Security vulnerabilities, AI-powered coding, and a whole lot of pull requests take center stage this week on Remote Ruby! Chris, Andrew, and David kick things off with some alarming security exploits, including a critical Active Storage vulnerability and the growing risks of AI-driven attacks. They explore how Hot Cell could make Rails file uploads safer, share frustrations over security requirements for AI plugin submissions, and discuss practical ways to make AI-assisted development more manageable. Andrew reveals his new five-file rule for creating smaller, easier-to-review pull requests, while Chris considers how AI could fundamentally change software development and Rails releases. Plus, there's talk of Discord's move toward Rust, major Active Record performance improvements, and upcoming SF Ruby plans. Hit download now!
[00:00:30] Chris, Andrew, and David discuss an alarming SSH vulnerability, social engineering attacks, and cryptocurrency theft.
[00:06:42] They review recent Rails security fixes, including Active Storage vulnerabilities, unsafe file processing, and potential mass assignment issues.
[00:09:57] Chris explains Hot Cell.
[00:12:32] Chris discusses content security policies (CSP), third-party JavaScript risks, and using AI to help secure Rails applications.
[00:14:56] They discuss a controversial incident involving a Railway employee's AI agent allegedly attacking another hosting provider's website.
[00:18:41] Andrew and Chris explore X-Forwarded-For errors, trusted proxies, and strategies for filtering suspicious traffic.
[00:23:59] Chris shares an unexpected change in Rails content negotiation that caused JSON error pages to appear instead of HTML.
[00:27:06] Andrew questions why OpenAI and Claude plugin review processes require production test accounts without multifactor authentication.
[00:30:23] Andrew explains his five-file rule for AI pull requests.
[00:37:10] Andrew and Chris discuss smaller projects, stacked PRs, and using multiple AI coding sessions to deliver features faster.
[00:41:01] They discuss reports of Discord reducing desktop memory usage by moving away from Electron.
[00:43:26] The conversation switches to RubyGems, Bundler, and Active Record improvements.
[00:44:40] Chris shares his excitement about delivering the closing keynote at SF Ruby.
[00:47:29] The episode ends with Andrew talking about using Claude and automated workflows to resolve security warnings, update dependencies, and increase development output.
Panelists:
- Chris Oliver
- Andrew Mason
- David Hill
Sponsors:
Links:
HoneybadgerHoneybadger is an application health monitoring tool built by developers for developers.
JudoscaleMake your deployments bulletproof with autoscaling that just works.
Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.
