What The Rails Security Issue Means For Your Startup
The "everybody has bugs" response is intellectually dishonest. Yes, everybody has bugs, but most people's bugs aren't an intentional feature that a trained monkey ought to have known was a bad idea.<p>- Someone implemented a YAML parser that executed code. This should have been obviously wrong to them, but it wasn't.<p>- Thousands of ostensible developers used this parser, saw the fact that it could deserialize more than just data, and never said "Oh dear, that's a <i>massive</i> red flag".<p>- The bug in the YAML parser <i>was reported</i> and the author of the YAML library genuinely couldn't figure out why this mattered or how it could be bad.<p>- The issue was reported to RubyGems multiple times and they <i>did nothing</i>.<p>This isn't the same thing as a complex and accidental bug that even careful engineers have difficulty avoiding, after they've already taken steps to reduce the failure surface of their code through privilege separation, high-level languages/libraries, etc.<p><i>This is systemic engineering incompetence that apparently pervades an entire language community, and this is the tipping point where other people start looking for these issues.</i>