5 ms·

Good post but please, please, please don't enable this in productiont. What an extremely wonderful way to DDoS any Rails app (as if it weren't easy enough alrea

Good post but please, please, please don't enable this in productiont. What an extremely wonderful way to DDoS any Rails app (as if it weren't easy enough already). If you need production like characteristics for accuracy of profiling then set up another environment that is production-like (Rails settings, replicated database, infrastructure etc.) and run it there.

nateberkopec 11y ago
You can put `rack-mini-profiler` behind authentication. It is not enabled by default in production. I believe I mentioned this in the article, if not, it's in the README.
- rubiquity 11y ago
  I would try and word it more carefully. The phrase "in production" has serious meaning. I think that's what startled myself (and it seems like some others, too).
  - madebysquares 11y ago
    Although your take away may have been that everyone should enable it in production. I think every developer should use common sense and practical knowledge when implementing a feature in their application. If you want to use it you should know that having this available for all users is not a great idea, and use it accordingly.
    - rubiquity 11y ago
      You would be surprised by the lack of common sense in the software community. Maybe even more so in Ruby/Rails. As an example, there are a lot of people running WEBrick in production.
- otterley 11y ago
  I agree with rubiquity - the article as written strongly suggests that users enable it in production. I'd amend it to be far clearer about what you mean. Directly from the second paragraph: > The best part - rack-mini-profiler is designed to be run in production. Yeah! Then later: > rack-mini-profiler is designed to be used in production.
sams99 11y ago
MiniProfiler was originally developed at StackExchange for production profiling. It gave admins a clear picture of what is going on, all the time, and transformed the way we reasoned about performance. rack-mini-profiler is a port, I use it in development and still predominantly in production! The key is that ONLY and ONLY admins get access to the features, and we only do profiling for admins. To achieve this nothing is measured unless a request is explicitly authorized. Very odd to hear this DDoS concern.

nateberkopec 11y ago

You can put `rack-mini-profiler` behind authentication. It is not enabled by default in production. I believe I mentioned this in the article, if not, it's in the README.

rubiquity 11y ago
I would try and word it more carefully. The phrase "in production" has serious meaning. I think that's what startled myself (and it seems like some others, too).
- madebysquares 11y ago
  Although your take away may have been that everyone should enable it in production. I think every developer should use common sense and practical knowledge when implementing a feature in their application. If you want to use it you should know that having this available for all users is not a great idea, and use it accordingly.
  - rubiquity 11y ago
    You would be surprised by the lack of common sense in the software community. Maybe even more so in Ruby/Rails. As an example, there are a lot of people running WEBrick in production.
otterley 11y ago
I agree with rubiquity - the article as written strongly suggests that users enable it in production. I'd amend it to be far clearer about what you mean. Directly from the second paragraph: > The best part - rack-mini-profiler is designed to be run in production. Yeah! Then later: > rack-mini-profiler is designed to be used in production.

sams99 11y ago

MiniProfiler was originally developed at StackExchange for production profiling. It gave admins a clear picture of what is going on, all the time, and transformed the way we reasoned about performance. rack-mini-profiler is a port, I use it in development and still predominantly in production! The key is that ONLY and ONLY admins get access to the features, and we only do profiling for admins. To achieve this nothing is measured unless a request is explicitly authorized. Very odd to hear this DDoS concern.