3 ms·

Wouldn't be so sure of safety - RoR just gets a lot more publicity when a vulnerability surfaces, although the huge amount of magic involved in RoR makes vulner

by RyanZAG 14y ago

Wouldn't be so sure of safety - RoR just gets a lot more publicity when a vulnerability surfaces, although the huge amount of magic involved in RoR makes vulnerabilities more common than more static code. http://forums.asp.net/1233.aspx http://forums.asp.net/1233.aspx http://www.troyhunt.com/2012/04/67-of-aspnet-websites-have-serious.html http://www.troyhunt.com/2012/04/67-of-aspnet-websites-have-s... etc Besides, most web app vulnerabilities are coding flaws in the user code itself, and very rarely in the framework.

Encosia 14y ago
The difference is that things like enabling remote errors or disabling request validation in ASP.NET requires that you explicitly change those settings. The default config doesn't expose either of those issues.
- gregors 14y ago
  I've got a screen capture with bing showing me remote errors. People do make mistakes.
  - meaty 14y ago
    Bing are Microsoft dogfooding new tech. They will make mistakes. For those of us who are conservative there are very few opportunities to make mistakes. We have checklists, security policies, code reviews and even protection components in our framework as well as completely segregated web and back end systems.
  - Encosia 14y ago
    Of course people make mistakes. The point is that the framework doesn't expose you to those risks by default. You have to explicitly make those mistakes yourself. Further, when ASP.NET does have the odd vulnerability crop up, patches roll out automatically as critical updates via Windows Update. So, these things get patched quickly even if the app or server is no longer actively maintained, as is the case with so much code out there on every platform. Ironically, it's a bit like Windows Server is the Google Chrome of server environments when it comes to frequency and pervasiveness of updates.
meaty 14y ago
However framework vulnerabilities offer a consistent attack surface which needs little analysis or tailoring. The only vulnerability we've seen (ms11-100) was swiftly dealt with and would have been eaten by our up front load balancers anyway. Regarding our application, our test load is 134,000 test cases and 220,000 lines of assertions. I can sleep well at night.
- RyanZAG 14y ago
  I've got to ask: could you share what app or at least industry that app is in? I've never seen 134,000 test cases before for a web app, and 220,000 assertions to boot. What's the ratio of test cases to code? It sounds like a record to me!
  - meaty 14y ago
    Financial services. Test ratio is 1 test per 6 loc. Not a record. There are some seriously big apps behind closed doors. Its a different world to the public facing web.
    - EwanToo 14y ago
      Facebook is composed of around 10 million lines of code [1] - the public facing web is big. I've no doubt Google looks at that and thinks it's almost trivially small (Chromium alone is 6.5 million lines [2]). There's big apps in private, but very few companies are at that scale. 1 - http://www.quora.com/How-large-is-Facebooks-codebase http://www.quora.com/How-large-is-Facebooks-codebase 2 - http://www.ohloh.net/p/chrome http://www.ohloh.net/p/chrome
      - joseph_cooney 14y ago
        I've worked in a number of medium to large financial institutions, and 10M LOC is nothing, really. They had subsystems that were bigger than that by a factor of 2.
        14y ago
deleted 14y ago
[deleted]

by RyanZAG 14y ago

Encosia 14y ago

The difference is that things like enabling remote errors or disabling request validation in ASP.NET requires that you explicitly change those settings. The default config doesn't expose either of those issues.

gregors 14y ago
I've got a screen capture with bing showing me remote errors. People do make mistakes.
- meaty 14y ago
  Bing are Microsoft dogfooding new tech. They will make mistakes. For those of us who are conservative there are very few opportunities to make mistakes. We have checklists, security policies, code reviews and even protection components in our framework as well as completely segregated web and back end systems.
- Encosia 14y ago
  Of course people make mistakes. The point is that the framework doesn't expose you to those risks by default. You have to explicitly make those mistakes yourself. Further, when ASP.NET does have the odd vulnerability crop up, patches roll out automatically as critical updates via Windows Update. So, these things get patched quickly even if the app or server is no longer actively maintained, as is the case with so much code out there on every platform. Ironically, it's a bit like Windows Server is the Google Chrome of server environments when it comes to frequency and pervasiveness of updates.

meaty 14y ago

However framework vulnerabilities offer a consistent attack surface which needs little analysis or tailoring. The only vulnerability we've seen (ms11-100) was swiftly dealt with and would have been eaten by our up front load balancers anyway. Regarding our application, our test load is 134,000 test cases and 220,000 lines of assertions. I can sleep well at night.

RyanZAG 14y ago
I've got to ask: could you share what app or at least industry that app is in? I've never seen 134,000 test cases before for a web app, and 220,000 assertions to boot. What's the ratio of test cases to code? It sounds like a record to me!
- meaty 14y ago
  Financial services. Test ratio is 1 test per 6 loc. Not a record. There are some seriously big apps behind closed doors. Its a different world to the public facing web.
  - EwanToo 14y ago
    Facebook is composed of around 10 million lines of code [1] - the public facing web is big. I've no doubt Google looks at that and thinks it's almost trivially small (Chromium alone is 6.5 million lines [2]). There's big apps in private, but very few companies are at that scale. 1 - http://www.quora.com/How-large-is-Facebooks-codebase http://www.quora.com/How-large-is-Facebooks-codebase 2 - http://www.ohloh.net/p/chrome http://www.ohloh.net/p/chrome
    - joseph_cooney 14y ago
      I've worked in a number of medium to large financial institutions, and 10M LOC is nothing, really. They had subsystems that were bigger than that by a factor of 2.
      - 14y ago

deleted 14y ago

[deleted]