6 ms·

A week with a Rails Security Strategy: More security, new habits

42 points by hawe 11y ago

tddfuckwitz 11y ago
The biggest issue we have seen in client projects, where they have an existing Rails project is not just the numerous holes in the core framework, but that they used many, many gems, the majority of which end us as abandonware, and are often chock-full of poor code, security blunders and generally bad design, that leaves the site wide open. We have been able to successfully migrate a number of clients onto alternative lighter frameworks, or in some cases lean stacks, given they received a massively over engineered rails project for what was really a CMS requirement. I really hope one day to stumble onto a well written, well maintained and we'll designed Rails app, but have not seen one yet...
- josai 11y ago
  > have not seen one yet Perhaps that's because the kind of person who has this kind of attitude, and who'd create an account called "tddfuckwitz" to come and spout it on HN, doesn't make a very good impression on the kind of rails devs who do know what they're doing, so you don't win them as clients. - signed, a professional rails dev who takes security and code quality very seriously indeed
  - tddfuckwitz 11y ago
    Cute - inserting the word 'professional' before rails dev, and then claiming to take security and code quality seriously! ROFL If a developer was professional, and cared about code quality and security, they would not use rails. Period.
    - evilduck 11y ago
      Says the 8 hour old troll account.
      - tddfuckwitz 11y ago
        Hey - your account is much older, all that time and still unable to say anything of value. What a tragedy!
        evilduck 11y ago
        Hope you have a great day.
      - dang 11y ago
        Please don't feed trolls with attention. Instead, flag them by clicking on a comment's timestamp to go to its page, then clicking "flag" at the top.
        evilduck 11y ago
        I did.
    - astrodust 11y ago
      Yeah! They'd use PHP! Or Java! Those never have any problems and their code-bases are always flawless. I'll take a bad Rails app any day over what people churn out in other platforms. I've seen Java apps so impenetrably opaque it's not even clear what it does. Rails is Rails. It's boring. It works. It's pretty hard to mangle the project so badly that you can't make sense of it. Unless, of course, you've got no idea what Rails is or how it works.
      - tddfuckwitz 11y ago
        The replacements in modern php were faster and more secure. But don't let your prejudice undo your argument.
        astrodust 11y ago
        What "replacements" are you talking about here? Laravel has tried to push PHP in the right direction in a huge way, but it's not without its minor problems, either. Additionally, like any non-trivial code base it's had some vulnerabilities. Now of course nobody uses Laravel, they just hand-roll, so the sorts of bugs you see in the PHP world are more pattern based (e.g. injection, XSS) than you'd see in a platform like Rails that is driven by convention.
- KurtMueller 11y ago
  What are some of the lighter frameworks you migrate your clients to? What do you mean by lean stacks?
LunaSea 11y ago
I didn't even know there was such a thing as "Ruby on Rails Security".
- LunaSea 11y ago
  To the people downvoting me: - http://www.cvedetails.com/product/22568/Rubyonrails-Ruby-On-Rails.html?vendor_id=12043 http://www.cvedetails.com/product/22568/Rubyonrails-Ruby-On-... - http://www.cvedetails.com/vulnerability-list/vendor_id-12043/product_id-22568/Rubyonrails-Ruby-On-Rails.html http://www.cvedetails.com/vulnerability-list/vendor_id-12043...
  - astrodust 11y ago
    It's a complicated platform, but on the whole has a very good track record. Picking on it for having vulnerabilities without providing something in the way of a comparison is not very meaningful.
    - trimble-alum 11y ago
      It's imporant to pick out vulnerabilities and deficiencies compared to other projects to get them addressed, rather than only say nice things. However, the core issue is that people raising them are usually ignored until there's an embarrassing hack or demonstration (Homakov). For example, all new gem releases should be signed and `HighSecurity` should be the policy but it's taken years to get very little progress. Changing to that policy would prevent entire classes of attacks, attacks that could subtly inject code into all sorts of apps in difficult-to-find ways. Large projects are still shipping unsigned gems, unsigned commits and unsigned tags. If RubyGems were hacked, progress might move slightly faster.
      - astrodust 11y ago
        Rubygems has been lagging behind other packagers like Apt, RPM, NPM, and even newer things like Rust's Cargo. It's woefully overdue for an update. That being said, there's great services like GemCanary (https://gemcanary.com/ https://gemcanary.com/) that will read your Gemfile and produce a list of vulnerable packages for you automatically. It'll even email you alerts when there's problems. The security story in Rails might not be perfect, but at least there's reporting and tools. Keep pushing for signed packages, though. Long overdue.
deleted 11y ago
[deleted]

42 points by hawe 11y ago

The biggest issue we have seen in client projects, where they have an existing Rails project is not just the numerous holes in the core framework, but that they used many, many gems, the majority of which end us as abandonware, and are often chock-full of poor code, security blunders and generally bad design, that leaves the site wide open. We have been able to successfully migrate a number of clients onto alternative lighter frameworks, or in some cases lean stacks, given they received a massively over engineered rails project for what was really a CMS requirement. I really hope one day to stumble onto a well written, well maintained and we'll designed Rails app, but have not seen one yet...

josai 11y ago
> have not seen one yet Perhaps that's because the kind of person who has this kind of attitude, and who'd create an account called "tddfuckwitz" to come and spout it on HN, doesn't make a very good impression on the kind of rails devs who do know what they're doing, so you don't win them as clients. - signed, a professional rails dev who takes security and code quality very seriously indeed
- tddfuckwitz 11y ago
  Cute - inserting the word 'professional' before rails dev, and then claiming to take security and code quality seriously! ROFL If a developer was professional, and cared about code quality and security, they would not use rails. Period.
  - evilduck 11y ago
    Says the 8 hour old troll account.
    - tddfuckwitz 11y ago
      Hey - your account is much older, all that time and still unable to say anything of value. What a tragedy!
      - evilduck 11y ago
        Hope you have a great day.
    - dang 11y ago
      Please don't feed trolls with attention. Instead, flag them by clicking on a comment's timestamp to go to its page, then clicking "flag" at the top.
      - evilduck 11y ago
        I did.
  - astrodust 11y ago
    Yeah! They'd use PHP! Or Java! Those never have any problems and their code-bases are always flawless. I'll take a bad Rails app any day over what people churn out in other platforms. I've seen Java apps so impenetrably opaque it's not even clear what it does. Rails is Rails. It's boring. It works. It's pretty hard to mangle the project so badly that you can't make sense of it. Unless, of course, you've got no idea what Rails is or how it works.
    - tddfuckwitz 11y ago
      The replacements in modern php were faster and more secure. But don't let your prejudice undo your argument.
      - astrodust 11y ago
        What "replacements" are you talking about here? Laravel has tried to push PHP in the right direction in a huge way, but it's not without its minor problems, either. Additionally, like any non-trivial code base it's had some vulnerabilities. Now of course nobody uses Laravel, they just hand-roll, so the sorts of bugs you see in the PHP world are more pattern based (e.g. injection, XSS) than you'd see in a platform like Rails that is driven by convention.
KurtMueller 11y ago
What are some of the lighter frameworks you migrate your clients to? What do you mean by lean stacks?

LunaSea 11y ago

I didn't even know there was such a thing as "Ruby on Rails Security".

LunaSea 11y ago
To the people downvoting me: - http://www.cvedetails.com/product/22568/Rubyonrails-Ruby-On-Rails.html?vendor_id=12043 http://www.cvedetails.com/product/22568/Rubyonrails-Ruby-On-... - http://www.cvedetails.com/vulnerability-list/vendor_id-12043/product_id-22568/Rubyonrails-Ruby-On-Rails.html http://www.cvedetails.com/vulnerability-list/vendor_id-12043...
- astrodust 11y ago
  It's a complicated platform, but on the whole has a very good track record. Picking on it for having vulnerabilities without providing something in the way of a comparison is not very meaningful.
  - trimble-alum 11y ago
    It's imporant to pick out vulnerabilities and deficiencies compared to other projects to get them addressed, rather than only say nice things. However, the core issue is that people raising them are usually ignored until there's an embarrassing hack or demonstration (Homakov). For example, all new gem releases should be signed and `HighSecurity` should be the policy but it's taken years to get very little progress. Changing to that policy would prevent entire classes of attacks, attacks that could subtly inject code into all sorts of apps in difficult-to-find ways. Large projects are still shipping unsigned gems, unsigned commits and unsigned tags. If RubyGems were hacked, progress might move slightly faster.
    - astrodust 11y ago
      Rubygems has been lagging behind other packagers like Apt, RPM, NPM, and even newer things like Rust's Cargo. It's woefully overdue for an update. That being said, there's great services like GemCanary (https://gemcanary.com/ https://gemcanary.com/) that will read your Gemfile and produce a list of vulnerable packages for you automatically. It'll even email you alerts when there's problems. The security story in Rails might not be perfect, but at least there's reporting and tools. Keep pushing for signed packages, though. Long overdue.

deleted 11y ago

[deleted]