Re:What The Rails Security Issue Means For Your Startup
by randomdata on Thursday January 31, 2013 @01:07PM
(#5146309)
Anything you implement to replace the functionality missed by not using Rails will be, statistically, just as insecure. Arguably, even more-so because you will no doubt lack the peer review a large project like Rails benefits from.
[ Parent
| on HN ]
Re:What The Rails Security Issue Means For Your Startup
by romaniv on Thursday January 31, 2013 @01:15PM
(#5146351)
Unless you implement it in a fundamentally simpler way.
Re:What The Rails Security Issue Means For Your Startup
by tomjen3 on Friday February 01, 2013 @06:48PM
(#5154319)
I don't think so. Rails has to cover all cases, you just have to code the few cases that you actually use.
And even if you get it wrong, you get it wrong in a different way. That might mean that you are technically more at risk, but so long as the attack is focused on getting as many targets as possible, rather than you explicitly, then that is arguably a great strategy: the cost of adapting an already existing attack to target a novel target is going to be astronomically high, versus using an already existing vulnability. If you are refining neuclear material for Iran, you are going to need all the protection you can get; if you are just another start-up you just need not to be vulneable to the latest drive-by exploit.