Update Rails or not – security issues either way
browserbite.com
Update Rails or not – security issues either way
1–10 of 48 posts
Re: Update Rails or not – security issues either way
#2Another option is to fork Rails and use the patch files (included with the CVE) that target only the vulnerabilities addressed in the CVE.
The problem with upgrading to mitigate security issues is that the Rails team does not release security patches. They bump the minor-minor and do a release. That release almost always includes commits that are unrelated to the security issue. This is especially true when a lot of time passes between CVEs.
Maintaining your own branch really isn't that difficult, because you can simply merge in from upstream. In most cases, you're really only interested in patching from Rails team issued security fixes, so you won't have conflicts. If you do have conflicts, you can safely overwrite anything in your fork, because you're not developing Rails, you're simply maintaining tighter control over the release that you use.
Re: Update Rails or not – security issues either way
#3Another option is to fork Rails and use the patch files (included with the CVE) that target only the vulnerabilities addressed in the CVE. The problem with upgrading to mitigate security issues is that the Rails team does not release security patches. They bump the minor-minor and do a release. That release almost always includes commits that are unrelated to the security issue. This is especially true when a lot of…
Or don't use Rails.
Re: Update Rails or not – security issues either way
#4Another option is to fork Rails and use the patch files (included with the CVE) that target only the vulnerabilities addressed in the CVE. The problem with upgrading to mitigate security issues is that the Rails team does not release security patches. They bump the minor-minor and do a release. That release almost always includes commits that are unrelated to the security issue. This is especially true when a lot of…
Or don't use Rails.
^^ This is good advice. Maybe they should question their choice of platform - there are other options, some of which seem to have had a bit more forethought in their architecture and engineering.
Remember: Ruby/Rails to pose, Python for pros.
Re: Update Rails or not – security issues either way
#5Another option is to fork Rails and use the patch files (included with the CVE) that target only the vulnerabilities addressed in the CVE. The problem with upgrading to mitigate security issues is that the Rails team does not release security patches. They bump the minor-minor and do a release. That release almost always includes commits that are unrelated to the security issue. This is especially true when a lot of…
Well - that's enough work to maintain your own app. Maintainging a fork of Rails and drilling through all of the vulnerabilities - that's an extra overhead. It's simpler to regression test your own app, I suppose.
Re: Update Rails or not – security issues either way
#6Earlier quoted context omitted.
Or don't use Rails.
^^ This is good advice. Maybe they should question their choice of platform - there are other options, some of which seem to have had a bit more forethought in their architecture and engineering. Remember: Ruby/Rails to pose, Python for pros.
> Remember: Ruby/Rails to pose, Python for pros.
How mature.
Re: Update Rails or not – security issues either way
#7Earlier quoted context omitted.
Or don't use Rails.
^^ This is good advice. Maybe they should question their choice of platform - there are other options, some of which seem to have had a bit more forethought in their architecture and engineering. Remember: Ruby/Rails to pose, Python for pros.
...and whitespacephiles. :)
Re: Update Rails or not – security issues either way
#8Another option is to fork Rails and use the patch files (included with the CVE) that target only the vulnerabilities addressed in the CVE. The problem with upgrading to mitigate security issues is that the Rails team does not release security patches. They bump the minor-minor and do a release. That release almost always includes commits that are unrelated to the security issue. This is especially true when a lot of…
Or don't use Rails.
Or Linux, or MySQL.
Re: Update Rails or not – security issues either way
#9So what was the issue from Rails, specifically?
Re: Update Rails or not – security issues either way
#10Do you know how many Rails developers I've heard pissing on Flash or Java and its security vulnerabilities? Many - until recently. Now suddeningly these faults are an accepted aspect of Rails development. Really. I guess this more of a rant about how unfairly the Rails community (ie. dhh) has been on others, but now expects critics to look away while it happens in the Rails community on a weekly basis.