rails/rails — comment on commit b83965785db1eec019edf1fc272b1aa393e6dc57
File:  line 0
By DouweM:

@abuddy I think that's because most people realize it's a stupid oversight on GitHub's part, but also not an entirely understandable one seeing as it's made way too easy by Rails to just define models and have the models be completely open for mass-assignment. GitHub fixed it, Rails's attribute protection defaults should be reevaluated and... anything else?

Yes, I'm disappointed that GitHub made such an obvious mistake, but I'm more concerned over all the other sites that have this vulnerability, caused in the first place by Rails defaults, not stupid developers.

@Tie-fighter He posted an issue about Rails mass-assignment attribute protection defaults, which they ignored/dismissed, which they shouldn't have. The first thing he did when he found vulnerabilities in GitHub seems to have been exploit them, not report them.