IMHO, it's a bad practice which is very widely promoted in Rails guides and scaffolding code. Mass-assignment is very difficult to get right in any complex app

IMHO, it's a bad practice which is very widely promoted in Rails guides and scaffolding code. Mass-assignment is very difficult to get right in any complex app (e.g. with multiple user roles) and the simplest way to avoid these problems would be to discourage the use of 'update_attributes' and teach people to explicitly set model properties. (Of course, Rails folks probably hate the non-DRY aspect of this, but I prefer to look at my code and see exactly what's happening with user input.)