News for hackers. Stuff that matters.

A comment on Static Typing for Ruby: Adopting Sorbet at Scale. Parent comment

Re:Static Typing for Ruby: Adopting Sorbet at Scale by fmakunbound on Friday November 20, 2020 @02:29PM (#25163950)
> hijack a running process and change memory without leaving a trace

Doesn't sound like a Ruby problem.

[ Parent | on HN ]
Re:Static Typing for Ruby: Adopting Sorbet at Scale by Indy9000 on Friday November 20, 2020 @03:40PM (#25164701)
No but, Ruby makes it trivial. No decompilations, no assembly, no debuggers necessary. Drop into an irb in a running process, change stuff and get out in seconds
[ Parent | on HN ]
Re:Static Typing for Ruby: Adopting Sorbet at Scale by viraptor on Friday November 20, 2020 @07:04PM (#25166643)
Compilation is not a security control. Also if you're handling transactions at a significant rate, PCI (with all its problems) makes sure there's a trace.
[ Parent | on HN ]
Re:Static Typing for Ruby: Adopting Sorbet at Scale by vinceguidry on Friday November 20, 2020 @07:16PM (#25166729)
> drop into an irb in a running process

This is a thing?

[ Parent | on HN ]
Re:Static Typing for Ruby: Adopting Sorbet at Scale by zeckalpha on Friday November 20, 2020 @09:00PM (#25167309)
It also is a thing in most other languages, including C, Python, Java, Erlang, ...
[ Parent | on HN ]
Re:Static Typing for Ruby: Adopting Sorbet at Scale by vinceguidry on Saturday November 21, 2020 @02:57PM (#25172334)
I'm not so sure. You can certainly attach a debugger to any running process. But that's not what parent was suggesting. He was saying anyone could attach a REPL. That's a totally different animal.

It's your own dumb fault if you expose the web-console or similar on production.

[ Parent | on HN ]