Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ruby 2.6

anamaria.martinezgomez.name

Post reply on HN
Print view View original

11–20 of 164 posts

Re: Ruby 2.6

#11

Post by xiphias2 »

faitswulff wrote: post #8
xiphias2 wrote: post #5

Earlier quoted context omitted.

For me it is too much fun. I love that I can use most of the standard library without thinking / looking at the documentation, and not needing to wait for compilation. But at the same time I hate that I love a language that performs so bad compared to being closer to the metal.

What use cases do you have that are more performant in other languages?

Right now I'm working on financial time series modelling. I can't use numerical arrays because the model is not parallelizable. Also R / Mathematica are not good for these kind of stuff.

I'm thinking of trying out Julia, as it's dynamic but still has a lot of interesting libraries, but for now I just decided with working with small data, so actually I don't have performance problems.

Re: Ruby 2.6

#12

Post by rurban »

> non-ASCII constant names

This is actually a security risk, avoiding all Unicode security recommendations. See e.g. http://websec.github.io/unicode-security-guide/visual-spoofi...

All they did was open the floodgates: https://github.com/ruby/ruby/commit/f852af0e59899157ef695edc...

no rtl checks, no spoofing, no mixed script checks, no normalization.

Re: Ruby 2.6

#13

Post by mmahemoff »

> Constant names can now start with non-ASCII capital letters. I am not sure how useful this is

Very? If you want to code in non-Latin languages.

Also, π = 3.14159

Re: Ruby 2.6

#14

Post by tedunangst »

rurban wrote: post #12

> non-ASCII constant names This is actually a security risk, avoiding all Unicode security recommendations. See e.g. http://websec.github.io/unicode-security-guide/visual-spoofi... All they did was open the floodgates: https://github.com/ruby/ruby/commit/f852af0e59899157ef695edc... no rtl checks, no spoofing, no mixed script checks, no normalization.

How is it it a security risk to name a constant in source code?

Re: Ruby 2.6

#15

Post by backenddev »

rurban wrote: post #12

> non-ASCII constant names This is actually a security risk, avoiding all Unicode security recommendations. See e.g. http://websec.github.io/unicode-security-guide/visual-spoofi... All they did was open the floodgates: https://github.com/ruby/ruby/commit/f852af0e59899157ef695edc... no rtl checks, no spoofing, no mixed script checks, no normalization.

I fail to see how so, especially since variable names could contain non-ascii symbols even before that.

Re: Ruby 2.6

#16

Post by 33degrees »

rurban wrote: post #12

> non-ASCII constant names This is actually a security risk, avoiding all Unicode security recommendations. See e.g. http://websec.github.io/unicode-security-guide/visual-spoofi... All they did was open the floodgates: https://github.com/ruby/ruby/commit/f852af0e59899157ef695edc... no rtl checks, no spoofing, no mixed script checks, no normalization.

For URLs sure. I can’t see the problem for internal constants...

Re: Ruby 2.6

#17

Post by dr_zoidberg »

tedunangst wrote: post #14
rurban wrote: post #12

> non-ASCII constant names This is actually a security risk, avoiding all Unicode security recommendations. See e.g. http://websec.github.io/unicode-security-guide/visual-spoofi... All they did was open the floodgates: https://github.com/ruby/ruby/commit/f852af0e59899157ef695edc... no rtl checks, no spoofing, no mixed script checks, no normalization.

How is it it a security risk to name a constant in source code?

He linked a resource that explains visual spoofing, an "attack technique" in which an attacker registers a domain that renders exaclty the same as yours, but actually isn't (because it uses unicode points which render the same --or very similar-- to latin alphabet letters).

I woulnd't go as far as saying "it's a security risk", but on some situations it may lead to weird bugs in which you think you're referring to one constant/variable and you're actually referring to another (visually equivalent/the same) const/var.

Re: Ruby 2.6

#18

Post by ascar »

rurban wrote: post #12

> non-ASCII constant names This is actually a security risk, avoiding all Unicode security recommendations. See e.g. http://websec.github.io/unicode-security-guide/visual-spoofi... All they did was open the floodgates: https://github.com/ruby/ruby/commit/f852af0e59899157ef695edc... no rtl checks, no spoofing, no mixed script checks, no normalization.

I only skimmed over the linked resource, but non of the mentioned attack vectors and issues seem to be a problem for variable names in source code?

Re: Ruby 2.6

#19

Post by xiphias2 »

rakoo wrote: post #6
xiphias2 wrote: post #5

Earlier quoted context omitted.

For me it is too much fun. I love that I can use most of the standard library without thinking / looking at the documentation, and not needing to wait for compilation. But at the same time I hate that I love a language that performs so bad compared to being closer to the metal.

Have you looked at crystal ( https://crystal-lang.org/ ) ? Very ruby-like, but has additional safeties and compiles to native.

It looks fun, but as I'm doing financial modelling right now, Julia may be a better fit for me, as it has very nice libraries as well.

Re: Ruby 2.6

#20

Post by Gravityloss »

jb3689 wrote: post #7
alfredmuffin wrote: post #2

Is it a good time to learn Ruby? I mostly do React and Node + Java work professionally, but I've been looking into Ruby as a fun side project language. I would appreciate any anecdotes!

Ruby isn't perfect but it's a great utility language and can do a lot of powerful things with very little effort. Read through Eloquent Ruby The only problems I wouldn't go to Ruby for are CPU intensive ones or ones where I need parallel threads (which you already have Java for)

You can also use JRuby. Powerful and can be very easy to the user.
Post reply on HN