Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenBSD removes Rails from the ports tree

marc.info

Post reply on HN
Print view View original

31–40 of 73 posts

Re: OpenBSD removes Rails from the ports tree

#31

Post by steveklabnik »

homosaur wrote: post #14
electic wrote: post #11

If I am reading this right, this title is wrong. They are talking about dependencies.

Rails is almost entirely a wrapper for these components like ActiveModel and Sprockets and such. You can use them apart from Rails but that's why they are all on the ports tree. It's probably the only thing that uses them.

> It's probably the only thing that uses them.

This is very much not true for many of the components. I have a few gems that rely on ActiveSupport and ActiveModel, Sprockets has integration with other frameworks, etc.

That said, you're right, the 'rails' gem is really a meta-gem that installs all the right versions of the other ones.

Re: OpenBSD removes Rails from the ports tree

#32

Post by martinced »

eksith wrote: post #16
PommeDeTerre wrote: post #12

Earlier quoted context omitted.

I see it somewhat differently. In the OpenBSD world, security isn't something that comes later via an endless stream of patches, like it does within the Ruby community. Security is done proactively in the OpenBSD realm. Care is taken to develop software that's secure from the very beginning, with security-related patches being a rare occurrence later on in the extreme case that something was accidentally overlooked.…

Even more than the security, the reason I use it at home is because I'm lazy and I don't want to go hopping about applying patches to lock things down. Most things take the least amount of effort to configure and, probably most importantly, things are predictable. There's no "magic", everything must be clear, documented and open. An old friend of mine also runs OpenBSD on his machine and I don't think he's restarted…

"An old friend of mine also runs OpenBSD on his machine and I don't think he's restarted in 2 years"

I regularly reach 6 months of uptime on my Debian desktop and I've got a Linux server which reaches 4-digits days of uptime.

I only reboot when I need to physically move the machine or when a remote-exploit affecting my setup is discovered.

OpenBSD takes this even further and more power to them. My "todo list" since a very long time is to install a firewall running OpenBSD. I should really take the time to do this.

Re: OpenBSD removes Rails from the ports tree

#33

Post by martinced »

byroot wrote: post #20
PommeDeTerre wrote: post #2

This is encouraging to see. If a given port isn't being maintained, and its security is haphazard to begin with, removing it is a very prudent course of action. While I know I can't trust Ruby and the Rails communities to do the right thing, I know with much more certainty that I can rely on the OpenBSD developers to.

I see your numerous FUD posts about Ruby, Javascript & others since a few weeks now, and I'm curious: What is your magical langage / technology that never had any security holes, nor any misconception ?

Logical fallacy: "Fallacy of gray".

This one many intelligent people fall for and I can't for the heck of myself understand why, so now every single time I read it I'll post this:

http://lesswrong.com/lw/mm/the_fallacy_of_gray/

I hope I'll get upvoted relentlessly until people stop making that fallacy.

Re: OpenBSD removes Rails from the ports tree

#34

Post by martinced »

wmoxam wrote: post #27
zzzeek wrote: post #24

Earlier quoted context omitted.

The choice of "security as an afterthought" and "never had any security holes ever" is a false choice between two extremes that don't actually exist (well, at least the second). The poster is referring to two very different approaches to software security. OpenBSD's approach is considered to be the most uncompromising in the industry, and goes further than probably most of us would prefer to go, but nonetheless serve…

I love openbsd but even their proactive approach hasn't made them immune to remote exploits

Logical fallacy: "Fallacy of gray".

http://lesswrong.com/lw/mm/the_fallacy_of_gray/

Re: OpenBSD removes Rails from the ports tree

#35

Post by inopinatus »

PommeDeTerre wrote: post #12
sanderjd wrote: post #8

Earlier quoted context omitted.

> While I know I can't trust Ruby and the Rails communities to do the right thing, I know with much more certainty that I can rely on the OpenBSD developers to. I find this intriguing. It seems to me that all of the recent Rails security issues have been communicated and patched quickly by the Ruby and Rails communities, while the ports maintained by the OpenBSD developers remained out of date and insecure, which arg…

I see it somewhat differently. In the OpenBSD world, security isn't something that comes later via an endless stream of patches, like it does within the Ruby community. Security is done proactively in the OpenBSD realm. Care is taken to develop software that's secure from the very beginning, with security-related patches being a rare occurrence later on in the extreme case that something was accidentally overlooked.…

Since neither Ruby nor Rails are part of the OpenBSD base system, this point is largely moot. Practically the entire ports tree consists of software that was not developed with careful security from the beginning. I think yours is a straw man argument, and it is not a surprise to me that you felt the need to fling invective at the Ruby community as backup.

Re: OpenBSD removes Rails from the ports tree

#36

Post by inopinatus »

I'd like to take this opportunity to highlight BSDPAN, which is how FreeBSD integrates her own package database with Perl's native module installation.

Since 99% of package management is just files on a filesystem and a bit of dependency analysis, for the purposes of easing installation, permitting bidirectional awareness of state, and alerting administrators to security updates.

I would commend any OS that has the smarts to hook into the package ecosystems of her guests. RubyGems, CPAN, npm, PEAR, PyPI into APT, RPM and what have you. Wouldn't it be great if.

Here's an edge case, though. In the specific world of both Ruby and her fat offspring Rails, the proliferation of versions (and the widespread separation of sysadmins from developers) means that in practice many Ruby applications have the runtime language binaries and package dependencies installed in app-specific or personal home directories, via the likes of rvm. Stick that in your package management pipe and solve it.

Re: OpenBSD removes Rails from the ports tree

#37

Post by inopinatus »

wildchild wrote: post #10

Wise decision. Ruby has it's own package system. I believe every developer using rvm/rbenv for managing ruby versions. Rails should be installed using rubygems. I always cry seeing pretty outdated rails packages in distributives. I don't care.

Unfortunately this leads to language binaries & libs being distributed by the developer with the application. Sysadmins then install the whole massive hairball in /opt as a single unit and never update it until the developer provides a point release. Which never happens because the dev team has been disbanded, they're all on new projects now.

If you don't think that's a problem in the real world, you ain't seen 95% of enterprise IT.

(This problem not confined to Ruby)

Re: OpenBSD removes Rails from the ports tree

#38

Post by tedunangst »

whalesalad wrote: post #19
wildchild wrote: post #10

Wise decision. Ruby has it's own package system. I believe every developer using rvm/rbenv for managing ruby versions. Rails should be installed using rubygems. I always cry seeing pretty outdated rails packages in distributives. I don't care.

Yep. I don't know why anyone would want to install something like Rails, Django etc... via their distribution or OS's built-in package management system. I think it's silly actually. Ruby has rubygems, Python has pip, Perl has cpan...

As somebody who occasionally uses software, besides just developing it, learning the command syntax and idiosyncrasies of a half dozen package systems is a pain in the butt. I want to type "pkg_add things I want" and be done with it.

Re: OpenBSD removes Rails from the ports tree

#39

Post by static_typed »

inopinatus wrote: post #35
PommeDeTerre wrote: post #12

Earlier quoted context omitted.

I see it somewhat differently. In the OpenBSD world, security isn't something that comes later via an endless stream of patches, like it does within the Ruby community. Security is done proactively in the OpenBSD realm. Care is taken to develop software that's secure from the very beginning, with security-related patches being a rare occurrence later on in the extreme case that something was accidentally overlooked.…

Since neither Ruby nor Rails are part of the OpenBSD base system, this point is largely moot. Practically the entire ports tree consists of software that was not developed with careful security from the beginning. I think yours is a straw man argument, and it is not a surprise to me that you felt the need to fling invective at the Ruby community as backup.

Not sure where anyone said it was part of Base, I am sure it was generally acknowledged as a port that was falling behind, and therefore presenting a security risk if installed, and a burden to maintain, given most users fall back to Ruby Gems anyway.

It is rather sad that any story with 'ruby' in the title seems to bring out people who are quick to shout, stamp, accuse and drown out any voices that question how things are currently being done in the Ruby world.

I would question one of your points though, you said "Practically the entire ports tree consists of software that was not developed with careful security from the beginning" - I presume you sat with each and every developer of each piece of code involved to question whether security was on their mind when they sat down to design and code, or do you feel "the need to fling invective" as you mentioned earlier?

Re: OpenBSD removes Rails from the ports tree

#40

Post by static_typed »

SEJeff wrote: post #4

I'm curious how many people run RoR on OBSD web servers. I suspect it exists, but very rarely

We did. Until a few days ago. IT Security pulled the apps after the recent critical vulns in Rails, and now this vuln with RubyGems.

Still using OpenBSD for hosting, but the apps are being ported to PHP and Python as we speak.

Post reply on HN