I don't care about cool or cutting edge or even performance. I hate rails because it is built by people with no understanding of security.
But most of all I hate it because it uses so much magic.
But most of all I hate it because it uses so much magic.
I think often when people say "I hate rails", they are really saying, "I hate building the types of apps that rails excels at". Which is fine, and makes sense, because rails excels at making apps that can be very cool and innovative on the product side, but are usually pretty boring on the engineering side--it doesn't really get interesting for the engineers until it's time to start replacing the lower level tiers of rails with something else. And while secure best practices are certainly stressed (and included as defaults), conservatism isn't seen as a valid reason to hold up progress. So you get both the speed and the occasionally bumpy ride that strategy entails.
It is not enough that it does work, I have to understand how it does. Otherwise, I'm constantly bogged down when implementing every single feature thinking about possible security and performance issues down the line. The performance thing might be premature optimisation in some cases, but the security definitely is not.
That's why I hate when frameworks or IDEs have so much magic -- I'm looking at you Xcode, I can't count the times I was wondering if a particular statement would cause a memory leak or not before I finally understood most of the related magic Xcode and the toolchain for iOS dev do.
For me at least, magic saps my productivity, it doesn't boost it. It also offers a steeper learning curve to proper mastery to get to that point where I'm actually productive. So yes, I haven't tried ruby on rails but I can definitely see myself hating it if it has too much magic.
I don't get why you think I must secretly hate what rails is used for -- I don't, at all. And yes when rails was written the productivity was so much better than its competitors, rails was the choice.
Today, not so much. Don't get me wrong if it is an internal wiki or other system then rails makes sense, since if you get hacked you can always find the guilty person.
As for conservatism? Dude I write HTML5 games for a living and I am not arguing for JSPs here, just Play or Django or Sinatra (Ruby is great, don't get me wrong) but Magic is going to bite you at some point.
I think the ecosystem in particular is an area where rails magic makes it possible for the community to create very powerful gems that just work, and is probably where the most time is saved vs. other frameworks that have more of an explicit bent. I understand the skepticism towards the implicit approach--it has certainly bitten me before, and I try to minimize magic in my own rails code wherever possible--but again, if you're optimizing for productivity, it can be a worthwhile tradeoff.
Take devise as an example. Despite using all kinds of implicit and convoluted magic underneath, it can save huge amounts of time, especially early in a project, and is well tested and proven in the community. I'm not aware of a lib in any other framework that can handle so many boring authentication issues (sessions, roles, encryption, email confirmation, lockouts, remember me, forgot password flow, session expiration, redirect flows, etc. etc.) with such minimal code and configuration.
Sorry if I put words in your mouth. I do think a framework like play has more conservatism in its blood, which is great. It's good that there are other options for when security, stability, and scalability are at more of a premium than developer productivity .
But seriously, maybe your friend just wasn't all that well versed in Scala. I'm no pro (yet), but on the topic of Utility functions, I haven't run across any big holes. The Collections API is very Fluent (in the Martin Fowler terminology describing Ruby's Array), so it's hard to fault that. In fact, it goes quite a bit farther.
You have Option, Try, Either to use FP in a way Ruby-only programmers probably won't ever grasp. I certainly didn't. I've never seen any real Ruby code that comes close to a foldMap (foldLeft(Tuple2[Accumulator, Map])), or a Try pattern match, or (you could go on and on...).
Templating I don't get unless you're wed to HAML maybe. There are similar libraries for Scala, but it's hard for me to imagine someone being able to compare Twirl (Play's templating) to ERb and declaring ERb superior on any metric. Twirl is arguably simpler, definitely far faster, has no identifiable magic, and Scala+Twirl makes it silly easy to avoid a whole class of common problems with branching logic (hello id=4 my old friend!).
Play has First Class Forms. Rails doesn't. I'm sure Rails will some day. Declarative data binding is simply better. Safer, simpler, provable correctness.
I'd give Play a second look. :-)
To be fair, the one gap I've come across is in String manipulation. A few minutes of googling and a little tweaking and I've got a quick slugging function though: https://gist.github.com/sam/5213151
And then there's stuff like writing:
10 seconds
On the other end of the spectrum, there's all the things Play gives you Rails doesn't: Futures. Actors. Async. Chunked Responses (which maybe Rails 5 will have?). WebSockets. Awesome XML (it's nice to use a lib that does not suck if you have to deal with it). Better JSON support. Functional Programming. Pattern Matching. Performance. Built in (Memory) Cache Concurrency. Functional Testing with Selenium. A built-in production ready web-server. Continuous Testing. Deployment Packaging. Bootstrap. LESS compilation. SBT: A single tool that provides file system watchers, Tasks, compilation, packaging, dependencies (including Git). All the JARs a Jar Jar could Jar if a Jar Jar could Jar Jars.
The only significant downsides I've run into are:
1. Sharing your code as a package is harder. Much harder. Nexus isn't nearly as low friction as rubygems.org. 2. Binary Compatibility concerns means sometimes your best option is a source dependency.
Git dependencies have been a good solution to #1 for me so far, but I know the day will come when I'll have to figure out hosting on Maven Central.
http://stackoverflow.com/questions/698700/escaping-html-in-r...
Correct me if I am wrong but it seems to me that RoR still isn't shipped with a safe default?
Edit: RoR added auto-escaping around February 2010, Django had it since November 2007
http://yehudakatz.com/2010/02/01/safebuffers-and-rails-3-0/ https://code.djangoproject.com/wiki/AutoEscaping?x=52&y=...
Prior before that, the standard way to sanitize html output was to write <%= h foo %> instead of <%= foo %> in your templates.
And as of late tons of similar bugs have been found. CSRF and database parameterization was well known issues when Rails was written, so yeah props for that. It is just not enough anymore.