Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A week with a Rails Security Strategy: More security, new habits

airpair.com

Post reply on HN
Print view View original

11–20 of 27 posts

Re: A week with a Rails Security Strategy: More security, new habits

#11

Post by tddfuckwitz »

astrodust wrote: post #9
tddfuckwitz wrote: post #5

Earlier quoted context omitted.

Cute - inserting the word 'professional' before rails dev, and then claiming to take security and code quality seriously! ROFL If a developer was professional, and cared about code quality and security, they would not use rails. Period.

Yeah! They'd use PHP! Or Java! Those never have any problems and their code-bases are always flawless . I'll take a bad Rails app any day over what people churn out in other platforms. I've seen Java apps so impenetrably opaque it's not even clear what it does. Rails is Rails. It's boring. It works. It's pretty hard to mangle the project so badly that you can't make sense of it. Unless, of course, you've got no idea…

The replacements in modern php were faster and more secure. But don't let your prejudice undo your argument.

Re: A week with a Rails Security Strategy: More security, new habits

#12

Post by tddfuckwitz »

evilduck wrote: post #7
tddfuckwitz wrote: post #5

Earlier quoted context omitted.

Cute - inserting the word 'professional' before rails dev, and then claiming to take security and code quality seriously! ROFL If a developer was professional, and cared about code quality and security, they would not use rails. Period.

Says the 8 hour old troll account.

Hey - your account is much older, all that time and still unable to say anything of value. What a tragedy!

Re: A week with a Rails Security Strategy: More security, new habits

#13

Post by evilduck »

LunaSea wrote: post #6
LunaSea wrote: post #3

I didn't even know there was such a thing as "Ruby on Rails Security".

To the people downvoting me: - http://www.cvedetails.com/product/22568/Rubyonrails-Ruby-On-... - http://www.cvedetails.com/vulnerability-list/vendor_id-12043...

Those stats are meaningless without context.

Django: http://www.cvedetails.com/product/18211/Djangoproject-Django...

PHP: http://www.cvedetails.com/product/128/PHP-PHP.html?vendor_id...

JRE: http://www.cvedetails.com/product/19117/Oracle-JRE.html?vend...

.Net: http://www.cvedetails.com/product/2002/Microsoft-.net-Framew...

Re: A week with a Rails Security Strategy: More security, new habits

#14

Post by evilduck »

tddfuckwitz wrote: post #12
evilduck wrote: post #7

Earlier quoted context omitted.

Says the 8 hour old troll account.

Hey - your account is much older, all that time and still unable to say anything of value. What a tragedy!

Hope you have a great day.

Re: A week with a Rails Security Strategy: More security, new habits

#15

Post by astrodust »

tddfuckwitz wrote: post #11
astrodust wrote: post #9

Earlier quoted context omitted.

Yeah! They'd use PHP! Or Java! Those never have any problems and their code-bases are always flawless . I'll take a bad Rails app any day over what people churn out in other platforms. I've seen Java apps so impenetrably opaque it's not even clear what it does. Rails is Rails. It's boring. It works. It's pretty hard to mangle the project so badly that you can't make sense of it. Unless, of course, you've got no idea…

The replacements in modern php were faster and more secure. But don't let your prejudice undo your argument.

What "replacements" are you talking about here?

Laravel has tried to push PHP in the right direction in a huge way, but it's not without its minor problems, either. Additionally, like any non-trivial code base it's had some vulnerabilities.

Now of course nobody uses Laravel, they just hand-roll, so the sorts of bugs you see in the PHP world are more pattern based (e.g. injection, XSS) than you'd see in a platform like Rails that is driven by convention.

Re: A week with a Rails Security Strategy: More security, new habits

#17

Post by dang »

evilduck wrote: post #7
tddfuckwitz wrote: post #5

Earlier quoted context omitted.

Cute - inserting the word 'professional' before rails dev, and then claiming to take security and code quality seriously! ROFL If a developer was professional, and cared about code quality and security, they would not use rails. Period.

Says the 8 hour old troll account.

Please don't feed trolls with attention. Instead, flag them by clicking on a comment's timestamp to go to its page, then clicking "flag" at the top.

Re: A week with a Rails Security Strategy: More security, new habits

#18

Post by trimble-alum »

astrodust wrote: post #8
LunaSea wrote: post #6

Earlier quoted context omitted.

To the people downvoting me: - http://www.cvedetails.com/product/22568/Rubyonrails-Ruby-On-... - http://www.cvedetails.com/vulnerability-list/vendor_id-12043...

It's a complicated platform, but on the whole has a very good track record. Picking on it for having vulnerabilities without providing something in the way of a comparison is not very meaningful.

It's imporant to pick out vulnerabilities and deficiencies compared to other projects to get them addressed, rather than only say nice things. However, the core issue is that people raising them are usually ignored until there's an embarrassing hack or demonstration (Homakov).

For example, all new gem releases should be signed and `HighSecurity` should be the policy but it's taken years to get very little progress. Changing to that policy would prevent entire classes of attacks, attacks that could subtly inject code into all sorts of apps in difficult-to-find ways. Large projects are still shipping unsigned gems, unsigned commits and unsigned tags. If RubyGems were hacked, progress might move slightly faster.

Re: A week with a Rails Security Strategy: More security, new habits

#19

Post by sanderjd »

LunaSea wrote: post #6
LunaSea wrote: post #3

I didn't even know there was such a thing as "Ruby on Rails Security".

To the people downvoting me: - http://www.cvedetails.com/product/22568/Rubyonrails-Ruby-On-... - http://www.cvedetails.com/vulnerability-list/vendor_id-12043...

You're getting downvoted because security issues are far from unique to Ruby on Rails. Are you aware of any web frameworks with a pristine security history?

Re: A week with a Rails Security Strategy: More security, new habits

#20

Post by astrodust »

trimble-alum wrote: post #18
astrodust wrote: post #8

Earlier quoted context omitted.

It's a complicated platform, but on the whole has a very good track record. Picking on it for having vulnerabilities without providing something in the way of a comparison is not very meaningful.

It's imporant to pick out vulnerabilities and deficiencies compared to other projects to get them addressed, rather than only say nice things. However, the core issue is that people raising them are usually ignored until there's an embarrassing hack or demonstration (Homakov). For example, all new gem releases should be signed and `HighSecurity` should be the policy but it's taken years to get very little progress. C…

Rubygems has been lagging behind other packagers like Apt, RPM, NPM, and even newer things like Rust's Cargo. It's woefully overdue for an update.

That being said, there's great services like GemCanary (https://gemcanary.com/) that will read your Gemfile and produce a list of vulnerable packages for you automatically. It'll even email you alerts when there's problems.

The security story in Rails might not be perfect, but at least there's reporting and tools.

Keep pushing for signed packages, though. Long overdue.

Post reply on HN