5 ms·

If you installed Rails from Ubuntu, you have to patch it by hand since they're not patching it. Use the conversions.rb patch for 2.x from https://groups.googl

by zurn 14y ago

If you installed Rails from Ubuntu, you have to patch it by hand since they're not patching it. Use the conversions.rb patch for 2.x from https://groups.google.com/forum/#!topic/rubyonrails-security/61bkgvnSGTQ/discussion https://groups.google.com/forum/#!topic/rubyonrails-security... "We're not patching it" statement: https://launchpad.net/bugs/320813 https://launchpad.net/bugs/320813

bdonlan 14y ago
The bug you link is some kind of 3d-related bug, what does it have to do with Rails?
- zurn 14y ago
  Yep, paste fail, andreaja's link is the right one.
andreaja 14y ago
That doesn't seem quite correct: https://bugs.launchpad.net/ubuntu/+source/rails/+bug/1097643 https://bugs.launchpad.net/ubuntu/+source/rails/+bug/1097643
fuzzix 14y ago
"We're not patching it" That's not what was said. They don't maintain it.
- zurn 14y ago
  They did too - they're not patching it unless someone "from the community" comes, does the work and succesfully lobbies to get it sponsored. Which almost certainly won't happen in time (if at all). Have a look at the track record of security bugs in launchpad that apply to universe (aka "community maintained") packages.
ZoFreX 14y ago
In my experience, using Ruby or gems from your package manager leads to headaches down the line - I'd highly recommend using bundler to manage your gems at the very least, and rvm or rbenv to manage rubies.
- potkor 14y ago
  Does this also apply to end-users of Ruby apps that are just an apt-get away? I don't really want to learn all that stuff (and remember to redo it on all installs) just to use some tool that happens to be written in Ruby.
  - astrodust 14y ago
    If you apt-get your gems you're doing it wrong.
  - mnutt 14y ago
    I don't believe there are any rails-apps-as-packages in the official debian/ubuntu repositories, but if there were I assume they would use bundler to bundle their gems internally.
    - zurn 14y ago
      Yes there are, in our case Redmine. A pretty popular piece of software I believe. In Debian it's in main and in Ubuntu it's in universe. Re. bundler/gems, I don't know what those are - the file "core_ext/hash/conversions.rb" I hand-patched was from a package called ruby-activesupport-2.3 which is a dependency of the Rails package.
      - ZoFreX 14y ago
        It was redmine I was using when I had the issues actually. The real problem though was that I was trying to use a newer version of Redmine than was available in the repo, and I did still manage to satisfy the dependencies but upgrading my Ruby version broke literally everything. I think if 100% of your eco system is from the package manager you would be fine, but if even a single component needs to come from outside I would reach straight for rvm and bundler (no prejudice against rbenv, rvm is just what I use)

by zurn 14y ago

bdonlan 14y ago

The bug you link is some kind of 3d-related bug, what does it have to do with Rails?

zurn 14y ago
Yep, paste fail, andreaja's link is the right one.

andreaja 14y ago

That doesn't seem quite correct: https://bugs.launchpad.net/ubuntu/+source/rails/+bug/1097643 https://bugs.launchpad.net/ubuntu/+source/rails/+bug/1097643

fuzzix 14y ago

"We're not patching it" That's not what was said. They don't maintain it.

zurn 14y ago
They did too - they're not patching it unless someone "from the community" comes, does the work and succesfully lobbies to get it sponsored. Which almost certainly won't happen in time (if at all). Have a look at the track record of security bugs in launchpad that apply to universe (aka "community maintained") packages.

ZoFreX 14y ago

In my experience, using Ruby or gems from your package manager leads to headaches down the line - I'd highly recommend using bundler to manage your gems at the very least, and rvm or rbenv to manage rubies.

potkor 14y ago
Does this also apply to end-users of Ruby apps that are just an apt-get away? I don't really want to learn all that stuff (and remember to redo it on all installs) just to use some tool that happens to be written in Ruby.
- astrodust 14y ago
  If you apt-get your gems you're doing it wrong.
- mnutt 14y ago
  I don't believe there are any rails-apps-as-packages in the official debian/ubuntu repositories, but if there were I assume they would use bundler to bundle their gems internally.
  - zurn 14y ago
    Yes there are, in our case Redmine. A pretty popular piece of software I believe. In Debian it's in main and in Ubuntu it's in universe. Re. bundler/gems, I don't know what those are - the file "core_ext/hash/conversions.rb" I hand-patched was from a package called ruby-activesupport-2.3 which is a dependency of the Rails package.
    - ZoFreX 14y ago
      It was redmine I was using when I had the issues actually. The real problem though was that I was trying to use a newer version of Redmine than was available in the repo, and I did still manage to satisfy the dependencies but upgrading my Ruby version broke literally everything. I think if 100% of your eco system is from the package manager you would be fine, but if even a single component needs to come from outside I would reach straight for rvm and bundler (no prejudice against rbenv, rvm is just what I use)