Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror
×
Bug Ruby Security Operating Systems Privacy Programming The Internet Build

MIT Bug Finder Uncovers Flaws In Web Apps In 64 Seconds (csoonline.com) 24

itwbennett quotes a report from CSO: A new tool from MIT exploits some of the idiosyncrasies in the Ruby on Rails programming framework to quickly uncover new ones, writes Katherine Noyes. In tests on 50 popular web applications written using Ruby on Rails, the system found 23 previously undiagnosed security flaws, and it took no more than 64 seconds to analyze any given program. Ruby on Rails is distinguished from other frameworks because it defines even its most basic operations in libraries. MIT's researchers took advantage of that fact by rewriting those libraries so that the operations defined in them describe their own behavior in a logical language.
This discussion has been archived. No new comments can be posted.

MIT Bug Finder Uncovers Flaws In Web Apps In 64 Seconds

Comments Filter:
  • by Anonymous Coward

    From what I can tell, it seems like it might be something like a code analysis tool that swapped in a logger to profile methods called along with some metadata (time spent in subroutine, etc).

    http://open.blogs.nytimes.com/2008/03/05/the-new-york-times-perl-profiler/?_r=0

    BUT ON AN APP!
    or am i missing something?

    • Re: (Score:2, Informative)

      by Anonymous Coward

      It seems that you can read more about it here:
      http://news.mit.edu/2016/patching-web-applications-0415
      It mentions that it was done by professor Daniel Jackson and postdoc Joseph Near. Joseph Near seems to have page here:
      http://www.cs.berkeley.edu/~jnear/
      Under software you can find "Derailer" and "Rubicon" (but not "Space) and under theses you can find this PhD:
      http://dspace.mit.edu/handle/1721.1/99841
      A short overview of the three pieces of software is given on page 15

  • by Gravis Zero ( 934156 ) on Friday April 15, 2016 @08:57PM (#51919519)

    the biggest flaw was that they were written in Ruby on Rails.

  • Gone in 64 seconds.

  • how long did it take to rewrite the libraries?

  • The Ruby world... (Score:5, Insightful)

    by mi ( 197448 ) <slashdot-2017q4@virtual-estates.net> on Friday April 15, 2016 @09:35PM (#51919663) Homepage Journal

    Many "cool and new" technologies started out with a rather dismissive and arrogant attitude towards predecessors — only to then encounter the same problems as other did before and have to solve them in a hurry, shooting yourself in the same extremity (with the same gun), and stepping on the same rake [123rf.com].

    From my experience, Ruby is especially bad at it. Release 1.9.2 not quite compatible with 1.9.1? What?!

    Published packages ("gems") not signed [rubygems.org]. Huh?

    So, when I hear about yet another problem in that world, all I can do is shrug...

  • by joss ( 1346 )

    Python and Ruby are similar languages, and yet the cultures around the two are very different. A certain segment of Ruby has moved to node.js now.

    https://www.youtube.com/watch?... [youtube.com]

"Because he's a character who's looking for his own identity, [He-Man is] an interesting role for an actor." -- Dolph Lundgren, "actor"

Working...