4 ms·

Rails and security. Again. Sigh.

• bradleyland 14y ago
  If you're going to work in software, you had better get used to it. The difference between software with a CVE rap sheet and software without is that you know about the vulns in the software with the CVE rap sheet.
  • deleted 14y ago
    [deleted]
  • lhc- 14y ago
    You know about some of them, anyway.
    • bradleyland 14y ago
      Fair point. The larger picture is that while the number of CVEs certainly matters, what matters most is that the maintainers of the software maintain a record of quick turn around on patches and a welcoming attitude toward security researchers. IMO, Rails has done a better job of this recently, and that makes me really happy.