6 ms·
Rails version 3.2.7 has been released
- joeycfan 14y agoI've basically given up on rails - and I wrote a 2.3.4 site - until it stabilizes a bit...
- aaronblohowiak 14y agoDon't call to_sym on untrusted input!
- tptacek 14y agoOh wow. rb_intern() is a mess.
- aaronblohowiak 14y agois the badness in st_lookup or rb_enc_str_new ? I haven't traced the execution deep enough to see where things go south...
- aaronblohowiak 14y agoOh wait, i get it. every symbolized string is added to the global symbol table, so you can basically make rails devour incredible amounts of memory by sending it new values. neat.
- tptacek 14y agoThere are worse problems than that, I think.
- tptacek 14y agoThere's badness just in rb_intern, at least in 187. MRI scares the bejeezus out of me.
- aaronblohowiak 14y agoOh, I'll have to give it another look. JRuby also suffers from the global symbol table =( so it does not avoid the potential denial attack through symbolizing..
- jballanc 14y agoI vaguely recall somewhere that Matz commented about how he felt that he was a good language designer, but not necessarily a good language implementor. I've always felt that MRI should be treated as a reference implementation, and the fact that there aren't more alternate implementations of Ruby is a (maybe sad?) reflection on the Ruby community.
- tenderlove 14y agoActually, I find it easy to read compared to some other functions in MRI. The trick is that it keeps the symbol in a global table (that never gets reaped).
- deleted 14y ago[deleted]
- hekker 14y agoWhy not? Can anybody explain why this is unsafe?
- film42 14y agoIs it just me or does it seem like everyone's stack is moving away from Rails? I mean, it's a great solution to many problems, I just feel that there's a lot more platforms that offer you even better customization and leave a far smaller footprint.
- true_religion 14y agoNope, its just that other things are being hyped apart from rails.
- aaronblohowiak 14y agoIt is going through the "small, cohesive" -> "full-featured!" -> "bloated" -> "modular" -> "too many abstractions" cycle.. in terms of overall adoption, I'm not sure. Many people like having all the "hard" problems solved for them. People tend to talk about what's new and shiny because there is greater social reward for being the advocate of something new/better than there is to say "what we have is good enough and so I like using it!"
- slurgfest 14y agoOrthodoxy has greater social reward when everyone around you is orthodox...
- tptacek 14y agoDefinitely what we need in a thread about a security issue in a hugely popular web stack is a language war.
- dschobel 14y ago"MRI scares the bejeezus out of me" - you, an hour ago I think asking about alternatives is fair game.
- tptacek 14y agoJRuby is a good alternative. You know where the "better alternatives to Rails" thread goes, and it's nowhere helpful for a security advisory post. But, your call, not mine.
- tenderlove 14y agoCrap. I keep forgetting to submit these announcements to hacker news. I'm saving up my HN points to get a commemorative pin! ;) If you have questions about the release, or the security issue, fire away. :-)