Hacker News Reader

I would absolutely use Rails for new projects, specifically because these issues are being surfaced and fixed.

A framework or system with only 10 users will never have the depth of security and bug fixing coverage that a larger, well used system has.

View on HN

That's not a very strong argument - the framework with 10 users is a far smaller target than the one with thousands of installs.

True, unless your site is high profile

Or someone gets bored.

Websites are targets, not frameworks - if your site is targeted, it's the same thing as having your home-brewed 1 user framework targeted, and as long as you're making money and/or storing valuable client info this can happen anytime...

Particular frameworks, CMSes, blog systems and other widely-installed web apps are targeted all the time.

When examining web server access logs, it's quite common to see hundreds of requests coming in from a single host during a short period of time, looking to see if certain exploitable framework- or app-specific pages exist.

Such scanners do appear to target certain frameworks or web apps, contrary to your suggestion that this does not happen.

Reply on news.ycombinator.com