TSS reaches new low as morons celebrate the recent Rails incident.

I'm still having mixed feelings about the (lack of) full-disclosure on the issue, I'm still unable to tell if a mistake has been made.
Although they should have provided the URL rewriting based workaround in the first place (instead of rushing out a release and force people to upgrade their systems a partial fix), I can understand they didn't want to tell people their site is vulnerable with using simple URL without giving them any change to upgrade...

As soon as you decide to rely on a framework to build your applications, you establish a close relation of trust with the designers and maintainers of that piece of software. On that peculiar case, I have enough confidence in the skills, the experience and, ultimately, the goodwill of the Rails core to know that when I'm being told to upgrade now, I just do it.

Do you ask yourself that many questions when your OS vendor pushes a new security update? It's just a matter of trust between you and your suppliers or delegates.
The most important thing is to constantly (re)evaluate that relation if you don't want yesterday's trust to become today's blind faith...

UPDATE: More ignorance unfolds as someone posted a follow up on the 1.1.6 release. Be warned: some very graphic examples of deep cluelessness are displayed in there...