3 ms·
This is a weird comparison, but they should adopt the same release policies as Drupal. Security releases are done separate from maintenance releases, even if th
by timdorr 14y ago
This is a weird comparison, but they should adopt the same release policies as Drupal. Security releases are done separate from maintenance releases, even if they are released at the same time.
That allows you to provide the security releases as a separate patch file so you can apply individually. You can skip maintenance releases that cause problems but still keep things secure.
- rst 14y agoHere's a pointer to the security fixes in the release as a monkeypatch to 3.2.12, without any of the other cruft: https://github.com/discourse/discourse/blob/master/lib/freedom_patches/rails_security_fixes.rb https://github.com/discourse/discourse/blob/master/lib/freed... The discourse folks who threw this together have an app (Rails-based forum software) that was hit very hard by the performance regressions.
- grey-area 14y agoThe rails team already does this. Here's an example patch for one change: https://groups.google.com/forum/#!msg/ruby-security-ann/o0Dsdk2WrQ0/3ghDsIDX4DQJ https://groups.google.com/forum/#!msg/ruby-security-ann/o0Ds... Unfortunately that wouldn't have avoided this issue, as the problem was actually with the small security patch.