From: Phillip Gawlowski <cmdjackryan@...>
Date: 2008-05-07T16:11:09+09:00
Subject: Re: In order to cross platform, Ruby is designed to be interpreted in  runtime, so Ruby code is exposed on the server. This brings a security danger  which is not acceptable.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Clifford Heath wrote:
| Phillip Gawlowski wrote:
|> 2) If the security of your application hinges on somebody not getting
|> the source code, your application wasn't written properly.
|> See also: http://en.wikipedia.org/wiki/Security_through_obscurity
|
| Not intending to feed the original troll, but your answer is only
| partly correct. Ruby injection is likely easier and more powerful
| than object-code injection onto a system that has no compiler. That's
| why many sensitive production systems allow no development tools to
| be installed. It's called "defense in depth". IMO Ruby does make the
| defense shallower... but not too shallow.

If I'm able to read source code in a, hopefully, protected directory,
I'm not going to bother with code injection.

I'd be doing something like
$ passwd
Type the new password for root:

If I have physical access to the machine or access to the programs
installed there, I'm going to hunt for known issues and exploit those
(ala Metasploit).

Also: How has introduced an issue that wasn't there already with, say,
Perl, Tcl, or PHP (go through a list of PHP functions that you should
close *at least* one of those days. Fun)?

Or with a hexeditor. Heck, download one from someplace, if you are able
to see the sources of a Ruby app.

There's security, and then there's security theater.

Ah production server should only run what's needed, anyway. That is the
main reason not to have dev tools running on them (though, have fun
trying to remove all text editors on a *NIX machine, and the Shell which
probably is Turing complete): Reducing the exposed surface area.

In short: Ruby makes the defense as shallow as Perl or Python.

- --
Phillip Gawlowski
Twitter: twitter.com/cynicalryan
Blog: http://justarubyist.blogspot.com

~ - You know you've been hacking too long when...
...you hear your alarm, but can't seem to get fully awake until you
successfully page your left arm back in from swap space.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkghVgkACgkQbtAgaoJTgL9GKQCeN4sQIEr3Vv0JgVIc4eKtWbCe
j+4An1KLZp9AL0Ir7I/r7hKqttsebTax
=SbBk
-----END PGP SIGNATURE-----