You can have a thousand people who use terminal services, and only have 100 licenses. Its just that only 100 people can be connected at once. For software that everyone has to use, all day, every day, its not so great. But for those apps that people use for a half hour a day, its ideal. And keep in mind, you would already have to be shelling out for tons of stupid licenses if you were just doing a windows only network anyways.
Not when the OS is booted over the network from a read-only copy on the server. Any changes made to the OS are lost when the machine is rebooted. Spyware is very easy to remove with the reset button this way.
It doesn't matter what apps they use, you just need a license for each concurrently connected user. Its still cheaper than buying that many copies of XP Pro.
Seriously, any business with hundreds to thousands of desktops does not allow users to install anything. If users need some software, they request it be installed for them. Do you really think these companies want to pay lots of sysadmins to wander around uninstalling comet cursors and such crap all day? Joe average user can go home and fuck up his own machine, when he is at work, he can stfu and do his damn job, that's what we let him use a computer for.
What complexity? In alot of cases it is WAY easier to run certain apps on a citrix server, even if its windows software and windows desktops, and this has been the case for years. The time savings of having desktops act as dumb clients that boot off the network and run all their apps remotely from servers is immense. Its so much easier to manage a medium to large sized network this way, and managing software upgrades is a breeze.
And your savings comes from the time spent, you need WAY fewer admins to manage such a network. Also, you gain additional savings from the fact that you gain control of your infrastructure. You no longer have to upgrade hundreds of desktops when microsoft tells you to, often having to upgrade hardware too just to support the latest version of windows that provides no benefit.
What desktop someone is using has nothing to do with it, unless they don't have enough RAM. Once the desktop environment has started up, it doesn't really use any CPU, just RAM. And I used openbox on both the machines I am basing my comparison on. Mozilla and OO run unacceptably slow on my 2Ghz p4m laptop for crying out loud, on a C3 it took over 15 seconds! for firefox to start up, which is just rediculous.
Unix admins are almost always as good at windows as a windows admin, plus have the unix knowledge. A unix admin for 40-60K will be able to replace the existing windows admin, not just suppliment him/her. And every competant windows admin I have ever come across has been perfectly capable of learning unix very quickly, so if they don't want to replace their admin they can simply train them. The fallacy of windows admins being cheaper and unable to admin unix machines is only true if you have incompetant windows admins.
Set up a windows server to run these apps, and use terminal services to connect from your linux desktops. Or, if you have a huge amount of people needing to use it at the same time then terminal services isn't so hot, so use citrix.
If you use citrix, you also have the advantage that you can have it so that people simply double click an icon on their desktop, and the app runs on the server, but appears in a window on their desktop just like with remote X apps. It works fantastically well, we use it for several old VB apps.
Linspire is not in the same "leage" as gentoo how? Because linspire users realize they are linux newbs?
Running something like OpenOffice or Mozilla on a C3 is incredibly painful, which linux distro you're using doesn't change that.
He very plainly and clearly pointed out that he doesn't have to repeat himself to make getter/setter methods in java, its less work than it is with ruby, because he doesn't do it at all, that's what your editor is for. Comparing the final output code isn't a fair comparison, because the java developer doesn't write all that code, lots of it is generated for him/her automatically.
I have done exactly what you are talking about. Taking a gaggle (or is it a murder?) of sales drones who know jack about computers and need to have a room full of computers they can log into when they are at the office, without it mattering which actual computer they use, profiles/home dirs are on a server.
The machines cost $200 each (walmart specials), and their cost to have me set it all up was $200 (2 hours work). It was 12 machines, but for comparison lets pretend it was 10 machines. That would mean $2200 vs windows $3790. No training was needed, these guys only applications are email, opening a single template word doc and filling in the blanks with customer details, and using a browser to look up and print maps on google to get to their sales appointments. Their desktop had nothing but "Email", "Internet", and the same bizzare name for the word doc they had always used. They had no problems and never needed any more help than they did with windows.
No, I'm basing that off the attitudes of the developers who repeatedly dismiss and/or ignore security issues, as well as the multiple security issues that have been pointed out here. Why is scaffolding vulnerable to XSS? Its not a matter of using it wrong, you can't use it safely at all. And of course, the developers think that's perfectly fine, you shouldn't be using scaffolding for real stuff anyways apparently.
I didn't say it was 1.0 or that it should be perfect. That particular instance isn't my problem, just an example. The attitude that security is something to pawn off on users instead of taking responsibility for is my problem. I was very clear about this, you refused to believe me, and now you are trying to pretend it doesn't matter. If it doesn't matter for you that's fine, but I do not use software written by people who don't take security seriously, and rails is one such piece of software.
And the developer knowing the quoting rules for the DB they are using has nothing to do with this, rails could and should prevent errors like this. Also that documentation did not exist at the time this happened, and it still doesn't excuse the attitude. There is no reason at all to make things potentially exploitable by default, and expect users to know enough to avoid the problems themselves. The whole idea of a web framework is so I don't have to worry about the details.
You're right, you can do things different ways to emulate what Ruby is doing naturally. But, then you begin to lose the beautiful meta-language-syntax that makes ActiveRecord and ActionPack so attractive.
See, you misunderstood me, because I didn't say emulating what ruby is doing naturally was a good idea. That's why I said that you aren't understanding me, and explained again that I never said emulating ruby was good. The rest of your post was you agreeing with me, after saying that you disagree with me. I was trying to point out that we aren't disagreeing, you simply misunderstood me. Why are you trying so hard to turn an agreement into a disagreement?
He asked what sucks about it. I told him. Seriously, nothing is perfect, including your precious rails, get over it. The list is only three items long, you should be proud, not trying to make up excuses.
I think I formed my opinions before the 0.10.0 release too. I tried what was being hyped as the greatest thing ever. These were the problems. Sorry you don't like it, but that's what I found. There has been no indication of a change in attitude with regards to security: http://article.gmane.org/gmane.comp.lang.ruby.rail s/749/match=sql+injection and a simple scaffolding blows up with the current version of rails for me, so I think clearly the mysql specific issue has not been dealt with sufficiently.
As for speed, benchmark ruby yourself, its recursion is an order of magnitude slower than other languages, PHP being the other language sharing this undesirable trait. And benchmarking rails vs some mess in tomcat doesn't mean anything about rubys performance. Benchmark ruby and java, java is WAY faster. I don't think this is that big of a deal, but you can't deny that this is one of the weaknesses rails has in it, which is what the poster specfically asked for. Everything has its downsides, and wanting to know about them from the start is a pretty smart move.
And its not a very ambiguous quote, its pretty clear. You claimed ruby is better for making a rails-like framework because ruby is like ruby and python and perl aren't.
However, I did reread what you said just to be sure, and in fact the quote is still there, and is still the same. If I read it over and over will it change or something?
This has nothing to do with letting people use arbitrary statements. I don't know how you could think that after me already saying repeatedly that I am not talking about users running their own SQL queries. Thanks to the poster above for the search link, this is what I am talking about:
That is a bad attitude for a developer, and I do not use software written by people with that attitude. I'm not sure why this was such a big deal for you guys to understand, but some people care about security, not just when its convenient.
The other posts in this thread have nothing to do with this. I am not talking about any tutorial that was exploited, and I know nothing about that case, never heard about it before now. I am talking about a patch David refused. Thanks for the search link though, didn't realize the newsgroup and mailing list were the same. Here's the link for you:
As you can see, David refuses to make things secure for people who didn't magically guess to do it the "right" way, because it might inconvenience people. This is the wrong attitude, and I do not trust software written by people who feel convenience trumps security.
You can do things different ways to emulate what ruby is doing naturally, but that would be dumb. There is no need to emulate what ruby is doing, just step away from ruby and rails for a second, and think of the problem, instead of one particular implimentation of the solution. In ruby it may be natural to solve this problem using techniques rails uses. In other languages its natural to do it different ways, which may be more, less or equally "elegant" depending on the perspective of the person reading the code.
So, when the entire page is filled with people blindly praising rails, that's all good. But when I say I don't care for rails, and I can't really comment on any other frameworks besides seaside and zope, I am "a bit of a nut"? Honestly, I don't care for python or perl, so I really can't make any comparisons of the various frameworks in those languages, sorry.
To answer your question, no, I do not contribute to seaside, I am just a user. I do not hate that it isn't as well known either. I am simply advocating it, just like dozens of people are advocating rails in this same discussion. I kinda wonder why you feel that pushing software you like is crazy, but only when I do it.
See, the larger user base argument has never held any water. Most of the users are just that, users. They do not contribute anything, and as such do not matter to me. And of course, you might think rails has alot of people, but it mostly has alot of hot air. There are way more java developers, so rails really isn't the best example of "choose this because everyone else is", you should be advocating against rails if you care about marketshare. I would be using windows and GaySP.net if I cared about what is popular. Instead, I use whatever makes me most productive, while still meeting the requirements of the project at hand.
I don't care if smalltalk is the current fad or not, that has no effect on me. I care about what framework allows me to be the most productive, which is very clearly, by a large margin, seaside. If someone else does better someday, then I'll certainly consider switching. But flaming java frameworks and developers isn't what I consider "doing better", and that's all that rails seems to care about right now.
JSP doesn't do that because JSP isn't a framework. He's not complaining about using mod_ruby + eruby and it not sanitizing input, he is complaining that a framework built on top of ruby technologies doesn't make any attempt at being secure.
Nobody is expecting languages to do these things, but its pretty reasonable to expect a framework specifically built to make dynamic website creation easier would deal with the specific problems that plague dynamic websites.
Slashdot Mirror
You can have a thousand people who use terminal services, and only have 100 licenses. Its just that only 100 people can be connected at once. For software that everyone has to use, all day, every day, its not so great. But for those apps that people use for a half hour a day, its ideal. And keep in mind, you would already have to be shelling out for tons of stupid licenses if you were just doing a windows only network anyways.
Not when the OS is booted over the network from a read-only copy on the server. Any changes made to the OS are lost when the machine is rebooted. Spyware is very easy to remove with the reset button this way.
It doesn't matter what apps they use, you just need a license for each concurrently connected user. Its still cheaper than buying that many copies of XP Pro.
Seriously, any business with hundreds to thousands of desktops does not allow users to install anything. If users need some software, they request it be installed for them. Do you really think these companies want to pay lots of sysadmins to wander around uninstalling comet cursors and such crap all day? Joe average user can go home and fuck up his own machine, when he is at work, he can stfu and do his damn job, that's what we let him use a computer for.
What complexity? In alot of cases it is WAY easier to run certain apps on a citrix server, even if its windows software and windows desktops, and this has been the case for years. The time savings of having desktops act as dumb clients that boot off the network and run all their apps remotely from servers is immense. Its so much easier to manage a medium to large sized network this way, and managing software upgrades is a breeze.
And your savings comes from the time spent, you need WAY fewer admins to manage such a network. Also, you gain additional savings from the fact that you gain control of your infrastructure. You no longer have to upgrade hundreds of desktops when microsoft tells you to, often having to upgrade hardware too just to support the latest version of windows that provides no benefit.
What desktop someone is using has nothing to do with it, unless they don't have enough RAM. Once the desktop environment has started up, it doesn't really use any CPU, just RAM. And I used openbox on both the machines I am basing my comparison on. Mozilla and OO run unacceptably slow on my 2Ghz p4m laptop for crying out loud, on a C3 it took over 15 seconds! for firefox to start up, which is just rediculous.
You already know about terminal server obviously, so what's the problem with custom windows apps?
Unix admins are almost always as good at windows as a windows admin, plus have the unix knowledge. A unix admin for 40-60K will be able to replace the existing windows admin, not just suppliment him/her. And every competant windows admin I have ever come across has been perfectly capable of learning unix very quickly, so if they don't want to replace their admin they can simply train them. The fallacy of windows admins being cheaper and unable to admin unix machines is only true if you have incompetant windows admins.
Set up a windows server to run these apps, and use terminal services to connect from your linux desktops. Or, if you have a huge amount of people needing to use it at the same time then terminal services isn't so hot, so use citrix.
If you use citrix, you also have the advantage that you can have it so that people simply double click an icon on their desktop, and the app runs on the server, but appears in a window on their desktop just like with remote X apps. It works fantastically well, we use it for several old VB apps.
Linspire is not in the same "leage" as gentoo how? Because linspire users realize they are linux newbs? Running something like OpenOffice or Mozilla on a C3 is incredibly painful, which linux distro you're using doesn't change that.
I'm sure someone can find some use for those things, but lots of people need a desktop replacement machine.
He very plainly and clearly pointed out that he doesn't have to repeat himself to make getter/setter methods in java, its less work than it is with ruby, because he doesn't do it at all, that's what your editor is for. Comparing the final output code isn't a fair comparison, because the java developer doesn't write all that code, lots of it is generated for him/her automatically.
I have done exactly what you are talking about. Taking a gaggle (or is it a murder?) of sales drones who know jack about computers and need to have a room full of computers they can log into when they are at the office, without it mattering which actual computer they use, profiles/home dirs are on a server.
The machines cost $200 each (walmart specials), and their cost to have me set it all up was $200 (2 hours work). It was 12 machines, but for comparison lets pretend it was 10 machines. That would mean $2200 vs windows $3790. No training was needed, these guys only applications are email, opening a single template word doc and filling in the blanks with customer details, and using a browser to look up and print maps on google to get to their sales appointments. Their desktop had nothing but "Email", "Internet", and the same bizzare name for the word doc they had always used. They had no problems and never needed any more help than they did with windows.
No, I'm basing that off the attitudes of the developers who repeatedly dismiss and/or ignore security issues, as well as the multiple security issues that have been pointed out here. Why is scaffolding vulnerable to XSS? Its not a matter of using it wrong, you can't use it safely at all. And of course, the developers think that's perfectly fine, you shouldn't be using scaffolding for real stuff anyways apparently.
I didn't say it was 1.0 or that it should be perfect. That particular instance isn't my problem, just an example. The attitude that security is something to pawn off on users instead of taking responsibility for is my problem. I was very clear about this, you refused to believe me, and now you are trying to pretend it doesn't matter. If it doesn't matter for you that's fine, but I do not use software written by people who don't take security seriously, and rails is one such piece of software.
And the developer knowing the quoting rules for the DB they are using has nothing to do with this, rails could and should prevent errors like this. Also that documentation did not exist at the time this happened, and it still doesn't excuse the attitude. There is no reason at all to make things potentially exploitable by default, and expect users to know enough to avoid the problems themselves. The whole idea of a web framework is so I don't have to worry about the details.
He asked what sucks about it. I told him. Seriously, nothing is perfect, including your precious rails, get over it. The list is only three items long, you should be proud, not trying to make up excuses.
l s/749/match=sql+injection
I think I formed my opinions before the 0.10.0 release too. I tried what was being hyped as the greatest thing ever. These were the problems. Sorry you don't like it, but that's what I found. There has been no indication of a change in attitude with regards to security:
http://article.gmane.org/gmane.comp.lang.ruby.rai
and a simple scaffolding blows up with the current version of rails for me, so I think clearly the mysql specific issue has not been dealt with sufficiently.
As for speed, benchmark ruby yourself, its recursion is an order of magnitude slower than other languages, PHP being the other language sharing this undesirable trait. And benchmarking rails vs some mess in tomcat doesn't mean anything about rubys performance. Benchmark ruby and java, java is WAY faster. I don't think this is that big of a deal, but you can't deny that this is one of the weaknesses rails has in it, which is what the poster specfically asked for. Everything has its downsides, and wanting to know about them from the start is a pretty smart move.
And its not a very ambiguous quote, its pretty clear. You claimed ruby is better for making a rails-like framework because ruby is like ruby and python and perl aren't.
However, I did reread what you said just to be sure, and in fact the quote is still there, and is still the same. If I read it over and over will it change or something?
This has nothing to do with letting people use arbitrary statements. I don't know how you could think that after me already saying repeatedly that I am not talking about users running their own SQL queries. Thanks to the poster above for the search link, this is what I am talking about:
l s/749/match=sql+injection
http://article.gmane.org/gmane.comp.lang.ruby.rai
That is a bad attitude for a developer, and I do not use software written by people with that attitude. I'm not sure why this was such a big deal for you guys to understand, but some people care about security, not just when its convenient.
The other posts in this thread have nothing to do with this. I am not talking about any tutorial that was exploited, and I know nothing about that case, never heard about it before now. I am talking about a patch David refused. Thanks for the search link though, didn't realize the newsgroup and mailing list were the same. Here's the link for you:
l s/749/match=sql+injection
http://article.gmane.org/gmane.comp.lang.ruby.rai
As you can see, David refuses to make things secure for people who didn't magically guess to do it the "right" way, because it might inconvenience people. This is the wrong attitude, and I do not trust software written by people who feel convenience trumps security.
You can do things different ways to emulate what ruby is doing naturally, but that would be dumb. There is no need to emulate what ruby is doing, just step away from ruby and rails for a second, and think of the problem, instead of one particular implimentation of the solution. In ruby it may be natural to solve this problem using techniques rails uses. In other languages its natural to do it different ways, which may be more, less or equally "elegant" depending on the perspective of the person reading the code.
So, when the entire page is filled with people blindly praising rails, that's all good. But when I say I don't care for rails, and I can't really comment on any other frameworks besides seaside and zope, I am "a bit of a nut"? Honestly, I don't care for python or perl, so I really can't make any comparisons of the various frameworks in those languages, sorry.
To answer your question, no, I do not contribute to seaside, I am just a user. I do not hate that it isn't as well known either. I am simply advocating it, just like dozens of people are advocating rails in this same discussion. I kinda wonder why you feel that pushing software you like is crazy, but only when I do it.
See, the larger user base argument has never held any water. Most of the users are just that, users. They do not contribute anything, and as such do not matter to me. And of course, you might think rails has alot of people, but it mostly has alot of hot air. There are way more java developers, so rails really isn't the best example of "choose this because everyone else is", you should be advocating against rails if you care about marketshare. I would be using windows and GaySP.net if I cared about what is popular. Instead, I use whatever makes me most productive, while still meeting the requirements of the project at hand.
I don't care if smalltalk is the current fad or not, that has no effect on me. I care about what framework allows me to be the most productive, which is very clearly, by a large margin, seaside. If someone else does better someday, then I'll certainly consider switching. But flaming java frameworks and developers isn't what I consider "doing better", and that's all that rails seems to care about right now.
JSP doesn't do that because JSP isn't a framework. He's not complaining about using mod_ruby + eruby and it not sanitizing input, he is complaining that a framework built on top of ruby technologies doesn't make any attempt at being secure.
Nobody is expecting languages to do these things, but its pretty reasonable to expect a framework specifically built to make dynamic website creation easier would deal with the specific problems that plague dynamic websites.