RubySource

Yes, however it's also worth noting that Rails core has acknowledged the awkwardness of relying solely on model-level protection for vulnerabilities that should be nipped in the bud at the controller level. Rails 4 will include DHH's new strong_parameters gem that allows params to be filtered proactively on every controller. This will of course help prevent a much broader class of vulnerabilities than ActiveRecord bugs. http://rubysource.com/rails-4-quick-look-strong-parameters/

I think that you've hit the nail on the head, and highlighted 2 differing styles of building web apps within the Ruby community. There is a great post about this here: http://rubysource.com/rails-or-sinatra-the-best-of-both-worlds/

from the ruby side of things, here's a very good write-up of the differing philosophies between rails [monolithic, batteries-included] and sinatra [small, lightweight]: http://rubysource.com/rails-or-sinatra-the-best-of-both-worlds/ the post goes into why there is room (and a need) for both in the ruby web ecosystem, and where you'd want to use each one.

"Ruby is a "me too" on those fronts, and not a particularly novel one." Of course. No one, especially not Matz, ever claimed Ruby was novel. Why should I care whether a language feature is new when I have features to ship? What you seem to be dogmatically, blindly ignoring is that Ruby's peculiar amalgamation of existing techniques, borrowed from (standing on the shoulders of) Smalltalk, Perl, Python, certain aspects of Lisp and others, created an expressiveness with those idioms that invited widespread adoption that Smalltalk and Lisp in all their glory only ever dreamed of. Innovation was the least of Ruby's concerns, and it's irrelevant to the conversation at hand. Type-safety seems to be a big thing for you. This may seem to be an enormous advantage to you, and I wish you well. I personally think type safety is the most overrated language feature in CS history. In my crankier moments I'd say it's essentially a compile-time unit test and refactoring/code-browsing crutch for IDE-jockeys that don't test their code. In my less-cranky moments...I'll probably say the same thing. And that's after a decade and an half in Java and C#, not quite a decade in Ruby. To me, type safety imposes far more overhead than it's worth -- generics, abstract classes, interfaces, all irrelevant and basically built-in and implicit in dynamic environments like Ruby. But that's another digression. Suffice it to say, in my entire software career I've kept track of the sum total of bugs I've fixed…

I think he's referring to the rails YAML exploit [0] because you can use yaml to create objects, like this: --- !ruby/hash:ActionDispatch::Routing::RouteSet::NamedRouteCollection 'foo; eval(eval(puts '=== hello there'.inspect);': !ruby/object:OpenStruct table: :defaults: {} Allowing people to run arbitrary code on rails servers. [0] http://rubysource.com/anatomy-of-an-exploit-an-in-depth-look-at-the-ra…

I know we shouldn't care about the source, crazy-insane as he obviously is, but FWIW, the author is Yusuke Endoh, one of the Ruby core members. RubySource had an interview with him here: http://rubysource.com/meet-fifteen-ruby-core-committers/ He lists his "hobby in programming" as: "writing a Quine and enjoying esoteric programming."

Let's get specific, because there's a point here that I think a lot of people are missing (including tptacek). ActionDispatch::Routing::RouteSet::NamedRouteCollection.add calls 'eval' on the property name passed to it. This invites exploitation. It also fails 'static_typed's desideratum of each component having a single responsibility. And I don't think calling it "magic" is too strong. I don't know to what extent the Ruby culture encourages calling 'eval' in random API routines like this, but when I previously argued here on HN that that had to be a bad idea, I got some pushback. I would certainly call this a dangerous anti-pattern. EDITED to add: reference: http://rubysource.com/anatomy-of-an-exploit-an-in-depth-look-at-the-ra…

Well, sort of. I wouldn't really call it running "ruby code on the Objective-C runtime". Your Ruby code is effectively being converted to Cocoa API calls during the compilation process. RubyMotion has a number of Objective-C subclasses that match back to Ruby objects (for example, strings in RubyMotion aren't NSStrings, but a subclass of them). If you dump the headers out of a RubyMotion app you can pretty clearly see this. Ruby and Objective-C definitely aren't that similar internally - as someone else has suggested, there's no technical reason you couldn't do something similar for Python. It just happens that Ruby to Cocoa bindings have been around for a while (for some time with Apple support), and as a result there has been generally more interest in carrying it forward. I've probably failed to adequately explain how it works, but the MacRuby source is available on GitHub, and Laurent Sansonetti has done a run through how RubyMotion does it's thing here: http://rubysource.com/laurent-sansonetti-on-rubymotion-internals/