3 ms·
Are people misunderstanding this? It is not a bug. It's an acknowledged part of the framework (http://guides.rubyonrails.org/security.html#mass-assignment http
by jclem 15y ago
Are people misunderstanding this?
It is not a bug. It's an acknowledged part of the framework (http://guides.rubyonrails.org/security.html#mass-assignment http://guides.rubyonrails.org/security.html#mass-assignment), although one that could get a developer into trouble without knowing to protect attributes where necessary.
If he'd known that there was something the GH team missed, he should have just brought the issue to them directly. If I realize my neighbor's house is in danger of collapsing because the contractor used the wrong type of wood, I don't bring the issue up with a lumber yard and then knock over my neighbor's house to prove a point when they ignore me.
I agree that it's a problem that many developers aren't aware that they need to protect against mass assignment, but it seems like this dude is totally misunderstanding the entire ecosystem here, and now people are calling him a "hero" because he took advantage of something that everyone already knows.
Big whoop.
- maratd 15y ago> If I realize my neighbor's house is in danger of collapsing because the contractor used the wrong type of wood, I don't bring the issue up with a lumber yard Yes, you do. Because the lumber yard sold your neighbor the wrong wood. If you're going to make a framework for a language, do so in a manner that discourages stupidity. PHP learned this the hard way quite a few years back. You never make things easier for the end-user at the expense of security. It's time for Rails to learn the same lesson.
- Drbble 15y agoYou can't chop off half of someone's sentence and then debate the leftover part. Not at an "and", at least.
- ben0x539 15y agoA harmless, spurious commit is hardly comparable to the insane property damage of destroying someone's house, likely to bankrupt a private person.