Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ruby on Rails Audit Complete

ostif.org

Post reply on HN
Print view View original

161–170 of 171 posts

Re: Ruby on Rails Audit Complete

#161

Post by sanswork »

sergiotapia wrote: post #155
sanswork wrote: post #136

Earlier quoted context omitted.

It's the opposite since it standardises everything as oppose to roll your own. If you need to hire someone you'd need to train them on your system no matter what, with a framework you can use their documentation to explain where things are and how they work.

Elixir is already a small fraction of a small and shrinking community (Rails). Ash is a tiny fraction of an already tiny fraction. I cannot imagine defending this choice to anyone unless I was literally the CEO of a company and answered only to myself. Ash does look badass though!

It doesn't really matter though. You have to train new staff on your systems/code base no matter what you use. So if they don't already know ash it's the exact same as if you didn't use it. Only now you can point them at the ash docs and buy them the ash book and they'll know where everything in your system goes.

Re: Ruby on Rails Audit Complete

#162

Post by yurishimo »

hhthrowaway1230 wrote: post #4

Thats good news! I'm a huge fan or Rails but a little surprised of such little vulnerabilities tbh. Would have expected more for such large codebase. But happy to hear it aint!

Wordpress is similar. The core project is quite battle tested, but the plugin ecosystem opens admins up to problems. With any system that allows modular code additions, the weakest attack area gets exponentially larger.

Re: Ruby on Rails Audit Complete

#163

Post by asa400 »

lilsoso wrote: post #97
kybishop wrote: post #37

Earlier quoted context omitted.

> Add in problems finding developers skilled in Elixir and Phoenix and the small available libraries. Is this actually a problem you see? I'm going on 15 years in the industry and haven't seen any issues training people up on a new language in just a couple months. If you need an expert in some library or language to make meaningful business progress I feel like that says more about whatever tool or language you're u…

> Is this actually a problem you see? I'm going on 15 years in the industry and haven't seen any issues training people up on a new language in just a couple months. Some years ago the largest company using Elixir in the US, or at least on the west coast, abandoned Elixir because they couldn't find enough developers. Yes. The adoption is poor despite the loud voices.

Just curious, what company? Disclosure: I work at a large Elixir company in the US.

Re: Ruby on Rails Audit Complete

#164

Post by rrr_oh_man »

josephg wrote: post #144
inopinatus wrote: post #143

Some good recommendations. Feedback on this one: > "X41 recommends to disallow the creation of un-escaped SqlLiteral objects with user input in favor of a complete model of SQL" Rails already has a sufficient model of SQL in its Arel layer. Complete? Not exactly, because SQL is never implemented by the standard, but certainly sufficient, and very composable and extensible. Sadly the core team killed off the public do…

> The recommendation is also a touch naive as framed, because it's nigh-impossible to outright disallow developers doing practically whatever they want to in Ruby Sure but defaults matter. Nothing is truly private in most languages. In C/C++, you can poke raw memory. In rust you can transmute. In Java you can override the classloader and edit classes before they’re passed to the JVM and so on. But most environments h…

> This is exactly what removing documentation does - it signals to developers that some API isn’t part of the expected golden path.

What an insane statement. "Knowledge is bad for you, dummy"?

Re: Ruby on Rails Audit Complete

#165

Post by josephg »

rrr_oh_man wrote: post #164
josephg wrote: post #144

Earlier quoted context omitted.

> The recommendation is also a touch naive as framed, because it's nigh-impossible to outright disallow developers doing practically whatever they want to in Ruby Sure but defaults matter. Nothing is truly private in most languages. In C/C++, you can poke raw memory. In rust you can transmute. In Java you can override the classloader and edit classes before they’re passed to the JVM and so on. But most environments h…

> This is exactly what removing documentation does - it signals to developers that some API isn’t part of the expected golden path. What an insane statement. "Knowledge is bad for you, dummy"?

I have no idea how you got that weird statement from my comment.

Re: Ruby on Rails Audit Complete

#166

Post by frou_dh »

wiseowise wrote: post #65
vinceguidry wrote: post #38

Earlier quoted context omitted.

Ruby has static type system built into the language. https://github.com/ruby/rbs There are others you can use if you like.

Unusable mess. Ruby should take lessons from Python and TS on how to make proper gradual typing.

It should stay true to itself and not do it at all.

Sigh - all languages needn't converge into Grey Goo.

Re: Ruby on Rails Audit Complete

#167

Post by meepmorp »

mattbrewsbytes wrote: post #44
ukprogrammer wrote: post #12

The productivity of Rails for B2B 'CRUD' software is unmatched. Surprised to not see more newer startups make use of it!

With so many generative AI tools out there, picking more obscure or niche languages is a detractor because the AI models won't have as much depth of training to pull from when you ask it to do things. Also, technology choices for B2B web apps is rarely going to be a sole factor in determining success or failure of any business. As much as this community likes to compare performance metrics, benchmarks, frameworks and…

"rails has better vibes" is certainly a take

Re: Ruby on Rails Audit Complete

#168

Post by sergiotapia »

arrowsmith wrote: post #158
sergiotapia wrote: post #155

Earlier quoted context omitted.

Elixir is already a small fraction of a small and shrinking community (Rails). Ash is a tiny fraction of an already tiny fraction. I cannot imagine defending this choice to anyone unless I was literally the CEO of a company and answered only to myself. Ash does look badass though!

Elixir really needs to lose the perception, if there is one, of it being a subset of the Ruby/Rails community. It's true that the initial influx of Elixir developers came from the Ruby world back when Elixir was new, but that was a long time ago. Tons of Elixir folk come into it nowadays without a Ruby background. Elixir and Ruby really aren't that similar anyway. The syntax differences are very superficial - Elixir'…

I didn't mean that elixir engineers all come from Ruby I was just using Ruby as an example sample size because that is what I'm familiar with.

Re: Ruby on Rails Audit Complete

#169

Post by const_cast »

mrinterweb wrote: post #90
Hnus wrote: post #55

Earlier quoted context omitted.

Serious question: do people actually enjoy writing Ruby? I feel I’m writing in something like Bash. I never felt this way until I picked up other languages like Rust, Zig, C#, and learned a tiny bit of programming language theory. After that, the loose and squishy feel of Ruby really started to bug me. Also, it seems like every Ruby programmer I know only ever uses other dynamic languages like Python. It’s never like…

I had a good background in C++ programming before switching to ruby. At first, I was terrified of the lack of strict typing, but after using it for a while, I realized my concern wasn't that warranted. For me it is about the tradeoff of dealing with types vs productivity. Sure I occasionally get bit by a random "method not defined for nil" error, but it is usually very easy to fix, and I don't run into the issue very…

I disagree, I think weak typing significantly lowers developer productivity. Because your IDE gets lobotomized. Types aren't just for people, they're for programs. If I can't go to definition or go through the control flow that's a problem to me. I program in PHP - I get it. I have to live in the debugger because my IDE is worthless when I'm using bespoke arrays for everything.

Also, most statically typed languages have very robust type inference. If you don't like writing types that's fine - the language can just infer them 95% of the time. A lot of times you can open up a C# file and find next to no types explicitly written. But if you hover over something in your IDE, you can see the type.

Re: Ruby on Rails Audit Complete

#170

Post by const_cast »

Spivak wrote: post #71
vinceguidry wrote: post #36

Earlier quoted context omitted.

NodeJS and the siren's song of using the same language on the server as the client. Despite the popularity, node never caught up with rails in terms of features and productivity. I was part of a replatforming from rails to node some 10 years ago. So many things we had to just rewrite because there was no option at the time in node. The team lead that made the decision left half-way through the project. Second worst t…

Well and that JS is really fast thanks to V8 and TS has leapfrogged Ruby in terms of developer tooling. Personally I think Ruby is a nicer language and JS has a lot of odd quirks but it became Java. A good natural choice that can be used for any project.

Java is both significantly faster than JS and significantly less buggy/footgunny. JS is pretty much just a bad language in my mind. It seems specifically designed to create as many bugs as humanly possible. It's a lot like C++ in that way, but at least C++ is actually performant.
Post reply on HN