4 ms·

Now is a good time to review alternative frameworks. A lot of them are simpler to understand, rely on less magic, and have communities around them that are inte

• donw 14y ago
  No, before starting to build a product is a good time to do that. Now is a good time to patch your code and keep building your company. Every framework has security bugs. Jumping ship to a framework you don't understand, possibly one that is harder to update, is a knee-jerk reactionary response to the problem. If all these compromises worry you, invest some time in setting a HIDS (Host Intrusion Detection System), subscribing to the relevant security mailing lists, and ensuring that your deployment workflow allows you to patch production code within a few minutes.
  • static_typed 14y ago
    At the end of the day, it is a trade-off: do I stick with a current framework full of security holes, indicative of poor design and keep the daily patch cycle fingers-crossed, or do I draw a line, migrate to a less magic less shiny but more secure better engineered framework and focus my time on building my apps instead of spending it all on patching. Tough call.