
Security News
Follow-up and Clarification on Recent Malicious Ruby Gems Campaign
A clarification on our recent research investigating 60 malicious Ruby gems.
h1. rspec-profiler
Currently tested only for rspec-2.11
The rspec-profiler is a custom formatter that adds functionality to the existing --profile option in rspec. The rspec-profiler first groups tests together by their folder under the spec directory (models, lib, controllers, etc...). Then the standard deviation is calculated. Any test within a group that is 2 or more standard deviations away from the mean is listed.
There are downsides of course to doing it this way. For example, with a mean of .02 seconds and a standard deviation of .01 seconds, a test that takes .04 seconds will be listed when perhaps one wouldn't think a test that takes 0.04 seconds to complete to be in need of attention. I will simply advise, as with any benchmark, to not take the results too seriously. Rather, you should use the results as a way to identify tests that may need to be looked at for performance issues. And, as always, running the benchmark multiple times will give you a better sense of the tests that are consistantly slow. A test may be benchmarked noticably slower in one trial due any number of reasons but run faster in the next.
h2. Installation
Put the profiler in your @Gemfile@
When running your specs use:
bc. $ rspec --format Profiler -p spec
If for some reason rspec cannot find the Profiler, you case use the @-r@ option and provide the PATH to @profiler.rb@.
Alternatively, you can make the Profiler formatter your default formatter by modifying your @.rspec@ file (the Profiler inherits from the Progress formatter, you know, the one that uses the green dots):
bc. --format Profiler
Note: The performance profile will not display unless you specify the @-p@ option when running rspec. Additionally, when tests fail, the profile will not display which is consistant with how the bundled profiler works as well.
If you use Timecop: If you use the timecop gem to freeze or change time be sure to also return the time after each of your tests. Not doing so will make it appear as if your tests are taking either far too long or have taken negative time to complete.
FAQs
Unknown package
We found that rspec-profiler demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.
Security News
ESLint now supports parallel linting with a new --concurrency flag, delivering major speed gains and closing a 10-year-old feature request.
Research
/Security News
A malicious Go module posing as an SSH brute forcer exfiltrates stolen credentials to a Telegram bot controlled by a Russian-speaking threat actor.