8 ms·

Given all the security problems with rails lately would you still recommend rails for a green field project?

tomfakes 13y ago
I would absolutely use Rails for new projects, specifically because these issues are being surfaced and fixed. A framework or system with only 10 users will never have the depth of security and bug fixing coverage that a larger, well used system has.
- bornhuetter 13y ago
  That's not a very strong argument - the framework with 10 users is a far smaller target than the one with thousands of installs.
  - pfraze 13y ago
    True, unless your site is high profile
    - Groxx 13y ago
      Or someone gets bored.
  - nnq 13y ago
    Websites are targets, not frameworks - if your site is targeted, it's the same thing as having your home-brewed 1 user framework targeted, and as long as you're making money and/or storing valuable client info this can happen anytime...
    - PommeDeTerre 13y ago
      Particular frameworks, CMSes, blog systems and other widely-installed web apps are targeted all the time. When examining web server access logs, it's quite common to see hundreds of requests coming in from a single host during a short period of time, looking to see if certain exploitable framework- or app-specific pages exist. Such scanners do appear to target certain frameworks or web apps, contrary to your suggestion that this does not happen.
mey 13y ago
I personally have been turned off from it. Not that they have security issues, everyone does, it's the time required to roll out changes basically requires not just updating a library, but updating your framework since the line between your code and the framework can be extremely blurred. This means that if you have multiple rails sites with limited or no timely dev support you may not be readily able to upgrade your site to resolve issues. This is why I took down my personal blog I had built in rails since I didn't want to be exposed to these issues and didn't have the time or desire to uplift the site onto more recent versions of rails.
- xentronium 13y ago
  They normally release patches and workarounds for those who can't upgrade immediately.
kryten 13y ago
I wouldn't. I'd go with something with a definitive support life and paid support if you need it. Either that or something simple enough you can run your own fork.
- steveklabnik 13y ago
  Rails has a definitive support life: http://weblog.rubyonrails.org/2013/2/24/maintenance-policy-for-ruby-on-rails/ http://weblog.rubyonrails.org/2013/2/24/maintenance-policy-f... And this article is about paid support if you need it. ;)
  - kryten 13y ago
    It does but commercial offerings that we have are still supported from their implementation in 2001. Paid support by the vendor?
    - steveklabnik 13y ago
      If you require paid support by a vendor, you're not really using very much open source. Which is fine, but it's a very different world than mine.
      - saryant 13y ago
        I disagree with that. Paid support is arguably the most popular monetization model for open source software. Redhat is a prime example of that.
        steveklabnik 13y ago
        Right, hence why I said 'much.' Red Hat is big, but it's one project of many.
jfb 13y ago
I don't write web software, but I can't imagine that any other framework of any kind that approaches Rails' feature breadth or popularity isn't as ridden with subtle security flaws, to say nothing of terrible, forehead-slapping boners.
- joseph_cooney 13y ago
  ASP.NET
  - euroclydon 13y ago
    It's a legit choice. Not quite as feature-rich but its getting there. SignalR is leaps and bounds above anything else. IIS is easier to configure for a new admin than nginx/*icorn. And that whole pay for support thing, well it's not a novel concept in the Windows world.
    - gregd 13y ago
      I'm curious to know what you think is in Rails that isn't in asp.net.
bascule 13y ago
Given the local root in Linux lately (CVE-2013-2094), would you still recommend Linux for a server OS? :P
- mynameisme 13y ago
  Linux is really good about backwards compatibility, so the situation is different.
gboudrias 13y ago
As a Drupal dev, I couldn't recommend any CMS if we go by that standard. None of them are secure forever. A security policy is what makes a CMS trustworthy, as there will always be holes. As a guy who dislikes it (and doesn't know all that much about it), I still find Rails' security policy to be efficient and reasonable.

I would absolutely use Rails for new projects, specifically because these issues are being surfaced and fixed. A framework or system with only 10 users will never have the depth of security and bug fixing coverage that a larger, well used system has.

bornhuetter 13y ago
That's not a very strong argument - the framework with 10 users is a far smaller target than the one with thousands of installs.
- pfraze 13y ago
  True, unless your site is high profile
  - Groxx 13y ago
    Or someone gets bored.
- nnq 13y ago
  Websites are targets, not frameworks - if your site is targeted, it's the same thing as having your home-brewed 1 user framework targeted, and as long as you're making money and/or storing valuable client info this can happen anytime...
  - PommeDeTerre 13y ago
    Particular frameworks, CMSes, blog systems and other widely-installed web apps are targeted all the time. When examining web server access logs, it's quite common to see hundreds of requests coming in from a single host during a short period of time, looking to see if certain exploitable framework- or app-specific pages exist. Such scanners do appear to target certain frameworks or web apps, contrary to your suggestion that this does not happen.

mey 13y ago

I personally have been turned off from it. Not that they have security issues, everyone does, it's the time required to roll out changes basically requires not just updating a library, but updating your framework since the line between your code and the framework can be extremely blurred. This means that if you have multiple rails sites with limited or no timely dev support you may not be readily able to upgrade your site to resolve issues. This is why I took down my personal blog I had built in rails since I didn't want to be exposed to these issues and didn't have the time or desire to uplift the site onto more recent versions of rails.

xentronium 13y ago
They normally release patches and workarounds for those who can't upgrade immediately.

kryten 13y ago

I wouldn't. I'd go with something with a definitive support life and paid support if you need it. Either that or something simple enough you can run your own fork.

steveklabnik 13y ago
Rails has a definitive support life: http://weblog.rubyonrails.org/2013/2/24/maintenance-policy-for-ruby-on-rails/ http://weblog.rubyonrails.org/2013/2/24/maintenance-policy-f... And this article is about paid support if you need it. ;)
- kryten 13y ago
  It does but commercial offerings that we have are still supported from their implementation in 2001. Paid support by the vendor?
  - steveklabnik 13y ago
    If you require paid support by a vendor, you're not really using very much open source. Which is fine, but it's a very different world than mine.
    - saryant 13y ago
      I disagree with that. Paid support is arguably the most popular monetization model for open source software. Redhat is a prime example of that.
      - steveklabnik 13y ago
        Right, hence why I said 'much.' Red Hat is big, but it's one project of many.

jfb 13y ago

I don't write web software, but I can't imagine that any other framework of any kind that approaches Rails' feature breadth or popularity isn't as ridden with subtle security flaws, to say nothing of terrible, forehead-slapping boners.

joseph_cooney 13y ago
ASP.NET
- euroclydon 13y ago
  It's a legit choice. Not quite as feature-rich but its getting there. SignalR is leaps and bounds above anything else. IIS is easier to configure for a new admin than nginx/*icorn. And that whole pay for support thing, well it's not a novel concept in the Windows world.
  - gregd 13y ago
    I'm curious to know what you think is in Rails that isn't in asp.net.

bascule 13y ago

Given the local root in Linux lately (CVE-2013-2094), would you still recommend Linux for a server OS? :P

mynameisme 13y ago
Linux is really good about backwards compatibility, so the situation is different.

gboudrias 13y ago

As a Drupal dev, I couldn't recommend any CMS if we go by that standard. None of them are secure forever. A security policy is what makes a CMS trustworthy, as there will always be holes. As a guy who dislikes it (and doesn't know all that much about it), I still find Rails' security policy to be efficient and reasonable.