Ramble On

For non-ruby programmers - going through the diff of Ruby 1.1.4 compared to 1.1.5 will make your head swim.

Although I have some theories now on what the 1.1.5 release was/is supposed to fix - but I’m not sure I understand the flow of things enough to be doing anything other than typing out of my rear when I say that. If my theory is correct, I’m confused as to the actual impact scenarios - but Rails has a pretty sizeable codebase (enough that we’ve maxed the inode count on a 3GB volume with frozen rails in the apps) - and I’m just looking at diffs and well, heck if I know actually.

Maybe I should start an Inkling Market on it. (that might be ironic actually)

(of course, my black helicopter theory is still wondering if this is a ruse)

So the happy little Ruby on Rails crew done gone and got themselves a security hole

Their release announcement certainly got my attention. And I’m honestly pretty reactive (”Problem! Problem! Solve it NOW!”) - so after a broadcast to our Rails-developin’ crew - we got on it and got our system and frozen rails up to 1.1.5 and the local dev boxes got there too (thanks Duff, Rafe, Aaron, and crew). But we are pretty flexible - we can move, and move fast still (and I hope that keeps up, although I’m not sure that staying with software releases is a familiar concept to all).

I like Rails. I’m happy we are using it.

But there’s going to be some absolute hell to pay in the Enterprise environments after a vendor announcement like that. This is going to be WAY fun to watch

p.s. don’t misunderstand the last statement. I take computing security very seriously - as I’m sure some colleagues will attest, with the occasional mention of words like “paranoia”. The fun part is that every good project has to grow up now and then, and there’s some growing pains. This will be a rather interesting case study.