A week with a Rails Security Strategy: More security, new habits
1–10 of 27 posts
Re: A week with a Rails Security Strategy: More security, new habits
#2The biggest issue we have seen in client projects, where they have an existing Rails project is not just the numerous holes in the core framework, but that they used many, many gems, the majority of which end us as abandonware, and are often chock-full of poor code, security blunders and generally bad design, that leaves the site wide open.
We have been able to successfully migrate a number of clients onto alternative lighter frameworks, or in some cases lean stacks, given they received a massively over engineered rails project for what was really a CMS requirement.
I really hope one day to stumble onto a well written, well maintained and we'll designed Rails app, but have not seen one yet...
Re: A week with a Rails Security Strategy: More security, new habits
#3I didn't even know there was such a thing as "Ruby on Rails Security".
Re: A week with a Rails Security Strategy: More security, new habits
#4The biggest issue we have seen in client projects, where they have an existing Rails project is not just the numerous holes in the core framework, but that they used many, many gems, the majority of which end us as abandonware, and are often chock-full of poor code, security blunders and generally bad design, that leaves the site wide open. We have been able to successfully migrate a number of clients onto alternativ…
> have not seen one yet
Perhaps that's because the kind of person who has this kind of attitude, and who'd create an account called "tddfuckwitz" to come and spout it on HN, doesn't make a very good impression on the kind of rails devs who do know what they're doing, so you don't win them as clients.
- signed, a professional rails dev who takes security and code quality very seriously indeed
Re: A week with a Rails Security Strategy: More security, new habits
#5The biggest issue we have seen in client projects, where they have an existing Rails project is not just the numerous holes in the core framework, but that they used many, many gems, the majority of which end us as abandonware, and are often chock-full of poor code, security blunders and generally bad design, that leaves the site wide open. We have been able to successfully migrate a number of clients onto alternativ…
> have not seen one yet Perhaps that's because the kind of person who has this kind of attitude, and who'd create an account called "tddfuckwitz" to come and spout it on HN, doesn't make a very good impression on the kind of rails devs who do know what they're doing, so you don't win them as clients. - signed, a professional rails dev who takes security and code quality very seriously indeed
Cute - inserting the word 'professional' before rails dev, and then claiming to take security and code quality seriously!
ROFL
If a developer was professional, and cared about code quality and security, they would not use rails. Period.
Re: A week with a Rails Security Strategy: More security, new habits
#6I didn't even know there was such a thing as "Ruby on Rails Security".
To the people downvoting me:
- http://www.cvedetails.com/product/22568/Rubyonrails-Ruby-On-...
- http://www.cvedetails.com/vulnerability-list/vendor_id-12043...
Re: A week with a Rails Security Strategy: More security, new habits
#7Earlier quoted context omitted.
> have not seen one yet Perhaps that's because the kind of person who has this kind of attitude, and who'd create an account called "tddfuckwitz" to come and spout it on HN, doesn't make a very good impression on the kind of rails devs who do know what they're doing, so you don't win them as clients. - signed, a professional rails dev who takes security and code quality very seriously indeed
Cute - inserting the word 'professional' before rails dev, and then claiming to take security and code quality seriously! ROFL If a developer was professional, and cared about code quality and security, they would not use rails. Period.
Says the 8 hour old troll account.
Re: A week with a Rails Security Strategy: More security, new habits
#8I didn't even know there was such a thing as "Ruby on Rails Security".
To the people downvoting me: - http://www.cvedetails.com/product/22568/Rubyonrails-Ruby-On-... - http://www.cvedetails.com/vulnerability-list/vendor_id-12043...
It's a complicated platform, but on the whole has a very good track record.
Picking on it for having vulnerabilities without providing something in the way of a comparison is not very meaningful.
Re: A week with a Rails Security Strategy: More security, new habits
#9Earlier quoted context omitted.
> have not seen one yet Perhaps that's because the kind of person who has this kind of attitude, and who'd create an account called "tddfuckwitz" to come and spout it on HN, doesn't make a very good impression on the kind of rails devs who do know what they're doing, so you don't win them as clients. - signed, a professional rails dev who takes security and code quality very seriously indeed
Cute - inserting the word 'professional' before rails dev, and then claiming to take security and code quality seriously! ROFL If a developer was professional, and cared about code quality and security, they would not use rails. Period.
Yeah! They'd use PHP! Or Java! Those never have any problems and their code-bases are always flawless.
I'll take a bad Rails app any day over what people churn out in other platforms. I've seen Java apps so impenetrably opaque it's not even clear what it does. Rails is Rails. It's boring. It works. It's pretty hard to mangle the project so badly that you can't make sense of it.
Unless, of course, you've got no idea what Rails is or how it works.
Re: A week with a Rails Security Strategy: More security, new habits
#10The biggest issue we have seen in client projects, where they have an existing Rails project is not just the numerous holes in the core framework, but that they used many, many gems, the majority of which end us as abandonware, and are often chock-full of poor code, security blunders and generally bad design, that leaves the site wide open. We have been able to successfully migrate a number of clients onto alternativ…
What are some of the lighter frameworks you migrate your clients to? What do you mean by lean stacks?