Exactly. This is like saying that it was fine for older versions of windows to broadcast the users directory tree over an open file server because they should k

Exactly. This is like saying that it was fine for older versions of windows to broadcast the users directory tree over an open file server because they should know better than to leave the server up. (This happened right? Correct me if it didn't.) It's like no, you should have to turn the server on in the first place. The fact that it took some Russian kid in his basement breaking into the github rails master for this self evident truth to be realized by the core rails team is totally outrageous.