Ruby on Rails Blog

Thanks for the links, which I think would lead to a more productive discussion because they are a comparison of similar frameworks. There are of course difficulties with gauging how much attention each gets (a lower CVE count is not proof of security), but overall Django looks better here.

I was thinking of the third one on this page (I suppose strictly speaking a vuln in a gem outside rails) which was pretty serious:

http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/

but there was a related YAML bug too at the same time with serialize, which also allowed users to supply input that was then instantiated (madness!). Do lots of people use serialize? I've never explicitly used it, unless it is used behind the scenes somewhere. I remembered the fuss being over JSON because of broader impact but may have misremembered.

Does anybody have any insights about how rest came to be such a buzzword?

My pet theory is that rest was popularized by Rails. If you look at trends [1], rest itself shows up as a super slow trend ramp that only now is starting to diminish... But rails seems to have had the peak of its popularity between 2006/2007 [2], which happens to be the time Rails 1.2 came up with "restful routes" support. Even if this theory is correct, it begs the question how did the Rails developers come in contact with rest themselves and how did it happen that the whole thick thesis derived in just a simple HTTP routes convention ...

1: https://trends.google.com/trends/explore?date=all&geo=US&q=%2Fm%2F03nsxd,%2Fm%2F0505cl

2: https://weblog.rubyonrails.org/2007/1/19/rails-1-2-rest-admiration-http-lovefest-and-utf-8-celebrations/

No one has suggested, is suggesting, or will suggest that you stop using Rubygems. That is not what this is about in any sense of the phrase. Everyone loves Rubygems, including Ryan Tomayko.

This is about the best way to use Rubygems. Check out Josh Peek's recent article: http://weblog.rubyonrails.org/2009/9/1/gem-packaging-best-practices

There are ways to use Rubygems without putting "require 'rubygems'" in your code. Those are the correct, most portable, least painful ways of using Rubygems. Learn them and cherish them!

That is what this is about: how you are using Rubygems, not whether or not to use them.

This was fixed in 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, 4.2.11.1 one week ago.

https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/

The two HN posts didn't get many upvotes though: https://hn.algolia.com/?query=https:%2F%2Fweblog.rubyonrails.org%2F2019%2F3%2F13%2FRails-4-2-5-1-5-1-6-2-have-been-released%2F&sort=byPopularity&prefix&page=0&dateRange=all&type=story

Admittedly there is probably a lot of applications out there running outdated versions.

edit: Kind of surprising this gets upvoted while we rarely see things from exploit-db / fulldisclosure

They could be using http streaming, like the feature introduced in rails 3.1 : http://weblog.rubyonrails.org/2011/4/18/why-http-streaming/

That actually makes <head> the preferred place for loading scripts.

Also, I find it a bit extreme to recommend putting inline javascript in a <script> tag. I'm ok with trying to maximize performances, but please, do not recommend to produce un-seperated and unclean code. Concatenating javascript in a single file (and compressing it) is way enough, having one single request to get all javascript is not so bad.

http://weblog.rubyonrails.org/2008/3/18/comparing-rails-2-0-to-1-2-for-speed

"Hongli Lai has compared a dummy scaffold application from Rails 1.2 to Rails 2.0 and found the latter to be 30-50% faster. That’s great to see.

But what I think is even more interesting is the progress we’ve been making on performance optimizations for more substantial applications. Rails 2.0 made a lot of progress for applications with lots of assets and for ones with big routes.rb files. The forthcoming Rails 2.1 will move things forward even further."