Your comment makes me wonder if you are aware of some undisclosed bugs that will be disclosed in the next few months, or if it's more of just a "4.0 is dropping, 2.3 support is going bye-bye" kind of thing. If the former, I'd appreciate some clarification on that point. I have no problem backporting patches myself (and in fact extensively patch libraries when needed!), but I'm wondering if there's an active-yet-undisclosed threat, or if it's just "people aren't going to do my work for me".
Can you elaborate?
A framework or system with only 10 users will never have the depth of security and bug fixing coverage that a larger, well used system has.
When examining web server access logs, it's quite common to see hundreds of requests coming in from a single host during a short period of time, looking to see if certain exploitable framework- or app-specific pages exist.
Such scanners do appear to target certain frameworks or web apps, contrary to your suggestion that this does not happen.
This means that if you have multiple rails sites with limited or no timely dev support you may not be readily able to upgrade your site to resolve issues.
This is why I took down my personal blog I had built in rails since I didn't want to be exposed to these issues and didn't have the time or desire to uplift the site onto more recent versions of rails.
I'd go with something with a definitive support life and paid support if you need it.
Either that or something simple enough you can run your own fork.
And this article is about paid support if you need it. ;)
Paid support by the vendor?
As a guy who dislikes it (and doesn't know all that much about it), I still find Rails' security policy to be efficient and reasonable.
No doubt it will get criticised :-)
As an aside, do you think there is a better way Rails could have handled this? Or (less controversially) is there a best practise you think OSS projects should maybe follow in regards to past versions?
I am quite happy that they were really explicit about "We are dropping support for 2.3 when 4.0 lands" so that those of us who depend on 2.3 to eat had months to explore other options prior to needing them urgently. That's something that many OSS projects can and should emulate.
For a few minutes. It has poor alignment with my skills (I'm a fairly decent developer and can play a security researcher occasionally, but I'm a lot better at selling/marketing software than I am at hardcore framework development) and desired lifestyle (to whit, not wanting to be up at 4 AM in the morning having to work on Rails security issues -- today excepted, apparently). It also wouldn't play well with my plans to dedicate most of my business efforts to AR going forward.
It seems more like someone should be giving you either cash or equity for your roles as both an evangelist and the person who realized this was going to be needed and organized it.
I don't take money for publicity, as a matter of policy. The idea is worth about as much as the tweet it takes to describe it. The only interesting coordination problem is matching up Customer Zero with a company interested in and capable of doing the work, and that would be worth compensation, but for the fact that I was Customer Zero.
I did briefly entertain the notion of banging down a few doors and selling this (on some model like "I'll guarantee you X amount of business, in return I get a payment of $Y0k when I bring it to your door") but, meh, I'm just not that interested in doing enterprise sales for things that I don't own. Heck, I can scarcely be bothered to do it for things that I do.
"... only benefit the our companies ..."