-AR find works fine for me, in most cases, in those cases you can always fall back directly to SQL (has happened a total of two times for me). The guy very incorrectly states that the :group stuff will choke in Postgres. It does not. There is a separate driver for each database that will make the queries compliant with the specific DB.
-When using joins, you're supposed to use :include, or has_and_belongs_to_many. These are NOT read only, and work very very well. He's complaining that something he is doing the wrong way does not work. That is because he is doing it wrong, and it isn't SUPPOSED to work.
-I agree with his point about understanding Rails and the options hashes. At this point, I really wish that Ruby had named arguments, as the options workaround gets really annoying.
-I don't understand what he means by quality assurance. Rails has an incredibly large automated testing suite. I've been using Rails for two years and I've found one bug. I really just have no idea what he's trying to get at.
-On the last point, about the "big-picture", he is provably false. If you've written a Rails app and there is even ONE XSS injection opportunity, you've done it wrong. Spend two seconds in the API docs and you will find this function called "sanitize":: http://api.rubyonrails.org/classes/ActionView/Helpers/Saniti...
It helps if you read the fucking documentation before you criticize something.