6 ms·

Feel free to ask me for elaboration if you need any, in particular if you have a CTO or other bosscritter who you need help convincing of the importance of this

by patio11 13y ago

Feel free to ask me for elaboration if you need any, in particular if you have a CTO or other bosscritter who you need help convincing of the importance of this. It will be seriously bad news for you if you stay on unpatched 2.3 over the next several months.

gadders 13y ago
It sounds like a sensible idea, and a nice thing for you to help organise. No doubt it will get criticised :-) As an aside, do you think there is a better way Rails could have handled this? Or (less controversially) is there a best practise you think OSS projects should maybe follow in regards to past versions?
- patio11 13y ago
  I have approximately 10,000 reasons to personally prefer Rails continuing to support 2.3 out of the goodness of their hearts, but I don't think that satisfying my (and other users') selfish desires is necessarily "better" than not doing that. It is necessary and proper that the project have priorities, and those aren't going to be optimal for every user every time. I am quite happy that they were really explicit about "We are dropping support for 2.3 when 4.0 lands" so that those of us who depend on 2.3 to eat had months to explore other options prior to needing them urgently. That's something that many OSS projects can and should emulate.
cheald 13y ago
I have several side projects that run on 2.3. I don't have the time to upgrade them or the resources to purchase commercial support for Rails 2.3. Your comment makes me wonder if you are aware of some undisclosed bugs that will be disclosed in the next few months, or if it's more of just a "4.0 is dropping, 2.3 support is going bye-bye" kind of thing. If the former, I'd appreciate some clarification on that point. I have no problem backporting patches myself (and in fact extensively patch libraries when needed!), but I'm wondering if there's an active-yet-undisclosed threat, or if it's just "people aren't going to do my work for me". Can you elaborate?
- patio11 13y ago
  I do not have, nor possess non-public knowledge about, unpublished vulnerabilities in Rails 2.3. I am just saying that my confidence in there existing one in the near term is "near total."
GavinB 13y ago
Did you consider this as a potential business opportunity for yourself? My reaction on reading this was that someone should be giving you either cash or equity for your roles as both an evangelist and the person who realized this was going to be needed and organized it.
- patio11 13y ago
  Did you consider this as a potential business opportunity for yourself? For a few minutes. It has poor alignment with my skills (I'm a fairly decent developer and can play a security researcher occasionally, but I'm a lot better at selling/marketing software than I am at hardcore framework development) and desired lifestyle (to whit, not wanting to be up at 4 AM in the morning having to work on Rails security issues -- today excepted, apparently). It also wouldn't play well with my plans to dedicate most of my business efforts to AR going forward. It seems more like someone should be giving you either cash or equity for your roles as both an evangelist and the person who realized this was going to be needed and organized it. I don't take money for publicity, as a matter of policy. The idea is worth about as much as the tweet it takes to describe it. The only interesting coordination problem is matching up Customer Zero with a company interested in and capable of doing the work, and that would be worth compensation, but for the fact that I was Customer Zero. I did briefly entertain the notion of banging down a few doors and selling this (on some model like "I'll guarantee you X amount of business, in return I get a payment of $Y0k when I bring it to your door") but, meh, I'm just not that interested in doing enterprise sales for things that I don't own. Heck, I can scarcely be bothered to do it for things that I do.
ericd 13y ago
This is awesome, I was really dreading the options before, and $195/mo is totally reasonable for my relatively limited needs. Thanks for finding a good company to support this.
InclinedPlane 13y ago
Given all the security problems with rails lately would you still recommend rails for a green field project?
- tomfakes 13y ago
  I would absolutely use Rails for new projects, specifically because these issues are being surfaced and fixed. A framework or system with only 10 users will never have the depth of security and bug fixing coverage that a larger, well used system has.
  - bornhuetter 13y ago
    That's not a very strong argument - the framework with 10 users is a far smaller target than the one with thousands of installs.
    - pfraze 13y ago
      True, unless your site is high profile
      - Groxx 13y ago
        Or someone gets bored.
    - nnq 13y ago
      Websites are targets, not frameworks - if your site is targeted, it's the same thing as having your home-brewed 1 user framework targeted, and as long as you're making money and/or storing valuable client info this can happen anytime...
      - PommeDeTerre 13y ago
        Particular frameworks, CMSes, blog systems and other widely-installed web apps are targeted all the time. When examining web server access logs, it's quite common to see hundreds of requests coming in from a single host during a short period of time, looking to see if certain exploitable framework- or app-specific pages exist. Such scanners do appear to target certain frameworks or web apps, contrary to your suggestion that this does not happen.
JshWright 13y ago
Typo in the first sentence of the third paragraph in "Option 5" "... only benefit the our companies ..."

by patio11 13y ago

gadders 13y ago

It sounds like a sensible idea, and a nice thing for you to help organise. No doubt it will get criticised :-) As an aside, do you think there is a better way Rails could have handled this? Or (less controversially) is there a best practise you think OSS projects should maybe follow in regards to past versions?

patio11 13y ago
I have approximately 10,000 reasons to personally prefer Rails continuing to support 2.3 out of the goodness of their hearts, but I don't think that satisfying my (and other users') selfish desires is necessarily "better" than not doing that. It is necessary and proper that the project have priorities, and those aren't going to be optimal for every user every time. I am quite happy that they were really explicit about "We are dropping support for 2.3 when 4.0 lands" so that those of us who depend on 2.3 to eat had months to explore other options prior to needing them urgently. That's something that many OSS projects can and should emulate.

cheald 13y ago

I have several side projects that run on 2.3. I don't have the time to upgrade them or the resources to purchase commercial support for Rails 2.3. Your comment makes me wonder if you are aware of some undisclosed bugs that will be disclosed in the next few months, or if it's more of just a "4.0 is dropping, 2.3 support is going bye-bye" kind of thing. If the former, I'd appreciate some clarification on that point. I have no problem backporting patches myself (and in fact extensively patch libraries when needed!), but I'm wondering if there's an active-yet-undisclosed threat, or if it's just "people aren't going to do my work for me". Can you elaborate?

patio11 13y ago
I do not have, nor possess non-public knowledge about, unpublished vulnerabilities in Rails 2.3. I am just saying that my confidence in there existing one in the near term is "near total."

GavinB 13y ago

Did you consider this as a potential business opportunity for yourself? My reaction on reading this was that someone should be giving you either cash or equity for your roles as both an evangelist and the person who realized this was going to be needed and organized it.

patio11 13y ago
Did you consider this as a potential business opportunity for yourself? For a few minutes. It has poor alignment with my skills (I'm a fairly decent developer and can play a security researcher occasionally, but I'm a lot better at selling/marketing software than I am at hardcore framework development) and desired lifestyle (to whit, not wanting to be up at 4 AM in the morning having to work on Rails security issues -- today excepted, apparently). It also wouldn't play well with my plans to dedicate most of my business efforts to AR going forward. It seems more like someone should be giving you either cash or equity for your roles as both an evangelist and the person who realized this was going to be needed and organized it. I don't take money for publicity, as a matter of policy. The idea is worth about as much as the tweet it takes to describe it. The only interesting coordination problem is matching up Customer Zero with a company interested in and capable of doing the work, and that would be worth compensation, but for the fact that I was Customer Zero. I did briefly entertain the notion of banging down a few doors and selling this (on some model like "I'll guarantee you X amount of business, in return I get a payment of $Y0k when I bring it to your door") but, meh, I'm just not that interested in doing enterprise sales for things that I don't own. Heck, I can scarcely be bothered to do it for things that I do.

ericd 13y ago

This is awesome, I was really dreading the options before, and $195/mo is totally reasonable for my relatively limited needs. Thanks for finding a good company to support this.

InclinedPlane 13y ago

Given all the security problems with rails lately would you still recommend rails for a green field project?

tomfakes 13y ago
I would absolutely use Rails for new projects, specifically because these issues are being surfaced and fixed. A framework or system with only 10 users will never have the depth of security and bug fixing coverage that a larger, well used system has.
- bornhuetter 13y ago
  That's not a very strong argument - the framework with 10 users is a far smaller target than the one with thousands of installs.
  - pfraze 13y ago
    True, unless your site is high profile
    - Groxx 13y ago
      Or someone gets bored.
  - nnq 13y ago
    Websites are targets, not frameworks - if your site is targeted, it's the same thing as having your home-brewed 1 user framework targeted, and as long as you're making money and/or storing valuable client info this can happen anytime...
    - PommeDeTerre 13y ago
      Particular frameworks, CMSes, blog systems and other widely-installed web apps are targeted all the time. When examining web server access logs, it's quite common to see hundreds of requests coming in from a single host during a short period of time, looking to see if certain exploitable framework- or app-specific pages exist. Such scanners do appear to target certain frameworks or web apps, contrary to your suggestion that this does not happen.

JshWright 13y ago

Typo in the first sentence of the third paragraph in "Option 5" "... only benefit the our companies ..."