Rails isn't the problem. If it wasn't this bug that caused the emails to be exposed, it would have been some other bug. The problem was that there wasn't enough test coverage, and there weren't enough runtime assertions to shut off failing software. (if to_emails > 10: logging.fatal("Sending message to too many emails %s", to_emails))
So if I'm driving my car and the accelerator pedal gets stuck... it's my fault for using the pedal without proper extensive testing? Even if the pedal got stuck after fixing my door locks because the manufacturer stuck the pedals as a side effect with no previous notice?
There is no excuse: change of behavior shouldn't happen when installing security patches, specially if it's not mentioned anywhere in the patch release notes (which were reviewed by the GitHub team).
Okay, I get your point, they should have tested it, you're right, but saying that Rails is not the problem is kind of being in denial.
It's more like taking a homebuilt experimental aircraft out for its first test flight. When the engine blows up 30 seconds into your flight and you crash into a house, you'll probably wish you turned the thing on on the ground before actually flying it. Sure, the engine was faulty, but any of the parts could have caused the failure. The root cause was that you didn't even try to see if the thing worked in safe conditions.
Like I said: yes, the engine failed, and the engine shouldn't fail. But it's unreasonable to expect that if only the engine had continued working, the test flight would have gone fine.
This is not a product that is marketed as something still in testing. Rails is supposedly mature by now.
A closer analogy would be if you were an airline and a technician from Boeing made some Boeing-recommended safety changes on a plane before it took off and then the engine blew up.
Sure, you should have had proper oversight of what said technician was doing but the bigger part of the blame is on Boeing for a faulty safety change.
I'm not talking about Rails, I'm talking about Github's mail-sending program. Rails is the engine. The email sending script is the experimental aircraft.
Blame Rails, I'm fine with that. But it's not going to prevent a serious problem with the email sending script in the future. To do that, you need to write some tests.
