Tenderlove on Rails security exploits (tenderlovemaking.com)

Aaron Patterson just rocks, what a great explanation.

Great blog post and it's explaining the problem and possible solutions.

  "Think of YAML as a human readable Marshal."

That's what people missed. YAML is a marshaling format, full stop. The Ruby community has to absorb this idea, and quickly, because YAML is everywhere.