Hacker News Reader

This is the first thing in securing your rails app a developer learns, how to properly handle mass-assignment. I don't blame rails, I blame Github.

View on HN

A system that is designed to rely on human diligence is inherently flawed. It's a mercy that drills and other dangerous tools aren't designed in the same way that a lot of software is.

Exactly. This is like saying that it was fine for older versions of windows to broadcast the users directory tree over an open file server because they should know better than to leave the server up. (This happened right? Correct me if it didn't.)

It's like no, you should have to turn the server on in the first place. The fact that it took some Russian kid in his basement breaking into the github rails master for this self evident truth to be realized by the core rails team is totally outrageous.

Reply on news.ycombinator.com