# Re: Rails 1.1.5: Mandatory security patch (and other tidbits

**URL:** <https://www.ruby-forum.com/t/re-rails-1-1-5-mandatory-security-patch-and-other-tidbits/64539>\
**Category:** Ruby\
**Created:** [August 9, 2006, 9:02pm UTC](https://www.ruby-forum.com/t/re-rails-1-1-5-mandatory-security-patch-and-other-tidbits/64539 "2006-08-09T21:02:20Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![BergerS\_Daniel](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/bc8723/32.png) [@BergerS\_Daniel](https://www.ruby-forum.com/u/BergerS_Daniel)\
**Post date:** [August 9, 2006, 9:02pm UTC](https://www.ruby-forum.com/t/re-rails-1-1-5-mandatory-security-patch-and-other-tidbits/64539/1 "2006-08-09T21:02:20Z")

</div>

> > This is a MANDATORY upgrade for anyone not running on a very recent  
> > This seems misguided to me. One of the things that I have always  
> > appreaciated about the general open source environment is that when  
> > there is a security vulnerability it is announced. It is described.  
> > And it is fixed.
> 
> The process is open, and it works because someone can go and look at  
> the information about the vulnerability and learn from it,  
> and they can  
> have faith in the advice to upgrade because the vulnerability  
> announcement is clear about what the exploit is and the risk from it.

I kinda took this message to mean that they would give folks some time  
to upgrade before (eventually) releasing the details. That’s fairly  
standard procedure, isn’t it? Maybe not, though.

- Dan

This communication is the property of Qwest and may contain confidential  
or  
privileged information. Unauthorized use of this communication is  
strictly  
prohibited and may be unlawful. If you have received this communication  
in error, please immediately notify the sender by reply e-mail and  
destroy  
all copies of the communication and any attachments.