From: Intransition <transfire@...>
Date: 2011-06-12T12:07:37+09:00
Subject: Re: RFC - One word alias for require_relative



On Jun 11, 8:32 pm, Phillip Gawlowski <cmdjackr...@googlemail.com>
wrote:
> On Sun, Jun 12, 2011 at 1:42 AM, Intransition <transf...@gmail.com> wrote:
>
> > You still have to remember the name of the method. Moreover my system
> > does things yours does not. So to be fair you would need another
> > method or two, and a hash option too, e.g.
>
> >  require 'ostruct', :library=>'ruby'
>
> What for?

It restricts where the file 'ostruct' can be found. In this case to
ruby's standard library.

> And yes, I have to remember the method name. A method name that's much
> more mnemonic than  '::whatever'.

Fair enough. The device isn't as important as what it accomplishes. A
hash option can work too.

> > What's your point? I don't see how that has anything to do with what
> > you said.
>
> You can't accidentally pollute the namespace if the file doesn't get
> loaded by default. One of the reasons we have "require" and
> "require_relative".

Quite true. #require_relative is a great feature of 1.9. There's still
requiring from other libraries though, and if some one follows bad
practices the wrong file can get loaded.

> > That's not it. The suggestion I am making moves beyond the simple path
> > system Ruby now uses. It would require that Ruby understand packages.
> > So it's not "still along the path".
>
> Please. Then I just define a package, put that someplace first in the
> loadpath, and *boom*, your system blowing up in your face again.

That's not how it works. You can't put something first in the load
path. Rather than a simple list of paths, such a system uses a table
of  { 'packgname' => 'path/to/package' }. Actually it's a little more
complicated than that b/c of versions and internal require_paths
settings but that's the basic idea.

> >> Which your system doesn't mitigate against at all. And it cannot, ever
> >> (nor does Bundler: It is a poor man's version and dependency control).
> >> Once code is on a machine, it can do whatever it wants. Ruby just
> >> makes it easier to modify its own classes, but the vector is still
> >> there: external code executed locally.
>
> > Yes it does. I use it all the time. I wrote such a system and use if
> > for development.
>
> Every programmer can invent a cypher he, himself, cannot break, as well.
>
> Unless you wrote your own OS that allows only the execution of
> specifically whitelisted binaries *and* script files (you have to
> prevent arbitrary code execution within a Ruby interpreter, too, after
> all, and just whitelisting the Ruby binary won;t work for that), code
> that is running on your machine, can manipulate your machine.
>
> >> Without auditing code, you have no idea what the code does to your
> >> machine, and who prevents anyone from claiming "I'm part of Ruby's
> >> namespace"?
>
> > Ruby.
>
> How? Since Ruby can execute arbitrary OS-level commands with system()
> or ``, how can Ruby prevent namespace pollution?

I think we are talking about two different things. I'm only talking
about preventing the wrong file from being loaded. Not anything to do
with what's in a file.