3 ms·

All the time: SQLi, XSS, arbitrary file upload, ...

• tedunangst 12y ago
  The fun part is that when you find a language/framework that (e.g.) deserializes data by running eval(), it's so much easier to write portable exploits. 32 bit, 64 bit, x86, arm, mips, aslr? None of that matters. Literally eval(system("/bin/sh")) and done.
• MichaelGG 12y ago
  XSS is a totally different level. When's the last time a bunch of networked devices needed patches because of XSS? And even if these problems were as widespread, eliminating a huge class of errors is a big step up. Nearly every serious vulnerability in Microsoft's code for the past years is from memory unsafeness. Hell, why bother with malaria or smallpox vaccines, since people just die from something else anyways.
  • peterwwillis 12y ago
    The answer to your question is "all the time", because most new appliances are using more high level languages and xss-prone interfaces. This also ignores all the ones that don't get found/fixed. Of course we should work to eliminate problems, but you have to consider the bigger picture and whether abandoning the language is worth it. So far the pros outweigh the few unique cons.