Show HN: Rubystub.com Run/Save Ruby Online

Post by alfiedotwtf » Fri, Dec 12, 2014, 3:33 PM UTC

  system("ls -l /");

Post by alfiedotwtf » Fri, Dec 12, 2014, 3:36 PM UTC

thejew wrote: post #3

alfiedotwtf wrote: post #2

I would take this offline right away: system("ls -l /");

You can safely use that as the Ruby is run in a limited contained env. Feel free to run `rm -rf` too

  system("ping -c 2 8.8.8.8");

  PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
  64 bytes from 8.8.8.8: icmp_req=1 ttl=55 time=1.98 ms
  64 bytes from 8.8.8.8: icmp_req=2 ttl=55 time=1.75 ms

Post by vidarh » Fri, Dec 12, 2014, 3:52 PM UTC

alfiedotwtf wrote: post #4

thejew wrote: post #3

Earlier quoted context omitted.

You can safely use that as the Ruby is run in a limited contained env. Feel free to run `rm -rf` too

I don't think you're going to be happy when somebody uses you to launch a DDOS: system("ping -c 2 8.8.8.8"); PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_req=1 ttl=55 time=1.98 ms 64 bytes from 8.8.8.8: icmp_req=2 ttl=55 time=1.75 ms

Post by thejew » Fri, Dec 12, 2014, 4:33 PM UTC

alfiedotwtf wrote: post #7

vidarh wrote: post #6

Earlier quoted context omitted.

Unless he's running this in an incredibly powerful machine on an incredible well connected network, nobody will be DOS'ing anyone worse from that machine than they could do by spinning up a single VM somewhere.

When it comes to netsec, any hole's a goal. And as rikkus pointed out, there's no timeout on runs too. This is just asking for trouble.