<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: RubyOnRails XSS Vulnerability Claims Twitter, Basecamp And My Confidence</title>
	<atom:link href="http://www.techcrunchit.com/2009/09/03/rubyonrails-xss-vulnerability-claims-twitter-basecamp-my-confidenc/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.techcrunchit.com/2009/09/03/rubyonrails-xss-vulnerability-claims-twitter-basecamp-my-confidenc/</link>
	<description>TechCrunching the Enterprise</description>
	<lastBuildDate>Wed, 17 Mar 2010 20:29:04 -0700</lastBuildDate>
	
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
		<item>
		<title>By: Week 36 in Review &#8211; 2009 &#124; Infosec Events</title>
		<link>http://www.techcrunchit.com/2009/09/03/rubyonrails-xss-vulnerability-claims-twitter-basecamp-my-confidenc/comment-page-1/#comment-14772</link>
		<dc:creator>Week 36 in Review &#8211; 2009 &#124; Infosec Events</dc:creator>
		<pubDate>Thu, 11 Feb 2010 10:42:19 +0000</pubDate>
		<guid isPermaLink="false">http://www.techcrunchit.com/?p=3500#comment-14772</guid>
		<description>[...] RubyOnRails XSS Vulnerability Claims Twitter, Basecamp And My Confidence &#8211; techcrunchit.com Today came news that an XSS vulnerability had been found in the RubyOnRails development framework. [...]</description>
		<content:encoded><![CDATA[<p>[...] RubyOnRails XSS Vulnerability Claims Twitter, Basecamp And My Confidence &#8211; techcrunchit.com Today came news that an XSS vulnerability had been found in the RubyOnRails development framework. [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Basecamp Review</title>
		<link>http://www.techcrunchit.com/2009/09/03/rubyonrails-xss-vulnerability-claims-twitter-basecamp-my-confidenc/comment-page-1/#comment-14666</link>
		<dc:creator>Basecamp Review</dc:creator>
		<pubDate>Wed, 20 Jan 2010 19:12:01 +0000</pubDate>
		<guid isPermaLink="false">http://www.techcrunchit.com/?p=3500#comment-14666</guid>
		<description>As a ruby developer and user of both Twitter and basecamp I appreciate you bringing this to our attention.</description>
		<content:encoded><![CDATA[<p>As a ruby developer and user of both Twitter and basecamp I appreciate you bringing this to our attention.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: WHAZUP &#8211; iPhone MMS, Android Market, Opera 10, Snow Leopard, Wetoku</title>
		<link>http://www.techcrunchit.com/2009/09/03/rubyonrails-xss-vulnerability-claims-twitter-basecamp-my-confidenc/comment-page-1/#comment-12926</link>
		<dc:creator>WHAZUP &#8211; iPhone MMS, Android Market, Opera 10, Snow Leopard, Wetoku</dc:creator>
		<pubDate>Mon, 07 Sep 2009 20:48:52 +0000</pubDate>
		<guid isPermaLink="false">http://www.techcrunchit.com/?p=3500#comment-12926</guid>
		<description>[...] Ruby On Rails XSS Vulnerability discovered Brian Masterbrook discovered a vulnerability on the uber-famous Ruby On Rails framework. The vulnerability impacted Twitter, Basecamp and the many applications written using Ruby On Rails. [...]</description>
		<content:encoded><![CDATA[<p>[...] Ruby On Rails XSS Vulnerability discovered Brian Masterbrook discovered a vulnerability on the uber-famous Ruby On Rails framework. The vulnerability impacted Twitter, Basecamp and the many applications written using Ruby On Rails. [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Tyler</title>
		<link>http://www.techcrunchit.com/2009/09/03/rubyonrails-xss-vulnerability-claims-twitter-basecamp-my-confidenc/comment-page-1/#comment-12909</link>
		<dc:creator>Tyler</dc:creator>
		<pubDate>Sun, 06 Sep 2009 10:22:40 +0000</pubDate>
		<guid isPermaLink="false">http://www.techcrunchit.com/?p=3500#comment-12909</guid>
		<description>4 days later and still no correction.  Keep it classy.</description>
		<content:encoded><![CDATA[<p>4 days later and still no correction.  Keep it classy.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Nikolay Kolev</title>
		<link>http://www.techcrunchit.com/2009/09/03/rubyonrails-xss-vulnerability-claims-twitter-basecamp-my-confidenc/comment-page-1/#comment-12899</link>
		<dc:creator>Nikolay Kolev</dc:creator>
		<pubDate>Sat, 05 Sep 2009 23:02:34 +0000</pubDate>
		<guid isPermaLink="false">http://www.techcrunchit.com/?p=3500#comment-12899</guid>
		<description>Twitter&#039;s front end is very simple. Probably it has more JavaScript nowadays than Ruby code - it&#039;s not a big effort to port it to Scala&#039;s &lt;a href=&quot;http://liftweb.net/&quot; rel=&quot;nofollow&quot;&gt;lift&lt;/a&gt;, for example, and standardize entirely on one technology.

Now, on the funny side... Ruby is being developed in Japan and historically has been having issues with Unicode that is designed to solve problems with non-English locales.</description>
		<content:encoded><![CDATA[<p>Twitter&#8217;s front end is very simple. Probably it has more JavaScript nowadays than Ruby code &#8211; it&#8217;s not a big effort to port it to Scala&#8217;s <a href="http://liftweb.net/" rel="nofollow">lift</a>, for example, and standardize entirely on one technology.</p>
<p>Now, on the funny side&#8230; Ruby is being developed in Japan and historically has been having issues with Unicode that is designed to solve problems with non-English locales.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Elton</title>
		<link>http://www.techcrunchit.com/2009/09/03/rubyonrails-xss-vulnerability-claims-twitter-basecamp-my-confidenc/comment-page-1/#comment-12882</link>
		<dc:creator>Elton</dc:creator>
		<pubDate>Sat, 05 Sep 2009 13:52:40 +0000</pubDate>
		<guid isPermaLink="false">http://www.techcrunchit.com/?p=3500#comment-12882</guid>
		<description>Some more insight into Twitter&#039;s architecture.

John Adams, &quot;Fixing Twitter: Improving the Performance and Scalability...&quot;

http://velocityconference.blip.tv/file/2300327/</description>
		<content:encoded><![CDATA[<p>Some more insight into Twitter&#8217;s architecture.</p>
<p>John Adams, &#8220;Fixing Twitter: Improving the Performance and Scalability&#8230;&#8221;</p>
<p><a href="http://velocityconference.blip.tv/file/2300327/" rel="nofollow">http://velocityconference.blip.tv/file/2300327/</a></p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Paolo</title>
		<link>http://www.techcrunchit.com/2009/09/03/rubyonrails-xss-vulnerability-claims-twitter-basecamp-my-confidenc/comment-page-1/#comment-12878</link>
		<dc:creator>Paolo</dc:creator>
		<pubDate>Sat, 05 Sep 2009 07:06:25 +0000</pubDate>
		<guid isPermaLink="false">http://www.techcrunchit.com/?p=3500#comment-12878</guid>
		<description>Depending on what application server you use you might have experienced XSS vulnerabilities with Java too. For example, this is one dating back to last July http://sunsolve.sun.com/search/document.do?assetkey=1-66-259588-1 on Sun Java System Web Server 6.1.
This one is of April, applying to Struts http://www.ca.com/us/securityadvisor/vulninfo/Vuln.aspx?ID=37269
Googling a little will find many more.</description>
		<content:encoded><![CDATA[<p>Depending on what application server you use you might have experienced XSS vulnerabilities with Java too. For example, this is one dating back to last July <a href="http://sunsolve.sun.com/search/document.do?assetkey=1-66-259588-1" rel="nofollow">http://sunsolve.sun.com/search/document.do?assetkey=1-66-259588-1</a> on Sun Java System Web Server 6.1.<br />
This one is of April, applying to Struts <a href="http://www.ca.com/us/securityadvisor/vulninfo/Vuln.aspx?ID=37269" rel="nofollow">http://www.ca.com/us/securityadvisor/vulninfo/Vuln.aspx?ID=37269</a><br />
Googling a little will find many more.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: pffft</title>
		<link>http://www.techcrunchit.com/2009/09/03/rubyonrails-xss-vulnerability-claims-twitter-basecamp-my-confidenc/comment-page-1/#comment-12877</link>
		<dc:creator>pffft</dc:creator>
		<pubDate>Sat, 05 Sep 2009 05:04:14 +0000</pubDate>
		<guid isPermaLink="false">http://www.techcrunchit.com/?p=3500#comment-12877</guid>
		<description>I wonder why I never had these problems... Oh that&#039;s right. I use java</description>
		<content:encoded><![CDATA[<p>I wonder why I never had these problems&#8230; Oh that&#8217;s right. I use java</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: sponge j</title>
		<link>http://www.techcrunchit.com/2009/09/03/rubyonrails-xss-vulnerability-claims-twitter-basecamp-my-confidenc/comment-page-1/#comment-12873</link>
		<dc:creator>sponge j</dc:creator>
		<pubDate>Sat, 05 Sep 2009 02:00:52 +0000</pubDate>
		<guid isPermaLink="false">http://www.techcrunchit.com/?p=3500#comment-12873</guid>
		<description>It is cute, techcrunch giving advice on development. Add this one, don&#039;t take development advice from techcrunch.

Anyone using RoR is foolish. Anyone sensible from that community bailed long ago. Funny you mention the disinterest of the basecamp guys, since they are &quot;the&quot; RoR guys. They mainly care about cash and ego. 

Last bit of advice, techcrunch, you should bail on your RoR systems, future fail comming for you.</description>
		<content:encoded><![CDATA[<p>It is cute, techcrunch giving advice on development. Add this one, don&#8217;t take development advice from techcrunch.</p>
<p>Anyone using RoR is foolish. Anyone sensible from that community bailed long ago. Funny you mention the disinterest of the basecamp guys, since they are &#8220;the&#8221; RoR guys. They mainly care about cash and ego. </p>
<p>Last bit of advice, techcrunch, you should bail on your RoR systems, future fail comming for you.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Brock Batsell</title>
		<link>http://www.techcrunchit.com/2009/09/03/rubyonrails-xss-vulnerability-claims-twitter-basecamp-my-confidenc/comment-page-1/#comment-12865</link>
		<dc:creator>Brock Batsell</dc:creator>
		<pubDate>Fri, 04 Sep 2009 16:44:51 +0000</pubDate>
		<guid isPermaLink="false">http://www.techcrunchit.com/?p=3500#comment-12865</guid>
		<description>Nik:

Care to explain why, after being informed 8+ hours ago that your last paragraph is completely factually incorrect, and seeming to acknowledge that fact, the piece still stands uncorrected?  That&#039;s absolutely insane.  The Rails security release doesn&#039;t even remotely say what you claim it does; simple reading comprehension would have disclosed that.</description>
		<content:encoded><![CDATA[<p>Nik:</p>
<p>Care to explain why, after being informed 8+ hours ago that your last paragraph is completely factually incorrect, and seeming to acknowledge that fact, the piece still stands uncorrected?  That&#8217;s absolutely insane.  The Rails security release doesn&#8217;t even remotely say what you claim it does; simple reading comprehension would have disclosed that.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: marcus</title>
		<link>http://www.techcrunchit.com/2009/09/03/rubyonrails-xss-vulnerability-claims-twitter-basecamp-my-confidenc/comment-page-1/#comment-12863</link>
		<dc:creator>marcus</dc:creator>
		<pubDate>Fri, 04 Sep 2009 16:03:35 +0000</pubDate>
		<guid isPermaLink="false">http://www.techcrunchit.com/?p=3500#comment-12863</guid>
		<description>Yes, classic case of &#039;who you know&#039;.  Ping a guy you know on the security team at Twitter = response.  Put in a support ticket like any other person = crickets.</description>
		<content:encoded><![CDATA[<p>Yes, classic case of &#8216;who you know&#8217;.  Ping a guy you know on the security team at Twitter = response.  Put in a support ticket like any other person = crickets.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: oops</title>
		<link>http://www.techcrunchit.com/2009/09/03/rubyonrails-xss-vulnerability-claims-twitter-basecamp-my-confidenc/comment-page-1/#comment-12861</link>
		<dc:creator>oops</dc:creator>
		<pubDate>Fri, 04 Sep 2009 15:36:44 +0000</pubDate>
		<guid isPermaLink="false">http://www.techcrunchit.com/?p=3500#comment-12861</guid>
		<description>almost as buggy as Omnidrive!</description>
		<content:encoded><![CDATA[<p>almost as buggy as Omnidrive!</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Saravanan</title>
		<link>http://www.techcrunchit.com/2009/09/03/rubyonrails-xss-vulnerability-claims-twitter-basecamp-my-confidenc/comment-page-1/#comment-12858</link>
		<dc:creator>Saravanan</dc:creator>
		<pubDate>Fri, 04 Sep 2009 15:20:52 +0000</pubDate>
		<guid isPermaLink="false">http://www.techcrunchit.com/?p=3500#comment-12858</guid>
		<description>and this vulnerability did not affect IE 8 thanks to its built-in XSS filter says Arstechnica
http://arstechnica.com/security/news/2009/09/ruby-on-rails-vulnerability-affects-twitter-ie8-immune.ars</description>
		<content:encoded><![CDATA[<p>and this vulnerability did not affect IE 8 thanks to its built-in XSS filter says Arstechnica<br />
<a href="http://arstechnica.com/security/news/2009/09/ruby-on-rails-vulnerability-affects-twitter-ie8-immune.ars" rel="nofollow">http://arstechnica.com/security/news/2009/09/ruby-on-rails-vulnerability-affects-twitter-ie8-immune.ars</a></p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Pete Austin</title>
		<link>http://www.techcrunchit.com/2009/09/03/rubyonrails-xss-vulnerability-claims-twitter-basecamp-my-confidenc/comment-page-1/#comment-12856</link>
		<dc:creator>Pete Austin</dc:creator>
		<pubDate>Fri, 04 Sep 2009 13:26:13 +0000</pubDate>
		<guid isPermaLink="false">http://www.techcrunchit.com/?p=3500#comment-12856</guid>
		<description>People don&#039;t only use Western European languages.</description>
		<content:encoded><![CDATA[<p>People don&#8217;t only use Western European languages.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Jonathan Cohen</title>
		<link>http://www.techcrunchit.com/2009/09/03/rubyonrails-xss-vulnerability-claims-twitter-basecamp-my-confidenc/comment-page-1/#comment-12854</link>
		<dc:creator>Jonathan Cohen</dc:creator>
		<pubDate>Fri, 04 Sep 2009 12:12:35 +0000</pubDate>
		<guid isPermaLink="false">http://www.techcrunchit.com/?p=3500#comment-12854</guid>
		<description>Ryanair would probably charge you $20 for the privilege of submitting a security report to them.</description>
		<content:encoded><![CDATA[<p>Ryanair would probably charge you $20 for the privilege of submitting a security report to them.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Rob Knight</title>
		<link>http://www.techcrunchit.com/2009/09/03/rubyonrails-xss-vulnerability-claims-twitter-basecamp-my-confidenc/comment-page-1/#comment-12853</link>
		<dc:creator>Rob Knight</dc:creator>
		<pubDate>Fri, 04 Sep 2009 12:00:50 +0000</pubDate>
		<guid isPermaLink="false">http://www.techcrunchit.com/?p=3500#comment-12853</guid>
		<description>It&#039;s still a bad argument.  Developers always have to assume that the code they&#039;re building on top of is secure.  RoR is just one layer in a stack that includes Rails, a web server, a database server, the Linux OS and possibly all kinds of other software/hardware for load balancing, caching, proxying and so on.  Yet nobody would suggest that it&#039;s wrong to run a web app on Linux unless you understand exactly how it works.  In fact, we generally measure technical progress by the number of things a person can do without having to understand exactly how they work.

RoR is widely adopted, both commercially and non-commercially, tested by many people in many circumstances, and provides security comparable with any other web framework, and substantially more security than the default &#039;no framework&#039; option.  It has flaws, just like the rest of the stack will have flaws, but fixing them is the responsibility of whoever maintains that level of the stack, not the people who use it.</description>
		<content:encoded><![CDATA[<p>It&#8217;s still a bad argument.  Developers always have to assume that the code they&#8217;re building on top of is secure.  RoR is just one layer in a stack that includes Rails, a web server, a database server, the Linux OS and possibly all kinds of other software/hardware for load balancing, caching, proxying and so on.  Yet nobody would suggest that it&#8217;s wrong to run a web app on Linux unless you understand exactly how it works.  In fact, we generally measure technical progress by the number of things a person can do without having to understand exactly how they work.</p>
<p>RoR is widely adopted, both commercially and non-commercially, tested by many people in many circumstances, and provides security comparable with any other web framework, and substantially more security than the default &#8216;no framework&#8217; option.  It has flaws, just like the rest of the stack will have flaws, but fixing them is the responsibility of whoever maintains that level of the stack, not the people who use it.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: itsnotvalid</title>
		<link>http://www.techcrunchit.com/2009/09/03/rubyonrails-xss-vulnerability-claims-twitter-basecamp-my-confidenc/comment-page-1/#comment-12852</link>
		<dc:creator>itsnotvalid</dc:creator>
		<pubDate>Fri, 04 Sep 2009 11:59:35 +0000</pubDate>
		<guid isPermaLink="false">http://www.techcrunchit.com/?p=3500#comment-12852</guid>
		<description>It is so true that white-listing is the real correct way on handling taunted data. Block everything, then open up things that get needed. Even if it would become too clumsy, it is just what developers have to live with.</description>
		<content:encoded><![CDATA[<p>It is so true that white-listing is the real correct way on handling taunted data. Block everything, then open up things that get needed. Even if it would become too clumsy, it is just what developers have to live with.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: RubyOnRails XSS Vulnerability Claims Twitter, Basecamp And My Confidence</title>
		<link>http://www.techcrunchit.com/2009/09/03/rubyonrails-xss-vulnerability-claims-twitter-basecamp-my-confidenc/comment-page-1/#comment-12850</link>
		<dc:creator>RubyOnRails XSS Vulnerability Claims Twitter, Basecamp And My Confidence</dc:creator>
		<pubDate>Fri, 04 Sep 2009 10:35:50 +0000</pubDate>
		<guid isPermaLink="false">http://www.techcrunchit.com/?p=3500#comment-12850</guid>
		<description>[...] By Techcrunch [...]</description>
		<content:encoded><![CDATA[<p>[...] By Techcrunch [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: nik</title>
		<link>http://www.techcrunchit.com/2009/09/03/rubyonrails-xss-vulnerability-claims-twitter-basecamp-my-confidenc/comment-page-1/#comment-12849</link>
		<dc:creator>nik</dc:creator>
		<pubDate>Fri, 04 Sep 2009 10:13:26 +0000</pubDate>
		<guid isPermaLink="false">http://www.techcrunchit.com/?p=3500#comment-12849</guid>
		<description>its about understanding the framework and what it does - not read howto + copy + paste</description>
		<content:encoded><![CDATA[<p>its about understanding the framework and what it does &#8211; not read howto + copy + paste</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: nik</title>
		<link>http://www.techcrunchit.com/2009/09/03/rubyonrails-xss-vulnerability-claims-twitter-basecamp-my-confidenc/comment-page-1/#comment-12848</link>
		<dc:creator>nik</dc:creator>
		<pubDate>Fri, 04 Sep 2009 10:11:45 +0000</pubDate>
		<guid isPermaLink="false">http://www.techcrunchit.com/?p=3500#comment-12848</guid>
		<description>&quot;your gonna be ok!&quot; :)</description>
		<content:encoded><![CDATA[<p>&#8220;your gonna be ok!&#8221; :)</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Peter Smith</title>
		<link>http://www.techcrunchit.com/2009/09/03/rubyonrails-xss-vulnerability-claims-twitter-basecamp-my-confidenc/comment-page-1/#comment-12847</link>
		<dc:creator>Peter Smith</dc:creator>
		<pubDate>Fri, 04 Sep 2009 09:48:02 +0000</pubDate>
		<guid isPermaLink="false">http://www.techcrunchit.com/?p=3500#comment-12847</guid>
		<description>not sure why Twitter gets off the hook. they took days to respond. didn&#039;t respond. and then only responded when a security employee was contacted directly. is that supposed to inspire confidence?</description>
		<content:encoded><![CDATA[<p>not sure why Twitter gets off the hook. they took days to respond. didn&#8217;t respond. and then only responded when a security employee was contacted directly. is that supposed to inspire confidence?</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Steve</title>
		<link>http://www.techcrunchit.com/2009/09/03/rubyonrails-xss-vulnerability-claims-twitter-basecamp-my-confidenc/comment-page-1/#comment-12845</link>
		<dc:creator>Steve</dc:creator>
		<pubDate>Fri, 04 Sep 2009 09:36:46 +0000</pubDate>
		<guid isPermaLink="false">http://www.techcrunchit.com/?p=3500#comment-12845</guid>
		<description>A framework makes development a heck of a lot easier, and saves an incredible amount of time.

Thousands of people use off-the-shelf identikit Wordpress installs and noone ever complains, yet someone goes off on their own to code their own site+application using a base framework that merely undertakes the most menial of tasks, and you complain that they&#039;re not &quot;real developers&quot;.
Why reinvent the wheel?

I also *highly* doubt that a single developer or small development team would be able to code something more secure that RoR first time (unless they were actively focusing on the security issue).
Every platform has security issues, we can only ever delay hackers, never stop them.</description>
		<content:encoded><![CDATA[<p>A framework makes development a heck of a lot easier, and saves an incredible amount of time.</p>
<p>Thousands of people use off-the-shelf identikit Wordpress installs and noone ever complains, yet someone goes off on their own to code their own site+application using a base framework that merely undertakes the most menial of tasks, and you complain that they&#8217;re not &#8220;real developers&#8221;.<br />
Why reinvent the wheel?</p>
<p>I also *highly* doubt that a single developer or small development team would be able to code something more secure that RoR first time (unless they were actively focusing on the security issue).<br />
Every platform has security issues, we can only ever delay hackers, never stop them.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Paolo</title>
		<link>http://www.techcrunchit.com/2009/09/03/rubyonrails-xss-vulnerability-claims-twitter-basecamp-my-confidenc/comment-page-1/#comment-12844</link>
		<dc:creator>Paolo</dc:creator>
		<pubDate>Fri, 04 Sep 2009 09:24:15 +0000</pubDate>
		<guid isPermaLink="false">http://www.techcrunchit.com/?p=3500#comment-12844</guid>
		<description>Nik, thanks for the info. I just patched a server of mine waiting for the official release.</description>
		<content:encoded><![CDATA[<p>Nik, thanks for the info. I just patched a server of mine waiting for the official release.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Paolo</title>
		<link>http://www.techcrunchit.com/2009/09/03/rubyonrails-xss-vulnerability-claims-twitter-basecamp-my-confidenc/comment-page-1/#comment-12843</link>
		<dc:creator>Paolo</dc:creator>
		<pubDate>Fri, 04 Sep 2009 09:22:07 +0000</pubDate>
		<guid isPermaLink="false">http://www.techcrunchit.com/?p=3500#comment-12843</guid>
		<description>They started using Scala for some background jobs and liked it. 

This is an interview to the Twitter team
http://www.artima.com/scalazine/articles/twitter_on_scala.html

Quoting from that article: &quot;We find Ruby and Scala are very complementary. We use Ruby, actually specifically Rails, for things that it is very strong at. All the front end stuff that it does very well. [...] our plan for the long run is to move more and more of our architecture into Scala. The vast majority of our traffic is API requests, and we want most of those to be served by Scala, either at an edge cache layer or a web application layer. Hopefully by the end of 2009 the majority of users’ interactions with Twitter are going to be Scala-powered. &quot;

Don&#039;t know at which point they are now but it seems to me that the front end (that is, the HTML pages) will be served by Ruby on Rails for the time being.</description>
		<content:encoded><![CDATA[<p>They started using Scala for some background jobs and liked it. </p>
<p>This is an interview to the Twitter team<br />
<a href="http://www.artima.com/scalazine/articles/twitter_on_scala.html" rel="nofollow">http://www.artima.com/scalazine/articles/twitter_on_scala.html</a></p>
<p>Quoting from that article: &#8220;We find Ruby and Scala are very complementary. We use Ruby, actually specifically Rails, for things that it is very strong at. All the front end stuff that it does very well. [...] our plan for the long run is to move more and more of our architecture into Scala. The vast majority of our traffic is API requests, and we want most of those to be served by Scala, either at an edge cache layer or a web application layer. Hopefully by the end of 2009 the majority of users’ interactions with Twitter are going to be Scala-powered. &#8221;</p>
<p>Don&#8217;t know at which point they are now but it seems to me that the front end (that is, the HTML pages) will be served by Ruby on Rails for the time being.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: nik</title>
		<link>http://www.techcrunchit.com/2009/09/03/rubyonrails-xss-vulnerability-claims-twitter-basecamp-my-confidenc/comment-page-1/#comment-12842</link>
		<dc:creator>nik</dc:creator>
		<pubDate>Fri, 04 Sep 2009 09:20:43 +0000</pubDate>
		<guid isPermaLink="false">http://www.techcrunchit.com/?p=3500#comment-12842</guid>
		<description>there are some frameworks that will give you a set of functions where you can allow certain classes of input (eg. A-Za-z0-9, all alpha-num plus some punctuation, some html tags etc.) these can come in handy. key is everything off by default and then whitelist. i have a list of regexp&#039;s here i should post at some point - been using it for years.</description>
		<content:encoded><![CDATA[<p>there are some frameworks that will give you a set of functions where you can allow certain classes of input (eg. A-Za-z0-9, all alpha-num plus some punctuation, some html tags etc.) these can come in handy. key is everything off by default and then whitelist. i have a list of regexp&#8217;s here i should post at some point &#8211; been using it for years.</p>
]]></content:encoded>
	</item>
</channel>
</rss>
