Rails version 3.2.7 has been released | Hacker News Reader

Rails version 3.2.7 has been released

weblog.rubyonrails.org

56 pointsjtsagata20 comments

Crap. I keep forgetting to submit these announcements to hacker news. I'm saving up my HN points to get a commemorative pin! ;)

If you have questions about the release, or the security issue, fire away. :-)

Is it just me or does it seem like everyone's stack is moving away from Rails? I mean, it's a great solution to many problems, I just feel that there's a lot more platforms that offer you even better customization and leave a far smaller footprint.

It is going through the "small, cohesive" -> "full-featured!" -> "bloated" -> "modular" -> "too many abstractions" cycle.. in terms of overall adoption, I'm not sure. Many people like having all the "hard" problems solved for them.

People tend to talk about what's new and shiny because there is greater social reward for being the advocate of something new/better than there is to say "what we have is good enough and so I like using it!"

Orthodoxy has greater social reward when everyone around you is orthodox...

It's just you. :) In seriousness, many of the newer stacks (e.g. Meteor) offer fast ways to get started then you realize you need functionality such as authentication, authorization, server-side validations, migrations, queues, caches, API connections to other sites to retrieve data, etc. When you add all that in, you're essentially rolling your own large framework of pieces.

Definitely what we need in a thread about a security issue in a hugely popular web stack is a language war.

"MRI scares the bejeezus out of me" - you, an hour ago

I think asking about alternatives is fair game.

JRuby is a good alternative.

You know where the "better alternatives to Rails" thread goes, and it's nowhere helpful for a security advisory post. But, your call, not mine.

He got some decent responses so it seems like it turned out okay. You can give the audience here a little bit of credit, really.

Nope, its just that other things are being hyped apart from rails.

Don't call to_sym on untrusted input!

Oh wow. rb_intern() is a mess.

Actually, I find it easy to read compared to some other functions in MRI. The trick is that it keeps the symbol in a global table (that never gets reaped).

is the badness in st_lookup or rb_enc_str_new ? I haven't traced the execution deep enough to see where things go south...

Oh wait, i get it. every symbolized string is added to the global symbol table, so you can basically make rails devour incredible amounts of memory by sending it new values. neat.

There are worse problems than that, I think.

There's badness just in rb_intern, at least in 187.

MRI scares the bejeezus out of me.

I vaguely recall somewhere that Matz commented about how he felt that he was a good language designer, but not necessarily a good language implementor. I've always felt that MRI should be treated as a reference implementation, and the fact that there aren't more alternate implementations of Ruby is a (maybe sad?) reflection on the Ruby community.

Oh, I'll have to give it another look.

JRuby also suffers from the global symbol table =( so it does not avoid the potential denial attack through symbolizing..

Why not? Can anybody explain why this is unsafe?

Reply on news.ycombinator.com