“There was a vulnerability with RubyGems.org, which allowed someone to execute code on the server,” a Ruby programmer I talked to said. “RubyGems is a big target, because if you could break in and change a Rails gem, you could gain access to a lot of servers.”

Popular sites such as Twitter, Groupon, Airbnb, and Hulu are built using Ruby on Rails, a framework built in the Ruby programming language. Ruby gems are packages of code that allow developers to distribute programs or libraries, and RubyGems.org is the central means the Ruby community has to publish and distribute those gems. Essentially, if a black hat hacker can corrupt those gems, he or she could potentially gain control of thousands, if not millions of sites around the world that run Ruby on Rails.

Source: https://gist.github.com/3e4829f79dbd1be11295

The exploit itself

“RubyGems is a critical part of the Ruby infrastructure,” the programmer said. “Everything depends on RubyGems.”

RubyGems explained the situation this way in a Google doc that site administrators set up for status updates:

A user uploaded a malicious gem that contained a malicious gem manifest (YAML file). The manifest contained embedded Ruby with this payload. This is the only known incident involving this vulnerability, but the vulnerability involved is a remote code execution exploit, so the usual rules apply.

The Ruby programmer I talked to, who did not want to be identified since he works with some of the key engineers at RubyGems and Heroku, said that the infected gem was executed by the server and then “emailed the database configuration details, including passwords, to a paste-it note on Pastie.org.”

As soon as Heroku became aware of the issue this morning, site administrators disabled access to site update and publishing services:

Ruby deploys have been temporarily disabled to protect our users from malicious gems. We will have more information available shortly, including a workaround for those who wish to deploy anyway.

Based on the information currently available, it doesn’t appear to have been an especially malicious attack, but rather a fairly strenuous way of informing the RubyGems organization that they had a vulnerability. The infected gem was called “exploit,” a pretty clear signal that the author or authors were not trying to slip something in unnoticed, and “they could have done more,” my source said.

Currently, RubyGems is verifying all files by comparing them for differences with older version before re-enabling all access to  functionality. The last update as of 7:30 PM PST is that the service’s classic API is up, as well as its V1 API, but its web application and Dependency API are still down.

photo credit: Andrew* via photopin cc

The past 12 months have been an exciting ride over here at DevBeat. We’ve had thrilling announcements, head-scratching corporate maneuvers, and more than a little bit of developer drama.

But as we prepare to take on 2013, we don’t want to offer just empty reflections on the year that’s passed. Rather, here are the big lessons we learned from the top developer news stories of 2012.

As always, we welcome your own reflections, stories, and lessons learned in the comments.

The Node hype cycle peaks

The year began with Node.js creator Ryan Dahl backing not-so-slowly away from the technology’s day-to-day operations inside Joyent, hinting on Twitter that he was a bit Node’d out. But as Node was passed into the hands of other caretakers, it was also gaining traction at larger companies and within larger applications. Walmart started using it. Google and Mozilla talked about how it can scale, and LinkedIn used it for its revamped mobile suite. And Yahoo used it to build a better mobile browser.

The story: “Also, let’s point out the obvious: For all these open-source programming technologies (PHP, Ruby, and now Node), there’s a killing to be made in offering enterprise-grade services and support for the more popular choices among them. And Node is nothing if not popular; late last year, Node eclipsed Ruby to become the most-watched repo on GitHub.”

The moral: Node is cool, sure, but it’s also grown-up enough for the enterprise and scaled apps.

The open-source hardware trend comes of age

After a good couple years of banging on its Open Compute Project, Facebook saw its project take flight this year, with new supporters in high places. And it wasn’t just Facebook; other companies started talking about open-source hardware and support for hardware hackers. From startups like Circuits.io and Upverter to the big guys with data centers to spare, everyone seems to be well on board with this trend — except Google, oddly enough.

The story: “‘Open Compute might evolve into a broader focus over time,’ said Facebook exec Frank Frankovsky. There’s a possibility that the same open-source workflow that’s being applied to this data center hardware might someday be applied to other networked devices and even mobile devices. Can you imagine, for example, how the community might work together to solve issues like cellphone battery life? ‘We might spread our wings,” Frankovsky concluded, ‘but for now, we want to stay focused on data centers, servers, and storage.’”

The moral: We should all care a little bit more about the energy it takes to process a click. And the answer isn’t fewer clicks; it’s collaborative work on energy-efficient hardware.

The lean startup ethic backfires

The tale of Curebit isn’t a pleasant one to recall. The young team of Y Combinator/500 Startups acolytes were doing their best to build a company the lean way, but they ended leaning a little too far toward outright theft. After getting caught red-handed stealing images, code, and even background music for their demo video, they were forced to publicly apologize, and their reputation was badly tarnished by the whole ugly episode.

The story: “On Twitter, some of the Internet’s more colorful personalities are currently battling it out in a war of colorful words. After the discovery, Ruby on Rails creator and thievery victim DHH called the Curebit team ‘fucking scumbags’ and Grant himself ‘a person of poor moral character.’”

The moral: Yes, Virginia, there is such a thing as a moral absolute. Even if you’re a cheap bastard.

The continuing war between responsive mobile web apps and nativists

No topic has been bandied about with more rancor than the mobile web — specifically, whether HTML 5-based mobile web applications can or ever will compete in terms of design and performance with native mobile applications.

After open-sourcing Ringmark, a first stab at a testing suite and standards for mobile browsers, Facebook seemed to be leading the charge to defend mobile web apps. And it had Mozilla, LinkedIn, Adobe, and a slew of others in tow. Then it released an all-native iPhone app, with Mark Zuckerberg saying that his company’s bet on the mobile web was all a huge mistake. It was basically the mobile web debate in a nutshell.

Like Facebook, we’re all still working and hoping for a better mobile web next year. And this time, we’re looking toward Mozilla’s die-hard mobile web guys to lead the charge.

The story: “You would think, given their identical aspirations, the three titans — Facebook, Yahoo, and Google — would pool their boundless resources to fast-track the mobile web from the janky, derided ghetto it is to the elegant utopia each of these parties sees in the near future. Yet they remain divided rather than collaborating, which means consumers lose and innovation stagnates.”

The moral: The mobile web is still a far-off ideal, but we’ll get there someday.

Twitter gives Ruby on Rails the kiss-off

Back in the summer of 2011, Twitter started quietly moving away from Ruby on Rails and toward Java/Scala. The “Ruby can’t scale” dictum had already grown tired in developer circles by then. But when Twitter faced its biggest challenge of scale to date — the 2012 presidential election — it held up beautifully. And Ruby on Rails was nowhere in sight. In talking with the company’s architecture demigods, we learned that Twitter’s capability to stay afloat during record-breaking traffic cost the company quite a bit, but its new architecture was the primary reason no fail whales were sighted that November night.

The story: “While Twitter used to see brief spikes during major media events, Twitter infrastructure VP Mazen Rawashdeh wrote today on the company blog that election night was a sustained, hours-long onslaught of activity. … ‘The bottom line: No matter when, where, or how people use Twitter, we need to remain accessible 24/7, around the world,’ said Twitter infrastructure VP Mazen Rawashdeh. ‘We’re hard at work delivering on that vision.’”

The moral: Dude. Your app is not Twitter-scale, and it probably never will be. Relax.

Twitter finally shuts down its API

And speaking of Twitter, the microblogging-service-that-could finally delivered on a two-year-old promise to stop giving away free candy vis-a-vis its API and the host of traffic-stealing Twitter clients built on said API. Since its first (and only) developer conference in 2010, Twitter had been gently pleading with developers to not build Twitter clients that duplicated the core Twitter experience. And it put teeth in those requests by buying up the Twitter clients it liked — namely, Tweetie and Tweetdeck. So when Twitter finally turned the garden hose off, so to speak, no one was surprised … right?

The story: “Twitter has put the kibosh on unofficial consumer clients for Twitter; the only loophole is for apps that have 100,000 users or fewer. The Twheel team has just decided that to keep the app alive, they’re going to take that loophole. And in an Internet economy where eyeballs equal money, 100,000 users or fewer still meets our definition of ‘doomed.’ You can’t raise funding on 100,000 users, and you can’t sell ads against 100,000 users — not enough ads to support a whole company, anyhow.”

The moral: This should have happened a long time ago, but better late than never — at least for Twitter’s business.

The “learn to code” craze

By far, our favorite ongoing story of the year has been normal people learning how to code. It’s been equally exciting to watch the crop of code-teaching startups spring up, get funding, and acquire huge numbers of users — and even revenue. From Codecademy to Treehouse to Bloc to Code School to Hackbright, we love how nerdy developers are showing everyone “the man behind the curtain” and proving that anyone — even women, even underprivileged kids, even poor folks — can improve their circumstances or understand the Internet better with a little effort and a little intelligence.

The story: “Jalen Rose is a year-old institution located in the northwest part of Detroit, where high school diplomas are not the norm in many students’ families and social spheres. Currently, only 32 percent of Detroit high school students graduate in four years. In a recent conversation with Treehouse founder and web guru Ryan Carson, we learned that Carson sees Treehouse (and coding education in general) as a world-changing stepping stone for underserved kids who can’t afford to — and maybe don’t need to — go to college.”

The moral: The world is a better place when users become builders and learn that code is not magic.

Image credits: konstantynov/Shutterstock, Ioannis Pantzi/Shutterstock, Jolie O’Dell/Flickr, Rafael Edwards/Flickr, lightpoet/Shutterstock

---

Big Data and Predictive/Real-time Analytics startups: Are you looking to jumpstart development & accelerate market traction? Sign up for the SAP Startup Focus program to receive technology, support, resources and community to help you develop new applications on SAP HANA, a cutting edge database platform. Get started here, and enter promo code “VB2013″ on the form.

---

This sponsored post is produced by StackSocial.

Have you ever want to learn a programming language but just haven’t known where to begin? Not only that, but you’re not sure how much time it will take – or if you have the time to invest? And just how challenging is it to learn a language like Ruby on Rails?

VentureBeat has a deal that answers all of those questions. It’s a tutorial called Ruby on Rails: a Programmer’s Best Friend, and it can be yours for just $59 – but only for a limited time. This Ruby on Rails tutorial for beginners is the perfect comprehensive video guided tour of modern Rails web development.

With this course you’ll get a grasp on the newest, most effective approach to web development as Micheal Hartl walks you through the entire Rails development process: installing and setting up Rails, designing Rails applications with MVC and REST, building dynamic pages, coding effectively in Ruby, implementing registration and authentication, adding social features, even testing and deployment.

Here are the key features of the course:

• Over 14 lectures and 19.5 hrs of content!
• Master core Rails concepts including the Model View Controller design pattern
• Learn how to master key Rails techniques, including REST, security, data modeling, messaging, and more
• Also covers RSS, search, caching, social features, performance, testing, refactoring and real-world deployment

Who is this course ideal for?

• Experienced web developers who are new to Rails
• JavaScript and other scripting language programmers who want to learn Rails
• Java programmers eager to master web application

The instructor behind this course is Michael Hartl. Hartl is a programmer, educator, and entrepreneur. He was co-author of RailsSpace, a Rails tutorial book published in 2007, and was co-founder and lead developer of Insoshi, a popular social networking platform in Ruby on Rails.

So if you’re looking to get into the basics of Ruby on Rails and don’t want to dig too deep into your wallet to do so, this course can’t be beat. Grab this VentureBeat Store offer while you can!

---

Big Data and Predictive/Real-time Analytics startups: Are you looking to jumpstart development & accelerate market traction? Sign up for the SAP Startup Focus program to receive technology, support, resources and community to help you develop new applications on SAP HANA, a cutting edge database platform. Get started here, and enter promo code “VB2013″ on the form.

---

Like Emperor Julius Caesar, BritRuby was brought down by white males and the Ides of March.

Scheduled for March 15 and 16th of 2013, this event which planned to bring together members of the global Ruby on Rails community for a summit in Manchester, England , is now canceled.

The intent was to hold a two-day conference with 500 developers and 20 speakers. A post on the company’s web page announcing the cancellation focuses on making apologies, rather than the details of the decision, and makes a few vague references to issues of race and gender equality.

“The Ruby community has been battling with issues of race and gender equality,” the post said .”We at BritRuby were well aware of this fundamental and important issue. This was one of the reasons why we encouraged everyone to submit a speaker proposal. Sadly, BritRuby was used as the arena to air these issues on Twitter and this has fundamentally destroyed any chance we had of addressing these issues. Instead the community should have worked together and allowed us to bring these issues to light at the conference. How can the community address these issues if every time someone tries they are shot down and accused of such awful things?”

A foray into the Twitter-verse revealed negative commentary because the speaker line up was entirely comprised of white males. The organizational team responded to these comments by saying they could not find qualified speakers outside the realm of white male. Debate ensued surrounding issues of discrimination, sexism and racism in the technology community, and whether it is better to have a “token female” or people without strong English abilities speaker, simply to diversify the attendees.

The decision to cancel the entire event seems dramatic, considering it its based primarily on a few negative tweets. Now, no-one of any background will be able to benefit from the events’ intention, which was to “to encourage Ruby developers to unite and create a community, which would allow such to network, exchange ideas and provoke innovation for the future of Ruby. We wanted to encourage jobs and allow companies the opportunity to meet the community and primarily boost the UK developer industry.”

It is quite a blow, for a startup economy that is just starting to take off. Perhaps the founders of BritRuby should pivot and hold an all-female hackathon. Than for BritRuby 2014, they may have a better chance.

---

Big Data and Predictive/Real-time Analytics startups: Are you looking to jumpstart development & accelerate market traction? Sign up for the SAP Startup Focus program to receive technology, support, resources and community to help you develop new applications on SAP HANA, a cutting edge database platform. Get started here, and enter promo code “VB2013″ on the form.

---

A certain kind of developer loves to hate on PHP. They are really going to hate where PHP’s custodians are taking it next.

PHP was created by Danish programmer Rasmus Lerdorf in 1995. In 1997, Israeli programmers Andi Gutmans and Zeev Suraski rewrote the parser, creating the base for PHP 3. By 1999, they had built the Zend Engine, which is still the interpreter for PHP.

Update October 18: Andi Gutmans just gave us more details about where PHP is going in mobile.

Gutmans and Suraski continued their partnership with Zend Technologies, a commercial entity that creates add-on products and services for PHP developers, particularly developers in the enterprise.

Today, after multiple massive iterations to the codebase, 35 percent of web traffic is handled by PHP, says Gutmans. Wikipedia says 75 percent of websites use PHP. Facebook, Wikipedia, Yahoo, and Photobucket are all built in PHP. WordPress, the most popular blogging platform in the world, runs on PHP and probably accounts for half of that 35 percent. Most of the other major content management systems, such as Drupal and Joomla, are also built in PHP.

No respect?

Still, the language can’t seem to get any respect and has been derided for years by programmers coding in C, Java, .NET, Python, or Ruby. In terms of trends, PHP as a search term has been dropping for years, and the mobile app revolution has led to the revival of Objective-C and Java.

So is the programming language that powers so much of the web disappearing gently into the night?

Not if Gutmans has anything to say about it. VentureBeat talked to him about PHP and the future, and he’s more bullish than ever, especially when it comes to the mobile-focused ace up his sleeve.

Riding the U.S.S. Enterprise

“All dynamic languages are gaining share from Java and .NET right now,” says Gutmans. “We’re getting a lot of benefit.”

Source: Wikipedia

Andi Gutmans

So the noise around trendier technologies like Ruby on Rails or Node.js doesn’t especially bother him. Mindshare is nice, of course, but market share is nicer. And market share is what Gutmans is focused on, especially in the enterprise.

“From a maturity point of view,” Gutmans told me, “I don’t think any other dynamic language right now has the full tool set. Our competition is Java and .NET … never with other dynamic languages.”

While he likes what Ruby on Rails is doing, and thinks there are some things there that PHP can learn and grow from, Gutmans points to PHP’s massive support in packaged solutions like WordPress, Drupal, and Magento.

“We’re better off than we were eight years ago … today we’re the only ones who have really hit the mainstream enterprise,” says Gutmans. “We do believe that the momentum and the size of PHP will continue. We don’t see it slowing down right now.”

Gutmans speaks with the enthusiasm of a founder; of course, there are other companies catering to the PHP-related needs of the enterprise. But Zend remains one of the biggest and best-known, especially due to its provenance.

And he’s got a point: Two-thirds of developers in a recent study reported spending half their time in PHP. And in a recent study by Rails developer Marc Gayle, half of all developer job postings on Craigslist call for PHP developers. When I talked to Gayle, he surmised the reason might be PHP’s super-popular content management systems.

“I think that is skewing the results,” he said. “But I can’t be sure.”

And a mysterious mobile story, coming soon

When it comes to mobile apps, Gutmans sides with the likes of JavaScript creator Brendan Eich in a firmly held belief that the web and web languages will eventually catch up and win out over native stacks.

But, he hinted to me, PHP and Zend will be providing client-side app-enabling tools.

Gutmans declined to comment further, saying he would only announce the full details at Zend’s conference in late October. However, it sounds like PHP will have a mobile app story of some sort, in spite of being the web’s predominant server-side language.

What that looks like and how it will be distributed is still mysterious. But a strong mobile story, says Gutmans, will only help PHP continue to grow.

It’s hard to argue with that.

photo credit: Red Bonzai

---

Big Data and Predictive/Real-time Analytics startups: Are you looking to jumpstart development & accelerate market traction? Sign up for the SAP Startup Focus program to receive technology, support, resources and community to help you develop new applications on SAP HANA, a cutting edge database platform. Get started here, and enter promo code “VB2013″ on the form.

---

It seems that four days ago Homakov tried to alert the folks behind Rails, one of the most popular programming languages, and the one used to create Github itself, about the security flaw. There was some back and forth for a day, and eventually the powers that be decided to close the thread, writing that “There was a proposal about changing that flag in #4062 and the consensus is the pros of the default configuration outweigh the pros of the alternative.”

But Homakov was’t going to go down without a fight. Since he couldn’t get things fixed through the proper channels, he decided to use the exploit himself. He used the loophole to give himself access to Ruby on Rails code repository and left a message confirming that any project on Github was indeed vulnerable. He didn’t change any code or do anything malicious.

When Github saw what happened, they suspended Homakov’s account, which created a firestorm of protest. A blog post entitled, Github, You Have Let Us All Down shot to the top of Hacker News, the world’s biggest news board for programmers. Github users threatened to pack up their projects and head to alternative services, claiming they felt vulnerable to hackers and betrayed by the response.

In the end, Github restored Homakov’s account and issued a public apology. It was a reminder that Github, which has become the defacto platform for collaborative coding, needs to take security very seriously. Software engineers often use their Github accounts as resumes when applying for jobs, so they have to feel their work is safe from tampering.

It was also an example of when the wisdom of the crowd got things wrong. Github exemplifies the benefits of open, collaboration. In this case, though, the wisdom of the crowds got things wrong, and it took a single contrarian, willing to work by any means to necessary, to show the community the danger they were in.

---

Big Data and Predictive/Real-time Analytics startups: Are you looking to jumpstart development & accelerate market traction? Sign up for the SAP Startup Focus program to receive technology, support, resources and community to help you develop new applications on SAP HANA, a cutting edge database platform. Get started here, and enter promo code “VB2013″ on the form.

---

Heroku helps developers streamline their Ruby on Rails web-based applications. Once a developer builds their app, they can launch it on Heroku, which then adjusts things like computing capacity and storage as needed. The community has more than 1 million developers and around 105,000 applications. Last fall, it started integrating with other services. For example, a company could launch their application on Heroku and then monitor it using services from another Rails startup, New Relic.

The company also recently raised a round of funding worth $10 million in May and has raised $15 million total after it was incubated by Y Combinator. The round was led by Ignition Partners, with participation from existing investors Redpoint Ventures, Baseline Ventures, and Harrison Metal Capital.

It’s a pretty sizable exit for a company that was founded in 2007, and another testament to how important cloud computing has become for a public company like Salesforce to pay out more than $200 million. It’s also another indication of a shift in Salesforce’s strategy to focus more on developers, as Heroku specializes in removing headaches for developers working with Ruby on Rails. Salesforce already works with VMforce, which similarly helps Java developers run their applications natively on Salesforce’s cloud application environment Force.com.

While Powerset gears up to release its search engine publicly later this year, it hopes to nurture an army of 50,0000 early testers, or “Powerlabbers,” to bang on different parts of it beforehand — the idea being that the converts will not only improve the product, but will help push it at launch.

To lure those volunteers, Powerset seeks to produce a hail of fun projects for them to work on — more on this below.

As reported, Powerset is significant because its search engine aims to understand phrases — not merely words, as Google does. Powerset’s approach is potentially powerful. However, it requires significant mass education before people change the keyword-like search habits.

Earlier this week, we spent another hour and a half with Powerset to learn about their latest progress. It is still secretive, but it is planning to open considerably over coming weeks.

For the testing phase, Powerset aims to stick volunteer testers on bite-sized pieces of its search problem. It is homing in on sixteen different topical areas – ranging from entertainment to travel and porn – and in each of these areas wants users to provide feedback on its results.

So for example, in the area of entertainment, if a user asks: “Who won an academy award in 2001?” Powerset finds that easy. It will produce answers like Halle Berry, who won the award for Monster’s Ball (see image below). But if you ask “What is the most recent movie Halle Berry started in?” the engine may break down. Powerset tracks the range of questions posed by users, which creates feedback about what is and isn’t working. That way, Powerset hopes to prepare in key, popular topical areas before launch.

.

Take another example, travel. See below for the topical page. Volunteers suggest ideas for useful search themes, and they vote to push the best ideas to the top.

A sign of Powerset’s readiness to think differently is its approach to Web architecture. Powerset will base its site on Ruby on Rails, a new, edgy framework liked by engineers for its nimbleness. But Ruby is controversial because some say it can’t handle vast amounts of traffic efficiently. Few big-traffic sites have built upon it.

The company which released the framework, 37Signals, has used it for four applications, including its popular Basecamp. CNET’s Chow and Chowhound – and most recently by popular messaging site, Twitter, are also built on it.

Powerset chose the framework after considerable research. Nine of Powerset’s team of 66 are working on it (Kevin Clark, the project leader, posted about the decision here).

This is not a company led by one or two brilliant co-founders. Rather, it is a team of now dozens of engineers — who to the outsider seem to share a single quality, a sort of wide-eyed, ebullient confidence, embodied by the relentlessly upbeat chief executive himself, Barney Pell. His two co-founders, Steve Newcomb and Lorenzo Thione, share the same trait. Or, if they have doubts, they try not to show it. That’s why they may pull something off.

Natural language search, as Powerset’s approach is called, faces an enormous challenge. The sheer number of phrases and semantic senses that can be intended by searchers is overwhelming.

Breaking it off in bits makes sense.

Powerlabs, the name given for the topical test features, launches in September, and is taking sign-ups now.

Powerset will specifically target high-school teachers for training on how to use its search engine. If they are recruited, they’ll impart their knowledge to students.

In return, Powerset hopes to get feedback on its main search engine. See below for example of a query: “Who proved Fermat’s last theorem?” Powerset provides a big blue feedback box. This way, if Powerset provides a poor result, testers can alert Powerset’s engine to the shortcoming.

Powerset is also working with databases to fill its result pages with more information. We’ve been told Powerset has partnered with MetaWeb’s Freebase (first reported by Techcrunch, which misspelled the name), though Powerset wouldn’t comment. In the entertainment example above, it pulls the “meta” information stored in Metaweb about Halle Berry into a widget. The widgets are useful, even if they’re not part of the main search engine technology. Powerset hopes to let bloggers embed the widgets into their blogs when they write about related material.

Another example of meta-data being used is on the result below about Steve Jobs and the iPod — you’ll see it pulls bio information and videos.

.