From: David Masover <ninja@...>
Date: 2008-08-18T13:11:31+09:00
Subject: Re: Security in use of contants

On Sunday 17 August 2008 22:06:51 loolek wrote:
> "What kind of bad thing can you do with Ruby constants? "
> 
> I think this is not the question of ruby. Imagine this -> there is a
> constant that holds the value that triggers the cooler sticks in a
> nuclear power plant. Than the bad guy "overwrites" it, what comes
> next ?

Ok, first, how does the "bad guy", whoever they are, get the ability 
to "overwrite" it? They shouldn't even be on the same _network_, let alone in 
my memory space.

And, for that matter, if they were in my memory space, they can do a hell of a 
lot worse than "overwriting a constant".

Here, I think XKCD explains this better than I could:

http://xkcd.com/463/

> Are you sure, you will be ingnorant if you where living in the next
> city from the plant ?

Sorry, but the magnitude of possible failure doesn't prove your point.

No one is saying that it's OK to be less secure. What we are saying is that 
you are wrong about how to go about being secure.

In other words, we are saying that your attitude towards security is more 
likely to blow up that hypothetical plant than, say, proper unit testing.