# I Love The world

**URL:** <https://www.ruby-forum.com/t/i-love-the-world/62181>\
**Category:** Ruby\
**Created:** [June 1, 2006, 8:06am UTC](https://www.ruby-forum.com/t/i-love-the-world/62181 "2006-06-01T08:06:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ruby](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/13edae/32.png) [@ruby](https://www.ruby-forum.com/u/ruby)\
**Post date:** [June 1, 2006, 8:06am UTC](https://www.ruby-forum.com/t/i-love-the-world/62181/1 "2006-06-01T08:06:46Z")

</div>

I work for a fortune 100 company in the telecom space. They are  
absolutely dirtying their shorts over security concerns. They haven’t  
had any major fallout yet, but they figure it’s inevitable. They have  
been flying in experts to tell us all how to write safer C code.

Having witnessed several such 1 to 3 day tirades on how to write safer C  
code, I think I can summate 99% of the issue as:  
“make sure you don’t over-run any buffers”. This is because almost all  
of the “exploits” that don’t involve walking in through an open door  
involve pushing executable code into an over-written buffer.

I’ve been thinking it over, and I can’t for the life of me think of a  
way to over-run a buffer in Ruby.

Is this the same as thinking one is safe from viruses because he’s  
driving a Macintosh, or is Ruby (and any other ducktyped and garbage  
collected, etc. etc. language) automatically much safer by default?

Asking the same question in a different way, does Ruby have any similar  
“Achilles heel” that one has to be careful of to avoid providing the  
hackers out there with “exploits 'aplenty”?

thanks,  
jp

---

<div class="post-metadata">

**Author:** ![ruby](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/13edae/32.png) [@ruby](https://www.ruby-forum.com/u/ruby)\
**Post date:** [June 1, 2006, 10:37am UTC](https://www.ruby-forum.com/t/i-love-the-world/62181/2 "2006-06-01T10:37:14Z")

</div>

On 6/1/06, Ruby [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote (about buffer overflows):

> Asking the same question in a different way, does Ruby  
> have any similar “Achilles heel” that one has to be careful  
> of to avoid providing the hackers out there with “exploits  
> 'aplenty”?

No.

The normal stuff about avoiding injection effects and being careful  
with evaluating external code holds, of course - yet those are common  
in all languages. The only thing is that it might be more tempting to  
evaluate external code in Ruby, since it’s so easy to create small  
Domain Specific Languages.

Eivind.

---

<div class="post-metadata">

**Author:** ![ruby](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/13edae/32.png) [@ruby](https://www.ruby-forum.com/u/ruby)\
**Post date:** [June 1, 2006, 11:54am UTC](https://www.ruby-forum.com/t/i-love-the-world/62181/3 "2006-06-01T11:54:36Z")

</div>

This is called type-safety. The basic idea is you can only operate the  
data with operations specified by the data type. There is no pointer  
type but object reference, which you can’t manipulate as an integer.  
The other basic idea is your code always branches to specified code  
entry point, rather than a random position of a buffer. I think Ruby  
holds true with these properties.

The problem is more than safety, but also security, which is hard to  
control at language level. Ruby has concept of Safe levels and Tainted  
objects to isolate the potential dangers. This would be good enough to  
protect your system. The execution of external code itself doesn’t  
really bring much more risks, as you already did with Applet or Flash  
or Ajax.

Thanks,  
xiaofeng