Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenBSD removes Rails from the ports tree

marc.info

Post reply on HN
Print view View original

21–30 of 73 posts

Re: OpenBSD removes Rails from the ports tree

#21

Post by [deleted] »

bradleyland wrote: post #13
PommeDeTerre wrote: post #12

Earlier quoted context omitted.

I see it somewhat differently. In the OpenBSD world, security isn't something that comes later via an endless stream of patches, like it does within the Ruby community. Security is done proactively in the OpenBSD realm. Care is taken to develop software that's secure from the very beginning, with security-related patches being a rare occurrence later on in the extreme case that something was accidentally overlooked.…

If you're going to follow that rationale to it's logical conclusion -- that software not adhering to the OpenBSD philosophy of security first, bar none, be excluded from ports -- then there are a lot of ports that should be removed. I'm not defending the Ruby/Rails/Rubygems community here. The problems we're facing are a result of decisions to ignore important security concerns when designing software. I'm just don't…

[deleted]

Re: OpenBSD removes Rails from the ports tree

#22

Post by protomyth »

jzwinck wrote: post #6
protomyth wrote: post #5

Earlier quoted context omitted.

I did for a while, but as the patch suggests, it is probably a better idea just to install using gem. There is really no need to have rails in the ports as it doesn't require any special compilation to run on OpenBSD.

Ironic to see this suggestion when this post is immediately below one on the front page saying rubygems are not safe to install. It would be too bad if the security savvy BSD folks pushed their users into a worse situation by using gem.

Well, I would expect the OpenBSD folks to think that the Rails folks will eventually get it together or die off. I would also imagine, given it takes no special code to run Rails on OpenBSD, that they feel the Rails folks have more resources to push out releases and OpenBSD folks shouldn't wait on a port.

Re: OpenBSD removes Rails from the ports tree

#23

Post by klochner »

PommeDeTerre wrote: post #2

This is encouraging to see. If a given port isn't being maintained, and its security is haphazard to begin with, removing it is a very prudent course of action. While I know I can't trust Ruby and the Rails communities to do the right thing, I know with much more certainty that I can rely on the OpenBSD developers to.

They made a reasoned decision based on:

  - gems shouldn't be installed via ports in the first place
  - the ports are not being maintained by BSD
  - the gems/ports in question would need to be patched
You turned that into "rails sux, BSD rules." Please stop.

Re: OpenBSD removes Rails from the ports tree

#24

Post by zzzeek »

byroot wrote: post #20
PommeDeTerre wrote: post #2

This is encouraging to see. If a given port isn't being maintained, and its security is haphazard to begin with, removing it is a very prudent course of action. While I know I can't trust Ruby and the Rails communities to do the right thing, I know with much more certainty that I can rely on the OpenBSD developers to.

I see your numerous FUD posts about Ruby, Javascript & others since a few weeks now, and I'm curious: What is your magical langage / technology that never had any security holes, nor any misconception ?

The choice of "security as an afterthought" and "never had any security holes ever" is a false choice between two extremes that don't actually exist (well, at least the second). The poster is referring to two very different approaches to software security. OpenBSD's approach is considered to be the most uncompromising in the industry, and goes further than probably most of us would prefer to go, but nonetheless serves as a good example of what's possible. You can read about it here: http://www.openbsd.org/security.html and there's also some good papers/presentations here: http://www.openbsd.org/papers/ .

Re: OpenBSD removes Rails from the ports tree

#25

Post by ballard »

wildchild wrote: post #10

Wise decision. Ruby has it's own package system. I believe every developer using rvm/rbenv for managing ruby versions. Rails should be installed using rubygems. I always cry seeing pretty outdated rails packages in distributives. I don't care.

Yes. Maintaining a canonical set of ports for frequently changing language-managed packages is like getting into a phonebook reprinting business. It would be a far better use of precious volunteer time for any given language package to push OS specific changes to that upstream rather than grow downstream collections. The *BSD community could also learn something from the arch AUP as a way to end-users to roll their own packages to make it easier to contribute and reduce their own deployed systems' entropy ... because having a singular ports collection is like SVN or top-down planned economies... they are labor-intensive to support and their decision making is distantly divorced from the intended use-case. Different from AUP would be human-sensible configuration management that doesn't require manual intervention or too much tweaking for deploying 1k+ nodes.

Re: OpenBSD removes Rails from the ports tree

#26

Post by wmoxam »

whalesalad wrote: post #19
wildchild wrote: post #10

Wise decision. Ruby has it's own package system. I believe every developer using rvm/rbenv for managing ruby versions. Rails should be installed using rubygems. I always cry seeing pretty outdated rails packages in distributives. I don't care.

Yep. I don't know why anyone would want to install something like Rails, Django etc... via their distribution or OS's built-in package management system. I think it's silly actually. Ruby has rubygems, Python has pip, Perl has cpan...

It makes sense from the perspective of it being a dependency of some end user software such as Typo or Redmine

Re: OpenBSD removes Rails from the ports tree

#27

Post by wmoxam »

zzzeek wrote: post #24
byroot wrote: post #20

Earlier quoted context omitted.

I see your numerous FUD posts about Ruby, Javascript & others since a few weeks now, and I'm curious: What is your magical langage / technology that never had any security holes, nor any misconception ?

The choice of "security as an afterthought" and "never had any security holes ever" is a false choice between two extremes that don't actually exist (well, at least the second). The poster is referring to two very different approaches to software security. OpenBSD's approach is considered to be the most uncompromising in the industry, and goes further than probably most of us would prefer to go, but nonetheless serve…

I love openbsd but even their proactive approach hasn't made them immune to remote exploits

Re: OpenBSD removes Rails from the ports tree

#28

Post by dlisboa »

wmoxam wrote: post #26
whalesalad wrote: post #19

Earlier quoted context omitted.

Yep. I don't know why anyone would want to install something like Rails, Django etc... via their distribution or OS's built-in package management system. I think it's silly actually. Ruby has rubygems, Python has pip, Perl has cpan...

It makes sense from the perspective of it being a dependency of some end user software such as Typo or Redmine

I've been messing around with FreeBSD for a few days and it has RubyGems set up very conveniently. Root installed packages (like the ones from ports) would already be attended through the root installed RubyGem.

Aside from OpenBSD which has their security procedures for installed software it doesn't seem like any ports distro really need to have copies of gems in their package tree if the RubyGems package is set up correctly. They could delegate that function to RubyGems, it'd be transparent to the user.

Some package managers go down a more drastic route and simply tell the user to install the dependency through the correct package manager (Homebrew does that with Node, top of my mind). Users can still do it locally with rbenv/rvm/chruby if they want, it doesn't change much.

The bigger I'd think is that they don't want to rely on external package managers for the stability of their system. Which is a very valid reason, if RubyGems is out you can't install certain ports. Or worse, the gems aren't safe. The system is then self-contained and tested, proven to work with the provided copies of gems.

But as a simple dependency resolution perspective I don't see it being the case.

Re: OpenBSD removes Rails from the ports tree

#29

Post by mpyne »

wmoxam wrote: post #27
zzzeek wrote: post #24

Earlier quoted context omitted.

The choice of "security as an afterthought" and "never had any security holes ever" is a false choice between two extremes that don't actually exist (well, at least the second). The poster is referring to two very different approaches to software security. OpenBSD's approach is considered to be the most uncompromising in the industry, and goes further than probably most of us would prefer to go, but nonetheless serve…

I love openbsd but even their proactive approach hasn't made them immune to remote exploits

It's not about total and complete prevention, it's about reduction of risk. Your logic taken to its logical conclusion would argue against practically any risk mitigation measures at all. For instance, even SSL/TLS have not been immune to exploits.

Re: OpenBSD removes Rails from the ports tree

#30

Post by static_typed »

byroot wrote: post #20
PommeDeTerre wrote: post #2

This is encouraging to see. If a given port isn't being maintained, and its security is haphazard to begin with, removing it is a very prudent course of action. While I know I can't trust Ruby and the Rails communities to do the right thing, I know with much more certainty that I can rely on the OpenBSD developers to.

I see your numerous FUD posts about Ruby, Javascript & others since a few weeks now, and I'm curious: What is your magical langage / technology that never had any security holes, nor any misconception ?

I think he was actually pointing out a difference in approaches. OpenBSD tend to take the conservative line, the Ruby crowd seem to take the front-door open with Yaml parsers blazing ready to run arbitrary code line.

I am sure it is possible to write conservative, stable, secure frameworks and tools in Ruby, but it is rather telling that we don't.

Post reply on HN