a sad story, comparing to the recent arc/hn security hacking: http://news.ycombinator.com/item?id=639976 http://news.ycombinator.com/item?id=639976 reading tha

a sad story, comparing to the recent arc/hn security hacking: http://news.ycombinator.com/item?id=639976 http://news.ycombinator.com/item?id=639976 reading that post was delighting me: a serious bug, a fix added, a community supporting & being thankful. here at rails, a framework i would like to love it, a serious bug, no fix, a community throwing the shit over the fence and each other. this immediately reminds me of the recent pr0n story in rails, where some members of the community were offended, by whatever reasons, by other community members. the only good, non-technical advancement in rails in the last period i saw was the documentation project supported by the community and backed by rails eminents. i'm expecting a firm and strong support here from rails, either would it come from dhh, or anybody else. otherwise even if i would like to work with rails and build my life on it i can't afford a serious security hole being treated like this. ruby and almost in the same way rails are close to my heart. i'm always defending them in such cases, even making myself being too subjective. i can accept rails edginess, mac-alike metrosexualism (no ofense to anyone!), handsomeness and awesomeness, funky geekness BUT in some cases, like this, we should act normally, promptly, professionaly as any other community does. EDIT: the official rails core answer: http://groups.google.com/group/rubyonrails-security/browse_thread/thread/20e17a978d2ccbd3?hl=en http://groups.google.com/group/rubyonrails-security/browse_t... posted 10hrs ago this comment was made. it contains a bugfix, instructions and a disclosure i'm copying here: Disclosure Notes ==== Due to communication difficulties and a mis-understanding between the reporter and the security team. This vulnerability has been publicly disclosed on several websites, users are advised to update their applications immediately. Steps are being taken to ensure that the security email is more reliable in the future. We regret the nature of this disclosure and will endeavor to update processes and documentation to ensure it doesn’t happen again in the future.