Search

Tech Talk on Brakeman

Charles Brian Quinn

1 min read

Jan 26, 2012

Tech Talk on Brakeman

Bicycle locks

Dave’s Tech Talk this week is on security on web applications, focusing on Ruby on Rails applications, and using the static analysis security scanner called Brakeman (brakeman on github).

In this talk, Dave looks at how static security analyzers work, and how we used it to find some very tiny (already fixed within a few minutes of finding) possible security weak-points in an application we built for a client.

Static analysis looks at your source code and looks for known vulnerabilities. As opposed to dynamic scanners, or intrusion “detection” scanners that scan a live site from the outside – these are run on the code itself.

In Ruby this is hard because it’s a dynamic language. Because of this, Brakeman (and any static analysis scanners) will identify “false positives” (code that isn’t necessarily a vulnerability) but they’re easy to track down, and safely ignore.

Dave notes, that because of Ruby’s dynamic-ness, if you are doing a lot of method_missing meta-programming, it won’t be able to analyze your code. The practices and places it does identify are easy to see, and you can apply Brakeman’s other recommendations in your meta-programming code, to secure your web application.

Check out the talk on Vimeo: Tech Talk on Brakeman

Image Credit: fishywang on Flickr

Mark Dalrymple

Reviewer Big Nerd Ranch

MarkD is a long-time Unix and Mac developer, having worked at AOL, Google, and several start-ups over the years.  He’s the author of Advanced Mac OS X Programming: The Big Nerd Ranch Guide, over 100 blog posts for Big Nerd Ranch, and an occasional speaker at conferences. Believing in the power of community, he’s a co-founder of CocoaHeads, an international Mac and iPhone meetup, and runs the Pittsburgh PA chapter. In his spare time, he plays orchestral and swing band music.

Speak with a Nerd

Schedule a call today! Our team of Nerds are ready to help

Let's Talk

Related Posts

We are ready to discuss your needs.

Not applicable? Click here to schedule a call.

Stay in Touch WITH Big Nerd Ranch News