DHH needs to focus on Rails again rather than Omarchy.
Government Rails Site Hit Hours After CVE Patch
11–20 of 41 posts
Re: Government Rails Site Hit Hours After CVE Patch
#12[dead]
Re: Government Rails Site Hit Hours After CVE Patch
#13DHH needs to focus on Rails again rather than Omarchy.
What does DHH have to do with this? Omarchy itself isn’t known for being secure; here is a root escalation from five days ago https://news.ycombinator.com/item?id=49499854
The rails developers are incredibly smart and capable. They patched the exploit. The problem is that it’s too easy to reverse engineer based on the patch. They can’t do anything about that.
Re: Government Rails Site Hit Hours After CVE Patch
#14This post could be 10% as long:
- There was a bug with a patch
- We applied it to our clients
- There were live exploits within eight hours of the patch being released
- The Rails team had to expedite release of the technical details because POCs obviated the need to embargo
Re: Government Rails Site Hit Hours After CVE Patch
#15DHH needs to focus on Rails again rather than Omarchy.
[deleted]
Re: Government Rails Site Hit Hours After CVE Patch
#16DHH needs to focus on Rails again rather than Omarchy.
What does DHH have to do with this? Omarchy itself isn’t known for being secure; here is a root escalation from five days ago https://news.ycombinator.com/item?id=49499854 The rails developers are incredibly smart and capable. They patched the exploit. The problem is that it’s too easy to reverse engineer based on the patch. They can’t do anything about that.
[deleted]
Re: Government Rails Site Hit Hours After CVE Patch
#17DHH needs to focus on Rails again rather than Omarchy.
What does DHH have to do with this? Omarchy itself isn’t known for being secure; here is a root escalation from five days ago https://news.ycombinator.com/item?id=49499854 The rails developers are incredibly smart and capable. They patched the exploit. The problem is that it’s too easy to reverse engineer based on the patch. They can’t do anything about that.
> What does DHH have to do with this?
DHH created Rails.
Re: Government Rails Site Hit Hours After CVE Patch
#18DHH needs to focus on Rails again rather than Omarchy.
He’s still very supportive of Rails. Come join us at RailsWorld in Austin later this month and see for yourself!
Re: Government Rails Site Hit Hours After CVE Patch
#19Nice write up, Claude.
Re: Government Rails Site Hit Hours After CVE Patch
#20Do you have to have matlab running on your rails server for this to happen?
Not running, but supported. You can check your app with: bin/rails runner ' require "vips" puts "ruby-vips #{Vips::VERSION} libvips #{Vips.version(0)}.#{Vips.version(1)}.#{Vips.version(2)}" begin Vips::Operation.new("matload") puts "matload PRESENT - this build can reach libmatio" rescue Vips::Error puts "matload ABSENT - this build cannot reach libmatio" end ' This is from the Rails official docs for the CVE which,…
Why would you have matlab on an external server? People don't even have a compiler on the server in this situation. Crazy.