Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ruby 2.6

anamaria.martinezgomez.name

Post reply on HN
Print view View original

21–30 of 164 posts

Re: Ruby 2.6

#21

Post by ascar »

mmahemoff wrote: post #13

> Constant names can now start with non-ASCII capital letters. I am not sure how useful this is Very? If you want to code in non-Latin languages. Also, π = 3.14159

I'm not sure about this being good for coding in non-latin. It might actually encourage behavior to mistreat ruby constants as regular variables. IIRC constants are not really constant, but only visual help for reading code and ruby just issues a warning on reassignment and these warnings are not shown by default.

I can totally imagine new devs just trying out non-ascii variables, see it not crashing and then actually writing all their code using constants.

Re: Ruby 2.6

#22

Post by pawelmurias »

tedunangst wrote: post #14
rurban wrote: post #12

> non-ASCII constant names This is actually a security risk, avoiding all Unicode security recommendations. See e.g. http://websec.github.io/unicode-security-guide/visual-spoofi... All they did was open the floodgates: https://github.com/ruby/ruby/commit/f852af0e59899157ef695edc... no rtl checks, no spoofing, no mixed script checks, no normalization.

How is it it a security risk to name a constant in source code?

it can be used to create malicious pull requests that are visually indistinguishable from correct ones

Re: Ruby 2.6

#23

Post by xiphias2 »

tedunangst wrote: post #14
rurban wrote: post #12

> non-ASCII constant names This is actually a security risk, avoiding all Unicode security recommendations. See e.g. http://websec.github.io/unicode-security-guide/visual-spoofi... All they did was open the floodgates: https://github.com/ruby/ruby/commit/f852af0e59899157ef695edc... no rtl checks, no spoofing, no mixed script checks, no normalization.

How is it it a security risk to name a constant in source code?

In Ruby it can easily be used to submit malicious source code to a repository (for example the reviewers thinking that a variable is set to some value, when in fact a new variable is created).

Re: Ruby 2.6

#24

Post by akulbe »

I was trying to go download the latest Ruby or even read the latest release notes, but the site seems to be down. It's still ruby-lang.org, right?

Re: Ruby 2.6

#25

Post by ascar »

alfredmuffin wrote: post #2

Is it a good time to learn Ruby? I mostly do React and Node + Java work professionally, but I've been looking into Ruby as a fun side project language. I would appreciate any anecdotes!

Ruby is awesome for prototyping. It's just incredibly fast to work with, because the language makes an effort to provide as much help as possible and adding as little obstacles as necessary. E.g. you can even add/change functions to/of Object, even during runtime, if you think it helps. Rails adds `blank?` like that, which is a helper for `nil? || empty?`.

Re: Ruby 2.6

#26

Post by augustl »

Really like the idea of using lazy ranges instead of magic negative indices! I.e `xs[6..]` instead of `xs[6..-1]`.

Re: Ruby 2.6

#27

Post by dragonwriter »

pawelmurias wrote: post #22
tedunangst wrote: post #14

Earlier quoted context omitted.

How is it it a security risk to name a constant in source code?

it can be used to create malicious pull requests that are visually indistinguishable from correct ones

> it can be used to create malicious pull requests that are visually indistinguishable from correct ones

If your only check on the correctness of submitted code is visual inspection, you've got a much bigger problem than Unicode confusability.

Re: Ruby 2.6

#28

Post by akulbe »

akulbe wrote: post #24

I was trying to go download the latest Ruby or even read the latest release notes, but the site seems to be down. It's still ruby-lang.org, right?

Weird. I googled "ruby 2.6 download" and links from the results worked, but simply trying to browse to "ruby-lang.org" times out.

Re: Ruby 2.6

#29

Post by maxfurman »

I am always happy to unwrap my Christmas present from the Ruby team! Some questions about this release:

- Are there any benchmarks for the new JIT?

- Why was `(Date.today..(Date.today + 1)) === DateTime.now #=> true` false in Ruby 2.5? It seems correct that right now is between today and tomorrow. Is it because one is a Date and the other a DateTime?

Re: Ruby 2.6

#30

Post by matt4077 »

ascar wrote: post #21
mmahemoff wrote: post #13

> Constant names can now start with non-ASCII capital letters. I am not sure how useful this is Very? If you want to code in non-Latin languages. Also, π = 3.14159

I'm not sure about this being good for coding in non-latin. It might actually encourage behavior to mistreat ruby constants as regular variables. IIRC constants are not really constant, but only visual help for reading code and ruby just issues a warning on reassignment and these warnings are not shown by default. I can totally imagine new devs just trying out non-ascii variables, see it not crashing and then actuall…

I don't quite understand how this change makes the (somewhat remote) misunderstanding you describe any more likely than it previously was for people using ASCII only.

I also just tried and was duly warned upon reassignment, a setting I don't remember changing.

Post reply on HN