Live data from Hacker News

Rails 5.0.1 has been released

weblog.rubyonrails.org

31–40 of 57 posts

Re: Rails 5.0.1 has been released

#32
If you're using Rails 5 ActionCable and you're not on Passenger, I would recommend upgrading to this release as soon as possible. Phusion[0] and other Rails 5 users[1] found a slow client issue with its implementation that was not protected against by the default app server Puma.

We contacted the Rails team early on about this issue and worked closely with them to have this issue solved. Now that 5.0.1 is released we are at liberty to disclose details about this security issue.

I've written a blog post[2] on the problem, using OS X network shaping tools and a simple app to demonstrate it. Rails apps running on Passenger were never affected as Passenger implements response buffering for regular requests as well as websockets connections. Note that even popular reverse proxies like Nginx don't perform response buffering for websockets as far as I know, so this is something to be aware of if you're running on other frameworks than Rails as well.

[0] GH merge of patch: https://github.com/rails/rails/pull/26646

[1] GH related issue: https://github.com/rails/rails/issues/26409

[2] Blog post: https://blog.phusion.nl/2016/12/21/actioncable-under-stress-...

Re: Rails 5.0.1 has been released

#35
post #9
post #6

TLDR: Definitely worth upgrading. Approximately hundreds of small bug fixes, across much of Rails. The fixes include some important ones for database types, time comparisons, thread issues, record reloading, etc. IMHO these fixes address dozens of bugs that could cause major puzzlement for a typical Rails developer. Thanks to all the contributors for excellent work on this release.

> IMHO these fixes address dozens of bugs that could cause major puzzlement for a typical Rails developer. That has been the reason I always avoid huge frameworks like RoR. If I was to hit a bug like this, I wouldn't know where to start debugging. How do people deal with obscure bugs in the framework with something like RoR?

   > That has been the reason I always avoid
   > huge frameworks like RoR.
For others it is the reason to use huge frameworks like RoR. Because alternative is to hunt obscure bugs in the framework you built yourself.

Re: Rails 5.0.1 has been released

#36
post #9

Earlier quoted context omitted.

> IMHO these fixes address dozens of bugs that could cause major puzzlement for a typical Rails developer. That has been the reason I always avoid huge frameworks like RoR. If I was to hit a bug like this, I wouldn't know where to start debugging. How do people deal with obscure bugs in the framework with something like RoR?

You start by boiling it down to an executable test case, for which there are templates here here: http://guides.rubyonrails.org/contributing_to_ruby_on_rails.... Then you share the test case in a bug report, and collaborate to fix it. Fixing it usually involves a source code dive. With Rails's reasonably well documented and reasonably well written codebase it's usually possible to grok the source and dependencies eve…

Interesting, my experience is the opposite: liberal use of ruby's dirty tricks often makes code hard to understand and thus debug.

Re: Rails 5.0.1 has been released

#37

Slightly off-topic: is learning Rails still a good career choice? I'm not particularly keen on JavaScript on the server and I think I am slightly tired using .NET on a daily basis.

Where I'm from (Toronto, Canada), Rails development pays significantly more than any other stack and there is substantially more work available.

Re: Rails 5.0.1 has been released

#40
post #36

Earlier quoted context omitted.

You start by boiling it down to an executable test case, for which there are templates here here: http://guides.rubyonrails.org/contributing_to_ruby_on_rails.... Then you share the test case in a bug report, and collaborate to fix it. Fixing it usually involves a source code dive. With Rails's reasonably well documented and reasonably well written codebase it's usually possible to grok the source and dependencies eve…

Interesting, my experience is the opposite: liberal use of ruby's dirty tricks often makes code hard to understand and thus debug.

That's a separate statement, and they are not contradictory.

Using Ruby's dirty tricks on shipped code -> hard for debugging/understanding. Using Ruby's dirty tricks while debugging -> boon.

The grandparent didn't claim the former to be false, only the later to be true.

Post reply on HN