6 ms·

I get a little chuckle when I tell people I am building some app and they ask "Why aren't you using RoR and MongoDB?" Maybe I am not comfortable with them in p

I get a little chuckle when I tell people I am building some app and they ask "Why aren't you using RoR and MongoDB?" Maybe I am not comfortable with them in production?

meaty 14y ago
I am of the same opinion. Having trialled both extensively, we stuck with asp.net MVC and SQL server. Expensive but well engineered.
- RyanZAG 14y ago
  Wouldn't be so sure of safety - RoR just gets a lot more publicity when a vulnerability surfaces, although the huge amount of magic involved in RoR makes vulnerabilities more common than more static code. http://forums.asp.net/1233.aspx http://forums.asp.net/1233.aspx http://www.troyhunt.com/2012/04/67-of-aspnet-websites-have-serious.html http://www.troyhunt.com/2012/04/67-of-aspnet-websites-have-s... etc Besides, most web app vulnerabilities are coding flaws in the user code itself, and very rarely in the framework.
  - Encosia 14y ago
    The difference is that things like enabling remote errors or disabling request validation in ASP.NET requires that you explicitly change those settings. The default config doesn't expose either of those issues.
    - gregors 14y ago
      I've got a screen capture with bing showing me remote errors. People do make mistakes.
      - meaty 14y ago
        Bing are Microsoft dogfooding new tech. They will make mistakes. For those of us who are conservative there are very few opportunities to make mistakes. We have checklists, security policies, code reviews and even protection components in our framework as well as completely segregated web and back end systems.
      - Encosia 14y ago
        Of course people make mistakes. The point is that the framework doesn't expose you to those risks by default. You have to explicitly make those mistakes yourself. Further, when ASP.NET does have the odd vulnerability crop up, patches roll out automatically as critical updates via Windows Update. So, these things get patched quickly even if the app or server is no longer actively maintained, as is the case with so much code out there on every platform. Ironically, it's a bit like Windows Server is the Google Chrome of server environments when it comes to frequency and pervasiveness of updates.
  - meaty 14y ago
    However framework vulnerabilities offer a consistent attack surface which needs little analysis or tailoring. The only vulnerability we've seen (ms11-100) was swiftly dealt with and would have been eaten by our up front load balancers anyway. Regarding our application, our test load is 134,000 test cases and 220,000 lines of assertions. I can sleep well at night.
    - RyanZAG 14y ago
      I've got to ask: could you share what app or at least industry that app is in? I've never seen 134,000 test cases before for a web app, and 220,000 assertions to boot. What's the ratio of test cases to code? It sounds like a record to me!
      - meaty 14y ago
        Financial services. Test ratio is 1 test per 6 loc. Not a record. There are some seriously big apps behind closed doors. Its a different world to the public facing web.
        EwanToo 14y ago
        Facebook is composed of around 10 million lines of code [1] - the public facing web is big. I've no doubt Google looks at that and thinks it's almost trivially small (Chromium alone is 6.5 million lines [2]). There's big apps in private, but very few companies are at that scale. 1 - http://www.quora.com/How-large-is-Facebooks-codebase http://www.quora.com/How-large-is-Facebooks-codebase 2 - http://www.ohloh.net/p/chrome http://www.ohloh.net/p/chrome
        joseph_cooney 14y ago
        I've worked in a number of medium to large financial institutions, and 10M LOC is nothing, really. They had subsystems that were bigger than that by a factor of 2.
        14y ago
  - deleted 14y ago
    [deleted]
- gregors 14y ago
  Hope you're not using default model binder, because M$ still allows for you to hang yourself with mass assignment attacks. Something they have yet to learn. Hope you're not running MVC 1 or MVC 2, you're still open to redirection attacks. It's not called patch Tuesday for nothing.
  - meaty 14y ago
    We have our own model binder implementation (with circuit breakers) and UI framework and are using mvc3. And yes we're always fully patched.
    - gregors 14y ago
      Really that's the point I'm trying to make. The default path in MVC isn't exactly secure. There is work to be done. I'd consider this particular rails update in line with a patch Tuesday update. Though I will say, I wish they had a better way of communicating when updates were available.
- j-kidd 14y ago
  SQL Server is anything but well engineered. What version of SQL Server are you currently running? Is it on the latest service pack only, or with the latest cumulative update applied? The later fixes critical bugs, but claimed to be "not fully tested" by Microsoft. This retarded release policy means there is no stable version of SQL Server.
  - meaty 14y ago
    I disagree. We're not using the latest patches. We're using an independently verified and tested set of patches. The baseline is 2008.
nathan_long 14y ago
Before you chuckle, you should be sure that you're doing security better than Rails. Read this and see how your framework or custom code stacks up. http://guides.rubyonrails.org/security.html http://guides.rubyonrails.org/security.html Also, ask yourself: "when I have a security vulnerability, how easy is it to fix?" Fixing a Rails vulnerability and deploying the fix to production takes about 2 minutes.
- Finster 14y ago
  This begs the question: Are the Rails devs reading that?
- thelarry 14y ago
  I am like Dr Hibbert, I chuckle at inappropriate times. But my point was just because something is popular, doesn't mean it is the best for everything. And that you _should_ understand how things work under the hood and not just choose these platforms blindly. I am not specifically hating on RoR, I feel that many developers choose it just because it is easy and popular without understanding what rails gives you and how it works.

I get a little chuckle when I tell people I am building some app and they ask "Why aren't you using RoR and MongoDB?" Maybe I am not comfortable with them in production?

meaty 14y ago

I am of the same opinion. Having trialled both extensively, we stuck with asp.net MVC and SQL server. Expensive but well engineered.

RyanZAG 14y ago
Wouldn't be so sure of safety - RoR just gets a lot more publicity when a vulnerability surfaces, although the huge amount of magic involved in RoR makes vulnerabilities more common than more static code. http://forums.asp.net/1233.aspx http://forums.asp.net/1233.aspx http://www.troyhunt.com/2012/04/67-of-aspnet-websites-have-serious.html http://www.troyhunt.com/2012/04/67-of-aspnet-websites-have-s... etc Besides, most web app vulnerabilities are coding flaws in the user code itself, and very rarely in the framework.
- Encosia 14y ago
  The difference is that things like enabling remote errors or disabling request validation in ASP.NET requires that you explicitly change those settings. The default config doesn't expose either of those issues.
  - gregors 14y ago
    I've got a screen capture with bing showing me remote errors. People do make mistakes.
    - meaty 14y ago
      Bing are Microsoft dogfooding new tech. They will make mistakes. For those of us who are conservative there are very few opportunities to make mistakes. We have checklists, security policies, code reviews and even protection components in our framework as well as completely segregated web and back end systems.
    - Encosia 14y ago
      Of course people make mistakes. The point is that the framework doesn't expose you to those risks by default. You have to explicitly make those mistakes yourself. Further, when ASP.NET does have the odd vulnerability crop up, patches roll out automatically as critical updates via Windows Update. So, these things get patched quickly even if the app or server is no longer actively maintained, as is the case with so much code out there on every platform. Ironically, it's a bit like Windows Server is the Google Chrome of server environments when it comes to frequency and pervasiveness of updates.
- meaty 14y ago
  However framework vulnerabilities offer a consistent attack surface which needs little analysis or tailoring. The only vulnerability we've seen (ms11-100) was swiftly dealt with and would have been eaten by our up front load balancers anyway. Regarding our application, our test load is 134,000 test cases and 220,000 lines of assertions. I can sleep well at night.
  - RyanZAG 14y ago
    I've got to ask: could you share what app or at least industry that app is in? I've never seen 134,000 test cases before for a web app, and 220,000 assertions to boot. What's the ratio of test cases to code? It sounds like a record to me!
    - meaty 14y ago
      Financial services. Test ratio is 1 test per 6 loc. Not a record. There are some seriously big apps behind closed doors. Its a different world to the public facing web.
      - EwanToo 14y ago
        Facebook is composed of around 10 million lines of code [1] - the public facing web is big. I've no doubt Google looks at that and thinks it's almost trivially small (Chromium alone is 6.5 million lines [2]). There's big apps in private, but very few companies are at that scale. 1 - http://www.quora.com/How-large-is-Facebooks-codebase http://www.quora.com/How-large-is-Facebooks-codebase 2 - http://www.ohloh.net/p/chrome http://www.ohloh.net/p/chrome
        joseph_cooney 14y ago
        I've worked in a number of medium to large financial institutions, and 10M LOC is nothing, really. They had subsystems that were bigger than that by a factor of 2.
        14y ago
- deleted 14y ago
  [deleted]
gregors 14y ago
Hope you're not using default model binder, because M$ still allows for you to hang yourself with mass assignment attacks. Something they have yet to learn. Hope you're not running MVC 1 or MVC 2, you're still open to redirection attacks. It's not called patch Tuesday for nothing.
- meaty 14y ago
  We have our own model binder implementation (with circuit breakers) and UI framework and are using mvc3. And yes we're always fully patched.
  - gregors 14y ago
    Really that's the point I'm trying to make. The default path in MVC isn't exactly secure. There is work to be done. I'd consider this particular rails update in line with a patch Tuesday update. Though I will say, I wish they had a better way of communicating when updates were available.
j-kidd 14y ago
SQL Server is anything but well engineered. What version of SQL Server are you currently running? Is it on the latest service pack only, or with the latest cumulative update applied? The later fixes critical bugs, but claimed to be "not fully tested" by Microsoft. This retarded release policy means there is no stable version of SQL Server.
- meaty 14y ago
  I disagree. We're not using the latest patches. We're using an independently verified and tested set of patches. The baseline is 2008.

nathan_long 14y ago

Before you chuckle, you should be sure that you're doing security better than Rails. Read this and see how your framework or custom code stacks up. http://guides.rubyonrails.org/security.html http://guides.rubyonrails.org/security.html Also, ask yourself: "when I have a security vulnerability, how easy is it to fix?" Fixing a Rails vulnerability and deploying the fix to production takes about 2 minutes.

Finster 14y ago
This begs the question: Are the Rails devs reading that?
thelarry 14y ago
I am like Dr Hibbert, I chuckle at inappropriate times. But my point was just because something is popular, doesn't mean it is the best for everything. And that you _should_ understand how things work under the hood and not just choose these platforms blindly. I am not specifically hating on RoR, I feel that many developers choose it just because it is easy and popular without understanding what rails gives you and how it works.