I think the short answer is probably, nobody at Github has a lot of macro-level regrets at this point.

I think the real issue is that the Rails community should be supremely grateful that they have a team like Github's building on the framework they've chosen. They all get to draft off the deployment/security/development/reliability work Github sinks into the platform.

And, painful though it will surely be for HN to hear this, snags like the one today are how frameworks eventually get to be solid. Spent much time looking at Java Spring's track record?

Honestly, I think it's great that this all gets aired out in the open. The amount of transparency behind all of this is a breath of fresh air.

Rails has had its share of growing pains; it really sucks that a security patch had a regression and I think this gave people a lot of flash backs to the pre Rails 3 days. By the end of this, however, we'll end up having a solid security infrastructure.

I'm willing to wager that 90% of the time these kinds of issues just get swept under the rug and silently patched.

This was true for young developers or people without the right experience developing web sites at the time.

Already in 1999 our company was using TCL framework built as Apache module that was quite similar to Rails. Following some designs similar to AOL Server.

We just happened to be in Portugal and never had the press coverage that Rails did.

By the time Rails appeared we had already moved into .NET/C++ to improve the scalability of our product.

The same scalability issues that Twitter, LinkedIn and other American companies found out with Rails while deciding to move to JVM based alternatives.

The technology behind Rails is was nothing new, it was just very well applied in a fresh language.

Very true. Transformative my ass. I was already pretty efficient at building websites without rails.

I'm probably not the only one who found it transformative, you're probably not the only one who didn't, and that's fine. A piece of technology doesn't have to be useful to everyone to be transformative.

I live in Germany nowadays.

Personally, I have a different recollection. I seem to remember the PHP MVC frameworks and ASP.Net MVC and and whatever the hell Java people use all came out because Rails and Django became popular. I do remember Django helped but as an outsider to the two frameworks I seemed to get the feeling Rails was clearly the thought leader.

Rails made MVC popular among lesser developers (bottom feeders, small projects, not much money - this may have changed now). A lot of organisations were using MVC as an enterprise design pattern a long time ago.

I think smalltalk devs were using the MVC pattern in the 80's and it's been in various Java enterprise stacks for a very very long time. It seems that everyone else caught up when being a low paid front end 'developer' became cool in the USA.

"Controller Model View Controller (MVC) is one of the most quoted (and most misquoted) patterns around. It started as a framework developed by Trygve Reenskaug for the Smalltalk platform in the late 1970s. Since then it has played an influential role in most UI frameworks and in the thinking about UI design."

- http://www.martinfowler.com/eaaCatalog/modelViewController.h...

I made fun of it at the time. "Great! Now audit and deploy it."

Understand, that doesn't take away from Rails' achievements, but it does underline that people in tech, especially web stuff, have a very short memory.

But rails is just doing what it's always done: trying to optimize developer productivity for front end web dev and routine web tasks. In this it's far ahead of the pack, and for many businesses, both small and large, this is exactly the right thing to optimize. Say what you want about github, but they push a lot of features and push them fast.

Rails is not for crafting algorithms, but when you need to crank out 6 new pages with various complex crud views and forms by Friday, and by the way can it be exportable to cvs and oh can you also do paypal and oauth integration and user avatars with thumbnails, and keep it all reasonably readable and organized... the sad fact is that for all of rails' heft and lack of cs cred, trying the above with any other framework after you know rails will drive you insane, because despite how great the language is or how many connections your server can handle, you are again and again spending days on things that take an hour in rails.

Ultimately, I don't think the way forward from rails is to search for a partial reimplementation of rails in some other language. Rails is the best we've got for rapid front end and shallow back end work. So use it for what it does well. For what it doesn't do well, use something else. Personally, I think it's silly to have an ORM written in ruby. ActiveRecord is for the most part a lovely api, but its guts should be a separate service written in go or something. Building a complex recommendation engine or game AI? Write clojure or haskell services. But when the data comes back and you need to dice it up and lay it out as html, with a hundred little ohs and ifs and buts, it's not a fun time without rails.

Well, they were pretty vocal about calling everybody, in no uncertain terms, for using frameworks other than Rub/Rails, an idiot. There is plenty of bad will that they've been accumulating because of that and this is simply the backlash.

If you really think you are the best there is no need to insult developers who do not use your frameworks. Unfortunately that is exactly what they did. People have long memories.

And in my opinion they deserve every bit of it.

The comment below by user mhartl demonstrates the attitude of pretending everybody else is shit.

>>Ah, so following Greenspun's tenth rule [1], perhaps we

>>have this:

>> Any sufficiently complicated web application contains

>> an ad hoc, informally specified, bug-ridden, slow

>> implementation of half of Ruby on Rails.

>>[1] http://en.wikipedia.org/wiki/Greenspun%27s_tenth_rule

The nerve to call other frameworks bug-ridden as if their shit didn't stink. Specially in light of all the security problems with Ruby/Rails that have come to light recently.

But most of all I hate it because it uses so much magic.

I think often when people say "I hate rails", they are really saying, "I hate building the types of apps that rails excels at". Which is fine, and makes sense, because rails excels at making apps that can be very cool and innovative on the product side, but are usually pretty boring on the engineering side--it doesn't really get interesting for the engineers until it's time to start replacing the lower level tiers of rails with something else. And while secure best practices are certainly stressed (and included as defaults), conservatism isn't seen as a valid reason to hold up progress. So you get both the speed and the occasionally bumpy ride that strategy entails.

It is not enough that it does work, I have to understand how it does. Otherwise, I'm constantly bogged down when implementing every single feature thinking about possible security and performance issues down the line. The performance thing might be premature optimisation in some cases, but the security definitely is not.

That's why I hate when frameworks or IDEs have so much magic -- I'm looking at you Xcode, I can't count the times I was wondering if a particular statement would cause a memory leak or not before I finally understood most of the related magic Xcode and the toolchain for iOS dev do.

For me at least, magic saps my productivity, it doesn't boost it. It also offers a steeper learning curve to proper mastery to get to that point where I'm actually productive. So yes, I haven't tried ruby on rails but I can definitely see myself hating it if it has too much magic.

I don't get why you think I must secretly hate what rails is used for -- I don't, at all. And yes when rails was written the productivity was so much better than its competitors, rails was the choice.

Today, not so much. Don't get me wrong if it is an internal wiki or other system then rails makes sense, since if you get hacked you can always find the guilty person.

As for conservatism? Dude I write HTML5 games for a living and I am not arguing for JSPs here, just Play or Django or Sinatra (Ruby is great, don't get me wrong) but Magic is going to bite you at some point.

I think the ecosystem in particular is an area where rails magic makes it possible for the community to create very powerful gems that just work, and is probably where the most time is saved vs. other frameworks that have more of an explicit bent. I understand the skepticism towards the implicit approach--it has certainly bitten me before, and I try to minimize magic in my own rails code wherever possible--but again, if you're optimizing for productivity, it can be a worthwhile tradeoff.

Take devise as an example. Despite using all kinds of implicit and convoluted magic underneath, it can save huge amounts of time, especially early in a project, and is well tested and proven in the community. I'm not aware of a lib in any other framework that can handle so many boring authentication issues (sessions, roles, encryption, email confirmation, lockouts, remember me, forgot password flow, session expiration, redirect flows, etc. etc.) with such minimal code and configuration.

Sorry if I put words in your mouth. I do think a framework like play has more conservatism in its blood, which is great. It's good that there are other options for when security, stability, and scalability are at more of a premium than developer productivity .

But seriously, maybe your friend just wasn't all that well versed in Scala. I'm no pro (yet), but on the topic of Utility functions, I haven't run across any big holes. The Collections API is very Fluent (in the Martin Fowler terminology describing Ruby's Array), so it's hard to fault that. In fact, it goes quite a bit farther.

You have Option, Try, Either to use FP in a way Ruby-only programmers probably won't ever grasp. I certainly didn't. I've never seen any real Ruby code that comes close to a foldMap (foldLeft(Tuple2[Accumulator, Map])), or a Try pattern match, or (you could go on and on...).

Templating I don't get unless you're wed to HAML maybe. There are similar libraries for Scala, but it's hard for me to imagine someone being able to compare Twirl (Play's templating) to ERb and declaring ERb superior on any metric. Twirl is arguably simpler, definitely far faster, has no identifiable magic, and Scala+Twirl makes it silly easy to avoid a whole class of common problems with branching logic (hello id=4 my old friend!).

Play has First Class Forms. Rails doesn't. I'm sure Rails will some day. Declarative data binding is simply better. Safer, simpler, provable correctness.

I'd give Play a second look. :-)

To be fair, the one gap I've come across is in String manipulation. A few minutes of googling and a little tweaking and I've got a quick slugging function though: https://gist.github.com/sam/5213151

And then there's stuff like writing:

  10 seconds

On the other end of the spectrum, there's all the things Play gives you Rails doesn't: Futures. Actors. Async. Chunked Responses (which maybe Rails 5 will have?). WebSockets. Awesome XML (it's nice to use a lib that does not suck if you have to deal with it). Better JSON support. Functional Programming. Pattern Matching. Performance. Built in (Memory) Cache Concurrency. Functional Testing with Selenium. A built-in production ready web-server. Continuous Testing. Deployment Packaging. Bootstrap. LESS compilation. SBT: A single tool that provides file system watchers, Tasks, compilation, packaging, dependencies (including Git). All the JARs a Jar Jar could Jar if a Jar Jar could Jar Jars.

The only significant downsides I've run into are:

1. Sharing your code as a package is harder. Much harder. Nexus isn't nearly as low friction as rubygems.org. 2. Binary Compatibility concerns means sometimes your best option is a source dependency.

Git dependencies have been a good solution to #1 for me so far, but I know the day will come when I'll have to figure out hosting on Maven Central.

http://stackoverflow.com/questions/698700/escaping-html-in-r...

Correct me if I am wrong but it seems to me that RoR still isn't shipped with a safe default?

Edit: RoR added auto-escaping around February 2010, Django had it since November 2007

http://yehudakatz.com/2010/02/01/safebuffers-and-rails-3-0/ https://code.djangoproject.com/wiki/AutoEscaping?x=52&y=...

http://yehudakatz.com/2010/02/01/safebuffers-and-rails-3-0/

Prior before that, the standard way to sanitize html output was to write <%= h foo %> instead of <%= foo %> in your templates.

And as of late tons of similar bugs have been found. CSRF and database parameterization was well known issues when Rails was written, so yeah props for that. It is just not enough anymore.

Rails brought very little to the table in that respect. Not to people who actually know what they're doing anyway.

Would be nice to see some side by side code of Rails and Java/Spring doing roughly the same things, both written by people experienced in those technology stacks. These debates aren't very useful without code to look at.

The whole 15 min blog thing is a good example of fast Rails, it's also a good example of non production ready i.e. maintainable and extendable, rails.

I think the big take away here is the importance of apparently redundant sanity checks....

I've mostly used Hibernate and NHibernate, and SQLAlchemy a few years ago.

  Python? Django, Tornado, Twisted, etc
  Go? "net/http" + Gorilla (http://www.gorillatoolkit.org/)
  Java? JSF 2.0, GWT, Spring, Tapestry, etc etc
  C#? ASP.NET MVC

"You know what you could do instead of using Rails? Implement your own ad-hoc version of 60% of Rails!"

Maybe you don't need to whole kitchen sink. Also its not as though there are not other Go libraries to get other functionality from such as DB/ORM functionality.

For the record, I have written some Go, but not worked on Revel specifically.

I can certainly recommend Django - I've been working with a large-ish Django codebase for 3 years and have yet to see a security vulnerability as bad as the ones Rails seems to have every month.

I've used it with NHibernate for the ORM and Postgres.

[1] https://news.ycombinator.com/item?id=2235204

I'm sure one of the alternative JVM languages would make this setup tolerable to work with, even pleasurable, but I don't know them.

I get tired of paying taxes and brushing my teeth, too, but I still do it, because life will get worse in a hurry if I don't.

Everything else is just extra they added on. Their core product is a Web based Git.

But I sometimes wonder this as well, I love Ruby a ton. But I wonder how Github would have done had they used another language PHP, Python, Lua what ever.

But then again the same thing can be said about Facebook, would they need less servers if they switched to another language?

I'm surprised they haven't tried to build their own framework / programming language (like Facebook with HipHop). It wasn't a bad idea to start with rails, but now they subject themselves to the issues of Ruby and Rails without an alternative

I'm confused by all these people that thing 'Rails is crap, clearly people should roll their own everything since that will be more reliable and better engineered'

If you think Rails is crap, the only answer is to look to 'more mature' platforms, not roll your own. Spring/Hibernate might be a reasonable answer. Django is not, being at a very similar level of maturity. Nothing in PHP even begins to approach the level of maturity.

Software engineering is hard. Really hard.

When you are as large as google or facebook or github, those decisions which don't naturally mesh with your workflow become more painful over time. And when you have enough in-house resources, the cost to working with the existing solution far exceeds that of extending it on your own or building your own.

Hiphop is a good example where Facebook saw certain things they wanted to optimize in PHP, and it made far more sense for them to work on their own thing (many of those decisions underlying hiphop make sense for facebook but not for most companies deploying PHP)

  Any sufficiently complicated web application contains 
  an ad hoc, informally specified, bug-ridden, slow 
  implementation of half of Ruby on Rails.

http://php.net/manual/en/function.create-function.php

Also: yes, building from minimal makes you appreciate the work that big frameworks have already done.

There is no excuse: change of behavior shouldn't happen when installing security patches, specially if it's not mentioned anywhere in the patch release notes (which were reviewed by the GitHub team).

Okay, I get your point, they should have tested it, you're right, but saying that Rails is not the problem is kind of being in denial.

If it works fine and it breaks with a security update then it's the framework maintainer's fault.

A closer analogy would be if you were an airline and a technician from Boeing made some Boeing-recommended safety changes on a plane before it took off and then the engine blew up.

Sure, you should have had proper oversight of what said technician was doing but the bigger part of the blame is on Boeing for a faulty safety change.

Blame Rails, I'm fine with that. But it's not going to prevent a serious problem with the email sending script in the future. To do that, you need to write some tests.

Hmm, I don't think I want to start my next commercial airline business on Rails.