None of the problems he outlined were a result of getting Diaspora out the door faster, but simply basic ignorance of security issues. attr_accessible, adding a

None of the problems he outlined were a result of getting Diaspora out the door faster, but simply basic ignorance of security issues. attr_accessible, adding a current_user. to db queries and so on doesn't take any time at all, and should be in muscle memory for any seasoned Rails developer. If they can't deal with beginner level stuff, how well do you think they will do with much harder problems like XSS? Edit: Actually I really want to drive this point home: you wouldn't write a TODO for any of these things because it would take you as long to write the TODO as it would take to fix them.