5 ms·
>why isn't there more of a focus on security here? Because this is ruby we're talking about. A "Fun" language that has 100000 ways todo the same thing, so new
by alexanderh 14y ago
>why isn't there more of a focus on security here?
Because this is ruby we're talking about. A "Fun" language that has 100000 ways todo the same thing, so newbs find it fun and easy. You can almost guess how the language works and almost always be right. Thats cool, great for learning, makes you feel like a superstar when you're just getting started with programming... but its really not such a good thing when it comes to maintainability, and security.
This breads a community of people who arent very mindful of anything but having fun coding. (not always a bad thing, but certainly not conducive to good security)
The second you talk about "Multi-platform" or "security" to your average ruby user, their eyes glaze over. They just want to make cool stuff on their Mac, not worry about Security and best practices.
You could say the same thing about a lot of interpreted languages, but Ruby is especially bad.
- Turing_Machine 14y agoYes, you're right. There have never been any security problems with "serious" "nonfun" languages like C, or Java, or the .NET stack. :-/ This has nothing to do with the Ruby language, by the way, any more than a hole in IIS is a problem with .NET. If you're going to talk smack, at least learn what you're talking about.
- marshray 14y agoHey, did you hear that scanf() will accept XML and YAML and automatically convert it into pointers handy for you to dereference? Neither did I.
- tptacek 14y agoOr how about when you put that 256th character in a ruby string and end up overwriting heap metadata? Man I hate it when that happens.
- deleted 14y ago[deleted]
- alexanderh 14y agoYou misinterpreted my comment. I agree, the language is largely inconsequential. Its the culture around the language that is the problem. Ruby's is particularly bad. All I'm saying is the "1000 ways todo the same thing" nature of Ruby, has the unfortunate consequence of attracting newbs, and making 'best practices' hard to nail down. Other languages tend to have more support in corporate/educational areas, tend to have more money backing them, tend to have more 'best practices', tend to have more rigorous testing and review. Ruby is the hipster hacker's language.... and the quality of code shows this. (in the core of the language, and by the individuals who use it) Other languages absolutely have these problems too, but it has been my experience that Ruby is particularly bad. You are welcome to disagree with that part. But IMO it makes sense. The quick and dirty 'million ways todo the same thing' nature of Ruby breads this kind of culture. I certainly didnt mean to single out interpreted languages tho, or imply other languages dont have security problems, or unique issues with their cultures. PHP is probably about just as bad. I'd put Ruby and PHP high up on the 'fun to program in' list, and low on the 'secure, quality languages' list.
- drstewart 14y agoI still believe you may not understand the difference between a language and a framework.
- tedunangst 14y agoThe distinction is rather academic with ruby and rails. 90% of the answers to "how do I do this in ruby" on forums are actually "how to do this with rails" answers, but they never mention that little detail, because who'd ever write a ruby program without rails, right? Trying to find straight ruby answers is annoying as hell.
- chimeracoder 14y agoI've had frustrations with certain "ruby" libraries requiring methods like "blank?" (IIRC) that are provided only via Rails, not Ruby. It made developing on a machine that Ruby but not rails rather annoying.
- tubbo 14y agoI guess you could consider this the "non-programmer opinion". Otherwise known as bullshit.
- bertomartin 14y agoSounds like PHP >_<
- homakov 14y agoI don't think so, a lot of ruby users are good at security
- wglb 14y agoSo far as I can tell, there are a seriously large number of people paid to work on Java. The security record of Java is way worse than Ruby. I can tell you that "security" is a topic that, unless handled carefully, will make anyone's eyes glaze over.
- yannicks 14y agoRemember when release cycles where short in Java? Me neither
- jasim 14y agoI'm curious. Is there any objective data apart from your anecdotal generalizations that can justify the claims? Most Ruby developers primarily work with Rails. I presume this is the reason you are conflating the framework with the language.