Hacker News Reader

Comment by callmeed | Hacker News Reader

I have a Rails 2.3x ecommerce app that is not our primary product but still makes us a good amount of money.

Personally, I'd like to upgrade to Rails 3.2x (and eventually 4) so I can take advantage of some newer gems. However, the task is a little daunting given we use some older authentication and file upload libraries. All that to say, if I can't get it done soon, I will definitely go the Rails LTS route.

BTW, If any Rails devs out there want a challenge and have some time, please get in touch with me.

View on HN

The backporting involved here is non-trivial. If the past 9 months are any indication, I would expect we haven't seen the last of the serious YAML vulnerabilities yet: http://www.cvedetails.com/vulnerability-list/vendor_id-12043...

My guess is that mostly no apps depend on that idiotic YAML can parse and execute anything anybody sends us feature, so wouldn't you forward secure rails (harden it?) by replacing YAML with a parser that only parse things?

One of the few things Rails LTS adds to prior 2.3 branches is a "hardened" set of security settings that turns off rarely-used and potentially vulnerable arg-parsing code.

I might be wrong but would the trick maybe be to break it down bit by bit, so for instance break off your existing file upload stuff and replace it with CarrierWave or something different. I don't know what your codebase is like but doing it that way should in theory make it more copable to slowly tick it up to rails 3+

Yeah, that's likely the best way to do it. Problem is, our image uploads now number in the high hundreds of thousands (not counting thumbnails).

The other problem is, we are short-staffed. So, if I tackle this, it takes me off other projects for 2+ weeks.

It looks like there is a fairly active Rails 3 fork of attachment_fu (what we use): https://github.com/pothoven/attachment_fu

Gotcha, there's also some information on migrating to paperclip[1] which might suit and I'm sure someone will have done similar for CarrierWave. Of course none of that helps with being short staffed.

[1]https://gist.github.com/serek/375203

Reply on news.ycombinator.com