Patch right now.
Someone should change the title of this post. I didn't read it for a good 3 hours because I didn't realize it was related to Rails.
Me neither, but most people who run Rails apps that are somewhat significant probably do.
Multiple vulnerabilities in parameter parsing in Action Pack
191–200 of 294 posts
Re: Multiple vulnerabilities in parameter parsing in Action Pack
#192Earlier quoted context omitted.
As there have been many exploits / issues recently realized in parameters parsing, why isn't there more of a focus on security here? Specifically, this is where users/hackers can put ANY DARN THING THEY WANT and your server has to deal with it. As a simple solution, one could pass a signed auth-hash of the fields generated by form_for, and the server could re-hash the fields submitted to ensure the form data you aske…
>why isn't there more of a focus on security here? Because this is ruby we're talking about. A "Fun" language that has 100000 ways todo the same thing, so newbs find it fun and easy. You can almost guess how the language works and almost always be right. Thats cool, great for learning, makes you feel like a superstar when you're just getting started with programming... but its really not such a good thing when it com…
Sounds like PHP >_<
Re: Multiple vulnerabilities in parameter parsing in Action Pack
#193Earlier quoted context omitted.
> why isn't there more of a focus on security here? More compared to what, exactly? This vulnerability was responded to pretty damn quickly after it was reported, given that almost nobody is even paid to work on Rails. If you saw Aaron tweeting about "working over the weekend" a few days ago, well, now you know. That said, you mention attr_accessible in your post: that's gone as of the next release of Rails. Basicall…
Nothing gives me confidence in a platform like "almost nobody is even paid to work on Rails."
Yes, judging platforms by how many people are paid to work on them instead of track record or other verifiable merits is totally the best way to go.
Re: Multiple vulnerabilities in parameter parsing in Action Pack
#194Heroku apps rely on Heroku's version of Rails gems (right?), so how does one tell if Heroku has patched these vulnerabilities yet?
Re: Multiple vulnerabilities in parameter parsing in Action Pack
#195Sweet! I can use this to infiltrate my main competitor's site, just need to install a backdoor before he upgrades...
Re: Multiple vulnerabilities in parameter parsing in Action Pack
#196Heroku apps rely on Heroku's version of Rails gems (right?), so how does one tell if Heroku has patched these vulnerabilities yet?
Heroku runs whatever version you say in your Gemfile. You must update your apps yourself; There is nothing Heroku can do to update your app for you.
Re: Multiple vulnerabilities in parameter parsing in Action Pack
#197Heroku apps rely on Heroku's version of Rails gems (right?), so how does one tell if Heroku has patched these vulnerabilities yet?
Heroku runs whatever version you say in your Gemfile. You must update your apps yourself; There is nothing Heroku can do to update your app for you.
But am I protected if I'm currently using a fixed version of Rails? (3.2.11, 3.1.10, 3.0.19, or 2.3.15)
Re: Multiple vulnerabilities in parameter parsing in Action Pack
#198Earlier quoted context omitted.
Heroku runs whatever version you say in your Gemfile. You must update your apps yourself; There is nothing Heroku can do to update your app for you.
But am I protected if I'm currently using a fixed version of Rails? (3.2.11, 3.1.10, 3.0.19, or 2.3.15)
yes
Re: Multiple vulnerabilities in parameter parsing in Action Pack
#199For a less hammered server, can use: source ' http://bundler-api.herokuapp.com in your Gemfile
Gems are unsigned. Patching from a different source is idiotic. Do not use: you have no clue who is the owner.
Not so idiotic if you know the owner. It is done by Heroku's Ruby team
http://hone.heroku.com/bundler%20heroku/2012/10/22/rubygems-...
Re: Multiple vulnerabilities in parameter parsing in Action Pack
#200Earlier quoted context omitted.
> why isn't there more of a focus on security here? More compared to what, exactly? This vulnerability was responded to pretty damn quickly after it was reported, given that almost nobody is even paid to work on Rails. If you saw Aaron tweeting about "working over the weekend" a few days ago, well, now you know. That said, you mention attr_accessible in your post: that's gone as of the next release of Rails. Basicall…
Nothing gives me confidence in a platform like "almost nobody is even paid to work on Rails."
I agree, this is a dangerous sentiment.
Whether money is involved or not, for a framework, developers should either be committed to their products or not.
If this was a different sort of product then that limitation of not getting paid might carry some weight, but when you encourage people to develop on top of your platform and when it is shown to have egregious flaws there is no excuse. You either get to work fixing them or you tell the world to stop using your framework because it's broken and not going to be fixed.
Fortunately, the Rails devs are seriously committed to their product, which is why these fixes came out so quickly.
Edit: The Rails team is certainly deserving of many thanks, but they don't get a pass on problems just 'cause they work for free. Similarly, if someone gives me a free car I will thank them, but if that car starts a fire in the garage and burns down my house I will curse them too.