Going to jinx it

Finally feel like I'm over the worst of this cold, but the last vestiges are proving difficult to shake off completely.

Had a fairly productive day at work today; a marked improvement over the first couple of days this week, spent starting blankly at a screen while my sleep-deprived brain struggled to comprehend how the internet works.

Got nothing done for Fate tonight, though. No feedback yet from my proof-readers, so nothing to tweak in the player's guide, and I think I'm as done with these first two chapters of gameplay as I'm going to be, without playtest experience.

Still have to figure out the third chapter and how to run the act finale, but letting those simmer for a couple of days is probably better than smacking my head off them much longer.

Rant on Rails

This isn't going to be particularly interesting, or make a whole lot of sense, to a lot of people. Probably best to just ignore it.

Over the last couple of weeks, there have been two major vulnerabilities identified in the parameter-parsing in Ruby on Rails - first in the YAML, then in the JSON bit. I don't really understand the ins and outs of it myself, but essentially it allows a malicious user to run unapproved code by forcing the Rails app to read input as if it was an object created in the application. This has knock-on risks for the database, which obviously isn't ideal.

Upgrading recent Rails apps is pretty straightforward; you just update your Gemfile to point to the new Rails gem, then bundle install and deploy your app.

One of our sites, however, runs an ancient version of Rails on an ancient version of Ruby - so old that I can't actually get it working right on my own PC at work. And that's without even trying to update Rails.

Long story short, I spent pretty much all of today trying to get things working on my own machine, and didn't get anywhere. I attempted to use a simpler solution to the problem on the live server, but that went horribly wrong and I had to roll it back pretty quickly.

I'm still not sure how I'm going to get this problem sorted. I don't think my preferred solution is going to be acceptable given the number of our customers who would flip out if this particular offering was to disappear - but it's getting so very, very tempting.