Hacker News Reader

Comment by nbevans | Hacker News Reader

http://i.imgur.com/RHxoW5J.png

1. Security flaw in leaking that much error info. 2. Who uses ColdFusion in 2013?

Re: 2) Some day when I have a huge amount of free time, I would like to migrate to Groovy on Grails. Until then - CF is what I had used for over a decade, and it was the easiest thing for me to use to build with at the time (Jan 2012). I was more interested in getting something out there than using whatever the latest trendy tech.

pud's latest project is still on the homepage of HN and he wrote it in CFML: https://news.ycombinator.com/item?id=6519743 Just because project X is not written in your language of choice, means absolutely nothing. Its all about execution and this project is pretty impressive.

If I remember correctly, F#&@ed Company, pud's old wonder box of startup gossip was also done in ColdFusion (though in those days it was quite a good platform to do web stuff).

No, there just wasn't a less-worse one. Bloody PHP is an improvement on ColdFusion.

I disagree with you here. Although I would not choose ColdFusion for anything these days, in 1998/1999 it was a super fast way to get a web site/app together. Post 2000 it was converted to Java and became a glorified JSP tag library. It was a good platform that didn't stand the test of time.

I remember it being quite horrible around that time. But, as you say, a fast way to get a site together. I maintain that PHP was actually less worse, and I despise PHP with a contempt that would give [INSERT DICTATOR HERE] pause.

Sorry, but choice of language means more than nothing. ColdFusion is pretty dead-end and not a particularly good choice these days for a variety of reasons.

I agree that Adobe's ColdFusion is deadend but not Open Source Railo which is more of a Java Framework. At the end of the day there's no logical reason against CFML any more than there is against PHP, Rails, etc.

Sorry, but it is completely logical to choose Ruby/Rails, Python/Django, etc over CFML in 2013 for web projects.

>ColdFusion is... not a particularly good choice these days for a variety of reasons.

Not that I disagree with you, but I wonder if the reasons you have in mind are valid. A lot of the reasons one might assume CF sucks aren't really applicable (i.e. speed, security) any more than most other languages.

I assume all major-ish choices have decent speed, security, etc. The main things are activity, books, resources, people to hire, libraries, support, etc.

As we (I work for Adobe!) have talked publicly about the next rev of ColdFusion, and have shown features, talked about focus areas, etc, it is certainly not dead-end in terms of active product development.

we need a package manager (aka bundler). just passing that along :)

Let me break it for you, nobody except you and some opinionated programmers on the web, cares what language you wrote website X or web app Y in. If it works, and you are able to maintain it - you won't hear a single word of praise from the 'users' congratulating you on your stellar choice of language. They'll rip you to shreds when it stops working but even then they'll never tell you off for choosing the wrong language.

If it works, and you can maintain it - its all good. Even Cold Fusion, even PHP, even Perl, even Brainf#@k

I understand your point of view, and in specific cases, the choice has little practical impact. However, when a business is dependent on an aging technology (language/framework/etc), the choice can have real consequences. As one example, when that very competent programmer who has expert level knowledge in this aging technology decides to move on, if the technology isn't well supported by a vendor, user community, and/or local talent pool, the business can be in a real bind.

There are few consequences for the business as long as they're making more money than they're spending.

The consequences come for the poor bastards that have that old crap on their resume... Bus number notwithstanding...

Lol, no one really. Just a few obscure organizations like NASA, Apple, Pud's DistroKid/Fandalism, Intel, AT&T, and tons of others. Oh and railo is a java framework, who uses java!? Its 2013!

According to Wired Java is experiencing a renaissance of sorts: http://www.wired.com/wiredenterprise/2013/09/oracle_java/

Exactly my point :)

Just like Coldfusion, many people have been saying Java is so 1995 but since Twitter showed how well Java scales compared to the woeful RoR it is seeing a renaissance. And since Railo is a Java framework that speeds development I have a feeling we will being seeing it experience a similar renaissance in the near future.

There clearly was some sarcasm involved in that post.

Actually a lot of enterprise applications are built with Java.

The majority of Internet companies operating at scale likely have services running on the JVM. They might be writing Scala – Twitter, LinkedIn, say – but it's still the Java ecosystem.

I use ColdFusion (well, technically I use Railo) and I love it.

I agree that the owner of the website here needs a <CFERROR> tag, which tells the server what to do instead of showing that big error message.

CFWheels has that already built into it, but I'm convinced that its a problem with the framework itself and not anything the author did.

the issue seems coming from this line:

https://github.com/cfwheels/cfwheels/blob/v1.1.8/wheels/even...

basically when wheels throws an error, it will try to send out an error email containing the environment and framework information. In this case there seems to be no smtp server defined, so CFML itself is spitting up its skull.

The error handling can be reworked so that the $mail() call is wrap in a try/catch so the 500 page will just be shown.

disclosure: part of wheels core.

* Who uses ColdFusion in 2013?*

Me? Because I have to maintain a rather old site for my employer, and there is absolutely no chance that anyone would sign-off on migrating it to a different platform.

Same here... Want to start a support group?

I need one.

Interestingly, about a year ago, we were told that we would no longer be doing any updates to the system, and yet, here we are, a year later, still doing minor releases. I suspect it will never go away.

Well, the whole thing is up on github[1], so if you want, you could always port it from ColdFushion to something else?

[1] https://github.com/jakefeasel/sqlfiddle

Can someone explain how leaking a traceback is a security flaw, considering it's a lot less information than just releasing the source code (which we do all the time and don't consider it a security flaw)?

There's nothing inherently insecure about it, it's just more information that a potential attacker has to use against your system. Obviously, if someone breaks into your system from the information in a traceback, it's likely because of a deeper security hole in your system, so hiding tracebacks is just security through obscurity, but given the choices of publicly showing this information vs not, it's better not to.

WRT to open source: in open source software, you theoretically have many benign eyes vetting your code for security issues, whereas with closed source applications, the only people who are looking for security holes are you and attackers. :)

There are tons of good explanations of why a stacktrace is a security risk. See, for example, this article that appeared on HN: http://www.troyhunt.com/2013/07/everything-you-wanted-to-kno...

Hundreds of prominent public companies have their investor relations (/ media relations) site served by coldfusion (including facebook, yahoo, ebay, paypal, EA, ...)

https://www.google.com/search?q=releaseDetail.cfm

Its not the sexiest of platforms out there, but it can get the job done...

Linode use Coldfusion for their management interface [1] [2].

[1] - http://webpulp.tv/episodes/managing-8-petabytes-and-virtual-... [2] - https://blog.linode.com/2013/04/16/security-incident-update/

Can't tell if sarcastic or not. Seeing how you link to the giant security fiasco caused by a cold fusion 0 day I'm assuming this is not a recommendation.

Looks like it's set up to email them on errors and the email is throwing an error too.

all my clients unfortunately.

ha, I came here to say pretty much this, except I'd finish with 'fortunately' - I was reluctant to engage when I was first introduced, but Coldfusion has been pretty good to me.

>Who uses ColdFusion in 2013?

About 2/3 of the federal government.

Also, that isn't ColdFusion, it's Railo, an OS alternative.

He had "railo" highlighted... I think he knows that it's not literally ColdFusion...

Reply on news.ycombinator.com