
> the source code, your application wasn't written properly.
> See also: http://en.wikipedia.org/wiki/Security_through_obscurity

Not intending to feed the original troll, but your answer is only
partly correct. Ruby injection is likely easier and more powerful
than object-code injection onto a system that has no compiler. That's
why many sensitive production systems allow no development tools to
be installed. It's called "defense in depth". IMO Ruby does make the
defense shallower... but not too shallow.

Erwin: if it's not acceptable to you, then don't use it.
But don't bother complaining here, because it's not likely to change.