GitHub incidents spawns Rails security debate

1) It must be easier to do something safely than to do it unsafely.

2) It must be easier to do something correctly than to do it incorrectly.

3) It must be easier to do something efficiently than to do it inefficiently.

Those three rules are not always aligned with each other, alas, and sometimes satisfying all three (or even any two) is strictly impossible. Different projects have different needs, and in some cases, the priorities shift orders.

In general, however, if you're a lead developer or technical director on a project who is ultimately responsible for the languages, APIs, and tools used by your fellow developers, you should follow those rules, in that order.

To do otherwise is to invite complexity, disaster, and ultimately failure.