A week with a Rails Security Strategy: More security, new habits
airpair.comI didn't even know there was such a thing as "Ruby on Rails Security".
To the people downvoting me:
- http://www.cvedetails.com/product/22568/Rubyonrails-Ruby-On-...
- http://www.cvedetails.com/vulnerability-list/vendor_id-12043...
Those stats are meaningless without context.
Django: http://www.cvedetails.com/product/18211/Djangoproject-Django...
PHP: http://www.cvedetails.com/product/128/PHP-PHP.html?vendor_id...
JRE: http://www.cvedetails.com/product/19117/Oracle-JRE.html?vend...
.Net: http://www.cvedetails.com/product/2002/Microsoft-.net-Framew...
It's a complicated platform, but on the whole has a very good track record.
Picking on it for having vulnerabilities without providing something in the way of a comparison is not very meaningful.
It's imporant to pick out vulnerabilities and deficiencies compared to other projects to get them addressed, rather than only say nice things. However, the core issue is that people raising them are usually ignored until there's an embarrassing hack or demonstration (Homakov).
For example, all new gem releases should be signed and `HighSecurity` should be the policy but it's taken years to get very little progress. Changing to that policy would prevent entire classes of attacks, attacks that could subtly inject code into all sorts of apps in difficult-to-find ways. Large projects are still shipping unsigned gems, unsigned commits and unsigned tags. If RubyGems were hacked, progress might move slightly faster.
Rubygems has been lagging behind other packagers like Apt, RPM, NPM, and even newer things like Rust's Cargo. It's woefully overdue for an update.
That being said, there's great services like GemCanary (https://gemcanary.com/) that will read your Gemfile and produce a list of vulnerable packages for you automatically. It'll even email you alerts when there's problems.
The security story in Rails might not be perfect, but at least there's reporting and tools.
Keep pushing for signed packages, though. Long overdue.
You're getting downvoted because security issues are far from unique to Ruby on Rails. Are you aware of any web frameworks with a pristine security history?
Node.js is not bad.
Node.js is not a web framework.
Express.js has 5 vulnerabilities in 6 years.
Yeah I think I'm going to take my chances with Express.js rather than Ruby on Rails with it 57 vulnerabilities in 6 years.
The problem with thinking this way is that you don't know what security issues that nobody knows about yet are lurking in there. I remember the time before the recent spate of Rails vulnerabilities in the last 5 years or so, and I thought similarly about its security as you seem to about the Nodejs ecosystem. It's definitely possible that your confidence won't ever be punctured by a similar run of security issues, but my personal view is that it tends to be hubris to think your favorite technology is just better at security, for vague reasons.
Express is a micro framework, Rails is not. Rails covers more ground. You would want to compare security of Express to Sinatra or Grape.