3 ms·
The good news is that the Rails project has a robust security process, and because we handle IP spoofing, there's a place to discuss this vulnerability. (See h
by wycats 14y ago
The good news is that the Rails project has a robust security process, and because we handle IP spoofing, there's a place to discuss this vulnerability.
(See http://rubyonrails.org/security http://rubyonrails.org/security ; as a member of the security list, I can verify that we take every report extremely seriously)
That means that long-term, the number of vulnerabilities in Rails apps decrease, even for users unaware of the specific vulnerabilities. Again, that doesn't mean that Rails apps will never be vulnerable, it just means that you're sharing much of the responsibility for securing your app with many others through a project that takes resolving security vulnerabilities extremely seriously.
- gingerlime 14y agoThat's really good to know. I don't doubt the rails project has a good security process. I wasn't aware of this page, but perhaps should have searched better. I believe that the security coordinator (Michael Koziarski) was actually involved on the discussion around this on github, so I'm not sure whether this needs to be forwarded to the email address again? I'm not trying to make this into a huge issue, which in most setups and apps most likely isn't. I do think it's important people are aware of this, and if they are vulnerable they can and should protect themselves. I have suggested a number of workarounds to address this issue on my post in hope that people use those, whether or not the rails project as a whole is going to address the issue.