7 ms·
However framework vulnerabilities offer a consistent attack surface which needs little analysis or tailoring. The only vulnerability we've seen (ms11-100) was
by meaty 14y ago
However framework vulnerabilities offer a consistent attack surface which needs little analysis or tailoring.
The only vulnerability we've seen (ms11-100) was swiftly dealt with and would have been eaten by our up front load balancers anyway.
Regarding our application, our test load is 134,000 test cases and 220,000 lines of assertions. I can sleep well at night.
- RyanZAG 14y agoI've got to ask: could you share what app or at least industry that app is in? I've never seen 134,000 test cases before for a web app, and 220,000 assertions to boot. What's the ratio of test cases to code? It sounds like a record to me!
- meaty 14y agoFinancial services. Test ratio is 1 test per 6 loc. Not a record. There are some seriously big apps behind closed doors. Its a different world to the public facing web.
- EwanToo 14y agoFacebook is composed of around 10 million lines of code [1] - the public facing web is big. I've no doubt Google looks at that and thinks it's almost trivially small (Chromium alone is 6.5 million lines [2]). There's big apps in private, but very few companies are at that scale. 1 - http://www.quora.com/How-large-is-Facebooks-codebase http://www.quora.com/How-large-is-Facebooks-codebase 2 - http://www.ohloh.net/p/chrome http://www.ohloh.net/p/chrome
- joseph_cooney 14y agoI've worked in a number of medium to large financial institutions, and 10M LOC is nothing, really. They had subsystems that were bigger than that by a factor of 2.
- meaty 14y agoyes one of our 3rd party quoting engines' source tops 20mloc of java. Facebook is a really simple project compared to most of these sort of things.
- PommeDeTerre 14y agoI have to wonder how many of those tests are merely performing the kinds of checks that the compiler would automatically perform were a compiled language like, say, C# or Java being used instead of Ruby.
- meaty 14y agoIt's written in c#!
- gregors 14y agoJust so that you do realize you have not proven that a bug nor a vulnerability exists - just the behavior of the current system.
- meaty 14y agoYes this is true but we proactively approach the problem rather than waiting for 3rd parties to find the holes. We are responsible for a couple of patch Tuesdays :)