rails/rails — comment on commit 06a3a8a458e70c1b6531ac53c57a302b162fd736
File:  line 0
By stevenh512:

True, we don't really know that Github wasn't using attr_accessible, the only way to truly know the exact cause of their particular vulnerability is if they tell us.. but we do know that there are plenty of apps out there that are not using attr_accessbile because 1) it is not enforced by default, 2) there's a lot of bad documentation out there, and 3) beginner/intermediate developers see that it "just works" and don't think about the security implications (which goes back to 1). I think it's a lot easier to fix it in Rails and "break" those already broken applications than it would be to go through (as you said) 6+ years of documentation, fix it, and then hope everybody pays attention.

Fixing XSS vulnerability "broke" a lot of things too, but again, those things were already broken.