rails/rails — comment on commit 06a3a8a458e70c1b6531ac53c57a302b162fd736
File:  line 0
By stevenh512:

@norv I agree, but I go a step further and say that a change to force mass-assignment security on all apps (not just new ones), with some reasonable way for a more advanced developer to disable it if they really needed to, wouldn't break a thing. Any app with those kinds of vulnerabilities was already broken the moment it was written and deployed and it's only a matter of time before someone exploits it.