[throttle]

...which further proves my point that Ruby is a bad, bad platform choice for production applications right now. You just can't have this level of insecurity, sloppiness, and unresponsiveness among the developers in a platform you would use for serious applications. Maybe one day Ruby, Rails, et al. will be ready for prime time, but it's just not now, IMO.

update: by Ruby I mean the standard Matz codebase.

[eggnet]

freebsd apparently agrees with you. They back ported the security fixes instead of syncing up with the latest version.

http://www.freshports.org/lang/ruby18/

Maybe this is a lesson not to blindly use ruby without going through a trusted distributor. Not unlike linux?

[maw]

Not just freebsd, of course. Backporting patches is standard practice for all the serious Linux distributors as well.

[ken]

So apps written in C never segfault? Proprietary platforms always have great tech support? Other programming languages always have same-day fixes? I won't make any particular claims about Ruby, but I have yet to see The Perfect Language. Every language in the world is "bad, bad platform choice" given some criteria.

Moreover, from reading the advisories and comments, the only thing I can tell for certain is that you can kill a Ruby process with something like "Array.new[0x7fffffff]=0". The only way that's going to take down a Rails app is if you're putting unchecked user input directly into array indices -- but then, if you're doing that, you're probably in trouble anyway.

Or if you're running a setup like Heroku, and you let users run a Ruby console. (Maybe. I don't actually know how Heroku works.) To the nearest percent, that describes 0% of Rails apps.

Can anybody describe how this would actually be used to attack a typical website running Rails?

[jey]

String is vulnerable too. You'd be hard pressed to write a useful program that didn't put user-provided data into Strings.

An attacker could study the code paths of popular ruby based open-source projects to craft special attack inputs that exploit the weaknesses in Array and/or String.

[Andys]

That sounds a little out of place for Hacker News.

As a hacker with the freedom to be creative with how I work on web applications, I can choose Ruby because I'm not an enterprise architecture astronaut working on Serious Applications.

The ruby thing was annoying but hasn't stopped me writing and deploying web apps in Rails. Hopefully it won't happen again.

[rw]

It's in place for Hacker News because when your site gets owned by a cracker, you can't do much hacking, can you? :)

[Andys]

Its completely open. I have the source code and the commit logs for the project. I can read the vulnerable code myself and make up my own mind about the potential attack vectors.

[Husafan]

Right. Open source languages become popular not by describing and fixing security holes promptly, but by having their super-users analyze patch notes for vulnerabilities, and code around them. The sure fire path to widely used, production ready releases.

[Andys]

All languages and their libraries have vulnerabilities, many not yet discovered.

Instead of living in perpetual fear of being hacked, I'm out there doing what is more important to me: creating great web applications that users want to use, in a language I love using.

[Husafan]

So then, in your opinion, IS there a difference between a language that is "production," ready, and one that is not? And if so, what is it?

[michaelneale]

would this strengthen the case for jruby and ironruby (at least for server/app code, perhaps not for quick scripts) ?

[jrsims]

What doesn't kill Ruby should hopefully make it stronger.