Don't really know much about Rails because I wound up picking Django instead when faced with the choice many years ago. That said, honestly, my perspective of Ruby on Rails has been tainted by watching GitLab get pwned over and over and over. My distro can barely keep up with GitLab being pwned because by the time the security release hits stable channels there's already another CVE. I liked GitLab, but something is deeply wrong.
Of course clearly not all apps are GitLab, but GitLab is the only Rails app I run, and must be one of the most problematic software I've ever deployed for security patching, and most of it seems to do with issues in the Ruby side of things. What makes GitLab so uniquely crap at security, and how do you avoid it as a Rails developer?
Of course clearly not all apps are GitLab, but GitLab is the only Rails app I run, and must be one of the most problematic software I've ever deployed for security patching, and most of it seems to do with issues in the Ruby side of things. What makes GitLab so uniquely crap at security, and how do you avoid it as a Rails developer?