3 ms·

Are any of these environments actually proven in more than a handful of real-world production environments? I'd certainly like to get into alternatives but my

Are any of these environments actually proven in more than a handful of real-world production environments? I'd certainly like to get into alternatives but my impression was that none of these battle-tested the way Rails and Django are.

bhauer 13y ago
I assume you mean battle-tested from a security standpoint. I suppose you'd need to make that judgment call yourself. In my opinion, many of the options I listed have seen sufficient production usage that I consider them roughly as secure as any mainstream framework. For example, Play and Scalatra are used at Netflix, BBC, LinkedIn, etc. Many expressly avoid notoriously dangerous (and frankly alarming) deserialize-user-input-and-execute patterns, which is in my experience the most common form of framework vulnerability. As for performance, scalability, and reliability under pressure, that is precisely the point I was making earlier: higher-performance platforms combined with frameworks designed for performance and scalability are targeting grace under pressure moreso than legacy frameworks. Higher performance gives you greater peace of mind with availability, responsiveness, and user experience.
jake_morrison 13y ago
There is a reason that the largest Internet companies are still running their infrastructure on Java and C++. It scales and operations people know how to manage it. Rails is the classic example of optimizing for developer ease of use instead of performance. Which probably makes sense for startups, but scaling is a pain in the ass. Openresty is great for infrastructure level solutions, e.g. request routing and authentication. It is used by some of the largest Internet companies in China. The benchmarks at http://www.techempower.com/benchmarks/ http://www.techempower.com/benchmarks/ are a reminder of how poorly some popular frameworks perform. And how poorly cloud performs vs relatively cheap dedicated hardware.
deleted 13y ago
[deleted]

bhauer 13y ago

I assume you mean battle-tested from a security standpoint. I suppose you'd need to make that judgment call yourself. In my opinion, many of the options I listed have seen sufficient production usage that I consider them roughly as secure as any mainstream framework. For example, Play and Scalatra are used at Netflix, BBC, LinkedIn, etc. Many expressly avoid notoriously dangerous (and frankly alarming) deserialize-user-input-and-execute patterns, which is in my experience the most common form of framework vulnerability. As for performance, scalability, and reliability under pressure, that is precisely the point I was making earlier: higher-performance platforms combined with frameworks designed for performance and scalability are targeting grace under pressure moreso than legacy frameworks. Higher performance gives you greater peace of mind with availability, responsiveness, and user experience.

jake_morrison 13y ago

There is a reason that the largest Internet companies are still running their infrastructure on Java and C++. It scales and operations people know how to manage it. Rails is the classic example of optimizing for developer ease of use instead of performance. Which probably makes sense for startups, but scaling is a pain in the ass. Openresty is great for infrastructure level solutions, e.g. request routing and authentication. It is used by some of the largest Internet companies in China. The benchmarks at http://www.techempower.com/benchmarks/ http://www.techempower.com/benchmarks/ are a reminder of how poorly some popular frameworks perform. And how poorly cloud performs vs relatively cheap dedicated hardware.

deleted 13y ago

[deleted]