Hacker News Reader

Comment by rubiquity | Hacker News Reader

Good post but please, please, please don't enable this in productiont. What an extremely wonderful way to DDoS any Rails app (as if it weren't easy enough already). If you need production like characteristics for accuracy of profiling then set up another environment that is production-like (Rails settings, replicated database, infrastructure etc.) and run it there.

View on HN

MiniProfiler was originally developed at StackExchange for production profiling.

It gave admins a clear picture of what is going on, all the time, and transformed the way we reasoned about performance.

rack-mini-profiler is a port, I use it in development and still predominantly in production!

The key is that ONLY and ONLY admins get access to the features, and we only do profiling for admins. To achieve this nothing is measured unless a request is explicitly authorized.

Very odd to hear this DDoS concern.

You can put `rack-mini-profiler` behind authentication. It is not enabled by default in production. I believe I mentioned this in the article, if not, it's in the README.

I would try and word it more carefully. The phrase "in production" has serious meaning. I think that's what startled myself (and it seems like some others, too).

Although your take away may have been that everyone should enable it in production. I think every developer should use common sense and practical knowledge when implementing a feature in their application. If you want to use it you should know that having this available for all users is not a great idea, and use it accordingly.

You would be surprised by the lack of common sense in the software community. Maybe even more so in Ruby/Rails. As an example, there are a lot of people running WEBrick in production.

I agree with rubiquity - the article as written strongly suggests that users enable it in production. I'd amend it to be far clearer about what you mean. Directly from the second paragraph:

> The best part - rack-mini-profiler is designed to be run in production. Yeah!

Then later:

> rack-mini-profiler is designed to be used in production.

Reply on news.ycombinator.com