xs_kid

Please do it

then we won't need a 4.0.2 and the next version will be 4.1

JSConfCo: http://jsconf.co/

RealtimeConf: http://2013.realtimeconf.com/

The metasploit exploit was possible only thanks to the release (see the tweets of metasploit maintainer @hdmoore), IMO they could have waited until Monday morning to release it.

Yes, you should do it

PoC is in codebase, it was published as a test-case for the fix.

- No CVE.

- Distributions weren't contacted prior the release.

- Everyone can see the diff for the fix in the codebase.

- There are a PoC as test-case in the code.

- The release was done in the start of weekend when everyone in America is leaving the office and everyone in Europe is sleeping.

- A big part of the community is in two conferences right now.

IMHO that was the worst way to provide a security update.

Your ruby version looks nicer:

https://gist.github.com/anonymous/7050542

sure, they published a PoC in the code: https://github.com/joyent/node/blob/085dd30e93da67362f044ad1...

Oracle has some JRuby apps on production

There are people working on it, see for example: http://sciruby.com/

Looks like they moved only the frontend from Rails to Node.js. Rails still existing in their SOA architecture and they still using Ruby/JRuby hardly.

No, I asked to an engineer last month and their still using their 'Monorail' for twitter.com

The author already opened a PR in rails: https://github.com/rails/rails/pull/11729

IMO looks great so far

There are any workaround for other web frameworks like Django or Padrino?

The developer of Prototype had to handle also with a lot of criticism and there is his response: http://sstephenson.us/posts/you-are-not-your-code

"I have learned that in the open-source world, you are not your code. A critique of your project is not tantamount to a personal attack"

klabnik isn't in rails core: http://rubyonrails.org/core

who's a rails core team member?

klabnik isn't: http://rubyonrails.org/core