On Sun, Jun 12, 2011 at 5:07 AM, Intransition <transfire / gmail.com> wrote:
>
> It restricts where the file 'ostruct' can be found. In this case to
> ruby's standard library.

See below.

>> Please. Then I just define a package, put that someplace first in the
>> loadpath, and *boom*, your system blowing up in your face again.
>
> That's not how it works. You can't put something first in the load
> path. Rather than a simple list of paths, such a system uses a table
> of  ¨Β §παγληξανε½Ύ §πατθ―το―παγλαηεύ® Αγτυαμμω ιτ§σ μιττμε νοςε
> complicated than that b/c of versions and internal require_paths
> settings but that's the basic idea.

Since you need to check for a package in different places (user
specific and global *at the very least*), you have a load path of some
sort. As long as my package comes first, your system can be broken,
subverted, by my package.

> I think we are talking about two different things. I'm only talking
> about preventing the wrong file from being loaded. Not anything to do
> with what's in a file.

Of course it has to do with what is *in* the file. If you execute a
file that arbitrarily loads code (like a Ruby file, for example, since
the file's contents get executed on load time already), your system
can be subverted. So, you do a lot of work to prevent something that
you *cannot* prevent to begin with. Not without changing how operating
systems work these days (i.e. instead of executing everything that's
not blacklisted, only that which is whitelisted gets executed).

-- 
Phillip Gawlowski

A method of solution is perfect if we can forsee from the start,
and even prove, that following that method we shall attain our aim.
- Leibnitz