5 ms·

I don't use rails but it seems that the quality of releases have been going downhill over the pass months.

by kclay 14y ago

zwily 14y ago
These vulnerabilities have been present for many years. They're just being found now. If anything, the quality is now going up. :)
bvdbijl 14y ago
It's just that there has been a large amount of vulnerabilities found in the last month
jerhinesmith 14y ago
Most of the vulnerabilities you (likely) have been seeing are from code that's been a part of rails for a lot longer than the past few months. The spate of recent vulnerabilities has more to do with YAML in particular than with rails itself.
eksith 14y ago
I'm not a Rails dev so this doesn't affect me, but from a software standpoint, discovering vulnerabilities is a good thing in the longer run. These are not new vulnerabilities, but are being discovered now, which means more spotlights are shining on the project. That's a sign of maturity too. From a maintenance standpoint, it will be a pain to apply patches to older software and those seeing heavy use, but it will cause some reexamination of existing code and practices. There will be a domino effect of more eyes focusing on the code now, which in turn will lead to more discoveries of course, but hopefully, new fixes too.
papsosouid 14y ago
The quality was always terrible, these are ancient bugs that are just being noticed now. Rails is designed with a 'convenience first, then use a couple regexes to "secure" it' mentality. Any software designed like that will be full of these sorts of holes.
- igravious 14y ago
  I've spent the last 10 minutes reading your comment history. You come across as an opinionated argumentative snide jerk. Note: before you take my comment apart and feed it back to me realize that I have no desire in getting into a verbal sparring match with you and won't reply to you. I suggest that you follow the advice, "if you can't think of anything nice or constructive to say, bite your tongue". The irony is not lost on me that in taking you to task for the tone you couch your comments in I am failing to live up to my own advice, but I'll make an exception here.
  - tanel 14y ago
    http://en.wikipedia.org/wiki/Ad_hominem http://en.wikipedia.org/wiki/Ad_hominem
    - igravious 14y ago
      Indeed, but not quite. Ask yourself if it was my intent to counter the person's claims by attacking the person. No, that was not my intent. I never intended to counter the person's claims. I was explicitly calling the person out based on tone and style of his/her comment and others in his/her comment history. The thought even crossed my mind while carefully drafting the above comment that I ought to preempt the accusation that I was committing this logical fallacy but I decided not to and now I wish the opposite. Anyway, I hope you see the difference?
      - SkyMarshal 14y ago
        Pro-tip: People are going to have strong opinions here. Rebutting their message rather than the delivery ends up rebutting both.
    - myndpage 14y ago
      This is not an Ad Hominem at all..
  - shadowmint 14y ago

I don't use rails but it seems that the quality of releases have been going downhill over the pass months.

by kclay 14y ago

I don't use rails but it seems that the quality of releases have been going downhill over the pass months.

zwily 14y ago

These vulnerabilities have been present for many years. They're just being found now. If anything, the quality is now going up. :)

bvdbijl 14y ago

It's just that there has been a large amount of vulnerabilities found in the last month

jerhinesmith 14y ago

Most of the vulnerabilities you (likely) have been seeing are from code that's been a part of rails for a lot longer than the past few months. The spate of recent vulnerabilities has more to do with YAML in particular than with rails itself.

eksith 14y ago

I'm not a Rails dev so this doesn't affect me, but from a software standpoint, discovering vulnerabilities is a good thing in the longer run. These are not new vulnerabilities, but are being discovered now, which means more spotlights are shining on the project. That's a sign of maturity too. From a maintenance standpoint, it will be a pain to apply patches to older software and those seeing heavy use, but it will cause some reexamination of existing code and practices. There will be a domino effect of more eyes focusing on the code now, which in turn will lead to more discoveries of course, but hopefully, new fixes too.

papsosouid 14y ago

The quality was always terrible, these are ancient bugs that are just being noticed now. Rails is designed with a 'convenience first, then use a couple regexes to "secure" it' mentality. Any software designed like that will be full of these sorts of holes.

igravious 14y ago
I've spent the last 10 minutes reading your comment history. You come across as an opinionated argumentative snide jerk. Note: before you take my comment apart and feed it back to me realize that I have no desire in getting into a verbal sparring match with you and won't reply to you. I suggest that you follow the advice, "if you can't think of anything nice or constructive to say, bite your tongue". The irony is not lost on me that in taking you to task for the tone you couch your comments in I am failing to live up to my own advice, but I'll make an exception here.
- tanel 14y ago
  http://en.wikipedia.org/wiki/Ad_hominem http://en.wikipedia.org/wiki/Ad_hominem
  - igravious 14y ago
    Indeed, but not quite. Ask yourself if it was my intent to counter the person's claims by attacking the person. No, that was not my intent. I never intended to counter the person's claims. I was explicitly calling the person out based on tone and style of his/her comment and others in his/her comment history. The thought even crossed my mind while carefully drafting the above comment that I ought to preempt the accusation that I was committing this logical fallacy but I decided not to and now I wish the opposite. Anyway, I hope you see the difference?
    - SkyMarshal 14y ago
      Pro-tip: People are going to have strong opinions here. Rebutting their message rather than the delivery ends up rebutting both.
  - myndpage 14y ago
    This is not an Ad Hominem at all..
- shadowmint 14y ago