Re:Yes We Can. Ruby "require" over HTTP, That Is.
by jrockway on Tuesday May 12, 2009 @02:49PM
(#605948)
The underlying assumption is that when you load "http://example.com/foo.rb ", you are example.com. Thus, it is not really a security problem, unless of course your data center is already compromised.
[Edit: I noticed a bug. The " at the end of the URL is eaten (won't even show up in the edit box after submitting) unless there is a space there. Oops.]
Re:Yes We Can. Ruby "require" over HTTP, That Is.
by lanaer on Tuesday May 12, 2009 @02:52PM
(#605957)
This increases the amount of harm a man-in-the-middle attack can do, also (though only if the attacker is after you, specifically, or at least people who blindly require & execute ruby code).
[Edit: I noticed a bug. The " at the end of the URL is eaten (won't even show up in the edit box after submitting) unless there is a space there. Oops.]