rails/rails — comment on commit 06a3a8a458e70c1b6531ac53c57a302b162fd736
File:  line 0
By aliix:

@stevenh512 Do we even know that GitHub was not using attr_accessible? They could have just opened up columns that are only accessible to admins to all users because of the bluntness of attr_accessible (somewhat remedied by the new role based feature).

Regardless, Rails can't protect developers against not paying attention when they apply untrusted form data directly to models - that is just an amateur mistake, and it seems most applications do just fine as their developers properly filter parameters before updating models.