I'm sorry to hear the problems you and your family had with it. But on the discussion we had before[1], this one does not seem to affect Rails[2]: tiegz 14 ho

I'm sorry to hear the problems you and your family had with it. But on the discussion we had before[1], this one does not seem to affect Rails[2]: tiegz 14 hours ago | link | parent Rails has been built around Rack for a couple years, but I think its sessions are safe from this Rack vulnerability. Rails' CookieStore class inherits from Rack::Session::Cookie, but it overwrites the unpacked_cookie_data() method which was open to a timing attack. Rails uses its own MessageVerifier class (https://github.com/rails/rails/blob/master/activesupport/lib... https://github.com/rails/rails/blob/master/activesupport/lib...) to do a constant time comparison, which would avoid this attack. Any other frameworks/libs that use Rack's session cookies should upgrade though, afaik. [1] http://news.ycombinator.com/item?id=5186245 http://news.ycombinator.com/item?id=5186245 [2] http://news.ycombinator.com/item?id=5186466 http://news.ycombinator.com/item?id=5186466