News for hackers. Stuff that matters.
Re:Rails, still? by ethagnawl on Saturday September 01, 2018 @08:13AM (#17891469)
"Sinatra is Ruby with Rails in mind. You will find yourself using more of Rails in your Sinatra application over time and ask yourself why you're not just using Rails."

This is an important point. If you've ever developed a non-trivial application using Sinatra, Express or any other "micro" or "non-opinionated" framework, you'll have hit this wall quickly.

To riff on Greenspun's Tenth Rule, "Any sufficiently complicated $MICRO-FRAMEWORK application contains an ad hoc informally-specified bug-ridden slow implementation of half of Ruby on Rails."

Re:Rails, still? by matthewmacleod on Saturday September 01, 2018 @08:41AM (#17891571)
Every time - every single time - I have started building an application using Sinatra I have regretted not building it in Rails from the start.

I totally understand the desire for a minimal and clean codebase. If I’m not going to use 80% of Rails, why would include it, right?

But in practice, I have found there is basically zero cost to using Rails instead.

Re:Rails, still? by petepete on Saturday September 01, 2018 @11:25AM (#17892247)
I still love Sinatra for back office and API stuff where you don't need to worry quite so much about authentication, exploits, web assets, permission hierarchies/matrices etc.

At the company I used to work for we built our invoicing system's API with it and it was fantastic, plain succinct Ruby with Sinatra, Sequel and not much else.

For public-facing apps that require signup, clever routing, image uploads and other non-trivial functionality, Rails definitely makes more sense.

Re:Rails, still? by seabrookmx on Saturday September 01, 2018 @04:11PM (#17893695)
Exactly.

I think the answer to 90% of these "framework A vs. framework B" discussions comes down to "use the best tool for the job".

Re:Rails, still? by squirrelicus on Saturday September 01, 2018 @03:40PM (#17893574)
For readers interested in a contrary anecdote, every time I've used Sinatra based frameworks, such a Express or Nancy, I've thought without a doubt it was the right choice over something MVC based.

The simplicity of these frameworks allows arbitrary changes with minimal friction, patterns, restrictions, and other people's opinions, i.e. conventions.

Re:Rails, still? by jfaucett on Saturday September 01, 2018 @10:53AM (#17892107)
> Every time - every single time...

Just thought I'd provide some counter data here. I've built small services in Sinatra, which did not warrant the usage of Rails and never had to change anything, having them in fully functional operation for years.

I could have built these little apps in Rails, but I did not need it, never did, and my code/deployment/etc. is cleaner and smaller because of it.

Also these services have always been quite small (a few endpoints or functions), which is what I think Sinatra is best for.

Re:Rails, still? by IMTDb on Saturday September 01, 2018 @04:40PM (#17893793)
I second this. I use sintra for all those sites that are 75% static pages and few dynamic parts here are there and could not be happier.

Non optionated means that I can really easily setup the model that I want/need without having any framework in my way. Love it. One caveat: I am a senior engineer 7+ years of experience. I would not have been comfortable having to do those design choices earlier in my career and Rails would have been better suited then.

Re:Rails, still? by rm_-rf_slash on Saturday September 01, 2018 @10:46AM (#17892071)
It’s been a few years since I’ve used Rails, but when I did, it always felt like within a year or two a new version of Rails would come out and I’d basically have to rewrite the site from scratch if I wanted to update.

I don’t know if the codebase has stabilized but the transition between 2.x to 3.x to 4.x was pretty rocky from my recollection. Hopefully it’s better, since Rails is probably the best framework to get a site up and running quickly.

Re:Rails, still? by dasil003 on Saturday September 01, 2018 @12:32PM (#17892601)
I've been using Rails since before 1.0 and the upgrade pain has decreased significantly over time. The worst upgrade I had was 3.0 to 3.1 where there was a performance regression that caused my test suite to go from 15 mins to about 8 hours on ruby 1.8.7, so I had to simultaneously upgrade to 1.9.3 at the same time. That involved YAML parser changes which I didn't catch before corrupting some serialized data in the DB.

Since that time both ruby and rails have stabilized their upgrades significantly. The biggest issue since then was updating to strong params, and that was only an issue for apps with a large CRUD surface area.

These days I think Rails is the perfect balance of stable and flexible for a wide swath of prototypes and apps. The areas where I'd look for an alternative would be web sockets, heavy concurrency (ie. needing more than background workers), or where raw compute is the bottleneck.

Re:Rails, still? by websitescenes on Saturday September 01, 2018 @10:53AM (#17892108)
Since v3 I’ve had no issues upgrading apps to the latest. As soon as a new release is available, I upgrade. V2 to v3 was pretty painful though..
Re:Rails, still? by rapind on Sunday September 02, 2018 @06:19PM (#17898997)
Specifically the change in the default to escape strings and having to specify when you want to pass it through unsafely (html_safe / raw). Broke a lot of v2 apps, but ultimately I think it was definitely the right call. Same thing again when strong_params become the default. So mostly due to security improvements.

v2 -> v3 also was the merb merging and a pretty significant rewrite, so it's pretty impressive that we didn't have even more trouble IMO.

Re:Rails, still? by swerveonem on Saturday September 01, 2018 @02:29PM (#17893254)
If you truly had to rewrite from scratch you did something wrong, the APIs are not vastly different.
Re:Rails, still? by rubyfan on Saturday September 01, 2018 @09:24AM (#17891719)
I agree, totally true even with some small trivial apps. The few places a Sinatra app have worked for me are highly specialized, single method and generally have been for performance reasons and could have been in any other framework due to them loading as SSI or AJAX call.
Re:Rails, still? by sametmax on Saturday September 01, 2018 @11:17AM (#17892201)
Same with flask and django. And the worst is that the flask version is often riddle with security holes (not flask's fault) that would have been prevented for free.

I actually always say that despite the apparent easiness of the micro framwork hello world, you have to actually be very skilled to use them correctly to do anything beyong a few pages. While a full feature framework will make a beginer produce a decent work by default.

Re:Rails, still? by toyg on Saturday September 01, 2018 @12:01PM (#17892421)
There are situations where Flask is good enough and very fast to deploy, while Django is overkill and more complicated to set up.

I agree that, should a system get significantly complex, eventually you will want Django; but a lot of projects simply never get there. That's why it's good to have a choice anyway.

Re:Rails, still? by sametmax on Saturday September 01, 2018 @12:33PM (#17892605)
Anything that requires auth or database access requires setup that a lot of dev will get wrong.

E.g : sqlalchemy sessions are very often badly handled. Of course you could write sql by hand, but then you loose the entire ecosystem of blueprints.

Re:Rails, still? by mixmastamyk on Saturday September 01, 2018 @02:27PM (#17893248)
> you loose the entire ecosystem of blueprints.

Blueprints for models?

Re:Rails, still? by sametmax on Saturday September 01, 2018 @05:57PM (#17894096)
Yes. E.g : sqlalchemy admin.
Re:Rails, still? by tankerdude on Saturday September 01, 2018 @07:44PM (#17894517)
Lately, I’ve used Flask with Connexion, JWT, SQLAlchemy, and Alembic did my microservice APIs.

Relatively few lines of code that comes with validation, API playground, and defined routes plugged in via the swagger doc.

The main I ssue is having a nice admin page, tbh. Flask doesn’t have one like Django but eh. Good enough I suppose.

Re:Rails, still? by shreyas-satish on Monday September 03, 2018 @02:57AM (#17900912)
There's Flask-Admin[0] which I found really useful.

[0] https://flask-admin.readthedocs.io/en/latest/

Re:Rails, still? by linux2647 on Saturday September 01, 2018 @11:22AM (#17892231)
What sort of security holes in Flask are you referring to?
Re:Rails, still? by sametmax on Saturday September 01, 2018 @12:29PM (#17892579)
Not flasks. Flask users code. The last flask app I worked on had a custom auth scheme with md5 hashed passwords.

You see because flask is so minimal, many beginers use it for an easy start, only to rewrite square wheels when the project gets real.

Re:Rails, still? by chc on Saturday September 01, 2018 @12:18PM (#17892508)
They didn't say there are holes in Flask, but that the Flask version of an app is more likely to contain holes (presumably because you're less pushed into safe defaults).
Re:Rails, still? by type0 on Saturday September 01, 2018 @11:52AM (#17892364)
Maybe that it doesn't sanitize the user input, but calling that security hole is a bit of a stretch. Sure you have the freedom to use some insecure libraries with flask but the same could be said about any framework.
Re:Rails, still? by sametmax on Saturday September 01, 2018 @12:38PM (#17892627)
Django protect you out of the box of xss, csrf, and click jacking while providing you with a proven robust extensible auth mechanism.

When using flask, you have to be able to make decisions about those. Many devs are not able to.

I'm ok with it: not everybody has to be an expert to be a great element in a company. But flask gives those profile a false sense of easiness.

Re:Rails, still? by type0 on Monday September 03, 2018 @06:32AM (#17901711)
I have seen a fare share of terribly written django apps, riddled with security holes that weren't so obvious at the first glimpse.

> But flask gives those profile a false sense of easiness.

It allows you to prototype very fast, not everyone needs nor wants the hand-holding that django provides.

Don't get me wrong I think django is fantastic at what it gives out of the box but saying that flask is insecure is just fud.

Also - try Pyramid, you'll never know when it suits your needs https://trypyramid.com/

Re:Rails, still? by flasker11 on Monday September 03, 2018 @01:47AM (#17900588)
Have you ever written a flask app yourself? It provides identical protections against xss etc. that you mentioned, as well as an auth plugin and tutorials on doing auth right... I think it's unfair to spread a negative opinion of Flask because you had to work on an app that used it badly.
Re:Rails, still? by danpalmer on Saturday September 01, 2018 @12:03PM (#17892434)
My rule of thumb...

ORM, sessions, auth, administration, form validation, template rendering, API infrastructure, static file management, RSS feeds, ...

If you think your service will ever need more that 2 of these, use a framework. These will integrate well with each other and save time.

Re:Rails, still? by jrs95 on Saturday September 01, 2018 @02:04PM (#17893123)
Rails might not be perfect, but there's a 95% chance it'll be better than the custom framework you end up building on Node.
Re:Rails, still? by aikah on Saturday September 01, 2018 @08:23AM (#17891504)
> This is an important point. If you've ever developed a non-trivial application using Sinatra, Express or any other "micro" or "non-opinionated" framework, you'll have hit this wall quickly.

Not really. You want an ORM? choose an ORM library. You want templates, choose a templating library. You want to send mails, choose a mailing library. I don't see how big frameworks like Rails make all these things better, especially when they don't give you the choice as to what tool to use. If you ever developed a non trivial application, you also know that your first concern will be to avoid unnecessary bloat and complexity and only bring in libraries that are strictly required. And as we are moving from traditional html rendered server apps, big frameworks lost even more value since there is no need for a templating libraries, html form libraries,...

Re:Rails, still? by matthewmacleod on Saturday September 01, 2018 @08:29AM (#17891532)
I actually consider Rails in its 3.x+ versions to be a pre-selected combination of smaller libraries - because it really is. Don’t need mail? Remove actionmailer. Don’t need a database? Remove ActiveRecord. The benefit is that when you do need those tools, they are there, they work together, and you don’t have to choose.

That’s not always perfect or suitable for every use case, but it’s not a bad thing.

Re:Rails, still? by steveklabnik on Saturday September 01, 2018 @09:58AM (#17891860)
Agreed; those days are when I worked on Rails, and that was a lot of the things that made 3.x different from 2.x. I wrote a blog post about it that’s one of my most popular ever: https://words.steveklabnik.com/rails-has-two-default-stacks

This sentiment also was a major theme of my forward to The Rails Way.

I’ve been thinking about this stuff a lot in the context of Rust...

Re:Rails, still? by canhascodez on Saturday September 01, 2018 @11:04AM (#17892157)
> I’ve been thinking about this stuff a lot in the context of Rust...

Do you mind extrapolating further, or will that be the topic of a future blog post?

Re:Rails, still? by steveklabnik on Saturday September 01, 2018 @05:30PM (#17893967)
For now, what I’ll say is that I’ve seen how Node never really got a rails, and how Rust has a zillion microframeworks but no Rails either, yet. Do we need one? What would it look like? That kind of thing.
Re:Rails, still? by ethagnawl on Saturday September 01, 2018 @08:38PM (#17894723)
> Node never really got a rails

I'm, admittedly, out of the loop when it comes to Node, but I do remember Sails looking promising when it was first announced. I recently suggested it to someone (who uses Node regularly) as a possible solution for a project we're working on and they'd never heard of it. So, between that reaction and the fact that I haven't heard of anyone else using it (or anything similar), I think you're right that a Railsy solution never took off.

Elixir is an interesting counterpoint, though. It seems like Phoenix was released and saw broad adoption very early on.

I'm wondering if this dichotomy is a result of where people are coming to these newer languages from: people writing Elixir probably aren't coming from the FE/JS world, but there's a very good chance people writing Node are. Prior to the somewhat recent proliferation of JS client app frameworks, using a smattering of libraries was a very common approach to solving problems. (It arguably still is, albeit at a different level of abstraction in React/Babel/Webpack land.)

Anyways, I'll be looking forward to reading the post you alluded to above, should it ever come together.

Re:Rails, still? by emodendroket on Saturday September 01, 2018 @12:49PM (#17892691)
I really don't care for Rails' components. But I think you are right when you talk about this -- monolithic frameworks allow you to get all these decisions out of the way and simply get on with developing your project. How much benefit are you really getting out of spending the time comparison shopping a bunch of serialization libraries instead of just picking on and moving on? Unless serialization is somehow a core part of what your application does, the benefit is probably quite marginal.
Re:Rails, still? by ryanbrunner on Saturday September 01, 2018 @10:40AM (#17892037)
The big value that Rails adds is that it eliminates valueless choices. Most of the time, which logging library, ORM, view templating language, whatever doesn't really make all that much difference in terms of effectiveness and essentially come down to aesthetics.

When working with a framework that doesn't make those decisions for you, you end up with two big downsides - you waste time and energy arguing over which of these low-value choices you want to take, and new developers take longer to come up to speed with your particular architecture, since they need to learn each of the choices and how they are integrated, whereas in Rails it's obvious where everything is and how it's configured if you're familiar with the framework.

Bloat is also over-emphasized, particularly for the backend. You'll load the gems in memory, sure, but they're a fairly small footprint on their own and it's not like Rails is calling the parts of the framework it's not using (save maybe middleware, although most of that is useful for most web applications).

Re:Rails, still? by jrumbut on Saturday September 01, 2018 @07:46PM (#17894529)
A big benefit of how opinionated frameworks preempt debates about marginal issues is that it's an externally imposed decision, instead of one team member triumphing over the others.

It really helps team cohesion for DHH to tell you that you're using X instead of Y as opposed to the most domineering devs getting their way every time. In my mind this even compensates for some suboptimal choices Rails may make.

Re:Rails, still? by prophetjohn on Saturday September 01, 2018 @09:55AM (#17891851)
> You want an ORM? choose an ORM library. You want templates, choose a templating library. You want to send mails, choose a mailing library.

But I'd rather spend my time creating business value than researching ORMs, templating libraries and mailers. And since I've never not been able to accomplish something with the ones Rails includes by default, I've never seen the need to use something else.

Re:Rails, still? by mbesto on Saturday September 01, 2018 @10:56AM (#17892121)
And guess what? Let's say you have that file parser that runs faster in Go? Send that call from Rails to Lambda and bam! you don't have to worry about infrastructure either!

If you're building a CRUD app (most are), then any popular MVC (Rails/Django/Laravel/.NET MVC/etc) will likely do. If you're worried about "Twitter/Facebook/Google scale" when you're starting, then you're doing it wrong.

Re:Rails, still? by JasonFruit on Saturday September 01, 2018 @10:06AM (#17891887)
I'm surprised to hear that a person can efficiently create business value without knowing the ecosystem of the language they are using. Without a knowledge of what exists outside Rails, how do you know you're not wasting time and effort? (Not to ask how you're going to get your next job.)
Re:Rails, still? by mgkimsal on Saturday September 01, 2018 @10:20AM (#17891945)
> Without a knowledge of what exists outside Rails, how do you know you're not wasting time and effort? (Not to ask how you're going to get your next job.)

So now you need to factor in research time. Then, continual research time, every time a new library or version of a library comes out. And if your research turns up that, no, in fact, version X or new lib Y is not substantively better (by whatever metric you're looking at), do you count that research time as 'wasted'?

> how do you know you're not wasting time and effort?

You look at the results of what you're doing vs what expectations were, firstly. You can then, periodically, look at your efforts, and compare reports from others who are claiming to do the same thing, and ... occasionally... spend time determining if a different approach offers radically better returns on the effort/results you have now. Switching to XYZ may also involve huge amounts of refactoring, upgrade, migration, etc. How do you know all that effort won't be "wasted" if new platform XYZ is abandoned 18 months from now?

"efficiently" doesn't necessarily mean "at maximum efficiency". Also, "business value" is almost always intertwined with hitting particular date/time goals, which often trump technical metrics.

Re:Rails, still? by toasterlovin on Saturday September 01, 2018 @10:31AM (#17891990)
Rails ain’t exactly new. It works pretty well for most things. I think most Rails developers generally stay abreast of large developments in the ecosystem, but the days where you would see significant benefits from being aware of every little library that comes out are long gone.
Re:Rails, still? by prophetjohn on Sunday September 02, 2018 @08:45AM (#17896788)
Yes, I agree that knowledge of the ecosystem is important to efficiently create business value. If I don't know that Devise exists and I roll my own auth library, that's a waste of time.

That's different than if I don't know that Sequel exists and I blindly use ActiveRecord. They're both ORMs. They can both read and write data from a database. And guess what — ActiveRecord is better for the vast majority of situations and everyone in the Rails community knows it, so my research into Sequel would have been time wasted.

Rails helps you avoid wasting time on this kind of stuff and pre-packages stuff that most everyone needs and where the alternatives are not substantively different.

Re:Rails, still? by gravypod on Saturday September 01, 2018 @08:27AM (#17891524)
The improvement comes from someone else making all of those decision for you and as long as you completely ignore your design requirements and force your problems into the framework's mold then you're golden! You never actually need to think!

You also get a uniformity of understanding of your library and a support network.

Re:Rails, still? by ryanbrunner on Saturday September 01, 2018 @10:48AM (#17892077)
Rails is tailored to a particular type of web application, and if your application strays far from this model it's probably not going to be a great fit. I don't think even the biggest Rails zealot would advocate building Google Maps in Rails.

The sweet spot that Rails covers, however, is a pretty common sort of web application - one in which you're primarily doing CRUD on different sorts of objects. If you treat every single application as a unique snowflake that needs a 100% bespoke collection of libraries to solve, you'll end up wasting a whole lot of time on architecture and library selection and not a lot of time on solving actual problems.

Re:Rails, still? by jashmatthews on Saturday September 01, 2018 @12:55PM (#17892720)
> I don't think even the biggest Rails zealot would advocate building Google Maps in Rails.

Rails excels at being the web layer in this situation. All the heavy lifting is done by the DB to spit back feature structures or do routing and native libraries to do image composition.

Re:Rails, still? by Doctor_Fegg on Saturday September 01, 2018 @01:33PM (#17892940)
And indeed, openstreetmap.org is a Rails site (though key parts of the API have been rewritten in C++ for performance).
Re:Rails, still? by toasterlovin on Saturday September 01, 2018 @10:23AM (#17891957)
The world is filled with other people. IMO, the benefit you get from another person being able to immediately be productive in your codebase vastly outweighs any benefit you would get from hand picking an ORM, a mailer, a templating library, etc.

And, anyway, Rails is pretty modular; you can rip out and replace anything that isn’t to your taste.

Re:Rails, still? by sametmax on Saturday September 01, 2018 @11:19AM (#17892220)
Choosing is much harder than it seems, and much more resource consumming. Then you have to integrate them. And of course test, maintain, document and update said integration.

All people I worked with that had your philosophy didn't so that last part, and it had important consequences for the whole project duration.

Re:Rails, still? by liveoneggs on Saturday September 01, 2018 @08:51AM (#17891601)
but in ruby rails dominates all of these components massively
Re:Rails, still? by spsoto on Saturday September 01, 2018 @11:40AM (#17892316)
I completely agree! I worked with Rails 2+ years and it was really comfortable that everything I needed was at hand at the moment of scaling the application with new features or requirements.

After that, I needed to make some microservices orchestration and NodeJS (using Koa as the HTTP server wrapper) was a better tool to deal with all these asynchronous tasks.

But: Routing? Parsing JSON? Storing files in S3? Dealing with databases? Serve some static assets (e.g. Swagger)? Up to you! And good luck finding the up-to-date and standard library for your needs.

Overall, using workers, doing asynchronous tasks (e.g. starting a thread after hitting an endpoint) and coding orchestration endpoints (e.g. GraphQL) was a enjoyable experience where you have almost full control of what you were doing, but I still miss those days working with Rails where the community was so helpful in finding a friendly path to dealing with some common problems. My impression is that it feels less fragmented overall.

I haven't found myself an ORM as good and expressive as ActiveRecord or Sequel. Overall I think it has to do with all the metaprogramming tools you have available on Ruby. That's something amazing to deal with cookie-cutter problems, but also a problem when you need to do more granular control or get out of the typical CRUD problems.

Re:Rails, still? by eropple on Saturday September 01, 2018 @03:01PM (#17893396)
> If you've ever developed a non-trivial application using Sinatra, Express or any other "micro" or "non-opinionated" framework, you'll have hit this wall quickly.

I have developed very nontrivial applications with Modern, which can be thought of as Sinatra-like, without regretting the choice or without implementing a bunch of Rails things. The web application is an immutable spec and defined as such; state is offloaded to dependent services pushed into your HTTP action handlers. Done. But, then, in 2018 (or 2016 when I started its predecessor), "an application" no longer required bashing into it ERB templates or the like, so I'll grant that it's a little easier.

https://github.com/modern-project/modern-ruby

That said, in the Node world I do use Hapi over Express, as it conforms better to the way I think about things.

Re:Rails, still? by onli on Saturday September 01, 2018 @10:47AM (#17892075)
I think that's totally valid. As web applications grow you run more and more into the need for new features and the need for common solutions, things that Rails already give you. For example, when I wanted to try out jRuby for an application of mine, one point that made that impossible was the existing usage of the sqlite gem. Had I used activerecord I could have moved it over to the jdbc api with a simple added gem, Rails would have set me up for that solution. Or locales: The construction I added into my software basically re-implements how a Rails gem is used.

But that's also the value in it: After you constructed a big enough Sinatra application you understand why and how Rails is doing the things it does. I think that's very useful.

Re:Rails, still? by vorpalhex on Saturday September 01, 2018 @12:25PM (#17892555)
I have worked on a lot of ugly rails apps that would of been infinitely less painful as a thin Sinatra app.

Use the solution to fit your problem. Microframeworks for small composable problems.

For some reason rails devs see it as the hammer for every nail, screw, bolt, pipe fitting and joint.

Re:Rails, still? by pbreit on Saturday September 01, 2018 @02:39PM (#17893306)
Is the holy grail of minimal enough to stay out of your way but maximal enough to handle all the common app needs really that difficult to reach?
[dead]
Re:Rails, still? by andybak on Saturday September 01, 2018 @08:23AM (#17891503)
Sorry. Did you just compare a language to a web framework as if one could be substituted for the other?
Re:Rails, still? by z3phyr on Saturday September 01, 2018 @08:26AM (#17891517)
Did you just compare a language to a web framework? Yes you did.