Live data from Hacker News

Ruby Fiddle: Ruby Snippets in the Browser

rubyfiddle.com

11–20 of 24 posts

Re: Ruby Fiddle: Ruby Snippets in the Browser

#11

This is great, a really nice way of sharing snippets. It's not the prettiest site, and it's a shame the Gistify button tries to load a popup (Which Chrome blocked), but the idea is really useful. And integrating with Github can only be a plus (Wouldn't mind seeing even deeper integration, user accounts or listing forks etc.)

I've thought about having user accounts on RubyFiddle. But don't we already have too many accounts all over the place? (coming at some point, maybe with github login)

Re: Ruby Fiddle: Ruby Snippets in the Browser

#13
post #8

Is there any security mechanism, which not allow execute external commands (for example `rm -Rf *`)?

Heroku provides a read-only file system on their Bamboo stack, and a "scratch-pad" file system on their Cedar stack where changes are thrown away after the web request finishes.

Re: Ruby Fiddle: Ruby Snippets in the Browser

#14
post #13
post #8

Is there any security mechanism, which not allow execute external commands (for example `rm -Rf *`)?

Heroku provides a read-only file system on their Bamboo stack, and a "scratch-pad" file system on their Cedar stack where changes are thrown away after the web request finishes.

Thanks, I didn't know that.

Re: Ruby Fiddle: Ruby Snippets in the Browser

#19
post #8

Is there any security mechanism, which not allow execute external commands (for example `rm -Rf *`)?

exec('sudo cat /etc/shadow') => RestrictedCodeException System Calls disabled

Also, while File.read('/etc/passwd') works, at least File.read('/etc/shadow') doesn't.

Re: Ruby Fiddle: Ruby Snippets in the Browser

#20
post #9

With the source code open it wouldn't be too hard to exploit this to do just about anything. Sure you could the same with a free Heroku instance but this lets you do it anonomously. Not that I would do such things but when I see these kinds of apps I wonder how they could be made more secure.

Code School open sourced their ruby sandboxing. Might be worth a look. https://github.com/envylabs/RubyCop
Post reply on HN