4 ms·

Are you basing this on how often the vulnerabilities get reported and upvoted on HN? http://www.hnsearch.com/search#request/submissions&q=django+security&start

Are you basing this on how often the vulnerabilities get reported and upvoted on HN? http://www.hnsearch.com/search#request/submissions&q=django+security&start=0 http://www.hnsearch.com/search#request/submissions&q=dja... Django has had its fair share of patches. This is no reflection on the quality of the project, as it shouldn't be for any sufficiently complicated framework (like Rails). I also think the vulnerabilities are similar enough to suggest that the first one gave valid reason to ensure the same issue doesn't occur elsewhere. Rather than dusting these issues under the rug or silently fixing them, they're being responsibly reported with patches and updates provided at the same time. This doesn't seem like broken process to me.

sandofsky 14y ago
No. I'm basing it on this database: http://www.cvedetails.com/vulnerability-list/vendor_id-12043/product_id-22568/Rubyonrails-Ruby-On-Rails.html http://www.cvedetails.com/vulnerability-list/vendor_id-12043... http://www.cvedetails.com/vulnerability-list/vendor_id-10199/product_id-18211/Djangoproject-Django.html http://www.cvedetails.com/vulnerability-list/vendor_id-10199... Django has 16 vulnerabilities of the DoS, XSS, and CSRF variety. Rails has 37. In addition to DoS, XSS, and CSRF, it has SQL injection and code execution. That we keep seeing similar vulnerabilities suggests the problem is systemic. Giving them praise for not sweeping these under the rug is giving someone praise for not being a sociopath.
- yannski 14y ago
  So what does that mean ? That Rails is twice as popular as Django ?