They would have averted the whole thing had they just paid the fuck attention to rubyonrails-security and updated in January when the bug was announced: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0156