5 ms·

If everyone is really going to take the route of "My X Framework is fine b/c nothing's been reported" then I'd like to contribute these links showing vulnerabil

• justsee 14y ago
  Interesting. Rails: numerous code execution and SQL injection vulnerabilities reported over the years. Django: no code execution or SQL injection vulnerabilities reported.
  • sil3ntmac 14y ago
    (yet).
    • tedunangst 14y ago
      To be honest, rails does seem to be going out of its way to increase its attack surface.
• eric970 14y ago
  Thank you.
• glfomfn 14y ago
  You are shooting your own feet with these links you know. According to your data Django had -ZERO- sql injections & code execution repots, now compare that to RoR which had 6 sql injections & 3 code execution reports since 2009. Even if you went by just the numbers RoR had way more vulnerabilities, now if you also take in consideration the kind of vulnerabilities i can tell you i feel way safer on django than RoR. How many times did you have to stay up late at night to patch your framework ?
• mars 14y ago
  Lulz :) I mean ruby nailed it, right?
• mje__ 14y ago
  It was pretty interesting to see the all-time details for the languages: * Python [1,2] : 20 + 15 = 35 * Ruby [3,4] : 31 + 8 = 39 * PHP [5] : 336 Ouch :( [1] http://www.cvedetails.com/product/2147/Python-Software-Foundation-Python.html?vendor_id=1238 http://www.cvedetails.com/product/2147/Python-Software-Found... [2] http://www.cvedetails.com/product/18230/Python-Python.html?vendor_id=10210 http://www.cvedetails.com/product/18230/Python-Python.html?v... [3] http://www.cvedetails.com/product/12215/Ruby-lang-Ruby.html?vendor_id=7252 http://www.cvedetails.com/product/12215/Ruby-lang-Ruby.html?... [4] http://www.cvedetails.com/product/3861/Yukihiro-Matsumoto-Ruby.html?vendor_id=2211 http://www.cvedetails.com/product/3861/Yukihiro-Matsumoto-Ru... [5] http://www.cvedetails.com/product/128/PHP-PHP.html?vendor_id=74 http://www.cvedetails.com/product/128/PHP-PHP.html?vendor_id... edit:formatting
  • thingification 14y ago
    That seems a little unfair on PHP if taken at face value. I don't know PHP, but doesn't it come with things like database client libraries and templating? That's not really comparable with the core Python distribution. Presumably a fairer comparison would compare (Python + Django) with (Ruby + RoR) with PHP?
• postmodern_mod3 14y ago
  Vulnerability counts are misleading metric for security. They do not include the vulnerabilities which have not yet been discovered or created.
  • jpatokal 14y ago
    And you're proposing to get a less misleading metric for undiscovered or uncreated (!?) vulnerabilities how, exactly?
    • postmodern_mod3 14y ago
      Maybe graph the rate of vulnerabilities discovered vs. LoC/files added? It's safer to only use vulnerability counts as a metric for how interesting software is to security researchers.
• mikegioia 14y ago
  Wow, good for CodeIgniter.