3 ms·

But plenty of those vulnerabilities are not the fault of the language but the frameworks written by others. You can just as easily create SQL injection attacks

But plenty of those vulnerabilities are not the fault of the language but the frameworks written by others. You can just as easily create SQL injection attacks in a Rust program or Ruby program. You can just as easily introduce XSS/CSRF problems in any of them. Etc.

beatgammit 7y ago
> You can just a easily create SQL injection attacks in a Rust program I disagree, mostly on the grounds that string concatenation isn't very convenient, so it tends to be easier to do things "the right way" instead of hacking things together. Yes, you can do string concatenation using something like `format!(...)`, but at that point it's really similar to the correct solution that it's not really what you'd reach for by default. And yeah, the community here is a huge part of it, and IMO languages can and should be judged by their communities. If a language's community promotes insecure solutions, that's a language that I don't want to use at my company because I don't want my employees following that example.
Avamander 7y ago
If the majority of frameworks for a language are vunerable it's the language's fault. Python definitely doesn't have that issue, Rust and Go don't either.
- francislavoie 7y ago
  > majority of frameworks for a language are vunerable Where's your proof? Modern PHP frameworks are secure by default.
  - Avamander 7y ago
    We're talking about the majority of frameworks that are being used, not about some newer versions 0.1% use. In the end arguing won't get neither of us anywhere, I get my livelihood from testing vulnerable software and you can keep writing software in PHP.
    - jtreminio 7y ago
      Majority of frameworks in use are: Symfony Laravel CodeIgniter CakePHP Yii Zend Slim All of these can (and recommend) using either PDO with named parameters, or a full ORM for SQL work. Most came packaged with a PDO (Doctrine, mostly) by default but have always supported whatever you wanted to use. Write shit code, win shit prizes.

beatgammit 7y ago

> You can just a easily create SQL injection attacks in a Rust program I disagree, mostly on the grounds that string concatenation isn't very convenient, so it tends to be easier to do things "the right way" instead of hacking things together. Yes, you can do string concatenation using something like `format!(...)`, but at that point it's really similar to the correct solution that it's not really what you'd reach for by default. And yeah, the community here is a huge part of it, and IMO languages can and should be judged by their communities. If a language's community promotes insecure solutions, that's a language that I don't want to use at my company because I don't want my employees following that example.

Avamander 7y ago

If the majority of frameworks for a language are vunerable it's the language's fault. Python definitely doesn't have that issue, Rust and Go don't either.

francislavoie 7y ago
> majority of frameworks for a language are vunerable Where's your proof? Modern PHP frameworks are secure by default.
- Avamander 7y ago
  We're talking about the majority of frameworks that are being used, not about some newer versions 0.1% use. In the end arguing won't get neither of us anywhere, I get my livelihood from testing vulnerable software and you can keep writing software in PHP.
  - jtreminio 7y ago
    Majority of frameworks in use are: Symfony Laravel CodeIgniter CakePHP Yii Zend Slim All of these can (and recommend) using either PDO with named parameters, or a full ORM for SQL work. Most came packaged with a PDO (Doctrine, mostly) by default but have always supported whatever you wanted to use. Write shit code, win shit prizes.