Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ruby 1.9.3-p385 is released

ruby-lang.org

Post reply on HN
Print view View original

1–8 of 8 posts

Re: Ruby 1.9.3-p385 is released

#2

Post by aaronblohowiak » 

    echo "--no-ri --no-rdoc" >> ~/.gemrc
install every gem much faster, avoid rdoc vulnerabilities. Since gem installation can run arbitrary code, I am suspicious of rdoc xss vulnerabilities being a cause for concern (if you are not running a publicly-accessible gem documentation site...)

Re: Ruby 1.9.3-p385 is released

#3

Post by why-el »

aaronblohowiak wrote: post #2

echo "--no-ri --no-rdoc" >> ~/.gemrc install every gem much faster, avoid rdoc vulnerabilities. Since gem installation can run arbitrary code, I am suspicious of rdoc xss vulnerabilities being a cause for concern (if you are not running a publicly-accessible gem documentation site...)

This will run these options for every gem command though. Better restrict it to install and update.

Re: Ruby 1.9.3-p385 is released

#4

Post by kawsper »

why-el wrote: post #3
aaronblohowiak wrote: post #2

echo "--no-ri --no-rdoc" >> ~/.gemrc install every gem much faster, avoid rdoc vulnerabilities. Since gem installation can run arbitrary code, I am suspicious of rdoc xss vulnerabilities being a cause for concern (if you are not running a publicly-accessible gem documentation site...)

This will run these options for every gem command though. Better restrict it to install and update.

Is it a problem that this gets passed to every gem command?

Re: Ruby 1.9.3-p385 is released

#5

Post by scraplab »

why-el wrote: post #3
aaronblohowiak wrote: post #2

echo "--no-ri --no-rdoc" >> ~/.gemrc install every gem much faster, avoid rdoc vulnerabilities. Since gem installation can run arbitrary code, I am suspicious of rdoc xss vulnerabilities being a cause for concern (if you are not running a publicly-accessible gem documentation site...)

This will run these options for every gem command though. Better restrict it to install and update.

Like so:

    install: --no-rdoc --no-ri 
    update:  --no-rdoc --no-ri

Re: Ruby 1.9.3-p385 is released

#6

Post by why-el »

kawsper wrote: post #4
why-el wrote: post #3

Earlier quoted context omitted.

This will run these options for every gem command though. Better restrict it to install and update.

Is it a problem that this gets passed to every gem command?

Yes because it does not make sense to pass it to some commands. For instance, what would `gem list --no-rdoc --local` mean? You will get a lot of invalid option errors.

Re: Ruby 1.9.3-p385 is released

#7

Post by regularfry »

scraplab wrote: post #5
why-el wrote: post #3

Earlier quoted context omitted.

This will run these options for every gem command though. Better restrict it to install and update.

Like so: install: --no-rdoc --no-ri update: --no-rdoc --no-ri

Also add --env-shebang so that you don't get stupid shebang lines which lock you to a specific interpreter.

Re: Ruby 1.9.3-p385 is released

#8

Post by lobster_johnson »

aaronblohowiak wrote: post #2

echo "--no-ri --no-rdoc" >> ~/.gemrc install every gem much faster, avoid rdoc vulnerabilities. Since gem installation can run arbitrary code, I am suspicious of rdoc xss vulnerabilities being a cause for concern (if you are not running a publicly-accessible gem documentation site...)

The .gemrc file is YAML [1], does that even work without "gem:" in front? Mine looks like this:

    gem: --no-rdoc --no-ri --both
    verbose: true
    update_sources: true
    sources:
    - http://rubygems.org/
    backtrace: false
    bulk_threshold: 1000
    benchmark: false
[1] http://docs.rubygems.org/read/chapter/11
Post reply on HN