Mass assignment is a fairly normal thing to do, any parameters you want the model to ignore can be marked as so in the model and then mass assignment will work anywhere. Rails loves DRY.
Since the only way in which one can get wrong arguments is if somebody is hacking you (or attempting to do so) in which case just throwing an error at them is a fair thing to do.
Rails gives you attr_accessible and attr_protected to alleviate this problem. Protip: the one from those two that you suggested to use is just as terrible an idea as allowing blind POST into your database. Blacklisting is always the wrong approach to security. I don't care if you have to repeat yourself and type more characters: use the whitelisting of attr_accessible.
The real culprit is Apple. It's just not ok to add unexpected parameters to people's POSTs. If anything, they should have put it in an HTTP header instead.
No, it's an abnormal thing to do and a security hole.
> any parameters you want the model to ignore can be marked as so
Which is complete insanity.
> Rails loves DRY.
Yes so does PHP, hence register_globals.
That's on the "idiotic" side of "I don't want to write stuff", and even the Rails staff stopped defending this insanity back in March.
And register_globals was widely used in PHP, that does not make it anything but moronic.
Because that seems entirely the wrong way around.
EDIT: looked at the link posted elsewhere here[1] and ound that it is possible to whitelist using "attr_accessible". Please tell me people know about and use this.
[1] http://guides.rubyonrails.org/security.html#mass-assignment
I, for one, don't like having my application error logs polluted by script kiddies running against my wall...