Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Update Rails or not – security issues either way

browserbite.com

Post reply on HN
Print view View original

21–30 of 48 posts

Re: Update Rails or not – security issues either way

#21

Post by PetrolMan »

static_typed wrote: post #19

Give a developer a Ruby-based web framework, and they can run for a day without patching, but give them anything else - even Prolog on Punchcards - and they run for so much longer! Stop today, and help recovering Ruby developers onto a better path!

I'm not really sure I understand this sentiment. I understand that the Rails community has had a reputation in the past of being arrogant but why take joy in the growing pains of a development community? Why foster an "us vs them" sentiment in the general development community? My understanding is that we are all doing the same things, we just have chosen different ways to get there.

Re: Update Rails or not – security issues either way

#22

Post by tptacek »

tomkin wrote: post #10

Do you know how many Rails developers I've heard pissing on Flash or Java and its security vulnerabilities? Many - until recently. Now suddeningly these faults are an accepted aspect of Rails development. Really. I guess this more of a rant about how unfairly the Rails community (ie. dhh) has been on others, but now expects critics to look away while it happens in the Rails community on a weekly basis.

The security problems of Flash and Java are not comparable to those of Rails. They're different in magnitude, different in number, and different in circumstance and origin.

I strongly agree with 'knowtheory that gloating about security vulnerabilities is a bad habit. But this Rails/Java comparison is even worse. Nobody personalizes Java insecurity. The Java applet plugin is a mess, responsible for a huge number of compromised desktops, but nobody I know would assume that a developer who worked in Java or on the JVM would be security-illiterate. That's not true of the Rails drama, which is really an opportunity for people to piss on DHH and his personality cult, as you can see in this subthread with 'static_typed's comment.

Re: Update Rails or not – security issues either way

#23

Post by davesims »

static_typed wrote: post #19

Give a developer a Ruby-based web framework, and they can run for a day without patching, but give them anything else - even Prolog on Punchcards - and they run for so much longer! Stop today, and help recovering Ruby developers onto a better path!

Your attempt to drive developers to Ruby and Rails by playing the role of a typical ignorant anti-rails fundamentalist crusader will fail.

Re: Update Rails or not – security issues either way

#24

Post by innguest »

superuser2 wrote: post #15
sergiotapia wrote: post #12

I've shared my sentiment here before on why I'm not going to use Rails anymore. Imagine having your code working fine, and you update a MINOR version 3.2.x - and your ORM starts returning results that it didn't used to. Heh. Not worth the heartburn. I've switched to a saner, more tought out framework. Rails is gorgeous, but not safe to use for any serious systems where you're in a small team.

What did you switch to?

Probably ASP.Net MVC -> https://news.ycombinator.com/item?id=5410169

Re: Update Rails or not – security issues either way

#25

Post by knowtheory »

static_typed wrote: post #13
tomkin wrote: post #10

Do you know how many Rails developers I've heard pissing on Flash or Java and its security vulnerabilities? Many - until recently. Now suddeningly these faults are an accepted aspect of Rails development. Really. I guess this more of a rant about how unfairly the Rails community (ie. dhh) has been on others, but now expects critics to look away while it happens in the Rails community on a weekly basis.

Rails became worse than the frameworks and ecosystems it laughed at in it's younger days. Remember - Rails is Omakase - meaning literally 'leave it to someeone else' - food for thought indeed.

Your point (trolling really) doesn't make any sense (and really the Omakase thing never made sense to begin with).

The core value proposition for Rails has always been it incorporates enough of all of the things you need to get a web app up and running quickly, easily, and with sufficient power that your app can continue to grow into the future.

That's what DHH's original blog post screen cast was about certainly. wycats and carllerche's contributions to Rails after the Rails/Merb merge have focused both on better code discipline and ease/simplicity of use for everyone, from beginners to advanced devs.

On top of that the Rails security team has been totally on top of these disclosures and releasing patches that address them. Prominent members of the Rails community have been extraordinarily vocal in advocating that EVERYONE needs to upgrade their apps.

So, please, tell me again how Rails leaves things to others.

P.S. if you really want á la carte, use Sinatra, or Padrino.

P.P.S. Ah, if you look at the actual meaning of omakase (http://en.wikipedia.org/wiki/Omakase ), it basically means, devs entrust the defaults to the Rails team, which is basically how things actually work w/ Rails.

Re: Update Rails or not – security issues either way

#26

Post by zwily »

philwelch wrote: post #16
sergiotapia wrote: post #12

I've shared my sentiment here before on why I'm not going to use Rails anymore. Imagine having your code working fine, and you update a MINOR version 3.2.x - and your ORM starts returning results that it didn't used to. Heh. Not worth the heartburn. I've switched to a saner, more tought out framework. Rails is gorgeous, but not safe to use for any serious systems where you're in a small team.

If you're willing to trade off stability for features, the Rails 2.3 line still receives security patches to this day. You can upgrade to Rails 3 when Rails 4 comes out. If you're willing to make a slightly different trade-off, just apply the security patches as they come out and don't upgrade minor versions without integration testing.

I have heard, but can't find an official reference to it now, that Rails 2.3 will stop receiving security updates once Rails 4 is released. (I suspect that patches will still become available for serious issues even once official support is dropped.)

Re: Update Rails or not – security issues either way

#27

Post by websitescenes »

There is no such thing as an insurmountable security configuration. No matter what you use or how you use it, there will always be new methods to compromise your data. Hackers are creative and enjoy a challenge and will continually attack systems until the end. Whether it be Rails or another framework, you will have to upgrade and address security issues forever. Developers need be realistic and understand that any system can be compromised if one tries hard enough. I don't necessarily think that you should go from rails 2 to 3 or 3 to 4 just to address security features. Better off staying in the branch you started the project in and applying the applicable patches for said security concerns. With that said, RAILS RULES!!

Re: Update Rails or not – security issues either way

#28

Post by tptacek »

knowtheory wrote: post #25
static_typed wrote: post #13

Earlier quoted context omitted.

Rails became worse than the frameworks and ecosystems it laughed at in it's younger days. Remember - Rails is Omakase - meaning literally 'leave it to someeone else' - food for thought indeed.

Your point (trolling really) doesn't make any sense (and really the Omakase thing never made sense to begin with). The core value proposition for Rails has always been it incorporates enough of all of the things you need to get a web app up and running quickly, easily, and with sufficient power that your app can continue to grow into the future. That's what DHH's original blog post screen cast was about certainly. wy…

I don't think I would take things so far as to say that the Rails project has been a model for how to handle security problems.

Re: Update Rails or not – security issues either way

#29

Post by knowtheory »

tptacek wrote: post #28
knowtheory wrote: post #25

Earlier quoted context omitted.

Your point (trolling really) doesn't make any sense (and really the Omakase thing never made sense to begin with). The core value proposition for Rails has always been it incorporates enough of all of the things you need to get a web app up and running quickly, easily, and with sufficient power that your app can continue to grow into the future. That's what DHH's original blog post screen cast was about certainly. wy…

I don't think I would take things so far as to say that the Rails project has been a model for how to handle security problems.

Yep, sorry if I gave that impression.

All I mean to say is that the implication that the Rails community has been particularly lax over security issues is simply false.

Is there room for improvement? Yeah, probably so.

Re: Update Rails or not – security issues either way

#30

Post by jrochkind1 »

Rails _needs_ to produce security-patch-only patch releases.

This won't be foolproof; there is no such thing as foolproof in software development. There can still be unintentional regressions in security-patch-only releases (and even new security vulnerabilities), as well as new security vulnerabilities in other releases.

Yes, nothing is foolproof. But you can work at improving your quality. Yes, there are other things Rails could do to improve quality, including trying to actually do some variation of semver.

But the most obvious thing with the highest benefit/cost that Rails team could do is always release security patches in security patch only releases, so developers can apply security patch only releases and minimize their exposure to new regressions when doing so. Git should not make this hard to do, just cherry pick the security-patch commits into a branch created off the last release, and release it as a patch release seperately from any other changes.

Am I missing something?

Post reply on HN