<story><title>Rails SQL injection vulnerability: here are the facts</title><url>http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/#.UOV2h_j3Giw</url></story><parent_chain><item><author>tptacek</author><text>This post is written very confidently. I am less confident than the author of this post that the likelihood of a generic exploit via application input (that is, not using forged cookies) is remote.&lt;p&gt;Wish there was more I could say right now. I&apos;m not saying I have a curl command that exploits the vulnerability. I&apos;d just be careful about making assumptions about this bug.</text></item></parent_chain><comment><author>PommeDeTerre</author><text>This smug attitude is something we&apos;ve seen a lot from the Ruby, and especially the Rails, community, and it always burns them.&lt;p&gt;They had this attitude when it came to the maintainability of Ruby apps. They&apos;d say that Ruby code was much more maintainable than Java code, for instance. Now that we&apos;ve got some Ruby apps that are several years old, and that have been worked on by a number of different people, it has become quite apparent that Ruby code is much less maintainable, over the long term, than Java code is.&lt;p&gt;This same attitude was shown when it came to Ruby&apos;s performance. Many of us had serious misgivings about just how poorly it performed, and the suitability of Ruby on Rails for anything beyond simple sites. Then when some Ruby on Rails sites started facing moderate traffic, they basically collapsed. The answer from the Rails advocates was to &quot;throw more hardware at it&quot;.&lt;p&gt;We even saw this same attitude when it came to this very issue. We&apos;d heard about how Ruby on Rails is far more &quot;secure&quot; than alternatives. Yet that&apos;s proven not to be the case.&lt;p&gt;When Rubyists make claims, it&apos;s best to doubt what they&apos;re saying, and to question every single detail about it. They have given themselves a bad reputation for making incorrect statements.</text></comment>
<story><title>Rails SQL injection vulnerability: here are the facts</title><url>http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/#.UOV2h_j3Giw</url></story><parent_chain><item><author>tptacek</author><text>This post is written very confidently. I am less confident than the author of this post that the likelihood of a generic exploit via application input (that is, not using forged cookies) is remote.&lt;p&gt;Wish there was more I could say right now. I&apos;m not saying I have a curl command that exploits the vulnerability. I&apos;d just be careful about making assumptions about this bug.</text></item></parent_chain><comment><author>FooBarWidget</author><text>Not disagreeing with you there. After all there&apos;s no way to prove that something doesn&apos;t exist. What&apos;s why I wrote that everyone should upgrade, just in case. :)&lt;p&gt;The goal of the article is not to defend Rails. It is to inform about the nature of the vulnerability and to replace the feeling of panic with rational thoughts.</text></comment>