Over the past month there have been a number of security issues with the Ruby on Rails framework. These issues have been serious. Whilst there is some debate whether this is an isolated Rails issue or if we can expect more frameworks to start seeing these sorts of vulnerabilities discovered this has left me with a niggling question at the back of my mind.
Should we use frameworks?
Rails is a massive monolithic framework, but (security issues aside) do the benefits of using it outweigh the benefits of not using it? This goes for any framework, in any language. Are we ultimately better developers for using frameworks, or for not using frameworks?
To answer these questions, I have drawn up a (completely non extensive and totally subjective) list of pros and cons.
The main benefit of using frameworks is the lack of having to constantly reinvent the wheel. Every time you start a new project, is it easier to use a framework that comes with ready-made modules for accessing the database, session management, caching etc, or is it easier writing all this stuff from scratch?
The answer simply must be the former. The reason for this is two fold:
Firstly, the time you save not having to reinvent the wheel you can put to actually developing your application. In this respect it will greatly speed up development time.
Secondly, as these utility modules (for want of a better term) are within a framework, you can be sure that the code has had more people looking over it than if you wrote it yourself.
This leads on to my next point. As Eric Raymond dubbed “Linus’s Law”: “given enough eyeballs, all bugs are shallow“. With a popular framework that has a vibrant and engaged community you should be relatively confident that the code has been reviewed a number of times by a number of different authors. Or at least, you should be relative confident.
But what of the vulnerabilities found in Rails? These issues had been lying there for some time. They had certainly been there long enough for the issues to be reported multiple times, but no action was taken. Again, I’m not trying to single out Rails here, but it is the highest profile framework at the moment.
However, there is nothing stopping you from auditing the code on your favourite open source framework and contributing back to the community. In my opinion this is another benefit of using a framework – the community. If you engage with the community, follow the mailing lists, chat in IRC then you can really improve your usage and productivity with the framework, again helping you develop better applications.
But what about the disadvantages of using frameworks?
Firstly it is yet another thing to learn. If you are just starting out with a framework you have to learn it. You must learn it’s foibles and nuances. This takes time, slowing you down. Granted, once you have learned the framework your development time is quicker than without a framework as discussed, but to start off with, development is slower.
As well as learning a frameworks foibles and nuances you must also learn its limitations. There are just some things that some framework will either not let you do, or are harder to do than if you write the code raw. When developing with a framework this is something that must be taken into account.
Ironically, whilst frameworks contain limitations, a lot of them are also bloated. Zend for PHP springs to mind as in fact does Rails. When using frameworks such as these your application is not as optimal as it can be because it is carrying around the huge and for you possibly mostly unneeded weight of the framework.
However, in my mind the biggest disadvantage is the “black box” scenario. People just blindly using the frameworks without delving deep into the code that the framework is made from. There is an element of faith here. Faith that the code is sound and secure. Faith that the code in the framework and the development of that code has been treated seriously, professionally and with respect. This is especially true with Rails, in part due to it’s “cool” tag a lot of newbie programmers are using it. There is nothing wrong with this, Ruby and Rails are great places to start the journey of coding. But if you are just starting out you cannot possibly know of all the implications of taking a codebase on faith.
In this case the users of Rails were badly let down.
So what is the conclusion? Should we use frameworks?
Overall, I think yes. A framework should be used. But what type of framework? that is the more important question.
The framework you use should be small, small enough so you can truly get to understand it. Small enough to only contain the elements that you really need. However, it should have a vibrant and responsive community. Now I don’t mind if the framework you use is an existing one or it is a framework you have developed for yourself. But if you have lovingly hand-crafted your own framework you should open source it. It is imperative that the framework you use must have a community. A community to find and fix bugs, to keep the code clean and optimised. To document and battle-harden.
You must either find a framework that is small and has a great community, or build the framework you need with a community to match.