4 ms·
> Gitlab is written on Ruby on Rails; you should understand the security implications of Ruby on Rails before using Gitlab Can someone ELI5 the security implic
by navanchauhan 6y ago
> Gitlab is written on Ruby on Rails; you should understand the security implications of Ruby on Rails before using Gitlab
Can someone ELI5 the security implications of Ruby on Rails?
- breatheoften 6y agoI'm sure its 'less bad' now -- but here's an example of an absolutely horrendous security-bug-as-a consequence-of-design-deeply-baked-into-rails ... https://github.com/rails/rails/issues/13420 https://github.com/rails/rails/issues/13420 Interestingly -- the rails developers decided to put in a really horrendous hack to mitigate the common paths through which this design-flaw might lead to unexpected security outcomes ... In a way, one could argue that the willingness to put in a horrendous hack to 'mitigate' a security flaw provides an example which demonstrates some amount of 'security reasonableness' in rails ... In reality tho -- I think that this example serves as evidence more for the fact that rails is deeply flawed and very unlikely to be secure in practice -- for reasons of design complexity alone.
- navanchauhan 6y agoThank you. I agree with you, even though most of the tech world is run on bodges, that does not mean it is the right thing to do.
- neurostimulant 6y agoThere were multiple high profile rails vulnerabilities in the past, such as the infamous yaml vulnerability in 2013 which allows executing arbitrary code in all rails app.
- navanchauhan 6y agoThank you for explaining
- moogly 6y agoFunny. Unless something changed, GitHub is also extensively using RoR.