Ruby app phoning home

General discussions about Little Snitch
Post Reply
DrTheopolis

Ruby app phoning home

Post by DrTheopolis » Wed Jul 18, 2007 1:34 am

I have no idea what the "Ruby" app is that's being intercepted by Little Snitch. Spotlight search is not revealing any hits. How the heck do I find out what it is?

Thanks in advance,
Doc.

Dave Bourke
Rank 1
Rank 1
Posts: 38
Joined: Fri Nov 17, 2006 7:32 pm
Location: Ireland

Post by Dave Bourke » Wed Jul 18, 2007 9:41 pm

It's a program on your Mac. Spotlight won't find it because there's lots of stuff in OS X that Apple don't want us ordinary computer users to mess with. Only people who know what they're doing. So Spotlight is programmed not to look in certain areas of your drive. If you want a real search application download the free EasyFind:

http://www.devon-technologies.com/produ ... index.html

Ruby is in /usr/bin/ and here's the intro from the manual:

"Ruby is an interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible.

"If you want a language for easy object-oriented programming, or you don't like the Perl ugliness, or you do like the concept of LISP, but don't like too much parentheses, Ruby may be the language of your choice."

I have no idea why it might be phoning home, though...

Kind regards.

FredB
Rank 2
Rank 2
Posts: 69
Joined: Sun Dec 31, 2006 8:19 am
Location: Liège, Belgium
Contact:

Post by FredB » Thu Jul 19, 2007 5:13 am

One thing is sure, the ruby language is not phoning home by itself. :)

Processes spawned by script/programs written in ruby are named "ruby", and it's one of them that is "phoning home". This could be anything, maybe an app you're using that uses some ruby script to do something. (Note that they are other reasons for accessing the network than "phoning home". Posting the exact LS message here could help. )

Open Activity Monitor, look for a process named ruby, double clic on it and select the "Open Files and Ports" tab, that can give you a clue as to where it comes from. Paste the list here if you're not sure.

You probably need to wait for the LS dialog to pop up before this process appears, so, when it happens, leave the dialog open and look for "ruby" in Activity Monitor, etc

--
FredB

Guest

Post by Guest » Fri Jul 20, 2007 2:17 pm

I have also been getting one of these. I did what you said and tracked it down to the TVShows application.

/Users/matt
/usr/bin/ruby
/usr/lib/ruby/1.8/powerpc-darwin8.0/stringio.bundle
/usr/lib/ruby/1.8/powerpc-darwin8.0/socket.bundle
/usr/lib/ruby/1.8/powerpc-darwin8.0/nkf.bundle
/usr/lib/dyld
/usr/lib/libSystem.B.dylib
/usr/lib/libobjc.A.dylib
/dev/null
/dev/console
/Users/matt/Library/Application Support/TVShows/TVShows.log
obj=0x03f2a1a0
obj=0x03f2a1a0


I just "deny forever" the request.

Guest

Post by Guest » Mon Sep 03, 2007 7:01 pm

unless you don't want TVShows to work, you probably shouldn't block this request ;-).

TVShows consists of various ruby scripts, which are used to retrieve RSS from tvrss.net. If you forbid ruby to connect to this site, you will never have new episodes of your scheduled series, donwloaded.

cheers

Post Reply