BlogFish - All Comments

Comment on 'Webistrano/Capistrano problem with git' by Barry

2009-09-12T02:23:33Z

You can also tell SSH to allow users to modify their environment variables. I’m using Enterprise Ruby on one server under /opt, so I set this to yes in /etc/ssh/sshd_config:

PermitUserEnvironment yes

and set up the PATH value I wanted in

~/.ssh/environment

Comment on 'Ruby on Rails Security' by mehmoomoo

2009-09-04T13:23:23Z

Garren, you do things according to widely known best practices not because they are always correct but because of consistency and its risk reducing behaviour. Also, 4k storage limitation is bad for many applications.

There is by the way no need for argumentum ad hominem.

Comment on 'Ruby on Rails Security' by Matt Jones

2009-09-03T22:08:41Z

The Java people that interpret this as meaning “Rails is insecure” most likely then go back to building SQL by concatenating query parameters without escaping. Because Java is always secure, right?

And session editing by brute-forcing HMAC-SHA1, while possible in theory, is likely to take ridiculous amounts of time. For example, the much faster HMAC-MD5 can be scanned at about 4 million hashes/second on a dual 3.2GHz Xeon box (from the MDCrack homepage). So to force a 30 character hex key like Rails generates by default, a quick calculation (16^{30 / 4000000) yields roughly 10}30 seconds, or 10^22 YEARS. Sure, with two billion Xeons in a cluster, you might finish sometime before the heat death of the universe. But I’d hardly class that as “insecure”.

Comment on 'Ruby on Rails Security' by Garren

2009-09-03T20:56:36Z

“I was honestly baffled to read those couple slides, considering posting them to thedailywtf.com ….”

The real wtf is this statement. Cookie session storage isn’t designed to be secure. It’s designed to be convenient, lightweight and very developer friendly. If you, as a developer, are putting together an application that requires actual security and you’re using cookie session storage, well, unlike mehmoomoo, you should know better.

Comment on 'Ruby on Rails Security' by Jonathan

2009-09-03T19:20:33Z

The default session store thing is true in that way that an attacker can read what is in his session. He cannot modify or create content. If you do not like this (and I do), changing it is very easy. It is just one line of configuration.

That said, most apps can live fine with it as they just have the user_id in the session. If you have valuable content in it you are prone to session replay attacks.

Comment on 'Ruby on Rails Security' by Jim Garvin

2009-09-03T19:16:56Z

Thanks for getting this out there. The US Government is masterful at wasting tax dollars, and this is a really good example of how they’ve elevated it to an art form. Rewriting applications from ruby to java? BAH!

Comment on 'Ruby on Rails Security' by mehmoomoo

2009-09-03T18:59:24Z

Well that thing with the cookie session storage is not good. It’s more or less common wisdom to only store the key to session into the cookies, and keep the actual session data elsewhere. I was honestly baffled to read those couple slides, considering posting them to thedailywtf.com ….

The rest are as you said: Similar to what the others are doing as well, and manageable reasonably.

Comment on 'Rescue exit' by Phreakaholic

2009-08-24T18:04:03Z

great tips, it’s pretty useful for me. thanks.

Comment on 'Webistrano 1.4 released' by Sebastian

2008-11-24T15:50:11Z

Very usefull post! THanks!

Comment on 'Webistrano 1.4 released' by Tim

2008-11-21T16:51:41Z

It looks very nice the new ui, i just had a small problem, it didn’t start at all, because of a problem in exception_notifiable plugin and the view-path (Unprocessed view path found: “…/vendor/plugins/smerf/app/views”. Set your view paths with #append_view_path, #prepend_view_path, or #view_paths=)

I just kicked it out, since i don’t need it for webistrano…

very nice work.

Comment on 'Webistrano 1.4 released' by Jonathan

2008-11-17T15:34:24Z

this link should work: http://labs.peritor.com/webistrano/raw-attachment/wiki/Download/webistrano-1.4.zip

Comment on 'Webistrano 1.4 released' by Elektronik

2008-11-16T23:01:26Z

Hallo, es scheint so als ob der Mirror zum Download down ist. Zumindest bekomme ich weder einen 404 noch antwortet der Server auf einen Ping.

Bitte prüfen.

Comment on 'Webistrano 1.4 released' by Denis

2008-11-06T15:47:36Z

very nice improvement, thanks for sharing it, this project is a must have :)

Comment on 'Gem permissions' by cthornhill

2008-07-16T17:49:55Z

Jonathan,

Thanks – after two hours of misdirection and confusion, I found your post and got back up in 5 min. This is a really nasty sort of error, and I hope the authors are fixing it fast. Many people are having a rough time if they are updating Ruby and Rails (from all the other posts I see). I am also in the middle of going from Mac 10.4 to 10.5 (I was delayed due to projects that prevented me updating in the middle). Thanks for the clear insight and easy fix.

Comment on 'why I love the windows experience' by Sam Florist, Jr

2008-06-24T01:48:56Z

Yes, MS has similar feature.