[#407882] Ruby extremely slow compared to PHP — Mick Jagger <lists@...>

Hello there, how are you? Hope you are fine. I am a PHP programmer

17 messages 2013/06/02

[#407908] TCPServer/Socket and Marshal problem — Panagiotis Atmatzidis <atma@...>

Hello,

18 messages 2013/06/03

[#407946] Is rubyquiz.com dead? — Alphonse 23 <lists@...>

Thread title says everything.

18 messages 2013/06/04

[#408012] Need help understanding recursion. — pedro oliva <lists@...>

Ive been reading Chris Pine's book 'Learn to Program' and its been going

11 messages 2013/06/06

[#408129] Getting Started With Development — Chamila Wijayarathna <cdwijayarathna@...>

I'm new to Ruby Development. I downloaded source from Github, but couldn't

24 messages 2013/06/11
[#408131] Re: Getting Started With Development — Per-erik Martin <lists@...> 2013/06/11

Ruby is often installed on linux, or can be easily installed with the

[#408146] Re: Getting Started With Development — "Chamila W." <lists@...> 2013/06/11

Per-erik Martin wrote in post #1112021:

[#408149] Re: Getting Started With Development — "Carlo E. Prelz" <fluido@...> 2013/06/11

Subject: Re: Getting Started With Development

[#408198] NokoGiri XML Parser — "Devender P." <lists@...>

Hi,

11 messages 2013/06/13

[#408201] trying to load a .rb file in irb — "Eric D." <lists@...>

I am trying to load a ruby program into irb and it will not load.

12 messages 2013/06/13

[#408205] Can I use Sinatra to render dynamic pages? — Ruby Student <ruby.student@...>

Hell Team,

18 messages 2013/06/13
[#408219] Re: Can I use Sinatra to render dynamic pages? — Nicholas Van Weerdenburg <vanweerd@...> 2013/06/14

You should be able to do this without JavaScript by using streaming.

[#408228] Re: Can I use Sinatra to render dynamic pages? — Ruby Student <ruby.student@...> 2013/06/14

Well, I got some good suggestions from everyone here. I thank you all for

[#408275] Compare and sort one array according to another. — masta Blasta <lists@...>

I have two arrays of objects that look something like this:

14 messages 2013/06/17

[#408276] Comparing objects — "Thom T." <lists@...>

How do I compare two objects in Ruby, considering only attributes

15 messages 2013/06/17

[#408307] getting the most out of Ruby — robin wood <lists@...>

I write a lot of scripts in Ruby, most are small simple things but some

13 messages 2013/06/18

[#408309] Creating ruby script exe — Rochit Sen <lists@...>

Hi All,

17 messages 2013/06/18

[#408357] Beginners problem with database and datamapper — cristian cristian <lists@...>

Hi all!

28 messages 2013/06/20

[#408437] How do I input a variable floating point number into Ruby Programs — "Michael P F." <lists@...>

I want to evaluate the following interactively:

10 messages 2013/06/23

[#408518] #!/usr/bin/env: No such file or directory — Todd Sterben <lists@...>

I am new to both linux and ruby. I am using Ubuntu and Ruby 1.9

17 messages 2013/06/27

[#408528] Designing a Cabinet class — Mike Vezzani <lists@...>

Hello all,

12 messages 2013/06/27

[#408561] Find elment in array of hashes — Rodrigo Lueneberg <lists@...>

array = {:id=>1, :price =>0.25} # index[0]

23 messages 2013/06/28

Re: Where does Ruby look to load files?

From: Jeremy Bopp <jeremy@...>
Date: 2013-06-03 23:10:47 UTC
List: ruby-talk #407942
On 06/03/2013 03:47 PM, J. V. wrote:
> It is going to take two days to fix one application alone; We have many 
> web apps on Ruby.  This is a serious hit on time; and I can imagine 
> there are many other out there that have to dedicate resources to this.

You do realize that the change to Ruby that is giving you problems here
was released almost 3 years ago, right?  Upgrading your application's
basic infrastructure after such a lag should be expected to take some
time and effort.  Try to stay calm.  This one has some workarounds
available.

If you would like to avoid large code changes and accept all the risks,
you can play with fire by appending '.' to the library path for Ruby. 
Locate one of the first files loaded by your application, and add this
near the top:

$: << '.'

Now your library search path is as unsafe as earlier versions of Ruby,
and the rest of your application can go about business as before.

> Can anyone explain exactly what the "security risk" was and why the Ruby 
> dev team could simply not leave this alone?

Maybe you already ran across this discussion:

http://stackoverflow.com/questions/2900370/why-does-ruby-1-9-2-remove-from-load-path-and-whats-the-alternative

Read it closely because it does explain the reasoning down in the comments.

Calling require can happen at any time during the execution of your
application.  If require looks in the current working directory of the
application for files to load, it can be tricked into loading the wrong
files or simply failing to load anything at all by the application's
working directory being something other than expected at the time
require is called.  This could be the result of maliciousness, a poorly
coded library, race conditions in threads, the user running the
application from an unexpected location, or anything else that could
trigger even a momentary change of the application's current working
directory.

While the risk may generally be remote, it is real, and requiring the
majority of developers to explicitly exclude the current working
directory from the library path because they don't need it is guaranteed
to fail somewhere along the way.  It's better to start secure and allow
those few who need this functionality to tweak their applications to
enable it or find better methods so that they don't need it either.

Could these changes have been implemented in some way that preserved
backward compatibility?  Maybe so, but the backward compatibility would
eventually need to be removed in the name of security anyway.  Would
your application have been able to make use of that even after 3 years? 
Maybe not.

There was quite a bit of angst at the time this change went live years
ago.  You're just a little late to the party.

> We cannot afford this type of downtime or resources to rewrite an app 
> everytime some yahoo Ruby dev thinks he is being clever by fixing a 
> security risk that is probably a result of irrational fear of some 
> extremely remote possibility of something happening.

I can understand your frustration, but remember that if you truly want
help, casting about insults is not going to garner much assistance. 
Please also consider that in this case you may not actually know better
than the Ruby developers on this particular point.

> I have seen enough of Ruby in the week dealing with it and will be 
> making the recommendation to rip it out entirely because of the 
> maintenance headache associated with it and the Ruby core devs who think 
> things like this are a bright idea.

Best of luck finding an application stack that can be ignored for years
and then upgraded without the need to touch any of your own application
code to account for API changes.  I've been where you are now
personally, and I can tell you that your problems can be summarized as:

1) Lack of understanding of the tools you're using (Ruby and its libraries).
2) An application code base that was allowed to bit rot for too long.

If your team no longer has any Ruby expertise, it probably makes sense
to go with something you know instead.  Unfortunately for you, you'll
still likely have to support your application in its current form while
you rewrite it from scratch.  It would be best to accept that and try to
avoid alienating those who may help you through this in the meantime.

-Jeremy

In This Thread