ar.rb

class ActiveRecord::Base
  attr_accessible nil

  def update_attributes *args
    raise "Don't call #{self.class.name}#update_attributes. " +
      "Mass assignment is pure evil."
  end
end

Can you clarify why update_attributes is bad? The Rails Security Guide states:

In a similar way, new, create, create!, update_attributes, and update_attributes! methods all respect mass-assignment security and accept either :as or :without_protection options.

Given that, I fail to see why disabling update_attributes is necessary.