[PLX-2M]

"..Its developer Joseph P. Near, under the supervision of MIT Computer Science and Artificial Intelligence Laboratory professor Daniel Jackson, ran the scanner against 50 open source Ruby on Rails applications that were favorited on Github for one reason or another. The scans turned up 23 new vulnerabilities that were reported to the respective developers; the maximum time per scan, MIT said, was 64 seconds."

Source [Threatpost]

[Oni]

Is it only useful for Ruby on Rails? I don't know many that use that.

[Wildfire]

There's still only so much a scanner can find, "advanced" or not. Bugs hide, they're never easy to find.

[meow]

There's still only so much a scanner can find, "advanced" or not. Bugs hide, they're never easy to find.

This.

I promise you that there are no/never will be any scanner that finds all bugs. Furthermore, it was scanning source code, and was only going against Ruby. I doubt it would find all it did if it were black box testing. Sometimes it takes hours for me to find bugs.

The beauty of manual testing is that with patience and experience, you will always find something. There's no guarantee that a scanner will find everything, and there's no guarantee that what it does find won't be a false positive.

tl;dr - fuck u manual scanning is better

[Wildfire]

This.

I promise you that there are no/never will be any scanner that finds all bugs. Furthermore, it was scanning source code, and was only going against Ruby. I doubt it would find all it did if it were black box testing. Sometimes it takes hours for me to find bugs.

The beauty of manual testing is that with patience and experience, you will always find something. There's no guarantee that a scanner will find everything, and there's no guarantee that what it does find won't be a false positive.

tl;dr - fuck u manual scanning is better

This. Right on the money with this.

[mothered]

tl;dr - fuck u manual scanning is better

Absolutely so.

About time, someone with common sense here.

[Wildfire]

DEFCON quote
>Companies request pentest
>No exploitation, just a vulnerability scan.
(._.)

[m0dem]

If it's just scanning source code... yeah...
Might not be too great in the wild.

[PLX-2M]

We will find out more once the ICSE conference takes place May 14-22. I will keep looking for more info on this and will report back.

[Wildfire]

I'm sure the developers will bring up the obvious weaknesses in the conference. Preferably in large, red, bold letters:

THIS IS NOT A COMPLETE PEN TEST
Static Code Analysis Only Gets You So Far