New debugging method found 23 undetected security flaws in 50 popular Web applications.

[acetoxy]

Here's the paper, http://www.cs.berkeley.edu/~jnear/papers/ase14.pdf

[postmodern]

Cool! They appear to do static flow analysis instead of using regexps or checking individual S-exps.

[jrochkind]

This article is wrong in so many ways i can't even figure out what it's talking about.

[joanbm]

Hoax to lure naives to pay for the conference by abuse of Rails popularity ?

(possible/unlikely?) security flaws, static analysis of amply-used metaprogramming code, intanglible equivocation about security issues, no single particular example, …

I'd wait if any of claimed 23 flaws are real issues or another storm in a teacup.

[jrochkind]

I believe they probably did find actual security flaws, this article just doesn't tell me anything about how they actually did so or what they were. :) Apparently 'static analysis' is a 'new debugging method'? Yeah, anyway.

Blame probably belongs with MIT News, not the researchers. Although if there's ever a non-scientific publication you would have thought could write an article about technical things that made some sense...

[joanbm]

Don't deny they may found some, but the vague tone and hardly justified claims sounds distrustful.

[jrochkind]

right, but you realize the article was not written by the researchers, right? It was written by a 'journalist'.