If "being proactive about security" was the only thing necessary then we'd all be using Internet Explorer still (a product which was pilloried over and over due

If "being proactive about security" was the only thing necessary then we'd all be using Internet Explorer still (a product which was pilloried over and over due to its sheer number of critical security vulnerabilities). It's appropriate you bring up OpenBSD. Not only are they open with their security vulnerabilities as they're discovered, but they make security a core engineering goal (which is the part that people have been saying is missing from Rails). No one is saying Rails shouldn't disclose security issues as they become informed about them. They're saying that there shouldn't be so many in the first place. However one might argue that those who care about security might at least suspect that a rapid development system so dependent on convention would have issues like these and so it's not really fair to pin all this entirely on the Rails devs. Just as you wouldn't use a C library filled with gets() for security-sensitive code, no one forced anyone to install Rails. Edit: And more to the point for Rails, it certainly seems to have delivered on the promise of rapid application development, ease of modification, etc. It's miles and miles better than using old CGI.pm with Perl (though there are other options now). Given that many simply would not have a neat-o Web 2.0 site (with many other built-in security protections) if they had used something else, it's hard to be too cross at the Rails devs... they may have burnt the pepperoni but at least they made you a pizza.