Hacker News Reader

Comment by veloper | Hacker News Reader

If everyone is really going to take the route of "My X Framework is fine b/c nothing's been reported" then I'd like to contribute these links showing vulnerability break downs...

* Rails: http://www.cvedetails.com/product/22568/Rubyonrails-Ruby-On-...

* Django: http://www.cvedetails.com/product/18211/Djangoproject-Django...

* CodeIgniter: http://www.cvedetails.com/product/11625/Codeigniter-Codeigni...

* Top 50 Products (Better stop using these too! /s): http://www.cvedetails.com/top-50-products.php

View on HN

You are shooting your own feet with these links you know. According to your data Django had -ZERO- sql injections & code execution repots, now compare that to RoR which had 6 sql injections & 3 code execution reports since 2009. Even if you went by just the numbers RoR had way more vulnerabilities, now if you also take in consideration the kind of vulnerabilities i can tell you i feel way safer on django than RoR.

How many times did you have to stay up late at night to patch your framework ?

Interesting.

Rails: numerous code execution and SQL injection vulnerabilities reported over the years.

Django: no code execution or SQL injection vulnerabilities reported.

(yet).

To be honest, rails does seem to be going out of its way to increase its attack surface.

It was pretty interesting to see the all-time details for the languages:

* Python [1,2] : 20 + 15 = 35

* Ruby [3,4] : 31 + 8 = 39

* PHP [5] : 336

Ouch :(

[1] http://www.cvedetails.com/product/2147/Python-Software-Found...

[2] http://www.cvedetails.com/product/18230/Python-Python.html?v...

[3] http://www.cvedetails.com/product/12215/Ruby-lang-Ruby.html?...

[4] http://www.cvedetails.com/product/3861/Yukihiro-Matsumoto-Ru...

[5] http://www.cvedetails.com/product/128/PHP-PHP.html?vendor_id...

edit:formatting

That seems a little unfair on PHP if taken at face value. I don't know PHP, but doesn't it come with things like database client libraries and templating? That's not really comparable with the core Python distribution.

Presumably a fairer comparison would compare (Python + Django) with (Ruby + RoR) with PHP?

Lulz :) I mean ruby nailed it, right?

Vulnerability counts are misleading metric for security. They do not include the vulnerabilities which have not yet been discovered or created.

And you're proposing to get a less misleading metric for undiscovered or uncreated (!?) vulnerabilities how, exactly?

Maybe graph the rate of vulnerabilities discovered vs. LoC/files added?

It's safer to only use vulnerability counts as a metric for how interesting software is to security researchers.

Wow, good for CodeIgniter.

Thank you.

Reply on news.ycombinator.com