Jeremy Kemper wrote:

> On Nov 10, 2005, at 2:36 PM, why the lucky stiff wrote:
>
>> My questions are three:
>> 1. Are removed constants and methods available elsewhere in the  
>> interpreter?
>> 2. Could this be distilled into a general practice, as standard as  
>> $SAFE?
>> 3. In general, what am I overlooking?
>
>
> I wonder whether I could craft foo such that Marshal.load(foo)  
> recovers, say, File or ObjectSpace for me?

 >> Marshal.load("\004\010m\020ObjectSpace")                                      

ArgumentError: undefined class/module ObjectSpace                               
 from (irb):6:in `load'                                                         
 from (irb):6                                                                   
 from (null):0

I'm sure we're looking for something more obscure here.  More like: can 
a handle to io_read() or rb_io_s_read() be referenced from a dump?

Yeah, I'd like to keep Marshal.

_why