5 ms·

As I asked in another thread discussing Rails security, what are the alternatives? What did you move to? I honestly want to know. I can understand that Rails h

by BSousa 14y ago

As I asked in another thread discussing Rails security, what are the alternatives? What did you move to? I honestly want to know. I can understand that Rails has this problems, and due to the way it originated (37 Signals apps) I can understand if security wasn't top priority. But now it does scare me a lot. I'm designing a product to be deployed at some large companies and every day I feel less and less secure about using Rails for that. It will be hard to explain to an executive in a top 500 company that I have to patch the damn system every week for a new problem.

SkyMarshal 14y ago
There are some frameworks that are designed with security as top priority: Lift (used at FourSquare and theguardian.co.uk), Opa, the main Haskell frameworks (Yesod, Happstack, Snap), and Google Web Toolkit come first to mind. And of course the mature J2EE frameworks if you want to go there. That's no guarantee, and Rails gets a lot of scrutiny so it's difficult to tell to what degree if any it is less secure than other, less scrutinized frameworks, but these are all worth checking out. http://liftweb.net/ http://liftweb.net/ http://opalang.org/ http://opalang.org/ http://www.yesodweb.com/ http://www.yesodweb.com/ http://happstack.com/ http://happstack.com/ http://snapframework.com/ http://snapframework.com/ https://developers.google.com/web-toolkit/ https://developers.google.com/web-toolkit/
- cmccabe 14y ago
  It's hard to take Google Web Toolkit seriously when Google themselves don't use it. I mean, it's cool and all, but a Rails-killer, it is not. And after all is said and done, if you had wanted to develop the site in Java, you could have just used J2EE. As for Haskell-- are you serious? You'll never find another developer who wants to maintain your Haskell code. I agree that Lift is a good choice, for all the same reasons why Scala is a good choice. I would also add Revel, for Golang, to that list.
  - SkyMarshal 14y ago
    >it's cool and all, but a Rails-killer, it is not I don't consider any of these to be Rails-killers, for comparative lack of the combination of lots of web-oriented libraries/plugins and ease of configuration, Rails' biggest draw. But OP asked for frameworks designed for security, ostensibly to suite the needs of his upcoming project. GWT and the others could be options for that project, depending on requirements. Only OP knows, but worth suggesting. >And after all is said and done, if you had wanted to develop the site in Java, you could have just used J2EE. Yup, as I mentioned. >You'll never find another developer who wants to maintain your Haskell code. That's an absolute with which I absolutely I beg to differ. >I would also add Revel, for Golang, to that list. Looks interesting, but not mature enough yet to include it in this answer. And when they say 'modeled on the Play framework', that's a yellow flag to me, given that Play wasn't designed from scratch for strong security. Originally Play was easily vulnerable to basic attacks like XSS and later patched - eg, not designed around security from scratch. They seemed to want to build a better Rails on the JVM, but they seem to have also adopted the Rails community's preference for 'cool, quick, easy, and magic with security bolted on later', and just added 'fast'. Hopefully the Revel guys do better.
    - BSousa 14y ago
      Since I'm the op, I'll answer ;) First, I do want to thank for pointing those frameworks out. I Knew about all the Haskell ones as well as Lift, but OPA I had no idea. Currently looking at it now. Not a fan of JS, but I'm open minded enough to take a loot at. I quite like Haskell, but I feel the Haskell frameworks aren't there. They may be secure, but the way we have to develop around them makes me cringe (snap for example, and how to get parameters from actions, or yesod with the template haskell everywhere). Also, not sure how battle tested they are. Looking at Haskell wiki, each project has about 10 sites to each framework, and none high profile enough. I love my unix shell, but I'm really considering .net for this (I think c# is quite a decent language, and f# allows me to have functional programming in there.) Microsoft is trusted by the enterprise (Even if there are issues, managers are more willingly to allow .net patches than framework of the day patches.) I'll look at lift/scala/play now, see if they allow me an ease to develop that I like, combined with JVM security (whatever that is, but more likely a manager will know about JAva than Ruby/Python)
  - tikhonj 14y ago
    Haskell is a great choice. While there are fewer Haskell developers in absolute terms, there is a very disproportionate amount of good developers who know Haskell. Startups using Haskell, as well as companies using similar languages like OCaml, have reported that, paradoxically, it's actually easier to hire Haskell programmers because they get more well qualified applicants and fewer unqualified ones. Moreover, if you're actually working with competent people, they should have no trouble learning Haskell. Chances are, everybody already is, and would be happy at a chance to use it at work. All the FUD spread around about Haskell is unfortunate. It's a brilliant, practical and extremely productive language, and people are turned away from it for misinformed and poorly considered reasons.
    - SkyMarshal 14y ago
      >All the FUD spread around about Haskell is unfortunate. Not necessarily, Haskell's unofficial motto is after all, "Avoid success at all costs". ;) http://www.codersatwork.com/simon-peyton-jones.html http://www.codersatwork.com/simon-peyton-jones.html

by BSousa 14y ago

SkyMarshal 14y ago

There are some frameworks that are designed with security as top priority: Lift (used at FourSquare and theguardian.co.uk), Opa, the main Haskell frameworks (Yesod, Happstack, Snap), and Google Web Toolkit come first to mind. And of course the mature J2EE frameworks if you want to go there. That's no guarantee, and Rails gets a lot of scrutiny so it's difficult to tell to what degree if any it is less secure than other, less scrutinized frameworks, but these are all worth checking out. http://liftweb.net/ http://liftweb.net/ http://opalang.org/ http://opalang.org/ http://www.yesodweb.com/ http://www.yesodweb.com/ http://happstack.com/ http://happstack.com/ http://snapframework.com/ http://snapframework.com/ https://developers.google.com/web-toolkit/ https://developers.google.com/web-toolkit/

cmccabe 14y ago
It's hard to take Google Web Toolkit seriously when Google themselves don't use it. I mean, it's cool and all, but a Rails-killer, it is not. And after all is said and done, if you had wanted to develop the site in Java, you could have just used J2EE. As for Haskell-- are you serious? You'll never find another developer who wants to maintain your Haskell code. I agree that Lift is a good choice, for all the same reasons why Scala is a good choice. I would also add Revel, for Golang, to that list.
- SkyMarshal 14y ago
  >it's cool and all, but a Rails-killer, it is not I don't consider any of these to be Rails-killers, for comparative lack of the combination of lots of web-oriented libraries/plugins and ease of configuration, Rails' biggest draw. But OP asked for frameworks designed for security, ostensibly to suite the needs of his upcoming project. GWT and the others could be options for that project, depending on requirements. Only OP knows, but worth suggesting. >And after all is said and done, if you had wanted to develop the site in Java, you could have just used J2EE. Yup, as I mentioned. >You'll never find another developer who wants to maintain your Haskell code. That's an absolute with which I absolutely I beg to differ. >I would also add Revel, for Golang, to that list. Looks interesting, but not mature enough yet to include it in this answer. And when they say 'modeled on the Play framework', that's a yellow flag to me, given that Play wasn't designed from scratch for strong security. Originally Play was easily vulnerable to basic attacks like XSS and later patched - eg, not designed around security from scratch. They seemed to want to build a better Rails on the JVM, but they seem to have also adopted the Rails community's preference for 'cool, quick, easy, and magic with security bolted on later', and just added 'fast'. Hopefully the Revel guys do better.
  - BSousa 14y ago
    Since I'm the op, I'll answer ;) First, I do want to thank for pointing those frameworks out. I Knew about all the Haskell ones as well as Lift, but OPA I had no idea. Currently looking at it now. Not a fan of JS, but I'm open minded enough to take a loot at. I quite like Haskell, but I feel the Haskell frameworks aren't there. They may be secure, but the way we have to develop around them makes me cringe (snap for example, and how to get parameters from actions, or yesod with the template haskell everywhere). Also, not sure how battle tested they are. Looking at Haskell wiki, each project has about 10 sites to each framework, and none high profile enough. I love my unix shell, but I'm really considering .net for this (I think c# is quite a decent language, and f# allows me to have functional programming in there.) Microsoft is trusted by the enterprise (Even if there are issues, managers are more willingly to allow .net patches than framework of the day patches.) I'll look at lift/scala/play now, see if they allow me an ease to develop that I like, combined with JVM security (whatever that is, but more likely a manager will know about JAva than Ruby/Python)
- tikhonj 14y ago
  Haskell is a great choice. While there are fewer Haskell developers in absolute terms, there is a very disproportionate amount of good developers who know Haskell. Startups using Haskell, as well as companies using similar languages like OCaml, have reported that, paradoxically, it's actually easier to hire Haskell programmers because they get more well qualified applicants and fewer unqualified ones. Moreover, if you're actually working with competent people, they should have no trouble learning Haskell. Chances are, everybody already is, and would be happy at a chance to use it at work. All the FUD spread around about Haskell is unfortunate. It's a brilliant, practical and extremely productive language, and people are turned away from it for misinformed and poorly considered reasons.
  - SkyMarshal 14y ago
    >All the FUD spread around about Haskell is unfortunate. Not necessarily, Haskell's unofficial motto is after all, "Avoid success at all costs". ;) http://www.codersatwork.com/simon-peyton-jones.html http://www.codersatwork.com/simon-peyton-jones.html