News for hackers. Stuff that matters.

A comment on Security releases issued. Parent comment

Re:Security releases issued by steveklabnik on Tuesday February 19, 2013 @05:29PM (#5247530)
One of the reasons that things get extracted to gems is specifically so that people who use it can improve stuff without the whole process of contributing to Rails (and its release cycles) getting in the way.

For example, ActiveResource[1]. Now that it's a gem, the people who use its features can actually take over the maintenance, and release versions independently from Rails proper. It's gotten a lot more contributions lately now that it's independent.

1: https://github.com/rails/activeresource

[ Parent | on HN ]
Re:Security releases issued by tptacek on Tuesday February 19, 2013 @05:33PM (#5247548)
It is also a way of burying hair-on-fire security issues, and of encouraging plugin-style development for what is properly considered a piece of core functionality for Rails.
[ Parent | on HN ]
Re:Security releases issued by steveklabnik on Tuesday February 19, 2013 @05:39PM (#5247591)
> It is also a way of burying hair-on-fire security issues,

:/ I'm sorry you feel that way. I can only speak for myself, but I certainly don't want to bury any security issues, I want to fix them.

> what is properly considered a piece of core functionality for Rails.

Maybe automatically parsing XML parameters shouldn't be?

[ Parent | on HN ]