Hacker News Reader

Comment by jarin | Hacker News Reader

Yep, there is a pretty easy way to do it. In your Gemfile, put:

  gem "rails", "~>3.2.0"

Then when there's an update, run:

  bundle update rails

Edit: fixed the gem directive

View on HN

That assumes you know about the vulnerability, though. If you aren't subscribed to an email group, you might not find out for some period of time. The majority of Rails programmers, or beginners even, aren't a part of these email groups, so they might leave vulnerable code up on their servers indefinitely -- not good.

It might be better to have a cronjob that nightly runs the bundle update command, then restart the server. But again, this depends on you being smart enough to realize this, which since we are talking about sane defaults, isn't something we might want to assume.

It's probably a good idea to subscribe to rails-security.

https://groups.google.com/forum/?fromgroups#!forum/rubyonrai...

I probably wouldn't allow a production app to update itself without human intervention.

The whole issue is that Rails has tried to package what's 'probably a good idea' into the framework by default for quite a while. Unless every guide ever tells you to subscribe to the rails-security group, only those 'in the know' will know to do so. What's better, to have access to these updates by default, or having half the Rails apps out there potentially being compromised?

You would really want to do

    gem 'rails', '~>3.2.0`

otherwise you could get upgraded to '3.3' or '3.4' which is more likely to break something.

Oops, fixed!

This assumes you don't commit your app's Gemfile.lock into your repository, which you generally should.

No, bundle update rails will change your Gemfile.lock to the version of rails it upgrades to.

You're right, my mistake. It's just a matter of running `bundle update rails` on your server as well as making the changes in your repository.

As long as you're using a reasonably good deploy script (capistrano, moonshine, Heroku, etc) you shouldn't have to worry about updating gems on your server.

Most deploy scripts will look at your Gemfile.lock and update if necessary during the deploy (or just run bundle install every time, which won't give you a locked version error if your Gemfile.lock matches your Gemfile).

Definitely, and that's the approach I personally would take. I think jarin was looking for a way to quickly update all his servers without having to redeploy for every app.

Reply on news.ycombinator.com