>Perhaps they should have done this up front, you know as part of the engineering, hence my point. And you know what, I have a feeling they did have multiple p

>Perhaps they should have done this up front, you know as part of the engineering, hence my point. And you know what, I have a feeling they did have multiple people looking over the code, and it's been vigorously refactored over the years. Rails 3 is a somewhat different beast from Rails 2. Careful auditing reduces bugs but does not eliminate them. Crowing about "proper engineering" is very nice but is somewhat farcical given the state of the art in the industry. >Are you saying guarding against bad inputs and enforcing type is bad? No. Of course you guard against bad inputs. But that's wholly separate from enforcing the type of the objects. And it's not like people are eval()ing stuff willy-nilly.