Hacker News new | past | comments | ask | show | jobs | submit login

Argh. Why not just neutralize XML to make it safer, rather than kicking the can to the developers who need it?



One of the reasons that things get extracted to gems is specifically so that people who use it can improve stuff without the whole process of contributing to Rails (and its release cycles) getting in the way.

For example, ActiveResource[1]. Now that it's a gem, the people who use its features can actually take over the maintenance, and release versions independently from Rails proper. It's gotten a lot more contributions lately now that it's independent.

1: https://github.com/rails/activeresource


It is also a way of burying hair-on-fire security issues, and of encouraging plugin-style development for what is properly considered a piece of core functionality for Rails.


> It is also a way of burying hair-on-fire security issues,

:/ I'm sorry you feel that way. I can only speak for myself, but I certainly don't want to bury any security issues, I want to fix them.

> what is properly considered a piece of core functionality for Rails.

Maybe automatically parsing XML parameters shouldn't be?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: