Anatomy of an Exploit: An In-depth Look at the Rails YAML Vulnerability

Should library users just be careful when using YAML or should YAML by default not allow arbitrary class loading?