I don't necessarily disagree with you, but it's still an astonishingly bad practice as a default. If there's one thing we should have learned from Rails' vario

I don't necessarily disagree with you, but it's still an astonishingly bad practice as a default. If there's one thing we should have learned from Rails' various security failures, it's that things must be secure by default.