Rails 3.0.20 and 2.3.16 have been released

Doesn't appear to affect 3.1.x or 3.2.x

Especially when you tell him it's the same bug.

He'll be happier than he would be if your site was compromised for someone else's gain. These patches are annoying but some people are doing us a favor by finding, reporting and fixing them.

Would your manager be more happy if you didn't use rails? Rails is a massive codebase with many vectors for attack and opportunites for performance issues. Does that mean your manager (or you) would rather code all this stuff from scratch?

Tell your manager to consider all the benefits your team has gotten from working with rails weighed against the trouble of a patch or version bump deploy.

Remind him/her that seeing these kinds of notices from the rails team is actually a good thing because it proves that there are eyes on the code base and a team of smart people reacting quickly when something gets noticed.

Could be worse, you could have developed everything with Java applets.

> Given we are still seeing more security issues with Rails, shouldn't the developers down tools for 5 mins to stop with the shiny-shiny, and maybe rewalk the codebase, the dependencies they set, and review things?

This is what's been happening and why we have seen a ton of releases.

Actually, the 'shiney' new versions don't have this bug. Only rails < 3.1

> I would rather see one better update to Rails for the release versions, arising from a proper audit, proactively closing the windows left from before, rather than shutting one each time it is reported.

Really? You'd rather security patches not occur and instead be issued via large batch releases? If that's truly the case, you could achieve the same end by not patching and upgrading to the next major version release. However, that seems truly more dangerous than the inconvenience of incremental patching.

What version of their Rails app was compromised?

I would argue that opinionated design and to a certain extent "magic" on the whole can reduce the amount of security problems.

Compare something like rails with sites that are developed in vanilla PHP. In my experience it is rare to find a vanilla PHP site that doesn't have a whole menu of vulnerabilities which can be found within ~10 minutes of prodding. Granted this might mean that each site has different vulnerabilities that have to be found on an individual basis rather than some vulnerability that can be attacked by spray and pray tools.

Rails will give you some very sensible defaults that even inexperienced developers get benefit from, just having template HTML sanitised, CSRF tokens and parametrised queries by default stumps a whole load of attacks that you would otherwise have to consider every time you build each web page.