Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rails for everything

literallythevoid.com

Post reply on HN
Print view View original

21–30 of 250 posts

Re: Rails for everything

#21

Post by jchw »

Don't really know much about Rails because I wound up picking Django instead when faced with the choice many years ago. That said, honestly, my perspective of Ruby on Rails has been tainted by watching GitLab get pwned over and over and over. My distro can barely keep up with GitLab being pwned because by the time the security release hits stable channels there's already another CVE. I liked GitLab, but something is deeply wrong.

Of course clearly not all apps are GitLab, but GitLab is the only Rails app I run, and must be one of the most problematic software I've ever deployed for security patching, and most of it seems to do with issues in the Ruby side of things. What makes GitLab so uniquely crap at security, and how do you avoid it as a Rails developer?

Re: Rails for everything

#22

Post by hk1337 »

I’m curious on others thoughts on whether or not to use Devise?

With the recent Rails updates, even in Rails 7, Devise didn’t seem that useful and seemed to over complicate the user authentication, registration, lost password experience and also seemed like I had to do a lot of work overriding their views to fit with my application. It seemed easier to not use Devise? It had its usefulness in earlier versions of Rails but not so much now?

Re: Rails for everything

#23

Post by loktarogar »

hk1337 wrote: post #22

I’m curious on others thoughts on whether or not to use Devise? With the recent Rails updates, even in Rails 7, Devise didn’t seem that useful and seemed to over complicate the user authentication, registration, lost password experience and also seemed like I had to do a lot of work overriding their views to fit with my application. It seemed easier to not use Devise? It had its usefulness in earlier versions of Rail…

Devise bakes in a lot of knowledge about auth. You probably don't need it for a simple app. As your needs grow, when you need things like social logins, Devise makes that easier. If you get really big you probably will have to build out something bespoke anyway. So Devise is sort of for the middle of the journey.

Re: Rails for everything

#24

Post by cjk »

FigurativeVoid wrote: post #16
ezekg wrote: post #10

After using SQLite in production for a little while, I don't think "SQLite is all you need." Migrations are a pain, so any long-lived app will eventually experience pain. As an example, SQLite doesn't have a way to add a NOT NULL constraint to an existing column; you have to rebuild the entire table using a temp table.

Huh. TIL. But in the rails context couldn’t you mostly manage with an ActiveRecord validation? I know it wouldn’t be ideal.

This is perhaps what you were hinting at when you said “wouldn’t be ideal”, but Active Record validations on their own are subject to race conditions with concurrent requests. The only truly safe way to ensure integrity of your data is to enforce validations/constraints at the database level.

IME you usually want _both_ the Active Record validations, and the database-level validations, because you get better error messages from the former, and the latter is just a safeguard.

Re: Rails for everything

#25

Post by Ocha »

hk1337 wrote: post #22

I’m curious on others thoughts on whether or not to use Devise? With the recent Rails updates, even in Rails 7, Devise didn’t seem that useful and seemed to over complicate the user authentication, registration, lost password experience and also seemed like I had to do a lot of work overriding their views to fit with my application. It seemed easier to not use Devise? It had its usefulness in earlier versions of Rail…

My experience is opposite. Getting devise up and running is very easy. Adding OAuth for GitHub, google, and other providers is also very easy. Editing views is pretty straightforward - you can put your forms or whatever you want - just post the form data to devise endpoint and that’s it. All in probably will take 30 minutes to set it up.

Re: Rails for everything

#26

Post by sethherr »

rich_sasha wrote: post #12

As someone who doesn't do enough web dev to justify learning Ruby just for Rails: how does it compare to Django? That's the only batteries-included web backend framework I'm familiar with... Asking out or curiosity.

One place that I think there is a big difference in developer experience is in testing. Rails, as described in the article, comes with CI setup and corresponding tests are automatically generated when using rails generators.

Re: Rails for everything

#27

Post by cjk »

hk1337 wrote: post #22

I’m curious on others thoughts on whether or not to use Devise? With the recent Rails updates, even in Rails 7, Devise didn’t seem that useful and seemed to over complicate the user authentication, registration, lost password experience and also seemed like I had to do a lot of work overriding their views to fit with my application. It seemed easier to not use Devise? It had its usefulness in earlier versions of Rail…

For very simple username/password authentication, what Rails 8 provides is probably sufficient. But the moment you need other auth providers, 2FA, etc., Devise is very much still useful.

Re: Rails for everything

#28

Post by _jss »

jchw wrote: post #21

Don't really know much about Rails because I wound up picking Django instead when faced with the choice many years ago. That said, honestly, my perspective of Ruby on Rails has been tainted by watching GitLab get pwned over and over and over. My distro can barely keep up with GitLab being pwned because by the time the security release hits stable channels there's already another CVE. I liked GitLab, but something is…

As a counter-point (and I know nothing about Gitlab), but GitHub and Shopify are both prominent Rails apps with pretty good security records. GitHub wrote about it last year: https://github.blog/engineering/architecture-optimization/bu...

I think the answer to your question is the same as any large application: pay attention to your supply chain, architect your systems well, if you don’t know how to do things securely go learn before building (or learn as you go, but that has consequences typically).

Re: Rails for everything

#29

Post by Ocha »

anthony_franco wrote: post #20

I agree with everything except for Kamal. I'm happy to have someone else handle the server side maintenance. Maybe once my service grows so huge that handling it myself makes sense moneywise, but starting off that way is overkill when there's such affordable alternatives.

I thought 2024 was very underwhelming for Rails - not really big advancements besides Kamal and Kamal should not have been part of rails to start with. If rails team wants to work on docker deployment tool, they can - just don’t call it rails feature

Re: Rails for everything

#30

Post by loktarogar »

FigurativeVoid wrote: post #15
phoronixrly wrote: post #2

The essential convention over configuration ideas still prevail when you want to pile on functionality quickly and without boilerplate.

I was going to write a bite more about convention over configuration in regards to AI, but it didn’t feel super tight. I think that the doctrine of convention over configuration leads to content that is much more legible to LLMs in training. I find querying Claude for Rails issues to be really helpful. I suspect would be very helpful to a novice.

Ai also works better with more mature frameworks that have a lot of examples/questions/posts on the internet where the API has been mostly the same for a while, like Rails
Post reply on HN