3 ms·
Rails security point release breaks apps by changing the ORM. News at 11.
by badgar 14y ago
Rails security point release breaks apps by changing the ORM.
News at 11.
- stanleydrew 14y agoI'm not sure why you found it necessary to post this comment. I found the original article to be a well-written warning about a rather serious bug that might affect a lot of people. But your comment seems to be sarcastically suggesting "move along, nothing to see here."
- mbetter 14y agoI'm not sure why you found it necessary to post that comment, or why I found it necessary to post this one.
- cmccabe 14y agoAnd I can't figure out why either of you two posted. Or why I'm posting. I guess it is what it is.
- jleader 14y agoI don't think the GP is criticizing the article, he's using the article to criticize Rails. Not so much "nothing to see here" as "well, what did you expect from Rails?". (I'm explaining what I think the GP meant, not my position; I'm an old Perl guy, still undecided on the overall trade-offs offered by Rails)
- badgar 14y agoYes, I was pointing out that Rails made backwards-incompatible changes to core functionality in a point release primarily targeting security. I don't know how much more succinctly I could have originally put it, and I thought that it was obvious that this is a Bad Thing. You can't reach everybody.
- michaelfairley 14y agoThe "backwards-incompatible change" was part of a security fix, not an unrelated non-security change.
- badgar 14y agoGithub's code doesn't rely on the security flaw to function. Their code should keep working after the security fix. Anyone who has ever consumed an API to build something they don't want to break understands this.
- stanleydrew 14y agoYes, it is obvious that this is a Bad Thing. That's why, no matter how succinct, I don't think your comment is particularly useful. I didn't find that it added anything to the discussion.
- badgar 14y agoNot every comment on Hacker News is useful. I'd say I was going for poignant if anything.
- obstacle1 14y agoI took it more like "oh look, another Rails security flaw, big surprise". Not "move along, nothing to see", but rather "take pause and reconsider using Rails".
- badgar 14y agoThe point isn't that they had a security flaw, it's that the patch release fixing it changed the god damn default ORM's semantics!
- rtwtlkj 14y agoI wonder if this is Karma for all the hyperbole and bad nature comments that the Rails community has thrown at Java. This is some really good schadenfreude. Please keep them coming Rails/Ruby.