3 ms·

I have a Rails 2.3x ecommerce app that is not our primary product but still makes us a good amount of money. Personally, I'd like to upgrade to Rails 3.2x (and

I have a Rails 2.3x ecommerce app that is not our primary product but still makes us a good amount of money. Personally, I'd like to upgrade to Rails 3.2x (and eventually 4) so I can take advantage of some newer gems. However, the task is a little daunting given we use some older authentication and file upload libraries. All that to say, if I can't get it done soon, I will definitely go the Rails LTS route. BTW, If any Rails devs out there want a challenge and have some time, please get in touch with me.

ryanmacg 13y ago
I might be wrong but would the trick maybe be to break it down bit by bit, so for instance break off your existing file upload stuff and replace it with CarrierWave or something different. I don't know what your codebase is like but doing it that way should in theory make it more copable to slowly tick it up to rails 3+
- callmeed 13y ago
  Yeah, that's likely the best way to do it. Problem is, our image uploads now number in the high hundreds of thousands (not counting thumbnails). The other problem is, we are short-staffed. So, if I tackle this, it takes me off other projects for 2+ weeks. It looks like there is a fairly active Rails 3 fork of attachment_fu (what we use): https://github.com/pothoven/attachment_fu https://github.com/pothoven/attachment_fu
  - ryanmacg 13y ago
    Gotcha, there's also some information on migrating to paperclip[1] which might suit and I'm sure someone will have done similar for CarrierWave. Of course none of that helps with being short staffed. [1]https://gist.github.com/serek/375203 https://gist.github.com/serek/375203
signifiers 13y ago
The backporting involved here is non-trivial. If the past 9 months are any indication, I would expect we haven't seen the last of the serious YAML vulnerabilities yet: http://www.cvedetails.com/vulnerability-list/vendor_id-12043/product_id-22568/Rubyonrails-Ruby-On-Rails.html http://www.cvedetails.com/vulnerability-list/vendor_id-12043...
- tomjen3 13y ago
  My guess is that mostly no apps depend on that idiotic YAML can parse and execute anything anybody sends us feature, so wouldn't you forward secure rails (harden it?) by replacing YAML with a parser that only parse things?
  - rst 13y ago
    One of the few things Rails LTS adds to prior 2.3 branches is a "hardened" set of security settings that turns off rarely-used and potentially vulnerable arg-parsing code.

ryanmacg 13y ago

I might be wrong but would the trick maybe be to break it down bit by bit, so for instance break off your existing file upload stuff and replace it with CarrierWave or something different. I don't know what your codebase is like but doing it that way should in theory make it more copable to slowly tick it up to rails 3+

callmeed 13y ago
Yeah, that's likely the best way to do it. Problem is, our image uploads now number in the high hundreds of thousands (not counting thumbnails). The other problem is, we are short-staffed. So, if I tackle this, it takes me off other projects for 2+ weeks. It looks like there is a fairly active Rails 3 fork of attachment_fu (what we use): https://github.com/pothoven/attachment_fu https://github.com/pothoven/attachment_fu
- ryanmacg 13y ago
  Gotcha, there's also some information on migrating to paperclip[1] which might suit and I'm sure someone will have done similar for CarrierWave. Of course none of that helps with being short staffed. [1]https://gist.github.com/serek/375203 https://gist.github.com/serek/375203

signifiers 13y ago

The backporting involved here is non-trivial. If the past 9 months are any indication, I would expect we haven't seen the last of the serious YAML vulnerabilities yet: http://www.cvedetails.com/vulnerability-list/vendor_id-12043/product_id-22568/Rubyonrails-Ruby-On-Rails.html http://www.cvedetails.com/vulnerability-list/vendor_id-12043...

tomjen3 13y ago
My guess is that mostly no apps depend on that idiotic YAML can parse and execute anything anybody sends us feature, so wouldn't you forward secure rails (harden it?) by replacing YAML with a parser that only parse things?
- rst 13y ago
  One of the few things Rails LTS adds to prior 2.3 branches is a "hardened" set of security settings that turns off rarely-used and potentially vulnerable arg-parsing code.