Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3

Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 by veloper on Monday January 28, 2013 @05:37PM (#5131179)

If everyone is really going to take the route of "My X Framework is fine b/c nothing's been reported" then I'd like to contribute these links showing vulnerability break downs...

* Rails: http://www.cvedetails.com/product/22568/Rubyonrails-Ruby-On-...

* Django: http://www.cvedetails.com/product/18211/Djangoproject-Django...

* CodeIgniter: http://www.cvedetails.com/product/11625/Codeigniter-Codeigni...

* Top 50 Products (Better stop using these too! /s): http://www.cvedetails.com/top-50-products.php

[ Parent | on HN ]

Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 by glfomfn on Monday January 28, 2013 @06:19PM (#5131384)

You are shooting your own feet with these links you know. According to your data Django had -ZERO- sql injections & code execution repots, now compare that to RoR which had 6 sql injections & 3 code execution reports since 2009. Even if you went by just the numbers RoR had way more vulnerabilities, now if you also take in consideration the kind of vulnerabilities i can tell you i feel way safer on django than RoR.

How many times did you have to stay up late at night to patch your framework ?

[ Parent | on HN ]

Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 by justsee on Monday January 28, 2013 @06:05PM (#5131315)

Interesting.

Rails: numerous code execution and SQL injection vulnerabilities reported over the years.

Django: no code execution or SQL injection vulnerabilities reported.

[ Parent | on HN ]

Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 by sil3ntmac on Monday January 28, 2013 @06:21PM (#5131397)

(yet).

[ Parent | on HN ]

Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 by tedunangst on Monday January 28, 2013 @09:50PM (#5132075)

To be honest, rails does seem to be going out of its way to increase its attack surface.

[ Parent | on HN ]

Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 by mje__ on Monday January 28, 2013 @06:55PM (#5131528)

It was pretty interesting to see the all-time details for the languages:

* Python [1,2] : 20 + 15 = 35

* Ruby [3,4] : 31 + 8 = 39

* PHP [5] : 336

Ouch :(

[1] http://www.cvedetails.com/product/2147/Python-Software-Found...

[2] http://www.cvedetails.com/product/18230/Python-Python.html?v...

[3] http://www.cvedetails.com/product/12215/Ruby-lang-Ruby.html?...

[4] http://www.cvedetails.com/product/3861/Yukihiro-Matsumoto-Ru...

[5] http://www.cvedetails.com/product/128/PHP-PHP.html?vendor_id...

edit:formatting

[ Parent | on HN ]

Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 by thingification on Monday January 28, 2013 @08:12PM (#5131792)

That seems a little unfair on PHP if taken at face value. I don't know PHP, but doesn't it come with things like database client libraries and templating? That's not really comparable with the core Python distribution.

Presumably a fairer comparison would compare (Python + Django) with (Ruby + RoR) with PHP?

[ Parent | on HN ]

Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 by mars on Monday January 28, 2013 @06:23PM (#5131409)

Lulz :) I mean ruby nailed it, right?

[ Parent | on HN ]

Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 by postmodern_mod3 on Monday January 28, 2013 @07:35PM (#5131660)

Vulnerability counts are misleading metric for security. They do not include the vulnerabilities which have not yet been discovered or created.

[ Parent | on HN ]

Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 by jpatokal on Monday January 28, 2013 @07:42PM (#5131677)

And you're proposing to get a less misleading metric for undiscovered or uncreated (!?) vulnerabilities how, exactly?

[ Parent | on HN ]

Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 by postmodern_mod3 on Monday January 28, 2013 @08:12PM (#5131790)

Maybe graph the rate of vulnerabilities discovered vs. LoC/files added?

It's safer to only use vulnerability counts as a metric for how interesting software is to security researchers.

[ Parent | on HN ]

Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 by mikegioia on Monday January 28, 2013 @08:02PM (#5131759)

Wow, good for CodeIgniter.

[ Parent | on HN ]

Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 by eric970 on Monday January 28, 2013 @06:11PM (#5131347)

Thank you.

[ Parent | on HN ]