News for hackers. Stuff that matters.

A comment on Don't find out about Ruby vulnerabilities through Hacker News and Twitter.

Re:Don't find out about Ruby vulnerabilities through Hacker ... by param on Thursday February 28, 2013 @10:39AM (#5299118)
How is this better than brakeman? (http://brakemanscanner.org/) Seems like they only pretty much check your gem dependencies while brakeman also does static code analysis and points out potential sql injection spots etc...
[ Parent | on HN ]
Re:Don't find out about Ruby vulnerabilities through Hacker ... by InAnEmergency on Thursday February 28, 2013 @11:12AM (#5299295)
Brakeman will not check all gem dependencies and is not a general-purpose gem dependency security checker... bundler-audit will probably end up being the de facto tool for that: https://github.com/postmodern/bundler-audit
[ Parent | on HN ]
Re:Don't find out about Ruby vulnerabilities through Hacker ... by re_todd on Thursday February 28, 2013 @11:27AM (#5299365)
Yeah, brakeman is awesome, here is a railscast for anyone interested: http://railscasts.com/episodes/358-brakeman
[ Parent | on HN ]
Re:Don't find out about Ruby vulnerabilities through Hacker ... by boonedocks on Thursday February 28, 2013 @12:05PM (#5299585)
Brakeman is great. I think it should check the Gemfile also. Seems like a good place for it. The opinion is mixed though.

https://github.com/presidentbeef/brakeman/issues/276

A complementary command-line tool would be fine too.

[ Parent | on HN ]