Rails 2.1 and 2.2: CSRF vulnerability and work-around

Wednesday, November 19th, 2008

I’ve done a quick write-up on the recent CSRF vulnerability on the Brightbox blog.

Rails vs Merb (updated)

Tuesday, November 18th, 2008
Ruby Programmers having a fight

Ruby Programmers having a fight

What the fuck is this?

Merb is launched and DHH suddenly has a load of “Rails Myths” posts up on his blog. Like this sly little dig:

it shows the great power of being an full-stack framework

Wycats responds with a slightly less sly dig:

For the moment, these differences are the reason that Rails will continue to dominate amongst developers seeking to build apps similar in scope to apps built by 37Signals. I suspect that Merb will pick up steam amongst developers looking to build innovative apps leveraging the latest and greatest Ruby techniques and libraries.

Zed responds angrily to a mistake by DHH (which DHH subsequently corrects).

I admit I’ve not had much time to look at Merb in detail; the times when I have played with it my impression has been “it’s much the same as Rails but done in a different (probably cleaner) way”. I love the fact in Rails that everything comes in one bundle (apart from RSpec :-), I love the fact that Merb gives you choices (even though I don’t have the time to research those choices), I like the fact that the two frameworks are now feeding off each other.

But the thing that impressed me most when I came to Rails was how nice and friendly the Ruby community was. But, it would appear that that was an illusion and massive egos are in charge. Discussion is good. Adapting your ideas in the face of competition and change is good. Having a massive pissing match because my framework is better than your framework is stupid. I wish you would all just shut the fuck up.

UPDATE:

And the fighting continues – this time it’s _why versus Zed.