2 ms·

How is it going to help anyone whose web application has been hacked to know that the problem was expected because the platform they were using was so popular/c

How is it going to help anyone whose web application has been hacked to know that the problem was expected because the platform they were using was so popular/complex/whatever? From a purely practical security point of view, using Rails currently for new applications is taking an aim at your own feet, because there exists less vulnerable solutions as well.

grey-area 13y ago
I'm not making excuses for Rails, which is comparable to many other frameworks on security issues in my experience, I'm pointing out (as many others have done) that your argument is based on false premises. If your home-grown solution is based on golang and you've had security audits done with nothing found, congratulations, but if you haven't, it is almost certainly more vulnerable to a wide range of flaws, some in the libraries, some in your code. For example what CSRF protection do you use, what XSS protections? I'm quite willing to believe that most of the golang web libraries are more solid than rails 1.0 ever was, because they were written by far more experienced programmers initially, but this is a complex topic, they do not cover everything you would need, and everyone makes mistakes. As an example, here is an exploit in play.golang.org: http://codearcana.com/posts/2013/04/23/exploiting-a-go-binary.html http://codearcana.com/posts/2013/04/23/exploiting-a-go-binar... You have provided no evidence that other options are significantly less vulnerable, unless you serve your web pages with OpenSSH?
- vesinisa 13y ago
  You keep putting words to my mouth. I have not compared OpenSSH, Go or Rails as web frameworks. I compared Ruby's speed to Go and Rails' security record to OpenSSH. But I give you misrepresentation is a great way to make someone look stupid. My personal intuition is that Rails is insecure and becoming increasingly insecure. I have cited a high number of CVEs. If you disagree, go ahead and use Rails for your app. You'll save some time, but remember to remain vigilant about security issues.
  - grey-area 13y ago
    The intention wasn't to make you look stupid but to point out the absurdity of the comparison between rails and OpenSSH. I completely agree on speed and (perhaps more importantly) memory size, minimal golang apps far surpass rails. On security, I'm not convinced a home-grown solution in plain go or any of the extant frameworks will be significantly more secure than Rails, nor that Rails is becoming more insecure. If anything I think they're putting more effort and time into security than they did previously.

grey-area 13y ago

I'm not making excuses for Rails, which is comparable to many other frameworks on security issues in my experience, I'm pointing out (as many others have done) that your argument is based on false premises. If your home-grown solution is based on golang and you've had security audits done with nothing found, congratulations, but if you haven't, it is almost certainly more vulnerable to a wide range of flaws, some in the libraries, some in your code. For example what CSRF protection do you use, what XSS protections? I'm quite willing to believe that most of the golang web libraries are more solid than rails 1.0 ever was, because they were written by far more experienced programmers initially, but this is a complex topic, they do not cover everything you would need, and everyone makes mistakes. As an example, here is an exploit in play.golang.org: http://codearcana.com/posts/2013/04/23/exploiting-a-go-binary.html http://codearcana.com/posts/2013/04/23/exploiting-a-go-binar... You have provided no evidence that other options are significantly less vulnerable, unless you serve your web pages with OpenSSH?

vesinisa 13y ago
You keep putting words to my mouth. I have not compared OpenSSH, Go or Rails as web frameworks. I compared Ruby's speed to Go and Rails' security record to OpenSSH. But I give you misrepresentation is a great way to make someone look stupid. My personal intuition is that Rails is insecure and becoming increasingly insecure. I have cited a high number of CVEs. If you disagree, go ahead and use Rails for your app. You'll save some time, but remember to remain vigilant about security issues.
- grey-area 13y ago
  The intention wasn't to make you look stupid but to point out the absurdity of the comparison between rails and OpenSSH. I completely agree on speed and (perhaps more importantly) memory size, minimal golang apps far surpass rails. On security, I'm not convinced a home-grown solution in plain go or any of the extant frameworks will be significantly more secure than Rails, nor that Rails is becoming more insecure. If anything I think they're putting more effort and time into security than they did previously.