I would love to see something like Django's Editing Views. Ever since George Brocklehurst described this at Ruby Manor earlier this year I can't get the idea o

I would love to see something like Django's Editing Views. Ever since George Brocklehurst described this at Ruby Manor earlier this year I can't get the idea out of my head. If you look at all the security issues and hand wringing over params parsing, roles, attr_accessible and strong attributes, etc, etc, a very large percentage of those issues are greatly improved or in some cases completely nullified by Django's approach to forms. It's actually one of the biggest Rails warts in my opinion. In essence, the idea there should be an object that knows how to render a form based on an internal object state paired with a deserializer that knows how to read the form in and convert it to an internal object state. This way, by default, the form only recognizes the params that were defined and the risk of leaky params causing security issues is reduced by orders of magnitude. I'm not sure how you retrofit something like this into Rails since it would be a huge architectural shift, but man it would be sweet to see something official along those lines.