Comment by joshwa | Hacker News Reader

Comment by joshwa | Hacker News Reader

Parent Full thread

Actual software:

http://www.cs.berkeley.edu/~jnear/derailer/

"Derailer uses an automatic static analysis to produce a visual representation of the information flows within a Ruby on Rails web application. The visualization organizes the results of the analysis in a tree, with the goal of helping the user to quickly find the most sensitive information flows, and also allows the user to filter the set of flows based on the conditions under which they occur."

http://www.cs.berkeley.edu/~jnear/rubicon/

"Rubicon is a library for Ruby, Rails, and RSpec that lets you write formal specifications of the behavior of your web apps. In addition to the standard RSpec language, Rubicon gives you the quantifiers of first-order logic, so your specifications cover all possible objects of the given type, and mock objects are no longer needed. "

The main one in the article:

http://www.cs.berkeley.edu/~jnear/space/

"SPACE is a specification-free tool for finding missing security checks in Ruby on Rails web applications using a catalog of access control patterns in which each pattern models a common access control use case. SPACE checks that for every kind of data exposure allowed by an application's code, some security pattern in our catalog also allows the exposure. The user provides a mapping from application types to the types of our catalog, and then SPACE identifies security bugs automatically."

The paper referenced:

https://dspace.mit.edu/bitstream/handle/1721.1/99841/9274107...

According to the metadata in the gem, Rubicon is from 2012. We must download the gem from its site, which is weird, and I couldn't find it on github. I assume it is a dead project.

Derailer's last commit is from Jan 29 2014 so it's another dead project. Too bad because it could be interesting. However, did anybody understand what to do with its output? Example: how do I use http://people.csail.mit.edu/jnear/derailer/example1/ to assess the security of the application?

> Derailer uses an automatic static analysis to produce a visual representation of the information flows within a Ruby on Rails web application.

Rails?

Such a tool might have been useful ten years ago but today?

Reply on news.ycombinator.com