3 ms·

I don't understand... The article first analyzes apps that use a certain number of vulnerable gems. Sure, most of them are probably patched, but it doesn't chan

• crazydoggers 12y ago
  > Sure, most of them are probably patched, but it doesn't change the fact that certain apps use old unpatched versions of these gems Why is that news?? That is true across every and all software platforms. > In what way any of it is misleading? Because the article assumes or implies the conclusion that there are a huge number of vulnerable Rails apps. The only way to discover that is to not simply count how many CVEs have been issued for each gem, but how many systems in production have not been patched. From the comments here, many people seem to assume this is an analysis of the number of unpatched vulnerable systems in production, which it most definitely is not.
  • smsm42 12y ago
    The news is quantifying what qualitatively is expected.
  • vasinov 12y ago
    > Why is that news?? It's not exactly news but it's nice to see it broken down in a cohesive way. > Because the article assumes or implies the conclusion that there are a huge number of vulnerable Rails apps. I think the article quite clearly indicates where all data points came from (Hakiri Facets) and then analyzes them. There is a post scriptum at the end that encourages readers to not evaluate their or any other projects based on the number of CVE vulnerabilities and goes into detail why it's not always a great idea.