Making Your Life Easier with Static Analysis for Dynamic Languages

No ratings

Presented at CactusCon 2014 by

Justin Collins

Security tools abound for statically-analyzing statically-typed languages, but dynamically-typed languages are often dismissed as "too hard" or even "impossible." Of course, that’s nonsense! We can and should have tools for dynamic languages and their frameworks. But while commercial tools continue to lag behind in this area, sites running on frameworks like Rails and Django are proliferating. I hope to offset that gap by getting you excited about static analysis and demonstrating it might not have to be that hard. This talk will include lessons I’ve learned while writing Brakeman (a static analysis security tool for Rails) and the many ways static analysis can be used to make your life easier, whether you are a developer or a security professional or both.