Rails version 3.2.7 has been released • Hacker News Board

Re: Rails version 3.2.7 has been released

#11

Post by tptacek » Fri, Jul 27, 2012, 1:51 AM UTC

aaronblohowiak wrote: post #9

aaronblohowiak wrote: post #6

Earlier quoted context omitted.

is the badness in st_lookup or rb_enc_str_new ? I haven't traced the execution deep enough to see where things go south...

Oh wait, i get it. every symbolized string is added to the global symbol table, so you can basically make rails devour incredible amounts of memory by sending it new values. neat.

There are worse problems than that, I think.

Re: Rails version 3.2.7 has been released

#12

Post by tptacek » Fri, Jul 27, 2012, 1:55 AM UTC

film42 wrote: post #5

Is it just me or does it seem like everyone's stack is moving away from Rails? I mean, it's a great solution to many problems, I just feel that there's a lot more platforms that offer you even better customization and leave a far smaller footprint.

Definitely what we need in a thread about a security issue in a hugely popular web stack is a language war.

Re: Rails version 3.2.7 has been released

#13

Post by jph » Fri, Jul 27, 2012, 1:59 AM UTC

film42 wrote: post #5

Is it just me or does it seem like everyone's stack is moving away from Rails? I mean, it's a great solution to many problems, I just feel that there's a lot more platforms that offer you even better customization and leave a far smaller footprint.

It's just you. :) In seriousness, many of the newer stacks (e.g. Meteor) offer fast ways to get started then you realize you need functionality such as authentication, authorization, server-side validations, migrations, queues, caches, API connections to other sites to retrieve data, etc. When you add all that in, you're essentially rolling your own large framework of pieces.

Re: Rails version 3.2.7 has been released

#14

Post by aaronblohowiak » Fri, Jul 27, 2012, 2:07 AM UTC

tptacek wrote: post #10

aaronblohowiak wrote: post #6

Earlier quoted context omitted.

is the badness in st_lookup or rb_enc_str_new ? I haven't traced the execution deep enough to see where things go south...

There's badness just in rb_intern, at least in 187. MRI scares the bejeezus out of me.

Oh, I'll have to give it another look.

JRuby also suffers from the global symbol table =( so it does not avoid the potential denial attack through symbolizing..

Re: Rails version 3.2.7 has been released

#15

Post by dschobel » Fri, Jul 27, 2012, 3:19 AM UTC

tptacek wrote: post #12

film42 wrote: post #5

Is it just me or does it seem like everyone's stack is moving away from Rails? I mean, it's a great solution to many problems, I just feel that there's a lot more platforms that offer you even better customization and leave a far smaller footprint.

Definitely what we need in a thread about a security issue in a hugely popular web stack is a language war.

"MRI scares the bejeezus out of me" - you, an hour ago

I think asking about alternatives is fair game.

Re: Rails version 3.2.7 has been released

#16

Post by tptacek » Fri, Jul 27, 2012, 3:36 AM UTC

dschobel wrote: post #15

tptacek wrote: post #12

Earlier quoted context omitted.

Definitely what we need in a thread about a security issue in a hugely popular web stack is a language war.

"MRI scares the bejeezus out of me" - you, an hour ago I think asking about alternatives is fair game.

JRuby is a good alternative.

You know where the "better alternatives to Rails" thread goes, and it's nowhere helpful for a security advisory post. But, your call, not mine.

Re: Rails version 3.2.7 has been released

#17

Post by tenderlove » Fri, Jul 27, 2012, 5:22 AM UTC

Crap. I keep forgetting to submit these announcements to hacker news. I'm saving up my HN points to get a commemorative pin! ;)

If you have questions about the release, or the security issue, fire away. :-)

Re: Rails version 3.2.7 has been released

#18

Post by tenderlove » Fri, Jul 27, 2012, 5:24 AM UTC

tptacek wrote: post #4

aaronblohowiak wrote: post #3

Don't call to_sym on untrusted input!

Oh wow. rb_intern() is a mess.

Actually, I find it easy to read compared to some other functions in MRI. The trick is that it keeps the symbol in a global table (that never gets reaped).

Re: Rails version 3.2.7 has been released

#19

Post by dschobel » Fri, Jul 27, 2012, 5:57 AM UTC

tptacek wrote: post #16

dschobel wrote: post #15

Earlier quoted context omitted.

"MRI scares the bejeezus out of me" - you, an hour ago I think asking about alternatives is fair game.

JRuby is a good alternative. You know where the "better alternatives to Rails" thread goes, and it's nowhere helpful for a security advisory post. But, your call, not mine.

He got some decent responses so it seems like it turned out okay. You can give the audience here a little bit of credit, really.

Re: Rails version 3.2.7 has been released

#20

Post by jballanc » Fri, Jul 27, 2012, 6:14 AM UTC

tptacek wrote: post #10

aaronblohowiak wrote: post #6

Earlier quoted context omitted.

is the badness in st_lookup or rb_enc_str_new ? I haven't traced the execution deep enough to see where things go south...

There's badness just in rb_intern, at least in 187. MRI scares the bejeezus out of me.

I vaguely recall somewhere that Matz commented about how he felt that he was a good language designer, but not necessarily a good language implementor. I've always felt that MRI should be treated as a reference implementation, and the fact that there aren't more alternate implementations of Ruby is a (maybe sad?) reflection on the Ruby community.