Bill Katz

RailsConf 2006 was one concentrated dose of Ruby and Rails goodness. I went through my talk a bit faster than expected. If you are looking for the slides, they are posted over at Writertopia. I plan on writing a lengthy article based on the talk to flesh in many points I skipped or glossed over.

The Authorization plugin has been getting a lot of love for the last two weeks. I stupidly labelled the pre-RailsConf release as "1.0 release candidate 1." Now I'm hacking things up, adding lots of sugar, and maybe merging an outside contribution into the code base. The differences between the release candidates will be closer to version changes than simple code stabilization. Oh well. Better to hack and release than worry about looking like a fool...

A new version of the Authorization plugin is available, just in time for RailsConf. A detailed description is available on the development page at Writertopia. An "Identity" plugin will soon be up as well.

(Updated 6/21) Please see the main Authorization plugin page for updated information.

(Updated 2/22) This treatise describes three aspects of an Authorization plug-in for Rails:

• a proposed domain-specific language (DSL) for authorization,
• a pattern for use that describes conventions, and
• a reference implementation that lets you test the ideas.

The authorization process decides whether a user is allowed access to some feature. It is distinct from the authentication process, which tries to confirm a user is authentic, not an imposter. There are many authentication systems available for Rails, e.g., acts_as_authenticated, salted_password, and LoginEngine. The Authorization plug-in only requires that the authentication system provides a current_user method, which returns an object that fulfills a few methods (explained below). Ruby's duck typing is our friend.

The founders of Reddit, a poster-child for web app development with Lisp, decided to rewrite their site using Python. The collective cries from the Lisp community are deafening. And the Ruby on Rails followers are wondering, "Why not Ruby?"

Aaron Swartz provides some insight into the Reddit move and why his web.py project was selected over Django. Web.py will be used by two of the startups (Reddit and Swartz's Infogami) from Paul Graham's Y Combinator.