<html><body><div style="color:#000; background-color:#fff; font-family:verdana, helvetica, sans-serif;font-size:10pt"><div><span>Forgive me if I'm questioning something that is widely accepted by anyone with any knowledge of security, but why does having the compiler toolchain installed create security problems? <br></span></div><div><span><br></span></div><div><span>I can see the obvious answer - if some miscreant gains access to your server then they can build themselves sharper sticks to poke at other servers in your network. But is it true that without build tools the attack would be much less effective? My probably naive assumption is that they can probably trash that compromised server without build tools, and if they've got through your DMZ you're in real trouble, compilers or not.<br></span></div><div><br><span></span></div><div><span>So are there good security reasons - theoretical or born out of studies of exploits in the wild
for not having a compiler around?</span></div><div><br><span></span></div><div><span>Thanks,</span></div><div><br><span></span></div><div><span>David<br></span></div><div><br><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; padding-left: 5px;"><div style="font-family: verdana, helvetica, sans-serif; font-size: 10pt;"><div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"><font size="2" face="Arial"><hr size="1"><b><span style="font-weight:bold;">From:</span></b> Daniel Lucraft <dan.lucraft@gmail.com><br><b><span style="font-weight: bold;">To:</span></b> London Ruby Users Group <chat@lists.lrug.org><br><b><span style="font-weight: bold;">Sent:</span></b> Thursday, 20 October 2011, 14:38<br><b><span style="font-weight: bold;">Subject:</span></b> [LRUG] Compiling native extensions during deployment?<br></font><br><div id="yiv1493389140">
<div>
Hi all,
</div><div><br></div><div>question about the current Ruby Way. We're moving to Bundler, and it seems the thing to do is to run "bundle install --deployment" when deploying, which will install the gems from vendor/cache into vendor/bundle.</div><div><br></div><div>Fine. Except what do we do with native extensions? We're not wild about having the compiler toolchain installed on all our appservers, partly for security reasons.</div><div><br></div><div>Is there something obvious we're missing about how to deploy native extensions with bundler?</div><div><br></div><div>thanks</div><div>Dan</div><div><br></div><div><br></div><div><div>__________________________</div><div>Daniel Lucraft</div><div><br></div><div>danlucraft.com/blog</div><div>twitter.com/danlucraft</div></div><div><br></div>
<div></div>
</div><br>_______________________________________________<br>Chat mailing list<br><a ymailto="mailto:Chat@lists.lrug.org" href="mailto:Chat@lists.lrug.org">Chat@lists.lrug.org</a><br><a href="http://lists.lrug.org/listinfo.cgi/chat-lrug.org" target="_blank">http://lists.lrug.org/listinfo.cgi/chat-lrug.org</a><br><br><br></div></div></blockquote></div></div></body></html>