Ruby 1.8.7 retired • Hacker News Board

Re: Ruby 1.8.7 retired

#61

Post by __mp » Mon, Jul 01, 2013, 9:10 AM UTC

regularfry wrote: post #53

__mp wrote: post #37

The whole ruby ecosystem is a nightmare for system administrators. Ubuntu/Debian still ships with ruby 1.8.7 and 1.9.1p0 (which is evil I heard). In order to install a new ruby version one has to most likely compile it from scratch: - Since there are no deb packages and there is no sane way to build deb packages - Overriding system ruby has to be avoided since we manage the whole infrastructure with puppet (yes you c…

> The whole ruby ecosystem is a nightmare for system administrators. It's getting better. John Leach over at Brightbox has a ppa with up-to-date binary ruby packages: http://blog.brightbox.co.uk/posts/next-generation-ruby-packa... https://launchpad.net/~brightbox/+archive/ruby-ng-experiment... I'd suggest giving them a go, and mirroring them inside your infrastructure if they work for you. It's very annoying that che…

>> It get's really interesting once you use puppet to install an RVM ruby version.

> Yeah, don't do that.

Why not? Puppet-RVM (https://github.com/blt04/puppet-rvm ) works very well. And puppet is basically a system documentation. Since it's clear what's installed on the machine.

Re: Ruby 1.8.7 retired

#62

Post by blablabla123 » Mon, Jul 01, 2013, 9:48 AM UTC

fbuilesv wrote: post #31

blablabla123 wrote: post #28

Earlier quoted context omitted.

> and you had five years to migrate to 1.9 Given that you were at the project right from the start and allowed to spend time necessary. It's funny to hear people moan on the one hand about corporate that use Java EE or even Cobol but on the other hand refuse to accept that in order for their software to be usable, it needs to be stable in some senses.

When you joined a project is irrelevant. If you were hired two days ago and only found out about this now: tough luck, you have some work to do [0]. Even "stable", older platforms like Cobol have to deal with this (Micro Focus makes money off it with products like their Cobol set of tools ( http://www.microfocus.com/mcro/cobol/index.aspx ) [1]). [0] Or maybe not. Your non-core [2] apps that run on 1.8.7 will still wo…

[0] Precisely.

[1], [2] After all management does such decisions. I have warned people face-to-face, via E-Mail, through all possible channels. So if things go wild, it's their problem, not mine.

Re: Ruby 1.8.7 retired

#63

Post by regularfry » Mon, Jul 01, 2013, 11:12 AM UTC

__mp wrote: post #61

regularfry wrote: post #53

Earlier quoted context omitted.

> The whole ruby ecosystem is a nightmare for system administrators. It's getting better. John Leach over at Brightbox has a ppa with up-to-date binary ruby packages: http://blog.brightbox.co.uk/posts/next-generation-ruby-packa... https://launchpad.net/~brightbox/+archive/ruby-ng-experiment... I'd suggest giving them a go, and mirroring them inside your infrastructure if they work for you. It's very annoying that che…

>> It get's really interesting once you use puppet to install an RVM ruby version. > Yeah, don't do that. Why not? Puppet-RVM ( https://github.com/blt04/puppet-rvm ) works very well. And puppet is basically a system documentation. Since it's clear what's installed on the machine.

First, you're introducing deployment-time dependencies on network resources you don't control. The worst time to discover just how bad an idea that is is when you've just had a critical server go pop while rvm.io (for instance) is having DNS problems, and you've got clients, bosses and clients' bosses breathing down your neck to fix it.

Second, it implies you've got build tools installed on your production machines. That's bad for security.

Third, I've seen RVM screw up too much to trust it. It's got far too many moving parts, and so far I haven't found anything I need which it does that isn't done better by some other simpler tool.

Re: Ruby 1.8.7 retired

#64

Post by enko » Tue, Jul 02, 2013, 4:39 AM UTC

regularfry wrote: post #59

enko wrote: post #58

Earlier quoted context omitted.

Sounds like an awful lot of work for no good reason I can think of. You'll need a compiler, anyway, once you start trying to use any number of libraries requiring compiled C extensions. "No compilers on production!" might be true elsewhere but I can't see any reason it applies for ruby deployments.

> Sounds like an awful lot of work for no good reason I can think of. Perfectly reproducible deploys and shutting down attack vectors are both very good reasons. > You'll need a compiler, anyway, once you start trying to use any number of libraries requiring compiled C extensions. Only if you're doing `gem install` in production. Guess what? That's not a particularly good idea either. > "No compilers on production!"…

In the real world, we don't have unlimited time, so we have to try to balance effort required versus the outcomes we desire in order to get the best "bang for buck" out of our time. Your suggestions are incompatible with this imperative.

> Perfectly reproducible deploys and shutting down attack vectors are both very good reasons.

No they're not. Firstly, I already have good enough deploys. Secondly, the attack vector you're talking about - having a compiler installed (!) - is almost not worth mentioning and certainly does not justify the huge extra effort. We're running a business here.

> Only if you're doing `gem install` in production. Guess what? That's not a particularly good idea either.

Says you, and pretty much only you. Anything else is a massive inconvenience. Everyone does this. It may not be "perfect" but again, we are running businesses here.

> If you've got reasons it should be exempt from the best practices that have been learnt elsewhere

No, it doesn't work like that. "Best practice" does not mean a blind adherence to some decade-old set of irrelevant rules ahead of all practical operational priorities. What the ruby community has is a practical balance - workable, efficient, fast. What you suggest rings of a disconnected IT department with no incentive to make life easy for those trying to iterate fast. It smacks of ass-covering and excuses; I know it well.

You've not made any points I find compelling in the least. Anyway, I don't wish to argue about it, I simply wish to point out, to any others reading this, that your opinion on best practise for ruby deployments is controversial, to say the least.

Anyway, I doubt you've actually done any deployments at all in accordance with the ridiculous "best practise" you've outlined. I doubt anyone has. I, on the other hand, have had great success with my approach, as have countless others. As usual, the armchair quarterback has any number of wise-sounding criticisms, but is not actually in the game.

Re: Ruby 1.8.7 retired

#65

Post by regularfry » Tue, Jul 02, 2013, 1:42 PM UTC

enko wrote: post #64

regularfry wrote: post #59

Earlier quoted context omitted.

> Sounds like an awful lot of work for no good reason I can think of. Perfectly reproducible deploys and shutting down attack vectors are both very good reasons. > You'll need a compiler, anyway, once you start trying to use any number of libraries requiring compiled C extensions. Only if you're doing `gem install` in production. Guess what? That's not a particularly good idea either. > "No compilers on production!"…

In the real world, we don't have unlimited time, so we have to try to balance effort required versus the outcomes we desire in order to get the best "bang for buck" out of our time. Your suggestions are incompatible with this imperative. > Perfectly reproducible deploys and shutting down attack vectors are both very good reasons. No they're not. Firstly, I already have good enough deploys. Secondly, the attack vector…

> Secondly, the attack vector you're talking about - having a compiler installed (!) - is almost not worth mentioning

I would mention "reducing the attack surface" and "privilege escalation", but you've already decided you know best on that front. Given the choice between "running a business" and "running a business securely"... well, you're happy with where you are on that spectrum, clearly.

>> If you've got reasons it should be exempt from the best practices that have been learnt elsewhere

> No, it doesn't work like that.

I'm afraid it does. Ruby may have a "practical balance", as you put it, but unless you can demonstrate, in specific, why it's better than established practice, the best practice stays. Otherwise you can't possibly understand the trade-off you're making. Blind adherence has no place here, in either direction.

I know Ruby has shiny tools for doing this stuff, but you're trading getting it done right for getting it done now when you don't actually know how much work doing it right would take. I can tell, because you seem to think ("huge extra effort"? Seriously?) packaging is hard.

> Everyone does this.

The Ruby ecosystem is the one claiming exceptionalism here, it's down to Rubyists to demonstrate why it's better, for instance, to gem install directly to production rather than build packages, and why it's worth risking rubygem's failure modes in addition to those which might affect the packaging system.

I get that it's comforting to travel in a herd. It's valuable to stop and question where that herd is going, and ask why the grass under your feet isn't better trampled.

> your opinion on best practise for ruby deployments is controversial, to say the least.

As an opinion on deployments in general, it really isn't. Now, tell me again why ruby deployments are special?

> As usual, the armchair quarterback has any number of wise-sounding criticisms, but is not actually in the game.

Heh. Cute. Wrong, but still cute :-) We can, and do, push out several ruby app deployments a day via apt-get, when we want to. Nothing stops us from iterating fast. You can have your cake and eat it too.

Re: Ruby 1.8.7 retired

#66

Post by enko » Tue, Jul 02, 2013, 1:58 PM UTC

regularfry wrote: post #65

enko wrote: post #64

Earlier quoted context omitted.

In the real world, we don't have unlimited time, so we have to try to balance effort required versus the outcomes we desire in order to get the best "bang for buck" out of our time. Your suggestions are incompatible with this imperative. > Perfectly reproducible deploys and shutting down attack vectors are both very good reasons. No they're not. Firstly, I already have good enough deploys. Secondly, the attack vector…

> Secondly, the attack vector you're talking about - having a compiler installed (!) - is almost not worth mentioning I would mention "reducing the attack surface" and "privilege escalation", but you've already decided you know best on that front. Given the choice between "running a business" and "running a business securely"... well, you're happy with where you are on that spectrum, clearly. >> If you've got reasons…

Sorry. I do not believe you deploy ruby apps of any significance. Your opinions are way out of alignment with the rest of the community. You're trying to paint yourself as some kind of "voice of sanity" security-wise but it is unavailing IMO.

Convenience vs security is always a tradeoff. You advocate a total lack of convenience, for a minimal, at best, gain in security (any issues are likely to be at a far higher level). I find your arguments unconvincing, to say the least, and I would decline to implement your suggestions at the 4 or so companies my opinions hold sway.

> it's down to Rubyists to demonstrate why it's better, for instance, to gem install directly to production rather than build packages

Great, an easy one. Ruby has its own packaging system and uses bundler to determine dependencies. Using this system I can install the dependencies - which may include complex custom compilations against local libraries - immediately and conveniently. I can update it any time I want.

You can't. You have some crazy manual system of packaging these compiled libraries then distributing them via some private repo. For what? You gain nothing. Now all deployments are some house of cards game of trying to get the sysadmin to package up the right X when you need it. Instead of the devs being able to deploy directly. Why would you even bother?

> I get that it's comforting to travel in a herd.

Stop trying to paint yourself as the sole voice of reason in an insane world. In this case, the herd is doing the right thing.

> We can, and do, push out several ruby app deployments a day via apt-get, when we want to

Bullshit. Sorry, but I don't believe a word you say. You have never deployed apps for a company who cares about speed and efficiency, like a startup. If you had, you wouldn't hold these ridiculous beliefs.

Re: Ruby 1.8.7 retired

#67

Post by sjtgraham » Thu, Jul 04, 2013, 8:17 PM UTC

enko wrote: post #66

regularfry wrote: post #65

Earlier quoted context omitted.

> Secondly, the attack vector you're talking about - having a compiler installed (!) - is almost not worth mentioning I would mention "reducing the attack surface" and "privilege escalation", but you've already decided you know best on that front. Given the choice between "running a business" and "running a business securely"... well, you're happy with where you are on that spectrum, clearly. >> If you've got reasons…

Sorry. I do not believe you deploy ruby apps of any significance. Your opinions are way out of alignment with the rest of the community. You're trying to paint yourself as some kind of "voice of sanity" security-wise but it is unavailing IMO. Convenience vs security is always a tradeoff. You advocate a total lack of convenience, for a minimal, at best, gain in security (any issues are likely to be at a far higher lev…

> Sorry. I do not believe you deploy ruby apps of any significance. Your opinions are way out of alignment with the rest of the community. You're trying to paint yourself as some kind of "voice of sanity" security-wise but it is unavailing IMO.

Wow. Appeal to authority and ad hominem in the first line. Good start!