[homakov]

>Web applications make state-changing operations on GET requests. You might not like it, but they do.

but when developer made a mistake with GET it is 100% his problem - it's out of question. he should be punished :D

[tptacek]

Nonsensical. CSRF isn't God's punishment for REST-lessness.

[baddox]

You're both just choosing different places to draw the line between developer responsibility and browser responsibility.

[tptacek]

That is like saying "you're both just suggesting two totally different designs for the HTTP security model".

His model is wrong. Again: I assume he wants to know that, so, bluntness.