[samhamilton]

Thanks for getting this out so fast!

Do you guys have plans to PR these changes back in Rails?

[bradleybuda]

Yep. I'm sending a patch for the CSRF token masking change shortly. I'm less sure about the length hiding change; it feels like an ugly hack, but we put it in because it's the least awful solution that the paper presents. I'm curious to find out exactly how effective the length hiding is one the PoC code is released.

[StavrosK]

It will probably make the attack a few orders of magnitude harder, but it'll still be feasible if you don't rate-limit requests.