Live data from Hacker News

Installing Rails on a Mac Shouldn't Be As Hard As It Is

cabforward.com

51–60 of 100 posts

Re: Installing Rails on a Mac Shouldn't Be As Hard As It Is

#53
post #23

Earlier quoted context omitted.

Too often you see advice like that. And this is supposed to be from technical users who know about security. And we wonder why mundanes click on spyware scams…

How is it any different from downloading any other code and running it? Are you saying you audit every piece of unsigned code you run? I admit that putting bit.ly into the chain of trust is quite a bold step, but is it really that different to, say, the rubygems server? Or your wireless router? EDIT: also, LOL at "mundanes."

You can check checksums. You can use a package manager which has been gpg signed and reviewed by people smarter than you. You could download it over https.

You're downloading and running in one go. If someone puts a badfile up for 1 minute, then restore it to normal, and you get hosed, it's pretty hard to check that, because the download link looks fine now. You cannot try to figure out what happened or who did it to try to track down the culprit.

Re: Installing Rails on a Mac Shouldn't Be As Hard As It Is

#54
post #42

Earlier quoted context omitted.

How is it any different from downloading any other code and running it? Are you saying you audit every piece of unsigned code you run? I admit that putting bit.ly into the chain of trust is quite a bold step, but is it really that different to, say, the rubygems server? Or your wireless router? EDIT: also, LOL at "mundanes."

Imagine Bit.ly gets backdoored, and that shortlink is repointed at a script that just contains rm -rf /

Or even better, the Lybian goverment siezes it.

Re: Installing Rails on a Mac Shouldn't Be As Hard As It Is

#55

Far too high a proportion of the questions in #ruby are about installation. Often people come in having (naturally) tried to install it from their distro's package manager. First we have to explain to them why this is a bad idea and persuade them to remove it. Then, often they have tried to install it from source, passing some fucked up value to --prefix, and they have to be helped to clean that mess up. Then we tell…

I use and love Ruby every day, but this package management business is ... irksome. First the Ruby guys crapped all over package management from Debian, who, despite their shortcomings, have been doing it a while and know a thing or two about it. That wasn't entirely unfounded, because there were some messy things there, and the intersection of two different package management systems is bound to be a bit confused.

Now we have rvm's and gemsets and bundles and additionally people trying to foist off alternatives to some of these, and the whole thing is beginning to look like an unholy mess.

Meanwhile, Debian/Ubuntu's package management continues to work pretty well at what it does.

Re: Installing Rails on a Mac Shouldn't Be As Hard As It Is

#57
post #53

Earlier quoted context omitted.

How is it any different from downloading any other code and running it? Are you saying you audit every piece of unsigned code you run? I admit that putting bit.ly into the chain of trust is quite a bold step, but is it really that different to, say, the rubygems server? Or your wireless router? EDIT: also, LOL at "mundanes."

You can check checksums. You can use a package manager which has been gpg signed and reviewed by people smarter than you. You could download it over https. You're downloading and running in one go. If someone puts a badfile up for 1 minute, then restore it to normal, and you get hosed, it's pretty hard to check that, because the download link looks fine now. You cannot try to figure out what happened or who did it to…

Checksums are only for transmission errors. If someone can change the code, they can change the checksum.

Indeed, using signed code is massively preferable, and it is increasingly common.

I was about to write that you can't operate running only signed code, but if you consider git hashes a form of signing then I suppose you largely can these days. However, running unsigned code is still so common that I don't think you can really single out people who pipe curl into sh.

Re: Installing Rails on a Mac Shouldn't Be As Hard As It Is

#58
The author points to my article: http://railsapps.github.com/installing-rails.html

I titled my article "Read This Before Installing Rails" because Rails is not just a Ruby gem, it is a complex and rapidly evolving ecosystem. Sure, if you want to see Rails running on your Mac you can use the installed system Ruby 1.8.7 and "gem install rails". But if you want to do development, you'll need to update (and keep updated) all the related gems and packages that are an essential part of the Rails habitat. Judging from the comments and help requests I see, that's not easy.

Packages such as RailsInstaller, Cinderella or the BitNami RubyStack are great but they inevitably slip further and further behind the evolving state of the Rails ecosystem. I'm hoping the design of Yehuda Katz's Tokaido will avoid this issue. In the meantime, yes, it's difficult to install (and keep current) a useful and fully functioning Rails development environment on a Mac (or any other machine!). I say that from the experience of attempting to keep my "Installing Rails" article current.

For example, would you like to develop using Ruby 1.9.3 (the current recommended version) and deploy to Heroku (which now supports Ruby 1.9.3)? You'll need to update to the unreleased 1.2.0.pre.1 bundler (which requires a "gem uninstall" not a "gem update"). That's true today. Maybe it'll change tomorrow.

A rapidly evolving ecosystem is not a bad thing. Rails is a powerful, widely used, and well-supported development platform. The constant changes bring increased utility. If you can keep up and find the right advice. The author's article is sound and offers some of that good advice.

Re: Installing Rails on a Mac Shouldn't Be As Hard As It Is

#59
post #27

Earlier quoted context omitted.

It might not be, but our Rails heads sure do like talking about PHP a lot. If a technology is truly supposed to be accessible it needs to actually, be accessible instead of carrying an air of superiority, otherwise software continues to suffer.

Rails isn't supposed to be accessible the way PHP is, i.e. built into every shared hosting account with unlimited flexibility as to what you can do with it. If that was the right way to go for web applications, there would have been no need for Rails in the first place, since PHP would have been sufficient.

I'm not sure where it was said PHP is only shared hosting. Besides, many places start on shared hosting, kind of like Heroku for rails code, no?

I'm also not sure where the idea is coming from that Rails shouldn't be accessible to developers. If you have some wider posts or links I'd love to read some more.

Re: Installing Rails on a Mac Shouldn't Be As Hard As It Is

#60
post #42

Earlier quoted context omitted.

How is it any different from downloading any other code and running it? Are you saying you audit every piece of unsigned code you run? I admit that putting bit.ly into the chain of trust is quite a bold step, but is it really that different to, say, the rubygems server? Or your wireless router? EDIT: also, LOL at "mundanes."

Imagine Bit.ly gets backdoored, and that shortlink is repointed at a script that just contains rm -rf /

Libya has traditionally been known as an incredibly corrupt regime, but since Ghaddafi is gone, who knows how things are run these days. My guess is, like it was before they gave him the boot, if you slip the right guy some cash, you can change that link all you want. Might be a different guy though, probably closer to the source, and the price is likely to be a lot lower now that there are less beaks to wet.
Post reply on HN