> I can't imagine a C version of Rails executing YAML as code This is the crux of the matter, so please take a moment to reflect on why you believe that. Ruby

> I can't imagine a C version of Rails executing YAML as code This is the crux of the matter, so please take a moment to reflect on why you believe that. Ruby code is used in much more dynamic environments; environments that would exist in some other language if Ruby didn't exist, and probably would show the same error. By choosing C you are not allowing some vulnerabilities to gain resistance against others. The gains are in other places: performance, code inertia. And that's the problem. You are deliberately sacrificing safety. Truth or not, that's why everyone is so pissed at this class of bugs.