Rails 3.2.21, 4.0.12, and 4.1.8 have been released

http://weblog.rubyonrails.org/2014/11/17/Rails-3-2-21-4-0-12-and-4-1-8-have-been-released/

by gerjomarty • 12 years ago

26 8 12 years ago

weblog.rubyonrails.org

taf22• 12 years ago

I can imagine there could be some files on the file system that would be useful to detect for certain types of undisclosed attacks... But anyone here have ideas about how serious of a threat this is?

whyowhyowhy• 12 years ago

The web framework that is chock-full of security blunders continues unabated.

How do people persist with it? Inertia?

jtc331• 12 years ago

Actually it's probably more secure than the vast majority of frameworks.

And certainly it's more secure by default than most web apps. Have you looked into how many PHP apps still suffer from obvious SQL injection attacks?

rickdale• 12 years ago

Well for one, its gotten a lot better and continues to get a lot better. And for two, the ruby on rails community is great. But for three: Mike Hartls beginning rails tutorial. Is there any other book like that on any other language? His book is a critical reason why I choose rails.

erkkie• 12 years ago

Because usage and popularity brings more eyes including security audits?

matthewmacleod• 12 years ago

Doesn't seem to have notably more security issues than comparable frameworks, like Django, so I think you're probably overstating it.

It remains popular because it's a pleasant and efficient build common web apps. It's not suitable for every scenario, but it hits a pretty sweet spot in most cases. I certainly keep coming back to it, regardless of the time I spend with other tools and frameworks.

tcopeland• 12 years ago

I'm betting most people have this setting already:

    irb(main):001:0> Rails.configuration.serve_static_assets
    => false

But anyhow, it's an easy upgrade since it's just the security fix.

taf22• 12 years ago

Thanks Tom! I was wondering how could this impact our applications.

Rails 3.2.21, 4.0.12, and 4.1.8 have been released

Related Stories