OpenBSD removes Rails from the ports tree
1–10 of 73 posts
Re: OpenBSD removes Rails from the ports tree
#2This is encouraging to see. If a given port isn't being maintained, and its security is haphazard to begin with, removing it is a very prudent course of action.
While I know I can't trust Ruby and the Rails communities to do the right thing, I know with much more certainty that I can rely on the OpenBSD developers to.
Re: OpenBSD removes Rails from the ports tree
#3Fun fact: January 11 was three weeks ago.
Re: OpenBSD removes Rails from the ports tree
#4I'm curious how many people run RoR on OBSD web servers. I suspect it exists, but very rarely
Re: OpenBSD removes Rails from the ports tree
#5I'm curious how many people run RoR on OBSD web servers. I suspect it exists, but very rarely
I did for a while, but as the patch suggests, it is probably a better idea just to install using gem. There is really no need to have rails in the ports as it doesn't require any special compilation to run on OpenBSD.
Re: OpenBSD removes Rails from the ports tree
#6I'm curious how many people run RoR on OBSD web servers. I suspect it exists, but very rarely
I did for a while, but as the patch suggests, it is probably a better idea just to install using gem. There is really no need to have rails in the ports as it doesn't require any special compilation to run on OpenBSD.
Ironic to see this suggestion when this post is immediately below one on the front page saying rubygems are not safe to install. It would be too bad if the security savvy BSD folks pushed their users into a worse situation by using gem.
Re: OpenBSD removes Rails from the ports tree
#7Earlier quoted context omitted.
I did for a while, but as the patch suggests, it is probably a better idea just to install using gem. There is really no need to have rails in the ports as it doesn't require any special compilation to run on OpenBSD.
Ironic to see this suggestion when this post is immediately below one on the front page saying rubygems are not safe to install. It would be too bad if the security savvy BSD folks pushed their users into a worse situation by using gem.
The situation currently is an unmaintained and guaranteed insecure package, so I don't think having users rely on something else will make it worse.
> These ports haven't been maintained and have been subject to numerous security issues over the past couple years (including a very critical one that made the news this week)
Re: OpenBSD removes Rails from the ports tree
#8This is encouraging to see. If a given port isn't being maintained, and its security is haphazard to begin with, removing it is a very prudent course of action. While I know I can't trust Ruby and the Rails communities to do the right thing, I know with much more certainty that I can rely on the OpenBSD developers to.
> While I know I can't trust Ruby and the Rails communities to do the right thing, I know with much more certainty that I can rely on the OpenBSD developers to.
I find this intriguing. It seems to me that all of the recent Rails security issues have been communicated and patched quickly by the Ruby and Rails communities, while the ports maintained by the OpenBSD developers remained out of date and insecure, which argues for the opposite conclusion to the one you have drawn. But I don't think it's any knock on the OpenBSD developers, keeping up with patches in a fast-moving project like Rails is a losing proposition, so they're absolutely right to remove the ports and cede that maintenance responsibility.
Re: OpenBSD removes Rails from the ports tree
#9Earlier quoted context omitted.
I did for a while, but as the patch suggests, it is probably a better idea just to install using gem. There is really no need to have rails in the ports as it doesn't require any special compilation to run on OpenBSD.
Ironic to see this suggestion when this post is immediately below one on the front page saying rubygems are not safe to install. It would be too bad if the security savvy BSD folks pushed their users into a worse situation by using gem.
Removing some insecure and/or untrustworthy code in no way forces any OpenBSD user to use other insecure and/or untrustworthy code.
I suspect that most responsible OpenBSD users with Ruby or Ruby on Rails code would likely already be looking at non-Ruby alternatives.
Re: OpenBSD removes Rails from the ports tree
#10Wise decision. Ruby has it's own package system. I believe every developer using rvm/rbenv for managing ruby versions. Rails should be installed using rubygems. I always cry seeing pretty outdated rails packages in distributives. I don't care.