Coding Horrors: You can gather all your technical debt into one easy framework!

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Coding Horrors: You can gather all your technical debt into one easy framework!

«‹›1503 »

Hiowf: Jun 28, 2013; We don't do .DOC in my cave.

Pollyanna posted:

Ostensibly security, but in reality it doesn't matter cause the whole thing is a shitstorm anyway: https://github.com/rails/rails/issues/8832

The +1-ing on a bug report makes we want to vomit.

# ? Jun 9, 2015 20:54

Adbot: ADBOT LOVES YOU

# ? May 24, 2024 17:13

necrotic: Aug 2, 2005; I owe my brother big time for this!

Internet Janitor posted:

I wandered around the related issues and I'm trying to understand how nils represent a security risk. It sounds like the Rails ORM uses arbitrary JSON requests to construct SQL queries and the logic underlying that is incapable of validating input structure in certain ways such that nils can result in queries which return more rows than desired, possibly leaking sensitive information. This seems like an inherently insecure architecture which places unnecessary trust in user input. Could anyone more familiar with the issue clarify?

The ORM itself doesn't do any permissions oriented validations, you have to use another gem or role your own. So yes, if you blindly go `SomeModel.where(params)` or whatever you have a huge security hole.

# ? Jun 9, 2015 21:00

Impotence: Nov 8, 2010; Lipstick Apathy

Factor Mystic posted:

Rails is bad. People who like it are neophytes or stockholmed. However when you're doing rails apps the "bad, because webdev" and "bad, because rails" all starts to blur together and after awhile it's easier to just go with the flow and get paid �\_(ツ)_/�

Rails is omakase.

# ? Jun 9, 2015 21:20

qntm: Jun 17, 2009

Pollyanna posted:

Rails by default compacts arrays when it munges incoming request parameters, which means that if you pass it a null value in an array it will silently remove it.

https://github.com/rails/rails/issues/8832#issuecomment-15076137 posted:

Difference between #9569 and #8862:

Received JSON:
{"person":[null]}

Result in #9569:
{"person":[]}

Result in #8862:
{"person":nil}

First result is probably more acceptable(it preserves class of array no matter what) while second is breaking JSON even further(empty array => array, array with nil => nil). This still is not valid parsing of JSON, but at least it will not break so many APIs...

I have to assume that `nil` isn't a legal value in a Ruby array, because otherwise I can't see how even the 9569 result would be acceptable.

It gets even better later:

https://github.com/rails/rails/issues/13420#issuecomment-31023144 posted:

The new table looks like, and should have always looked like:

pre:

JSON                          Hash
{"person":null}               {'person' => nil}
{"person":[]}                 {'person' => []}
{"person":[null]}             {'person' => []}
{"person":[null, null, ...]}  {'person' => []}
{"person":["foo", null]}      {'person' => ["foo"]}
{"person":{}}                 {'person' => nil}

Look at that final line. It's the exact same problem but with objects instead of arrays. Again, I hope Ruby just doesn't have a concept of an empty object/dict/associative array because otherwise that's absurd.

# ? Jun 9, 2015 22:34

sarehu: Apr 20, 2007; (call/cc call/cc)

Of course nil is a legal value in a Ruby array. And empty dicts, empty arrays, they're all real.

# ? Jun 9, 2015 22:48

ExcessBLarg!: Sep 1, 2001

qntm posted:

I have to assume that `nil` isn't a legal value in a Ruby array,

It is.

qntm posted:

Again, I hope Ruby just doesn't have a concept of an empty object/dict/associative array because otherwise that's absurd.

It does have that concept, and it is absurd. The provided JSON trivially translates to Ruby objects. In fact, if you just changed the colons to "=>", null to "nil", and removed the ellipses, it is syntactically correct Ruby. Which is exactly how the JSON module in Ruby's standard library parses it.

# ? Jun 9, 2015 22:50

Pollyanna: Mar 5, 2005; Milk's on them.

And yet.

Factor Mystic posted:

Rails is bad. People who like it are neophytes or stockholmed. However when you're doing rails apps the "bad, because webdev" and "bad, because rails" all starts to blur together and after awhile it's easier to just go with the flow and get paid �\_(ツ)_/�

Color me curious: what should I use?

# ? Jun 10, 2015 03:49

kitten emergency: Jan 13, 2008; get meow this wack-ass crystal prison

Pollyanna posted:

And yet.

Color me curious: what should I use?

Literally anything else? It's not like the world is lacking for web frameworks.

# ? Jun 10, 2015 04:15

brap: Aug 23, 2004; Grimey Drawer

Rest assured they are pretty much all bad. ASP.NET MVC is good but you pretty much still have to be in windows world to develop a site with it which has its disadvantages.

If you just want to get started with something quick, node.js is alright but I'm skeptical of it for anything big or important.

I realize the web frameworks debate is a massive can of worms so I'm sorry for my relatively uninformed opinions.

# ? Jun 10, 2015 04:44

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

ExcessBLarg! posted:

It does have that concept, and it is absurd. The provided JSON trivially translates to Ruby objects. In fact, if you just changed the colons to "=>", null to "nil", and removed the ellipses, it is syntactically correct Ruby. Which is exactly how the JSON module in Ruby's standard library parses it.

Like a straight string replace + eval?

TheBlackVegetable posted:

It's horrors all the way down...

It does kinda help with code organization and this code has been accreting for a decade, so some architectural ugliness is bound to happen. I've dealt with worse.

# ? Jun 10, 2015 04:49

New Yorp New Yorp: Jul 18, 2003; Only in Kenya.; Pillbug

fleshweasel posted:

Rest assured they are pretty much all bad. ASP.NET MVC is good but you pretty much still have to be in windows world to develop a site with it which has its disadvantages.

This will be less true in ~2 months when they release ASP .NET 5 / .NET Core. I was playing with it on my Mac with Visual Studio Code a few weeks ago and it was a pretty good experience. Of course, I haven't done anything Big and Serious with it yet.

# ? Jun 10, 2015 04:50

Pollyanna: Mar 5, 2005; Milk's on them.

uncurable mlady posted:

Literally anything else? It's not like the world is lacking for web frameworks.

I said "should", not "could". If Rails is a bad option, what is considered a good option?

fleshweasel posted:

Rest assured they are pretty much all bad.

Actually, let's go with this.

# ? Jun 10, 2015 05:12

piratepilates: Mar 28, 2004; So I will learn to live with it. Because I can live with it. I can live with it.

Pollyanna posted:

And yet.

Color me curious: what should I use?

Django, Flask, Dropwizard, my butt.

# ? Jun 10, 2015 05:16

Sinestro: Oct 31, 2010; The perfect day needs the perfect set of wheels.

Yesod is my personal favorite.

# ? Jun 10, 2015 05:16

Knyteguy: Jul 6, 2005; YES to love
NO to shirts; Toilet Rascal

Seconding .net mvc. The skills translate well to many other things, but most especially it's because Visual Studio is a pleasure to work in.

# ? Jun 10, 2015 06:28

Dessert Rose: May 17, 2004; awoken in control of a lucid deep dream...

C# is a great language and ASP.net MVC is a ... good framework.

fleshweasel posted:

If you just want to get started with something quick, node.js is alright but I'm skeptical of it for anything big or important.

I think node.js might be one of the only frameworks you could have picked that is actually worse than Rails.

Probably your first concern when picking a framework is picking a language.

# ? Jun 10, 2015 08:12

Deus Rex: Mar 5, 2005

node.js isn't a framework, at least not in the way that Flask or Rails or ASP.NET or Play or Snap is.

# ? Jun 10, 2015 09:05

Soricidus: Oct 21, 2010; freedom-hating statist shill

Pollyanna posted:

And yet.

Color me curious: what should I use?

Whiskey. Lots of it.

# ? Jun 10, 2015 10:08

Volmarias: Dec 31, 2002; EMAIL... THE INTERNET... SEARCH ENGINES...

Pollyanna posted:

And yet.

Color me curious: what should I use?

CGI + Perl :unsmigghh:

# ? Jun 10, 2015 12:47

ChickenWing: Jul 22, 2010

Most people I talk to swear by flask+sqlalchemy for any sort of webdev.

Admittedly most of those people hang out together and have the same ideas about things so

# ? Jun 10, 2015 13:45

Space Kablooey: May 6, 2009

Flask + SQLAlchemy is actually, unironically pretty good. :shrug:

# ? Jun 10, 2015 14:18

Drastic Actions: Apr 7, 2009; FUCK YOU!
GET PUMPED!; Nap Ghost

Ithaqua posted:

This will be less true in ~2 months when they release ASP .NET 5 / .NET Core. I was playing with it on my Mac with Visual Studio Code a few weeks ago and it was a pretty good experience. Of course, I haven't done anything Big and Serious with it yet.

It's really cool until you want to use a library that's not supported yet, then it becomes a pain in the rear end. Of course, as it matures and more people port their stuff over it will get better, but for the short term it can be a pain. It is nice to just have a site run on all of those platforms though with minimal effort. EF 7 is also still kinda flaky, but has come a long way in a short time and they are quite responsive when issues arise.

# ? Jun 10, 2015 14:20

New Yorp New Yorp: Jul 18, 2003; Only in Kenya.; Pillbug

Drastic Actions posted:

It's really cool until you want to use a library that's not supported yet, then it becomes a pain in the rear end. Of course, as it matures and more people port their stuff over it will get better, but for the short term it can be a pain. It is nice to just have a site run on all of those platforms though with minimal effort. EF 7 is also still kinda flaky, but has come a long way in a short time and they are quite responsive when issues arise.

I hate EF anyway, I'm just hoping nHibernate is ported over soon.

# ? Jun 10, 2015 14:25

ExcessBLarg!: Sep 1, 2001

Munkeymon posted:

Like a straight string replace + eval?

For the provided sample, a straight string replace and eval would yield the same result as Ruby's JSON.parse. JSON.parse doesn't actually do a straight string replace and eval though.

# ? Jun 10, 2015 15:30

Drastic Actions: Apr 7, 2009; FUCK YOU!
GET PUMPED!; Nap Ghost

Bug, assigned to me.

# ? Jun 10, 2015 19:24

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

ExcessBLarg! posted:

JSON.parse doesn't actually do a straight string replace and eval though.

That's what I was wondering about - just didn't word it well.

# ? Jun 10, 2015 19:33

Dessert Rose: May 17, 2004; awoken in control of a lucid deep dream...

Drastic Actions posted:

Bug, assigned to me.

People have no sense of humor, I swear.

# ? Jun 10, 2015 20:14

No Safe Word: Feb 26, 2005

Drastic Actions posted:

Bug, assigned to me.

reply with:

☞( ﾟ∀ﾟ)☞ �\_(ツ)_/� [wontfix]

# ? Jun 10, 2015 20:28

Dessert Rose: May 17, 2004; awoken in control of a lucid deep dream...

I enjoy "expected result: unexpected xxx should not.." Thanks for the detail!

# ? Jun 10, 2015 20:41

pseudorandom name: May 6, 2007

Clearly you should be using 😸

# ? Jun 10, 2015 20:48

Carthag Tuek: Oct 15, 2005; Tider skal komme,
tider skal henrulle,
sl�gt skal f�lge sl�gters gang

No Safe Word posted:

reply with:

(╯�□�）╯︵ ┻━┻

# ? Jun 10, 2015 21:03

The MUMPSorceress: Jan 6, 2012; ^SHTPSTS; Gary’s Answer

Drastic Actions posted:

Bug, assigned to me.

I mean, if you're not familiar with little ascii drawings of people, that emote kinda looks like a pair of boobs, so I could see someone being bugged by it.

# ? Jun 10, 2015 21:13

New Yorp New Yorp: Jul 18, 2003; Only in Kenya.; Pillbug

LeftistMuslimObama posted:

I mean, if you're not familiar with little ascii drawings of people, that emote kinda looks like a pair of boobs, so I could see someone being bugged by it.

I thought it was breasts. :shrug:

# ? Jun 10, 2015 21:18

Drastic Actions: Apr 7, 2009; FUCK YOU!
GET PUMPED!; Nap Ghost

LeftistMuslimObama posted:

I mean, if you're not familiar with little ascii drawings of people, that emote kinda looks like a pair of boobs, so I could see someone being bugged by it.

That was the issue. The QA tester had zero clue what that was.

For slightly more background: When you submit a new component to the Xamarin component store and finish, this is the view you get

For updating components though, the process was basically a hacked version of the edit component screen, with some different session variables. It was a lovely experience and most users had to have their hand held to actually update their stuff. That's not a good process, so I wrote a new component update page, and an actual new landing when you finish:

I was just riffing on the :-) thing. After this bug was filed, I went to my boss and a few others to see what they thought the ascii was. Some knew it was a high five, but others were stumped. So instead of fighting, I just took it out

. Not saying it won't reappear though somewhere :v:

.

I thought there could be bugs written for what I wrote. Just not for this.

# ? Jun 10, 2015 21:20

Factor Mystic: Mar 20, 2006; Baby's First Post-Apocalyptic Fiction

http://blog.parse.com/learn/how-we-moved-our-api-from-ruby-to-go-and-saved-our-sanity/

Kind of an interesting & apropos article

the article posted:

The hardest part of the rewrite was dealing with all the undocumented behaviors and magical mystery bits that you get with Rails middleware. Parse exposes a REST API, and Rails HTTP processing is built on a philosophy of �be liberal in what you accept�. So developers end up inadvertently sending API requests that are undocumented or even non-RFC compliant � but Rails middleware cleans them up and handles it fine.

Rails and/or webdevs �\_(ツ)_/�

a commenter posted:

Also, you want performance ? Rails is not for speed, it does 10,000 things until your code kicks in, it does 10,000 things to make life of thousands of developers easier, who don't run popular API thank need to process thousand requests per second. You want speed in ruby ? Write a Rack application or use micro framework such as 'cuba.is', you will get ten times better performance than Rails. Does it mean Rails sucks ? NO, Rails is $%^&$% amazing if you use it for what it makes sense. Comparing Rails vs Go, is just plain stupid.

Rails does 10,000 things before your code, and this is good, except it is slow, which also... somehow doesn't mean rails is bad. Also, why in the world would anyone compare two backend languaegs for a website?? �\_(ツ)_/�

Factor Mystic fucked around with this message at 21:24 on Jun 10, 2015

# ? Jun 10, 2015 21:22

TheBlackVegetable: Oct 29, 2006

Factor Mystic posted:

http://blog.parse.com/learn/how-we-moved-our-api-from-ruby-to-go-and-saved-our-sanity/

Kind of an interesting & apropos article

Rails and/or webdevs ¯\_(ツ)_/¯

Rails does 10,000 things before your code, and this is good, except it is slow, which also... somehow doesn't mean rails is bad. Also, why in the world would anyone compare two backend languaegs for a website?? ¯\_(ツ)_/¯

There's nothing wrong with accepting performance tradeoffs with ease of development / hiring developers if you're not going to be affected by those performance issues.

That said, obviously these guys chose the wrong tradeoffs, but most people have had to scrap a prototype when new requirements became apparent

TheBlackVegetable fucked around with this message at 22:02 on Jun 10, 2015

# ? Jun 10, 2015 21:53

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

Not everything needs to be maximally fast.

# ? Jun 10, 2015 21:56

gonadic io: Feb 16, 2011; >>=

Factor Mystic posted:

http://blog.parse.com/learn/how-we-moved-our-api-from-ruby-to-go-and-saved-our-sanity/

Kind of an interesting & apropos article

Rails and/or webdevs �\_(ツ)_/�

Rails does 10,000 things before your code, and this is good, except it is slow, which also... somehow doesn't mean rails is bad. Also, why in the world would anyone compare two backend languaegs for a website?? �\_(ツ)_/�

Unexpected behaviour: lots of weird symbols in the middle of this post.
Expected behaviour: no unexpected symbols in the middle of this post.

# ? Jun 10, 2015 22:41

Plorkyeran: Mar 22, 2007; To Escape The Shackles Of The Old Forums, We Must Reject The Tribal Negativity He Endorsed

In the HN comments the people involved say that in retrospect Rails was the correct choice to build the first version in, and all that they'd change given a time machine is migrate away a bit sooner.

# ? Jun 10, 2015 22:45

Adbot: ADBOT LOVES YOU

# ? May 24, 2024 17:13

Soricidus: Oct 21, 2010; freedom-hating statist shill

TheBlackVegetable posted:

That said, obviously these guys chose the wrong tradeoffs, but most people have had to scrap a prototype when new requirements became apparent

In startups, maybe. In big companies and government work, you scrap the new requirements instead.

# ? Jun 11, 2015 01:30

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Coding Horrors: You can gather all your technical debt into one easy framework!

«‹›1503 »