3 ms·

I suspect behind your comment there's probably a bit of nagging resentment because Rails seems to have triumphed over <PreferredFramework> despite Rails' Obviou

I suspect behind your comment there's probably a bit of nagging resentment because Rails seems to have triumphed over <PreferredFramework> despite Rails' Obvious Flaws -- amirite? No, you couldn't be any more wrong. I'm not sure why you Ruby on Rails advocates always make this assumption, or accusation, any time that you encounter somebody doesn't hold a pro-Rails attitude. I saw some other commenter in this thread make the same incorrect assumption. I couldn't even tell you exactly how many programming languages, frameworks and libraries I've worked with over my career. I've used Fortran, PL/I, COBOL, C, C++, Objective-C, Java, C#, VB, VB.NET, Python, Perl, JavaScript, and yes, even Ruby professionally at one time or another. I'm probably forgetting some, and there are also some proprietary languages I've worked with, too. I've lost track of how many different GUI, database, and web development frameworks I've encountered. Ruby on Rails is merely one among probably at least 80 to 100 frameworks that I've used at one time or another. You see, I don't really have a "preferred framework". I do know that some communities are made up of people who hold attitudes that are, to put it mildly, quite toxic. They make claims that they cannot back up. They make serious mistakes without realizing it, and then deny it when they are pointed out. The Ruby on Rails community is like this, unfortunately. I'm not going to pretend that they aren't, either.

jwilliams 14y ago
Ok, but what's your point and how does it relate to the article? Your original post points to smugness, a lax approach to security and incorrect statements -- none of which I witness or interpreted from this blog post. In fact I'd argue this blog post actually refutes all of the points you are making. It's factual, detailed, to the point and it doesn't make light of the issue at all.
- PommeDeTerre 14y ago
  Follow the entire thread of discussion, right back to tptacek's original post, and the article itself. The article's conclusion says, "... it is not a “giant bug”, it is much more subtle than that and requires a specific combination of code and circumstances to work. Most apps are not vulnerable." To me, Thomas Ptacek appears to be suggesting that maybe there is more to this situation than meets the eye, and that maybe the article is not correct in making statements like, "Most apps are not vulnerable." I merely pointed out that the Ruby on Rails community, in general, has a bad reputation when it comes to making claims. Often, the claims are shown to be complete nonsense. If there is more to this vulnerability, and that it turns out that many Ruby on Rails apps actually are affected, then I wouldn't be surprised at all. I just hope that people do take this vulnerability seriously, contrary to what some articles may say, and do proper inspections of their Rails web apps.
  - FooBarWidget 14y ago
    I believe you've accidentally omitted the following important and relevant pieces from the article and the following author comments: "There are other exploitable scenarios, but it really depends on what your app is doing. Since it is impossible to prove that something isn’t insecure, you should take the vulnerability seriously and upgrade anyway even if you think you aren’t affected." - article subsection "Summary: what is this vulnerability?" "a leaked key is NOT necessary to exploit the bug" - author comment on the article. "Another (unrelated) Rails vulnerability has been found today. That vulnerability has not been publicized yet, but suffice to say it is a very embarrassing and serious vulnerability that deserves immediate attention. Please keep your eye open on future advisories." - author comment on the article. "Not disagreeing with you there. After all there's no way to prove that something doesn't exist. What's why I wrote that everyone should upgrade, just in case. :) The goal of the article is not to defend Rails. It is to inform about the nature of the vulnerability and to replace the feeling of panic with rational thoughts." - author comment on HN

jwilliams 14y ago

Ok, but what's your point and how does it relate to the article? Your original post points to smugness, a lax approach to security and incorrect statements -- none of which I witness or interpreted from this blog post. In fact I'd argue this blog post actually refutes all of the points you are making. It's factual, detailed, to the point and it doesn't make light of the issue at all.

PommeDeTerre 14y ago
Follow the entire thread of discussion, right back to tptacek's original post, and the article itself. The article's conclusion says, "... it is not a “giant bug”, it is much more subtle than that and requires a specific combination of code and circumstances to work. Most apps are not vulnerable." To me, Thomas Ptacek appears to be suggesting that maybe there is more to this situation than meets the eye, and that maybe the article is not correct in making statements like, "Most apps are not vulnerable." I merely pointed out that the Ruby on Rails community, in general, has a bad reputation when it comes to making claims. Often, the claims are shown to be complete nonsense. If there is more to this vulnerability, and that it turns out that many Ruby on Rails apps actually are affected, then I wouldn't be surprised at all. I just hope that people do take this vulnerability seriously, contrary to what some articles may say, and do proper inspections of their Rails web apps.
- FooBarWidget 14y ago
  I believe you've accidentally omitted the following important and relevant pieces from the article and the following author comments: "There are other exploitable scenarios, but it really depends on what your app is doing. Since it is impossible to prove that something isn’t insecure, you should take the vulnerability seriously and upgrade anyway even if you think you aren’t affected." - article subsection "Summary: what is this vulnerability?" "a leaked key is NOT necessary to exploit the bug" - author comment on the article. "Another (unrelated) Rails vulnerability has been found today. That vulnerability has not been publicized yet, but suffice to say it is a very embarrassing and serious vulnerability that deserves immediate attention. Please keep your eye open on future advisories." - author comment on the article. "Not disagreeing with you there. After all there's no way to prove that something doesn't exist. What's why I wrote that everyone should upgrade, just in case. :) The goal of the article is not to defend Rails. It is to inform about the nature of the vulnerability and to replace the feeling of panic with rational thoughts." - author comment on HN