you need to put some thought into the engineering process behind it, and that includes putting some forethought into how you're going to handle security p

you need to put some thought into the engineering process behind it, and that includes putting some forethought into how you're going to handle security problems Again, the ruby-core crew aren't thoughtless, or inexperienced; they have processes in place for both normal releases and security advisories, and have a pretty damn good track record for getting updates into the hands of the folks who need 'em. There are now far too many versions of Ruby out there in the wild for the core team to effectively predict who is going to be affected by a particular issue. Every Linux distro and release of OS X has a slightly different bundled Ruby runtime, and most people don't seem to bother tracking the stable release from the core team until something like the last round of security updates leaves them scrambling to keep up. The problem isn't the core team failing to handle security issues, it's the community not giving a shit about the code that makes up the 'ruby' binary until something goes wrong, and then not having any clue how to update their systems and do basic compatibility testing.