3 ms·

Before anybody gets the wrong idea here: Yes, there are a lot of highly publicized Rails vulnerabilities lately. If you avoid Rails, it will protect you from th

by chc 14y ago

Before anybody gets the wrong idea here: Yes, there are a lot of highly publicized Rails vulnerabilities lately. If you avoid Rails, it will protect you from these vulnerabilities. But give somebody familiar with pentesting a little while with your app and I rather strongly suspect they will find new and different vulnerabilities that would horrify you as much as anything you find in Rails. Rails gets a lot of scrutiny. Just because your ad hoc Flask app doesn't does not mean it would hold up a lot better. If you believe it will, think very hard about the reasons. (This is not to say you shouldn't use something else either — just that the gut instinct of "Well, my app on this little microframework won't be getting security advisories every couple of weeks" is not necessarily something you want to follow. Like I said, think very hard about whether you really believe you can do justice to your app better than the Rails security team. And read up on some anecdotes from people who do application security while you're thinking about it, because I find people tend to underestimate just how broken most software is.)

saurik 14y ago
I agree with you; however, there is something to be said for "not subject to drive-by mass tagetings on short notice" that is ignored by this argument. There may be 7 obvious bug in your program, but of you have a couple hundred users, will any of them bother? However, even if you have no users at all, you are going to get hacked by these 0-days due to people just scanning the Internet looking for vulnerable systems. In my case, every single time I've been hacked has been due to a 0-day dropping that I didn't pay enough attention to (like exim4), as opposed to the assuredly infinate number of bugs I have in my own software.
- chc 14y ago
  That's true, and there's something to be said for that, though I'm ambivalent about exactly what that something is. That's part of why I tried to make it clear that my point was "Don't knee-jerk on this" rather than "You must stick with Rails or you are a fool." I'm not going to preach security practices at people — there are people much better qualified to do that — I just want people to make sure they understand what tradeoffs they're making with whatever decision they make. A lot of people have drastic misconceptions about these sorts of things. If you're intending to have a little site that largely depends on security through obscurity not to get owned, you should at least know that.
- jiggy2011 14y ago
  Out of those couple of hundred users you only need one of them to be a bored teenager who has read a bit about web security to bust your application. It's not like this stuff is that hard in a lot of cases, it's often just "if I put a semicolon in the URL, how does it respond?" or "does this form have a CSRF token?".
  - bad_user 14y ago
    I'm a senior developer and I can assure you that stuff like "if I put a semicolon in the URL, how does it respond?" never works on my software. It doesn't because as a general rule I sanitize all input or rely on the stack to do it for me, but in general I know which parts of the stack are doing sanitization to lift that burden from me. That doesn't mean my software is secure. Unfortunately some bugs are far more subtle, including the recent Rails exploit. So on one hand I trust Rails even more, precisely because such problems are found and fixed. But on the other hand this does open you up to mass exploits, which does give me the shivers. So it really depends on how much effort you're spending on your app. If you actively maintain your app then you can take notice of zero day exploits and upgrade ASAP. But if you want a worry-less app that you don't want to maintain, a more custom stack is more suitable. Case in point, Wordpress is the most popular blogging platform in the world. It's also the most targetted and shitty weekend blog implementations are far less likely to get hacked.
X-Istence 14y ago
I know you mentioned Flask, but I haven't seen the same sort of stuff for Django, Pylons or Pyramid. Yes, some if not all of those frameworks use the flawed Pickle method for storing cookies, but so long as the secret is, well a secret, there is no way to get remote code execution on a very simple app built on those frameworks.
static_typed 14y ago
Sadly, in the Ruby community shiny and magic are seen as more important than secure, robust or well engineered. That is the bottom line, and if choosing a new framework or language for your new projects, developers should really consider this. Yes, it is wonderful creating meta DSLs, scaffold create new blog, and the rest. But when the server gets compromised, it looks a lot less shiny.
- chc 14y ago
  This seems like a slightly gussied-up version of "Ruby developers smell bad." It's just a bunch of ad hominem against the Ruby community with no substance to justify it. If you had accused the Ruby community of valuing cool new tricks over solid engineering seven years ago, it might have been a little bit realistic, because the Ruby community was small and starry-eyed back then and there wasn't a whole lot of battle-hardened code. But nowadays? Rails is actually quite mature and a lot of work has gone into its engineering. It has a security team and they take these things very seriously. You might not feel they're doing well enough, but accusing them (based on no evidence whatsoever) of being obsessed with "shiny" things is not the way to express that concern. This is not to say that you can't use whatever you want, obviously. Just that you seem to be throwing around dated stereotypes in service of a language pissing match rather than critically analyzing the merits of the framework.

by chc 14y ago

saurik 14y ago

I agree with you; however, there is something to be said for "not subject to drive-by mass tagetings on short notice" that is ignored by this argument. There may be 7 obvious bug in your program, but of you have a couple hundred users, will any of them bother? However, even if you have no users at all, you are going to get hacked by these 0-days due to people just scanning the Internet looking for vulnerable systems. In my case, every single time I've been hacked has been due to a 0-day dropping that I didn't pay enough attention to (like exim4), as opposed to the assuredly infinate number of bugs I have in my own software.

chc 14y ago
That's true, and there's something to be said for that, though I'm ambivalent about exactly what that something is. That's part of why I tried to make it clear that my point was "Don't knee-jerk on this" rather than "You must stick with Rails or you are a fool." I'm not going to preach security practices at people — there are people much better qualified to do that — I just want people to make sure they understand what tradeoffs they're making with whatever decision they make. A lot of people have drastic misconceptions about these sorts of things. If you're intending to have a little site that largely depends on security through obscurity not to get owned, you should at least know that.
jiggy2011 14y ago
Out of those couple of hundred users you only need one of them to be a bored teenager who has read a bit about web security to bust your application. It's not like this stuff is that hard in a lot of cases, it's often just "if I put a semicolon in the URL, how does it respond?" or "does this form have a CSRF token?".
- bad_user 14y ago
  I'm a senior developer and I can assure you that stuff like "if I put a semicolon in the URL, how does it respond?" never works on my software. It doesn't because as a general rule I sanitize all input or rely on the stack to do it for me, but in general I know which parts of the stack are doing sanitization to lift that burden from me. That doesn't mean my software is secure. Unfortunately some bugs are far more subtle, including the recent Rails exploit. So on one hand I trust Rails even more, precisely because such problems are found and fixed. But on the other hand this does open you up to mass exploits, which does give me the shivers. So it really depends on how much effort you're spending on your app. If you actively maintain your app then you can take notice of zero day exploits and upgrade ASAP. But if you want a worry-less app that you don't want to maintain, a more custom stack is more suitable. Case in point, Wordpress is the most popular blogging platform in the world. It's also the most targetted and shitty weekend blog implementations are far less likely to get hacked.

X-Istence 14y ago

I know you mentioned Flask, but I haven't seen the same sort of stuff for Django, Pylons or Pyramid. Yes, some if not all of those frameworks use the flawed Pickle method for storing cookies, but so long as the secret is, well a secret, there is no way to get remote code execution on a very simple app built on those frameworks.

static_typed 14y ago

Sadly, in the Ruby community shiny and magic are seen as more important than secure, robust or well engineered. That is the bottom line, and if choosing a new framework or language for your new projects, developers should really consider this. Yes, it is wonderful creating meta DSLs, scaffold create new blog, and the rest. But when the server gets compromised, it looks a lot less shiny.

chc 14y ago
This seems like a slightly gussied-up version of "Ruby developers smell bad." It's just a bunch of ad hominem against the Ruby community with no substance to justify it. If you had accused the Ruby community of valuing cool new tricks over solid engineering seven years ago, it might have been a little bit realistic, because the Ruby community was small and starry-eyed back then and there wasn't a whole lot of battle-hardened code. But nowadays? Rails is actually quite mature and a lot of work has gone into its engineering. It has a security team and they take these things very seriously. You might not feel they're doing well enough, but accusing them (based on no evidence whatsoever) of being obsessed with "shiny" things is not the way to express that concern. This is not to say that you can't use whatever you want, obviously. Just that you seem to be throwing around dated stereotypes in service of a language pissing match rather than critically analyzing the merits of the framework.