What The Rails Security Issue Means For Your Startup
The "everybody has bugs" response is intellectually dishonest. Yes, everybody has bugs, but most people's bugs aren't an intentional feature that a trained monkey ought to have known was a bad idea.- Someone implemented a YAML parser that executed code. This should have been obviously wrong to them, but it wasn't.- Thousands of ostensible developers used this parser, saw the fact that it could deserialize more than just data, and never said "Oh dear, that's a massive red flag".- The bug in the YAML parser was reported and the author of the YAML library genuinely couldn't figure out why this mattered or how it could be bad.- The issue was reported to RubyGems multiple times and they did nothing.This isn't the same thing as a complex and accidental bug that even careful engineers have difficulty avoiding, after they've already taken steps to reduce the failure surface of their code through privilege separation, high-level languages/libraries, etc.This is systemic engineering incompetence that apparently pervades an entire language community, and this is the tipping point where other people start looking for these issues.