Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenBSD removes Rails from the ports tree

marc.info

Post reply on HN
Print view View original

41–50 of 73 posts

Re: OpenBSD removes Rails from the ports tree

#41

Post by chimeracoder »

tedunangst wrote: post #38
whalesalad wrote: post #19

Earlier quoted context omitted.

Yep. I don't know why anyone would want to install something like Rails, Django etc... via their distribution or OS's built-in package management system. I think it's silly actually. Ruby has rubygems, Python has pip, Perl has cpan...

As somebody who occasionally uses software, besides just developing it, learning the command syntax and idiosyncrasies of a half dozen package systems is a pain in the butt. I want to type "pkg_add things I want" and be done with it.

Not to mention that package management isn't a problem that should be solved at every single level possible - package management for the OS, package management for developing in $LANGUAGE, package management for extensions of $PROGRAM written in $LANGUAGE, etc....

Aside from the fact that that's redundant, it's highly error-prone.

Re: OpenBSD removes Rails from the ports tree

#42

Post by [deleted] »

inopinatus wrote: post #36

I'd like to take this opportunity to highlight BSDPAN, which is how FreeBSD integrates her own package database with Perl's native module installation. Since 99% of package management is just files on a filesystem and a bit of dependency analysis, for the purposes of easing installation, permitting bidirectional awareness of state, and alerting administrators to security updates. I would commend any OS that has the s…

[deleted]

Re: OpenBSD removes Rails from the ports tree

#43

Post by igravious »

inopinatus wrote: post #36

I'd like to take this opportunity to highlight BSDPAN, which is how FreeBSD integrates her own package database with Perl's native module installation. Since 99% of package management is just files on a filesystem and a bit of dependency analysis, for the purposes of easing installation, permitting bidirectional awareness of state, and alerting administrators to security updates. I would commend any OS that has the s…

I know this is a bit of a me too post but this is something I have thought should exist for years now.

Another benefit this would provide would be that you'd only have to learn one set of incantations rather than forgetting and looking up whatever subsystem it is you're messing with.

For the life of me I don't know why this does not exist yet. I have such a desire for it that I thought long and hard about building something like this myself but balked at the prospect, for yea it is daunting.

There are others as well: LaTeX (TeXLive) has a package system too, and I am sure there are lots more.

Re: OpenBSD removes Rails from the ports tree

#44

Post by igravious »

tedunangst wrote: post #38
whalesalad wrote: post #19

Earlier quoted context omitted.

Yep. I don't know why anyone would want to install something like Rails, Django etc... via their distribution or OS's built-in package management system. I think it's silly actually. Ruby has rubygems, Python has pip, Perl has cpan...

As somebody who occasionally uses software, besides just developing it, learning the command syntax and idiosyncrasies of a half dozen package systems is a pain in the butt. I want to type "pkg_add things I want" and be done with it.

Therefore 'pkg_add' needs to be able to hook into 'gem install' and 'gem list' and save you (and me) the bother. And this needs to be solved for apt and yum and homebrew and so on as well. I don't know, something needs to be done definitely.

Re: OpenBSD removes Rails from the ports tree

#45

Post by rjbond3rd »

static_typed wrote: post #40
SEJeff wrote: post #4

I'm curious how many people run RoR on OBSD web servers. I suspect it exists, but very rarely

We did. Until a few days ago. IT Security pulled the apps after the recent critical vulns in Rails, and now this vuln with RubyGems. Still using OpenBSD for hosting, but the apps are being ported to PHP and Python as we speak.

Whoa, could you elaborate? I'm sure people would love to hear more context for totally rewriting (not second-guessing, just intensely curious).

Re: OpenBSD removes Rails from the ports tree

#46

Post by static_typed »

rjbond3rd wrote: post #45
static_typed wrote: post #40

Earlier quoted context omitted.

We did. Until a few days ago. IT Security pulled the apps after the recent critical vulns in Rails, and now this vuln with RubyGems. Still using OpenBSD for hosting, but the apps are being ported to PHP and Python as we speak.

Whoa, could you elaborate? I'm sure people would love to hear more context for totally rewriting (not second-guessing, just intensely curious).

Sure. We had a number of Rails apps running in our production environment. The recent weeks have been a very stressful time. A critical Rails or Ruby related vuln is discovered, and then we have to make emergency changes to try avoid the app or server getting compromised.

Of course, given the large number of these critical issues, the business decided to pull and rewrite the apps based on input from the It Security team who described the current Ruby developer culture as being immature, ignorant of software engineering principles, unaware of secure coding, too enamoured with shiny/magic/convenience to care about longer-term implications in their design choices, thinking that constant band-aid fixes are the right way forward rather than acknowledge and fix poor design and implementation, and basically a liability for the company and it's data.

Re: OpenBSD removes Rails from the ports tree

#47

Post by eric970 »

static_typed wrote: post #46
rjbond3rd wrote: post #45

Earlier quoted context omitted.

Whoa, could you elaborate? I'm sure people would love to hear more context for totally rewriting (not second-guessing, just intensely curious).

Sure. We had a number of Rails apps running in our production environment. The recent weeks have been a very stressful time. A critical Rails or Ruby related vuln is discovered, and then we have to make emergency changes to try avoid the app or server getting compromised. Of course, given the large number of these critical issues, the business decided to pull and rewrite the apps based on input from the It Security t…

Dude, every one of your posts on HN I've seen has been about how Ruby sucks and should be thrown away. Either you're a troll or you're a very angry and upset person. Either way, I feel sorry for you.

Re: OpenBSD removes Rails from the ports tree

#48

Post by jdhendrickson »

martinced wrote: post #32
eksith wrote: post #16

Earlier quoted context omitted.

Even more than the security, the reason I use it at home is because I'm lazy and I don't want to go hopping about applying patches to lock things down. Most things take the least amount of effort to configure and, probably most importantly, things are predictable. There's no "magic", everything must be clear, documented and open. An old friend of mine also runs OpenBSD on his machine and I don't think he's restarted…

"An old friend of mine also runs OpenBSD on his machine and I don't think he's restarted in 2 years" I regularly reach 6 months of uptime on my Debian desktop and I've got a Linux server which reaches 4-digits days of uptime. I only reboot when I need to physically move the machine or when a remote-exploit affecting my setup is discovered. OpenBSD takes this even further and more power to them. My "todo list" since a…

May I recommend PFSense rather than OpenBSD proper, all the power of PF wrapped up in a gui that lends itself directly to firewall configuration. I really enjoyed setting up CARP with it.

Re: OpenBSD removes Rails from the ports tree

#49

Post by PommeDeTerre »

byroot wrote: post #20
PommeDeTerre wrote: post #2

This is encouraging to see. If a given port isn't being maintained, and its security is haphazard to begin with, removing it is a very prudent course of action. While I know I can't trust Ruby and the Rails communities to do the right thing, I know with much more certainty that I can rely on the OpenBSD developers to.

I see your numerous FUD posts about Ruby, Javascript & others since a few weeks now, and I'm curious: What is your magical langage / technology that never had any security holes, nor any misconception ?

I've used a lot of different languages, libraries, frameworks, and whatnot over my career. They all have their own problems.

Some, however, have far, far more problems (and more serious problems) than others. JavaScript, Ruby and PHP are three examples of very troubled languages. The languages themselves are filled with rather stupid flaws. Their communities are toxic, and in many cases ignorant. The software written in such languages generally exhibits poor performance, poor security, poor maintainability, and various other issues.

Call it "FUD" if you want. I see it more as the expression of truths that some find painful to acknowledge. Some programming languages and their surrounding environments are much, much worse than others. I'm not going to pretend that they're good when they aren't.

Re: OpenBSD removes Rails from the ports tree

#50

Post by PommeDeTerre »

eric970 wrote: post #47
static_typed wrote: post #46

Earlier quoted context omitted.

Sure. We had a number of Rails apps running in our production environment. The recent weeks have been a very stressful time. A critical Rails or Ruby related vuln is discovered, and then we have to make emergency changes to try avoid the app or server getting compromised. Of course, given the large number of these critical issues, the business decided to pull and rewrite the apps based on input from the It Security t…

Dude, every one of your posts on HN I've seen has been about how Ruby sucks and should be thrown away. Either you're a troll or you're a very angry and upset person. Either way, I feel sorry for you.

I don't mean you any offense, but your response is the kind that makes the entire Ruby community look very bad.

It is perfectly normal for responsible software developers, system administrators and business leaders to get angry or upset by security vulnerabilities. The impact such vulnerabilities can have on an organization is staggering.

When they're exploited, there can be huge sums of money lost. There can be serious legal ramifications. A company's reputation can be destroyed by a single incident. And those are just a few of the consequences.

Even when these vulnerabilities aren't exploited, there are still significant costs associated with fixing them, testing such fixes, deploying the fixes, and so forth.

Software is supposed to bring benefits to its users, not problems and costs. Costly problems with software will make many people angry.

Ruby, Ruby on Rails and some related software have had a very bad time lately. They have caused a lot of problems for a lot of people, and this has indeed resulted in anger and wasted monkey. Some people are making a sensible decision to look toward alternative technologies, to try to minimize their losses.

Instead of labeling such people as "trolls", the Ruby community as a whole needs to engage in some significant self-evaluation. Try to understand why people are expressing what they are, and perhaps even try to learn from what they're saying. Security is important, and the Ruby community needs to learn this fact.

Post reply on HN