Re:Bitcoin exchange hacked via Rails exploit, funds stolen
by raesene2 on Friday January 11, 2013 @12:44PM
(#5043853)
While you're obviously correct to imply that languages/frameworks have different levels of security the problem with that proposition is how does a prospective user of the framework assess the level of security it provides?
You could argue that "big, enterprise" systems are likely to be more secure, but experience with things like Oracle databases around 8/9/10 would indicate that's not always a good measure.
You could argue (and people do) that the framework being open source is a good thing, or a bad thing.
So absent that information how would someone factor that into their choice of system?
Re:Bitcoin exchange hacked via Rails exploit, funds stolen
by dons on Friday January 11, 2013 @12:24PM
(#5043714)
Most languages are inappropriate for highly sensitive information or other critical systems. You don't see the the aerospace industry putting Ruby hardware controllers into planes, nor do you see the defense industry putting classified information behind Ruby web servers.
Re:Bitcoin exchange hacked via Rails exploit, funds stolen
by tlowrimore on Friday January 11, 2013 @12:17PM
(#5043664)
Many banks like to use Java rather than something amateurish like Ruby. Here's a link for you, I'll let you draw your own conclusions:
http://blog.trendmicro.com/trendlabs-security-intelligence/j...
Cheers!
Re:Bitcoin exchange hacked via Rails exploit, funds stolen
by benmmurphy on Friday January 11, 2013 @12:56PM
(#5043936)
and if people ran ruby applets in the browser they would have much worse security :) java client sandbox is a different story than java server side
Now how many real banks do run their website using Rails? Ruby?
You guys certainly aren't as stupid as to believe this is the latest major 0-day Rails exploit to create havoc right?
And now comes the answers containing the logical fallacy: "All languages/frameworks have security issues". Which is rubbish in that it would imply that all the languages/frameworks do offer exactly the same level of security...