From: Tony Arcieri <tony.arcieri@...>
Date: 2013-02-13T09:13:09+09:00
Subject: Re: Why doesn't Ruby have a built in sandbox class?

--047d7b67824802221204d5900137
Content-Type: text/plain; charset=ISO-8859-1

Wow, I wasn't aware $SAFE=4 was quite that powerful. Too bad it doesn't
work on JRuby or I might seriously consider using it ;)


On Tue, Feb 12, 2013 at 2:37 AM, Ano Hito <lists@ruby-forum.com> wrote:

> Tony Arcieri wrote in post #1096413:
> > I posted a strawman for something similar a few days ago. It's a bit
> > different idea from yours and a super-granular class whitelist:
> >
> > https://gist.github.com/tarcieri/4719525
> >
> > Clearly that doesn't cover all the "NO" cases, but I hope it gives you a
> > general idea
>
> Creating a secure context inside of a block would certainly be more
> rubylike than $SAFE = 4. But would you allow for managing what classes
> and methods are allowed to be used in a SecureContext? Otherwise it's
> not that different from just running the code in a new thread after
> setting $SAFE = 4 in the thread's context.
>
> --
> Posted via http://www.ruby-forum.com/.
>
>


-- 
Tony Arcieri

--047d7b67824802221204d5900137
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Wow, I wasn&#39;t aware $SAFE=3D4 was quite that powerful.=
 Too bad it doesn&#39;t work on JRuby or I might seriously consider using i=
t ;)</div><div class=3D"gmail_extra"><br><br><div class=3D"gmail_quote">On =
Tue, Feb 12, 2013 at 2:37 AM, Ano Hito <span dir=3D"ltr">&lt;<a href=3D"mai=
lto:lists@ruby-forum.com" target=3D"_blank">lists@ruby-forum.com</a>&gt;</s=
pan> wrote:<br>

<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">Tony Arcieri wrote in post #1096413:<br>
<div class=3D"im">&gt; I posted a strawman for something similar a few days=
 ago. It&#39;s a bit<br>
&gt; different idea from yours and a super-granular class whitelist:<br>
&gt;<br>
&gt; <a href=3D"https://gist.github.com/tarcieri/4719525" target=3D"_blank"=
>https://gist.github.com/tarcieri/4719525</a><br>
&gt;<br>
&gt; Clearly that doesn&#39;t cover all the &quot;NO&quot; cases, but I hop=
e it gives you a<br>
&gt; general idea<br>
<br>
</div>Creating a secure context inside of a block would certainly be more<b=
r>
rubylike than $SAFE =3D 4. But would you allow for managing what classes<br=
>
and methods are allowed to be used in a SecureContext? Otherwise it&#39;s<b=
r>
not that different from just running the code in a new thread after<br>
setting $SAFE =3D 4 in the thread&#39;s context.<br>
<div class=3D"HOEnZb"><div class=3D"h5"><br>
--<br>
Posted via <a href=3D"http://www.ruby-forum.com/" target=3D"_blank">http://=
www.ruby-forum.com/</a>.<br>
<br>
</div></div></blockquote></div><br><br clear=3D"all"><div><br></div>-- <br>=
Tony Arcieri<br>
</div>

--047d7b67824802221204d5900137--