From a triage point of view, Ruby/RoR is excellent. I'm not trying to hate on Ruby people - the community is amazing and the inherent openness and transparency

From a triage point of view, Ruby/RoR is excellent. I'm not trying to hate on Ruby people - the community is amazing and the inherent openness and transparency is to be lauded. That's not my issue though. The project's reputation is fiercely protected by it's community - and I wonder at what point this could be damaging. To borrow some terminology, they're not `user-space` bugs like the majority of PHP security flaws (for example). They're bugs in the firmament. Talking to penetration testers, you often hear this story: if it's .NET, you're going to have a hard time; If it's PHP, you can count on the developer leaving an injection flaw of varying exploitability; If it's RoR, you can count on an out of date package with a critical flaw that bypasses the app entirely. (btw: I'm primarily a python/django person - I won't comment on that!).