OpenBSD removes Rails from the ports tree • Hacker News Board

Re: OpenBSD removes Rails from the ports tree

#71

Post by steveklabnik » Sun, Feb 03, 2013, 8:35 PM UTC

homosaur wrote: post #68

steveklabnik wrote: post #31

Earlier quoted context omitted.

> It's probably the only thing that uses them. This is very much not true for many of the components. I have a few gems that rely on ActiveSupport and ActiveModel, Sprockets has integration with other frameworks, etc. That said, you're right, the 'rails' gem is really a meta-gem that installs all the right versions of the other ones.

Yeah but are those other gems in the OpenBSD ports tree? The point is not that they are not used for other things but that they are probably not used in OpenBSD

Ahhh probably not. Good point.

Re: OpenBSD removes Rails from the ports tree

#72

Post by eric970 » Tue, Feb 05, 2013, 12:39 AM UTC

eric970 wrote: post #47

static_typed wrote: post #46

Earlier quoted context omitted.

Sure. We had a number of Rails apps running in our production environment. The recent weeks have been a very stressful time. A critical Rails or Ruby related vuln is discovered, and then we have to make emergency changes to try avoid the app or server getting compromised. Of course, given the large number of these critical issues, the business decided to pull and rewrite the apps based on input from the It Security t…

Dude, every one of your posts on HN I've seen has been about how Ruby sucks and should be thrown away. Either you're a troll or you're a very angry and upset person. Either way, I feel sorry for you.

Ruby isn't my first or only language. I'm pointing out that there doesn't seem to be much of any analysis or reasoning behind his posts. That's it. It amuses me that people automatically assumed I meant Ruby > all. I haven't claimed that and definitely do not think that. I think this is actually a sign of how people judge other languages really badly.

Re: OpenBSD removes Rails from the ports tree

#73

Post by davidfischer » Fri, Feb 15, 2013, 4:11 AM UTC

bradleyland wrote: post #13

PommeDeTerre wrote: post #12

Earlier quoted context omitted.

I see it somewhat differently. In the OpenBSD world, security isn't something that comes later via an endless stream of patches, like it does within the Ruby community. Security is done proactively in the OpenBSD realm. Care is taken to develop software that's secure from the very beginning, with security-related patches being a rare occurrence later on in the extreme case that something was accidentally overlooked.…

If you're going to follow that rationale to it's logical conclusion -- that software not adhering to the OpenBSD philosophy of security first, bar none, be excluded from ports -- then there are a lot of ports that should be removed. I'm not defending the Ruby/Rails/Rubygems community here. The problems we're facing are a result of decisions to ignore important security concerns when designing software. I'm just don't…

I realize this response is a bit late. However, it's worth mentioning that there's been quite a bit of movement here from the Python community in the past two weeks. No doubt this is a response to what happened with Ruby. A proper cert for pypi.python.org is being rolled out this week and pip should shortly have cert checking.

https://github.com/pypa/pip/issues/425