How is that any worse than traditional web development environments, where it's equally easy to a "select * from orders" ? It's so easy to forget a WHERE clause.

If anything, I think the presence of "all" in "Orders.all.each { |order| ... code goes here ... }" is much easier to spot than a missing SQL clause.

Not that that excuses any of Rails' other flaws that you pointed out.

How many of these questions would you have? Suppose you spent the time to make 1000 or 10,000. The attacker would simply have them solved by a group of humans (say using Amazon's Mechanical Turk) and put the question/answer pairs into a dictionary for automated attacks.

I grew up on the early Sierra and Lucasarts adventure games, and even some text adventures, but even then - puzzles often felt forced and arbitrary.

"Oh, look -- another door in this dungeon is locked, but has a series of gem-shaped indentations in it! I can't wait to figure out the proper order of the gems! Hooray!"

The best puzzles were the ones integrated into the story, when Character A (whom we already care about, because of previous plot developments) needs Item B and I need to talk to Character C (whom we also already care about) and figure out that I need to use Item D with Item E at Location F to accomplish that goal.

But even then, those puzzles bordered on tedium that you simply had to endure in order to see the next bit of (often wonderfully-written) story.

It was downright schizophrenic: wonderful story, tedious puzzle, wonderful story, tedious puzzle, wonderful story, etc.