Re:Update Rails or not – security issues either way
by kasparloog on Monday April 01, 2013 @10:55AM
(#5473397)
Well - that's enough work to maintain your own app. Maintainging a fork of Rails and drilling through all of the vulnerabilities - that's an extra overhead. It's simpler to regression test your own app, I suppose.
Re:Update Rails or not – security issues either way
by bradleyland on Monday April 01, 2013 @11:36AM
(#5473693)
I disagree that it's simpler to regression test your own app. The recent minor-minor version upgrade passed Rails core tests, as well as test suites at high profile Rails users, yet it contained a regression that caused the disclosure of some sensitive issues at those same high profile shops.
It's easier, from my viewpoint, to stick it out at a release that you know works for you, applying patches from the files contained in the CVEs. There's still a chance that the security patch will cause a regression, but at least you're not pulling in all the interim commits.
Re:Update Rails or not – security issues either way
by locofacetwice on Monday April 01, 2013 @10:42AM
(#5473293)
Or don't use Rails.
Re:Update Rails or not – security issues either way
by myke_cameron on Monday April 01, 2013 @11:29AM
(#5473639)
No matter your stack, you are occasionally going to have to deal with security vulnerabilities. Thankfully, rails at least is quick to issue releases which address security vulnerabilities. Back when I was working on java applets, I remember security issues in Java plugins which would persist for weeks, months, or even years.
Re:Update Rails or not – security issues either way
by tptacek on Monday April 01, 2013 @11:20AM
(#5473561)
Or Linux, or MySQL.
Re:Update Rails or not – security issues either way
by bradleyland on Monday April 01, 2013 @01:37PM
(#5474575)
Or Postgres.
Re:Update Rails or not – security issues either way
by tptacek on Monday April 01, 2013 @01:45PM
(#5474628)
My subtext isn't very clear: there are other projects that haven't totally mastered handling vulnerabilities, but few people will fault you for using them. Rails is different because it has a personality cult, which makes it easy to personalize an issue that is a dry inconvenience for other popular packages.
I'm not sure I'd put Postgres alongside Linux and Rails in terms of handling security issues.
Re:Update Rails or not – security issues either way
by static_typed on Monday April 01, 2013 @10:52AM
(#5473376)
^^ This is good advice. Maybe they should question their choice of platform - there are other options, some of which seem to have had a bit more forethought in their architecture and engineering.
Remember: Ruby/Rails to pose, Python for pros.
Re:Update Rails or not – security issues either way
by sbank on Monday April 01, 2013 @11:05AM
(#5473470)
> Remember: Ruby/Rails to pose, Python for pros.
How mature.
Re:Update Rails or not – security issues either way
by stephenhuey on Monday April 01, 2013 @11:14AM
(#5473510)
...and whitespacephiles. :)
The problem with upgrading to mitigate security issues is that the Rails team does not release security patches. They bump the minor-minor and do a release. That release almost always includes commits that are unrelated to the security issue. This is especially true when a lot of time passes between CVEs.
Maintaining your own branch really isn't that difficult, because you can simply merge in from upstream. In most cases, you're really only interested in patching from Rails team issued security fixes, so you won't have conflicts. If you do have conflicts, you can safely overwrite anything in your fork, because you're not developing Rails, you're simply maintaining tighter control over the release that you use.