4 ms·

Bad framework, with too much magic, poor security, poor performance, not good for anything beyond the five minute blog.

kordless 13y ago
You are indirectly blaming a WHOLE LOTTA people with this comment. Learn to play nicely with others and maybe someone will listen to your complaints. Chances are, you don't care. <---- that's a blaming statement.
vesinisa 13y ago
Sadly, I tend to agree. It seems anyone starting a new publicly-accessible web site with Rails are aiming for a shot at their own feet. Rails might still be usable for Intranet servers in a trusted network setting or prototyping web site ideas before transitioning to a "serious" framework. The continuing security issues and lack of focus on performance make it terrible choice for any production web site.
- matthewmacleod 13y ago
  With respect, you don't know what the hell you are talking about. All software suffers from security issues, and Rails' performance issues are overstated.
  - vesinisa 13y ago
    Rails does suffer disproportionately from security issues. The framework code has become increasingly bloated and serious security vulnerabilities are being continuously discovered (see http://www.cvedetails.com/vulnerability-list/vendor_id-12043/product_id-22568/Rubyonrails-Ruby-On-Rails.html http://www.cvedetails.com/vulnerability-list/vendor_id-12043...) both on the low and high level code (the seriousness of this specific vulnerability depends on application). While I like Rails, I would not choose it as a server-side framework for my product anymore: painful to maintain (backwards-compatibility is not a priority) and slow (compared to say, Go, anyway). Rails is nowadays easily replaced. Most of the fancy server-side bits are not really that useful, and on the front-end the zeitgeist are JavaScript frameworks, where the server acts as an API but serves static HTML/JS/CSS files.
    - djur 13y ago
      Comparing Rails to Go doesn't make any sense. Rails regularly has security vulnerabilities reported because it's popular, mature, deployed in a lot of places, and thus gets a lot of attention. When something like Play or whatever is equivalent in the Go world is similarly exposed I would expect to see security vulnerabilities reported there, too. Software only _gets_ widely reported CVEs if it's popular. The lack of these reports for smaller, less popular frameworks does not indicate the lack of security flaws.
      - vesinisa 13y ago
        It does not suffice that a software is popular to render it insecure. OpenSSH is wildly more popular than Rails will ever be, yet it has a superior security record ( http://www.cvedetails.com/product/585/Openbsd-Openssh.html?vendor_id=97 http://www.cvedetails.com/product/585/Openbsd-Openssh.html?v... ). Good strategy to avoid security issues is to use the smallest possible set of well-tested tools to achieve your task. Rails is almost the complete opposite of this: a large package of pretty much everything, of which most will ever use only a small portion.
        grey-area 13y ago
        You're comparing a web app framework to a language and then to encrypted communication software which has been around for over a decade? You're grasping at straws here and it is telling you quote the OpenSSH security record but not that of other frameworks. Even comparing it to Go is pretty flawed, because of course Go is a language, not a framework, and it has not been tested extensively or attacked extensively, nor have the apps you have written in it. You can expect those apps to have some vulnerabilities you don't even know about as yet, unless you have had a security audit? Like many projects, Rails is continually discovering potential security problems, though I wouldn't say it is significantly worse than other comparable frameworks/stacks, and some of the flaws they are fixing nowadays are pretty much harmless for normal use (some not, like this one, which is dangerous for the subset of users using these advanced features (probably under 5% of users)). Pick any other widely used app framework, and you will find a similar history of security exploits discovered, though I'm sure some are better than others. It's fine to say that Rails has worse security than project x, backed up by figures, but saying anyone using Rails is shooting themselves in the foot is hyperbole. The worst recent issue in rails I can remember is the JSON parsing incident, which also affected some python users. Just as an example comparison, in Golang if you are lazy and unmarshal into an interface or map[string]interface you might end up with similar problems of unintended data leakage, and if you unmarshal into your own struct without carefully checking what you get, you might end up with unexpected nils which only surface much later or data overwritten which was unintended. You're unlikely to get clobbered just as the Ruby JSON parser was, but you could easily introduce vulns without knowing it. I actually prefer golang to ruby for other reasons, but the frameworks are neither mature nor battle tested, so it's not a great example to compare on security, and neither is OpenSSH.
- Axsuul 13y ago
  Ya you don't know what the hell you're talking about. For crying out loud, I would say Rails is probably the most popular framework of choice of YC startups.
  - vesinisa 13y ago
    Not sure how to respond. I am arguing for concrete technical points here. Something being popular does not equate it being right. Does the YC community diswelcome those making critical arguments, or what?
    - Axsuul 13y ago
      Critical arguments are welcome but baseless ones are always challenged. Saying Rails isn't a serious framework discredits the billions of dollars in valuations of companies using it in production today. Even Rails itself is backed by 37signals (now Basecamp), a for-profit company with serious problems that needs serious solutions for its widely popular product. Does Rails win in every technical aspect against other frameworks? Of course not, we all admit it has its flaws. But what it wins at it is developer productivity, getting shit done, and getting new developers up to speed. It does enough to enable a startup to get off the ground and become a million or even billion dollar company. That in itself makes it serious enough.
- Andys 13y ago
  .. because those are the reasons startups fail?
- gaelian 13y ago
  It would be interesting to see an analysis of the number and severity of Rails security issues as compared to similar frameworks with similarly sized user-bases. I would be happy to be convinced by _actual and relevant data_ that Rails has an unusual problem with security. But until then, to me, the people complaining about Rails security sound a lot like the people that complain about Windows security. When you have a product that's used by a whole lot of people, then there's going to be a lot of incentive to find security holes and a whole lot of people using the product in sometimes hard to predict ways. This does not necessarily mean that the product is inherently less secure than alternatives, it just means it's popular.
  - batiste 13y ago
    Just compare it to Django https://news.ycombinator.com/item?id=7262595 https://news.ycombinator.com/item?id=7262595
- djur 13y ago
  What kind of "serious" frameworks are you thinking about? Every large framework I can think of has similar issues as Rails, while minimalist frameworks avoid security holes by encouraging users to implement their own.
venus 13y ago
Very telling that you felt the need to create a new account to make these idiotic comments - you're obviously unwilling to have your real account associated with them. So even you know you're talking shit. Knock it off, why don't you?

You are indirectly blaming a WHOLE LOTTA people with this comment. Learn to play nicely with others and maybe someone will listen to your complaints. Chances are, you don't care. <---- that's a blaming statement.

vesinisa 13y ago

Sadly, I tend to agree. It seems anyone starting a new publicly-accessible web site with Rails are aiming for a shot at their own feet. Rails might still be usable for Intranet servers in a trusted network setting or prototyping web site ideas before transitioning to a "serious" framework. The continuing security issues and lack of focus on performance make it terrible choice for any production web site.

matthewmacleod 13y ago
With respect, you don't know what the hell you are talking about. All software suffers from security issues, and Rails' performance issues are overstated.
- vesinisa 13y ago
  Rails does suffer disproportionately from security issues. The framework code has become increasingly bloated and serious security vulnerabilities are being continuously discovered (see http://www.cvedetails.com/vulnerability-list/vendor_id-12043/product_id-22568/Rubyonrails-Ruby-On-Rails.html http://www.cvedetails.com/vulnerability-list/vendor_id-12043...) both on the low and high level code (the seriousness of this specific vulnerability depends on application). While I like Rails, I would not choose it as a server-side framework for my product anymore: painful to maintain (backwards-compatibility is not a priority) and slow (compared to say, Go, anyway). Rails is nowadays easily replaced. Most of the fancy server-side bits are not really that useful, and on the front-end the zeitgeist are JavaScript frameworks, where the server acts as an API but serves static HTML/JS/CSS files.
  - djur 13y ago
    Comparing Rails to Go doesn't make any sense. Rails regularly has security vulnerabilities reported because it's popular, mature, deployed in a lot of places, and thus gets a lot of attention. When something like Play or whatever is equivalent in the Go world is similarly exposed I would expect to see security vulnerabilities reported there, too. Software only _gets_ widely reported CVEs if it's popular. The lack of these reports for smaller, less popular frameworks does not indicate the lack of security flaws.
    - vesinisa 13y ago
      It does not suffice that a software is popular to render it insecure. OpenSSH is wildly more popular than Rails will ever be, yet it has a superior security record ( http://www.cvedetails.com/product/585/Openbsd-Openssh.html?vendor_id=97 http://www.cvedetails.com/product/585/Openbsd-Openssh.html?v... ). Good strategy to avoid security issues is to use the smallest possible set of well-tested tools to achieve your task. Rails is almost the complete opposite of this: a large package of pretty much everything, of which most will ever use only a small portion.
      - grey-area 13y ago
        You're comparing a web app framework to a language and then to encrypted communication software which has been around for over a decade? You're grasping at straws here and it is telling you quote the OpenSSH security record but not that of other frameworks. Even comparing it to Go is pretty flawed, because of course Go is a language, not a framework, and it has not been tested extensively or attacked extensively, nor have the apps you have written in it. You can expect those apps to have some vulnerabilities you don't even know about as yet, unless you have had a security audit? Like many projects, Rails is continually discovering potential security problems, though I wouldn't say it is significantly worse than other comparable frameworks/stacks, and some of the flaws they are fixing nowadays are pretty much harmless for normal use (some not, like this one, which is dangerous for the subset of users using these advanced features (probably under 5% of users)). Pick any other widely used app framework, and you will find a similar history of security exploits discovered, though I'm sure some are better than others. It's fine to say that Rails has worse security than project x, backed up by figures, but saying anyone using Rails is shooting themselves in the foot is hyperbole. The worst recent issue in rails I can remember is the JSON parsing incident, which also affected some python users. Just as an example comparison, in Golang if you are lazy and unmarshal into an interface or map[string]interface you might end up with similar problems of unintended data leakage, and if you unmarshal into your own struct without carefully checking what you get, you might end up with unexpected nils which only surface much later or data overwritten which was unintended. You're unlikely to get clobbered just as the Ruby JSON parser was, but you could easily introduce vulns without knowing it. I actually prefer golang to ruby for other reasons, but the frameworks are neither mature nor battle tested, so it's not a great example to compare on security, and neither is OpenSSH.
Axsuul 13y ago
Ya you don't know what the hell you're talking about. For crying out loud, I would say Rails is probably the most popular framework of choice of YC startups.
- vesinisa 13y ago
  Not sure how to respond. I am arguing for concrete technical points here. Something being popular does not equate it being right. Does the YC community diswelcome those making critical arguments, or what?
  - Axsuul 13y ago
    Critical arguments are welcome but baseless ones are always challenged. Saying Rails isn't a serious framework discredits the billions of dollars in valuations of companies using it in production today. Even Rails itself is backed by 37signals (now Basecamp), a for-profit company with serious problems that needs serious solutions for its widely popular product. Does Rails win in every technical aspect against other frameworks? Of course not, we all admit it has its flaws. But what it wins at it is developer productivity, getting shit done, and getting new developers up to speed. It does enough to enable a startup to get off the ground and become a million or even billion dollar company. That in itself makes it serious enough.
Andys 13y ago
.. because those are the reasons startups fail?
gaelian 13y ago
It would be interesting to see an analysis of the number and severity of Rails security issues as compared to similar frameworks with similarly sized user-bases. I would be happy to be convinced by _actual and relevant data_ that Rails has an unusual problem with security. But until then, to me, the people complaining about Rails security sound a lot like the people that complain about Windows security. When you have a product that's used by a whole lot of people, then there's going to be a lot of incentive to find security holes and a whole lot of people using the product in sometimes hard to predict ways. This does not necessarily mean that the product is inherently less secure than alternatives, it just means it's popular.
- batiste 13y ago
  Just compare it to Django https://news.ycombinator.com/item?id=7262595 https://news.ycombinator.com/item?id=7262595
djur 13y ago
What kind of "serious" frameworks are you thinking about? Every large framework I can think of has similar issues as Rails, while minimalist frameworks avoid security holes by encouraging users to implement their own.

venus 13y ago

Very telling that you felt the need to create a new account to make these idiotic comments - you're obviously unwilling to have your real account associated with them. So even you know you're talking shit. Knock it off, why don't you?