In the talk titled "Sandboxing Ruby: The Good, the Bad, and the Fugly," Eric Allam explores the challenges and techniques associated with securely running untrusted Ruby code. He reflects on his experiences over the past year related to sandboxing and shares insights on various methods attempted and their vulnerabilities.

Key Points:

• Understanding Sandboxing: The primary goal of sandboxing is to execute untrusted code without compromising the security of the host environment. It involves protecting against namespace pollution, blocking dangerous operations, limiting resource utilization, and safeguarding sensitive information.

• Initial Challenges: Allam recounts the problematic experience of hosting a tutorial session where users could submit Ruby code online. Poor safeguards led to servers being overwhelmed by malicious submissions, prompting a need for more robust sandboxing methods.

• Existing Methods: Several techniques were discussed:

  • $SAFE Levels: Utilization of Ruby's built-in security features like $SAFE levels which restrict code execution.
  • RubyCop: A semantic analysis tool aimed at analyzing code submissions for safety without executing them.

• Breaking Sandboxes: Allam sets up a live demo where participants are encouraged to attempt breaking the outlined sandbox methods, highlighting the importance of understanding vulnerabilities in sandboxing.

• J Ruby Sandbox: The use of JRuby was introduced as a more effective means for sandboxing due to its ability to isolate namespaces and block dangerous operations more effectively than previous approaches. This method leverages features in JRuby to create a safer execution environment for untrusted code.

• Performance and Limitations: The talk addresses real-world application performance with over 1.3 million code submissions leveraging these sandboxing techniques and details on how current approaches still leave room for improvements and potential exploits.

Conclusions:

Allam emphasizes the ongoing need for enhancing Ruby's sandboxing capabilities and invites the audience to participate in the development of better solutions. In conclusion, he expresses that achieving a balance between security and usability in sandboxing Ruby is a continuous challenge requiring collaborative efforts within the community. The presentation wraps by encouraging the audience to try the sandbox themselves while reflecting on their innovations in Ruby
learning tools.