4 ms·
It isn't a bad thing necessarily. Just because the vulnerabilities haven't popped up in other frameworks doesn't mean they aren't there.
by PetrolMan 14y ago
It isn't a bad thing necessarily. Just because the vulnerabilities haven't popped up in other frameworks doesn't mean they aren't there.
- sandofsky 14y agoThat's creationist logic.
- navyrain 14y agoHardly the same. Lets not kid ourselves into thinking any of the popular software we use is bug-free, which is nigh impossible feat for any large codebase. If this rails bug had not been discovered, it would still be there.
- sandofsky 14y agoWho said software is bug free? The issue is that similar projects, with similar success, with a similar number of developers looking at them, have fewer severe vulnerabilities. The simplest explanation is that one project has more vulnerabilities lying dormant.
- btilly 14y agoNo, it is not. When a particular bit of code gets audited, you tend to find a bunch of holes. And any time you find a conceptual mistake that was made once in code, odds are that a careful audit will find it repeated. Everyone thinks that they are different, until it happens to them.