Essential Tools, Updates, and Strategies in Rails Eight with Greg Molnar - RUBY_671

WEBVTT
1
00:00:04.639 --> 00:00:07.599
Hey everybody, Welcome back to another episode of the Ruby
2
00:00:07.679 --> 00:00:11.560
Rogues podcast. This week, on our panel we have Valentino Stole.
3
00:00:12.480 --> 00:00:16.440
They know. I'm Charles Maxwood from Top Endevs. We have
4
00:00:16.480 --> 00:00:19.440
a special guest this week. It is Greg Monar. Greg,
5
00:00:20.320 --> 00:00:23.039
we've had you on before. But how are things in
6
00:00:23.079 --> 00:00:24.000
the middle of the Atlantic?
7
00:00:25.519 --> 00:00:28.760
Hi, guys. Yeah, all is good. Still, We're still alive
8
00:00:28.960 --> 00:00:30.039
in the middle of the ocean.
9
00:00:33.280 --> 00:00:36.159
The island's still upright, so things are good.
10
00:00:36.320 --> 00:00:39.560
Yes, yes, shitty leather sometimes, but yeah. It's been that time.
11
00:00:41.079 --> 00:00:43.840
I heard a clip not that long ago. It's an
12
00:00:43.840 --> 00:00:47.479
older clip, but it was a US congressman that he
13
00:00:47.640 --> 00:00:52.920
was interviewing a general or an admiral or something, and
14
00:00:53.359 --> 00:00:55.880
basically he was talking about Guam and he said, well,
15
00:00:56.439 --> 00:00:59.359
are you worried that the island is going to capsize?
16
00:01:00.399 --> 00:01:04.120
And the general with the straight face, right, because they
17
00:01:04.159 --> 00:01:05.959
have to have some decorum in there and they don't
18
00:01:05.959 --> 00:01:08.120
want to tick off the congressman. He looks at him
19
00:01:08.159 --> 00:01:10.920
and he goes he goes, no, no, we don't anticipate
20
00:01:10.959 --> 00:01:17.040
that didn't capsize.
21
00:01:17.400 --> 00:01:20.000
No, no, And the math it's supposed to be done
22
00:01:20.000 --> 00:01:21.959
for a few years now and it's still there, right,
23
00:01:22.040 --> 00:01:24.640
So I don't know what are these forecasts about.
24
00:01:24.959 --> 00:01:28.120
Yeah, all right, well we brought you on to talk
25
00:01:28.159 --> 00:01:33.480
about security in Rails eight. I don't even know where
26
00:01:33.480 --> 00:01:36.480
to start. Did a whole lot change or is it
27
00:01:36.560 --> 00:01:38.640
mostly the same as seven point two?
28
00:01:40.079 --> 00:01:42.680
Well, yeah, there are a bunch of things which are
29
00:01:42.760 --> 00:01:46.040
seven point two. But I think the imitation was triggered
30
00:01:46.079 --> 00:01:49.359
by my talk at Rails fird Yes, which was tied
31
00:01:49.439 --> 00:01:52.000
to the state of security in Rails eight. But some
32
00:01:52.040 --> 00:01:54.680
of the things I mentioned were actually Rail seven point two.
33
00:01:55.400 --> 00:01:58.359
But I think it was still worth mentioning those because
34
00:01:59.040 --> 00:02:01.000
a lot of people don't even know about those new
35
00:02:01.040 --> 00:02:06.519
features which were three years old back then, and Rail
36
00:02:06.599 --> 00:02:09.120
say it wasn't even know it really is at the conference.
37
00:02:09.159 --> 00:02:12.759
So it was a bit of a ah a pre
38
00:02:12.759 --> 00:02:14.159
planned talk.
39
00:02:15.680 --> 00:02:17.759
So so yeah, so where do we start then?
40
00:02:19.120 --> 00:02:20.960
Well, I can just list out the things which I
41
00:02:21.039 --> 00:02:23.319
was talking about. If you guys are that, you can
42
00:02:23.479 --> 00:02:25.319
go through all of those and you can ask questions
43
00:02:25.319 --> 00:02:30.120
and we can sound So one of the first things
44
00:02:30.120 --> 00:02:34.000
I mentioned during the talk was every new rails app
45
00:02:34.360 --> 00:02:37.319
this is a seven point two feature. Every newly generated
46
00:02:37.400 --> 00:02:42.120
Rails application has a default depend about GitLab CI file,
47
00:02:42.360 --> 00:02:46.159
which means if you are using not gitlabs for GitHub,
48
00:02:46.280 --> 00:02:49.840
if you're using GitHub, then on your CI automatically runs
49
00:02:49.840 --> 00:02:56.199
depend about, which is a dependent vulnerable dependency checks. So
50
00:02:56.319 --> 00:02:58.840
if any of the gems you are using has a
51
00:02:58.919 --> 00:03:02.000
vulnerability public, then you are getting alerted and then you
52
00:03:02.000 --> 00:03:07.199
can just upgrade and save yourselves from any hustles and
53
00:03:07.639 --> 00:03:08.159
so good.
54
00:03:08.759 --> 00:03:12.599
Yeah, I think yep, Well, I was just gonna say
55
00:03:12.599 --> 00:03:14.840
some people. I think most people know what depend about
56
00:03:14.840 --> 00:03:18.039
it is. But effectively you get poor requests if you
57
00:03:18.159 --> 00:03:21.879
have vulnerable versions of your dependencies.
58
00:03:22.199 --> 00:03:24.680
Yeah, or even for outdated bones. That's why I don't
59
00:03:24.759 --> 00:03:28.800
like dependabo. Actually I prefer bundle oud it, but it's
60
00:03:28.800 --> 00:03:31.919
basically it's very similar thing. But bundleoud it only alerts
61
00:03:32.000 --> 00:03:36.159
you about security issues, whereas depend about I think you
62
00:03:36.199 --> 00:03:38.719
can configure it depends a but also alerts you're about
63
00:03:38.800 --> 00:03:42.840
outdated ones. Where usually my way of when I work
64
00:03:42.840 --> 00:03:45.039
on the rest, my way of handling upgrades is it's
65
00:03:45.080 --> 00:03:47.479
like on a regular basis, like every three months. That
66
00:03:47.639 --> 00:03:51.479
is like a spike update all the dependencies. But secretary
67
00:03:51.479 --> 00:03:54.280
dependency is a different. Secrety issues are different. Obviously, you
68
00:03:54.319 --> 00:03:56.919
want to upgrade them immediately. But the rest I don't
69
00:03:56.960 --> 00:03:59.639
really care when a new GEM comes out. If it's
70
00:03:59.680 --> 00:04:02.759
just a non security issue, I will update it when
71
00:04:02.759 --> 00:04:05.479
I do my regular upgrade upgrades.
72
00:04:06.280 --> 00:04:09.199
Right, that makes sense. I do the same thing because
73
00:04:09.240 --> 00:04:12.240
a lot of times you're you're upgrades. If it's a
74
00:04:12.560 --> 00:04:16.639
major even sometimes a minor version, you know, it changes
75
00:04:16.639 --> 00:04:20.199
the API. Right, It's not just oh, hey, you're going
76
00:04:20.279 --> 00:04:22.199
to upgrade this and you're going to get security goodies
77
00:04:22.480 --> 00:04:25.959
right now. You may have to pull a major minor
78
00:04:26.040 --> 00:04:29.759
upgrade version because because there is a security issue and
79
00:04:30.160 --> 00:04:32.279
they didn't fix it in the version you're using, in
80
00:04:32.319 --> 00:04:34.680
which case, yeah, you have to go through the upgrade
81
00:04:34.720 --> 00:04:38.759
rigmarole and update your code as well as the gem.
82
00:04:39.319 --> 00:04:42.240
But yeah, I'm with you. I tend to tackle those
83
00:04:42.279 --> 00:04:47.800
things when I feel the need, right. So sometimes legitimately
84
00:04:47.800 --> 00:04:49.319
it's like, hey, there's a new feature in this that
85
00:04:49.360 --> 00:04:54.800
I need yep, But if it's the older version, how
86
00:04:54.800 --> 00:04:57.079
do I put this? I've been having conversations with people
87
00:04:57.079 --> 00:05:00.000
about like AI in programming, and it's like, hey, look,
88
00:05:00.360 --> 00:05:02.439
it makes you more effective in all of these different ways,
89
00:05:02.959 --> 00:05:05.079
and a lot of people are asking, is that going
90
00:05:05.120 --> 00:05:07.399
to replace programmers and I'm like, have you ever met
91
00:05:07.399 --> 00:05:09.480
a have you ever worked on a project that ran
92
00:05:09.480 --> 00:05:11.839
out of things for you to work on? And the
93
00:05:11.920 --> 00:05:14.120
answer is you might have had a side project that
94
00:05:14.160 --> 00:05:17.560
you decided was done right, And so with this, it's
95
00:05:17.560 --> 00:05:21.399
the same thing. It's like, okay, until it's a real
96
00:05:21.480 --> 00:05:23.879
high priority, there's just no reason to do it. And
97
00:05:23.920 --> 00:05:24.800
so I'm with you on that.
98
00:05:25.639 --> 00:05:27.000
Yeah, Yeah, it's funny.
99
00:05:27.040 --> 00:05:29.480
I've been trying to push people to just like bundle
100
00:05:29.560 --> 00:05:34.279
update patch on like every deploy because like the chances
101
00:05:34.319 --> 00:05:36.800
of something going wrong in a patch release is like
102
00:05:37.000 --> 00:05:40.800
so low that like you've gained so much more by
103
00:05:40.879 --> 00:05:44.360
like all of those security enhancements and like fixes in
104
00:05:44.399 --> 00:05:47.120
a patch little version that it's almost worth just like
105
00:05:47.680 --> 00:05:51.279
doing it if the test pass right, Like, yeah.
106
00:05:50.560 --> 00:05:52.920
So what does bundle update patch do Because I've used
107
00:05:52.959 --> 00:05:56.680
like the pessimized gem that locks in your version right
108
00:05:56.920 --> 00:05:58.360
and let's you upgrade from there.
109
00:05:58.680 --> 00:06:02.360
Yeah, so bundle bundle update tool it has like a
110
00:06:02.399 --> 00:06:05.120
way to give it different flags of like, so it's
111
00:06:05.120 --> 00:06:07.680
a canonical version to all the Ruby gems typically are,
112
00:06:08.360 --> 00:06:11.319
so as long as the gems in dependency's using our canonicals,
113
00:06:11.360 --> 00:06:14.040
meaning there's like a patch level a minor and a
114
00:06:14.079 --> 00:06:17.079
major version to it, then you could just say, okay,
115
00:06:17.120 --> 00:06:22.920
give me only the latest you know, patch updates. And
116
00:06:23.040 --> 00:06:26.839
like people I feel like as at least for like
117
00:06:26.920 --> 00:06:30.279
everything that reels would touch, Like the gem maintainers of
118
00:06:30.279 --> 00:06:32.800
those are very careful about what to release in a
119
00:06:32.839 --> 00:06:35.399
patch version and not like cause any issues because like
120
00:06:35.600 --> 00:06:37.279
they don't want to deal with all the issues that
121
00:06:37.319 --> 00:06:39.839
come from that, right, Like I'm not being like, oh, hey,
122
00:06:39.920 --> 00:06:42.319
like I have like this new like obscure thing, like
123
00:06:42.600 --> 00:06:44.879
they would rather just like, okay, let's make it minimal
124
00:06:44.920 --> 00:06:47.360
and then you know, in a minor major version, like
125
00:06:47.879 --> 00:06:50.199
it's to be expected, right, We've outlined these things that's
126
00:06:50.240 --> 00:06:53.519
gone through the process. But a patch version like it's like, hey,
127
00:06:53.560 --> 00:06:56.079
we fix this thing as serious, Like you should really
128
00:06:56.879 --> 00:06:57.519
integrate this.
129
00:06:58.879 --> 00:07:01.240
Right. So if I have in my gem file just
130
00:07:01.720 --> 00:07:05.079
sidekick and I didn't specify a version and there's a
131
00:07:05.079 --> 00:07:09.079
major version update, I can do bundle update with patch
132
00:07:09.120 --> 00:07:13.160
flag and it'll just update it to the highest patch
133
00:07:13.240 --> 00:07:15.639
version and it won't do a major update.
134
00:07:15.639 --> 00:07:17.279
It won't do it won't even do the minor right,
135
00:07:17.319 --> 00:07:17.959
so it will keep it.
136
00:07:18.000 --> 00:07:20.000
If it's like three point two, it'll do that and
137
00:07:20.040 --> 00:07:21.920
then just like pump it to the latest one, which,
138
00:07:22.319 --> 00:07:22.600
to be.
139
00:07:22.560 --> 00:07:26.240
Honest, doing that with Rails maybe a little trickier because.
140
00:07:26.000 --> 00:07:27.800
It does like, yeah, Rails is fine.
141
00:07:27.879 --> 00:07:30.199
You know, it has so many patches that get released,
142
00:07:30.240 --> 00:07:32.040
so if you like fall behind, but like that's why
143
00:07:32.079 --> 00:07:34.879
you're like, if you're deploying a lot anyway, right, Like
144
00:07:35.040 --> 00:07:38.720
then like getting Rails to update itself incrementally as it
145
00:07:38.759 --> 00:07:41.279
gets updated at a patch level is not going to
146
00:07:41.319 --> 00:07:44.079
be so bad. And a lot of times, you know,
147
00:07:44.160 --> 00:07:46.279
if you have a good test case, which you know,
148
00:07:46.360 --> 00:07:49.439
let's hope everybody does, but like if you don't, like
149
00:07:49.639 --> 00:07:51.680
obviously maybe you don't want to build this into your
150
00:07:51.720 --> 00:07:54.680
deployee process. But like, if you have a good like
151
00:07:54.839 --> 00:07:58.720
test infrastructure, like doing a patch update, like it's gonna
152
00:07:58.920 --> 00:08:01.480
be almost nothing and you'll catch most of the issues
153
00:08:01.800 --> 00:08:06.480
in any of the test files applications.
154
00:08:06.519 --> 00:08:09.519
What if they deplicate things in a I know it's
155
00:08:09.519 --> 00:08:11.759
shit they shouldn't, but sometimes they do, and then your
156
00:08:11.800 --> 00:08:15.360
logs are littered with all of the deplication warnings, right,
157
00:08:15.480 --> 00:08:16.279
and then you're.
158
00:08:16.079 --> 00:08:22.959
Like, I mean, personally, I would rather have it be
159
00:08:23.279 --> 00:08:27.920
secure than like, uh, you know, worry about all the
160
00:08:27.959 --> 00:08:32.320
proposity of the outputs, right, Like I feel like, you know, yeah,
161
00:08:32.799 --> 00:08:35.360
littered logs is not great to deal with, but like
162
00:08:35.799 --> 00:08:38.720
it's honestly better than the alternative of having like a
163
00:08:38.720 --> 00:08:42.720
security hole and then like getting like you know, page
164
00:08:42.720 --> 00:08:44.639
your duty in the middle of the night, like, hey,
165
00:08:44.759 --> 00:08:47.159
somebody took advantage of this. We need to like start
166
00:08:47.200 --> 00:08:49.919
an incident response, right Like, yeah.
167
00:08:49.720 --> 00:08:53.080
But that's why you should use bundle audit or depend
168
00:08:53.120 --> 00:08:55.960
on what we the security updates, because then even though
169
00:08:55.960 --> 00:08:58.240
it's a patrities, you will notified that this is an
170
00:08:58.240 --> 00:09:02.159
important paturities you need to do this upgrade.
171
00:09:02.519 --> 00:09:04.200
Yeah, So I'm curious what your thoughts are there, Like
172
00:09:05.440 --> 00:09:08.519
is that the best like approach still today is like
173
00:09:08.679 --> 00:09:12.879
using the audit feature, Like what is your workflow?
174
00:09:13.240 --> 00:09:15.000
Like, look like that's.
175
00:09:14.759 --> 00:09:17.120
What I use. It's running on CI and it's running
176
00:09:17.120 --> 00:09:21.279
also in development in a git hook and then it's
177
00:09:21.360 --> 00:09:24.240
just you not divide imitated also on cil of people.
178
00:09:24.279 --> 00:09:26.480
What they forget is they sell it up to run
179
00:09:26.519 --> 00:09:31.559
on the Magic Quest or Poor Requests, whichever geitos they use,
180
00:09:32.240 --> 00:09:35.440
but they don't run it daily on the master or
181
00:09:35.519 --> 00:09:37.879
main branch, which is if you don't deplay every day.
182
00:09:37.919 --> 00:09:41.159
If you don't match requests every day, then you might
183
00:09:41.240 --> 00:09:44.080
not be notified about an important secretaries. So it's a
184
00:09:44.080 --> 00:09:46.159
good idea to actually the way I sell it up,
185
00:09:46.200 --> 00:09:48.679
if I have the chance to set up anywhere, run
186
00:09:48.720 --> 00:09:51.159
it twice a day on the master branch, and run
187
00:09:51.200 --> 00:09:55.279
it on every poor quest MARGC quest M because then
188
00:09:55.320 --> 00:09:58.559
you all anyways also like weekends, so if it's on
189
00:09:58.600 --> 00:10:01.480
a weekend, really something on a Saturday, you don't getting
190
00:10:01.480 --> 00:10:03.159
notified if you.
191
00:10:05.039 --> 00:10:10.240
Right, and it'll it'll fail the build if if it
192
00:10:10.279 --> 00:10:11.600
doesn't pass the audit right.
193
00:10:12.320 --> 00:10:14.799
Yeah, and if it fails a musta but you are
194
00:10:14.799 --> 00:10:17.519
don't expect the old day, we'll get an need imlification
195
00:10:17.600 --> 00:10:20.240
or whatever you set up and then you know that,
196
00:10:20.320 --> 00:10:23.279
oh I need to look into this because something is up.
197
00:10:24.480 --> 00:10:25.000
Makes sense.
198
00:10:26.000 --> 00:10:28.240
Yeah, I'm just waiting for the day to have like
199
00:10:28.440 --> 00:10:32.240
you know, reels autopilot just automatic like if you have
200
00:10:32.320 --> 00:10:34.559
like a bunch of hobby projects that you're just like, oh,
201
00:10:34.639 --> 00:10:36.039
like I'm not going to spend any time on this
202
00:10:36.120 --> 00:10:39.360
for six months, like just like automatically merge any updates
203
00:10:39.360 --> 00:10:41.759
as it comes and like resolve itself, Like oh I
204
00:10:41.759 --> 00:10:43.399
would love that and then just come back and then
205
00:10:43.440 --> 00:10:45.720
you know, if when I'm ready to work on it again,
206
00:10:45.840 --> 00:10:47.519
at least it's up to date and I can like
207
00:10:47.639 --> 00:10:50.480
resolve any issues that there are. Right, But you know,
208
00:10:50.559 --> 00:10:53.320
every single time I go back to a hobby project
209
00:10:53.320 --> 00:10:55.799
and I'm like, shit, I can't spend any time on
210
00:10:55.799 --> 00:10:57.840
this because I gotta spend the time update again, and
211
00:10:57.840 --> 00:10:58.720
then I lose that.
212
00:10:58.879 --> 00:11:02.960
Like you know, uh, you should very depend I think
213
00:11:03.000 --> 00:11:06.320
dependab What doesn't You can set it automatic? Yeah you can.
214
00:11:06.399 --> 00:11:09.840
You can, yeah, yeah, for for a patch level, and
215
00:11:10.159 --> 00:11:11.679
maybe you can do it for mine, and maybe you
216
00:11:11.720 --> 00:11:13.159
can do it for every level. I don't know, but
217
00:11:13.240 --> 00:11:16.000
you can do it for sure, and then yeah it
218
00:11:16.360 --> 00:11:21.080
is everything. Things might break because you might not get
219
00:11:21.120 --> 00:11:24.159
it with the test, but there is you never know.
220
00:11:24.360 --> 00:11:26.559
I don't, right, I don't. Maybe it's just me that
221
00:11:26.600 --> 00:11:29.519
this is why I also don't trust AI. It's I
222
00:11:29.600 --> 00:11:33.000
just I trust humans more for some reason, there's some
223
00:11:33.200 --> 00:11:36.720
human oversight. I trust that process like an order of
224
00:11:36.799 --> 00:11:39.759
magnitude more than if it's just something wholly automated.
225
00:11:41.080 --> 00:11:44.360
Yeah. I think it's getting better, but I don't blame
226
00:11:44.399 --> 00:11:44.799
you there.
227
00:11:45.799 --> 00:11:50.120
Yeah, yeah, I've been liking the review process so like automate,
228
00:11:50.159 --> 00:11:53.159
but review, so like you know, well, all just like
229
00:11:53.200 --> 00:11:55.519
set out a plan and then like the okay, I
230
00:11:55.559 --> 00:11:58.720
executed all the plan and then notify you okay, review this.
231
00:11:59.480 --> 00:12:02.200
I did the things right right, and then if you do,
232
00:12:02.320 --> 00:12:04.919
like decide not to review it, like okay, Well that's
233
00:12:05.080 --> 00:12:07.440
the same as like working with a coworker that did
234
00:12:07.480 --> 00:12:09.360
the same thing right and you didn't review it and
235
00:12:09.399 --> 00:12:10.559
they did it anyway right.
236
00:12:11.720 --> 00:12:16.480
Yeah, definitely, But also from a human I expect more
237
00:12:16.519 --> 00:12:19.799
than from a So with AI, my issue is that
238
00:12:19.919 --> 00:12:21.840
I write a piece of code, right, I asked him
239
00:12:21.879 --> 00:12:24.440
can you refractor this to me? It speeds back a
240
00:12:24.480 --> 00:12:28.720
bunch of changes which I need to review. And if
241
00:12:28.759 --> 00:12:31.480
I ask a junior developer can you work on this feature?
242
00:12:31.600 --> 00:12:34.000
They work, They submit to polly quest and if they
243
00:12:34.039 --> 00:12:36.639
are uncertain about some things which they did, they will
244
00:12:36.679 --> 00:12:39.360
highlight that here is my polly quest, but I'm not
245
00:12:39.399 --> 00:12:43.000
really sure about this part. Can you review that more totally?
246
00:12:44.000 --> 00:12:46.600
But yeah, doesn't do that. It's confidently saying this is
247
00:12:46.639 --> 00:12:50.080
the solution, and they are like, okay, it's like fifty
248
00:12:50.240 --> 00:12:53.360
lines of changes. Am I going to focus on each
249
00:12:53.360 --> 00:12:53.919
fifty line?
250
00:12:54.200 --> 00:12:56.679
You bring up a great point maybe what we're missing
251
00:12:56.919 --> 00:13:00.559
is a junior AI right, like that has it in
252
00:13:01.000 --> 00:13:03.679
I am not confident, I don't know what I'm doing.
253
00:13:04.039 --> 00:13:07.480
And then IT can, you know, be maybe a little
254
00:13:07.480 --> 00:13:08.159
more cautious.
255
00:13:08.799 --> 00:13:10.480
I think you're onto something there or.
256
00:13:10.600 --> 00:13:12.799
Vey or vade what it gives it, because it can
257
00:13:12.840 --> 00:13:15.919
be confident about some parts which are like basic or
258
00:13:16.360 --> 00:13:18.440
or it knows it too well. But if you are
259
00:13:18.480 --> 00:13:21.320
a little bit uncertain about something, highlight that, so I
260
00:13:21.399 --> 00:13:23.600
carry you that more.
261
00:13:24.279 --> 00:13:26.759
Yeah. The issue that I run into though, is that
262
00:13:26.840 --> 00:13:28.679
a lot of times what I get back from AI,
263
00:13:30.320 --> 00:13:32.399
I'm not confident that A it would flag the right
264
00:13:32.440 --> 00:13:35.600
things or B that a lot of times I get
265
00:13:35.639 --> 00:13:39.480
code back that it's like it's like, yeah, like the
266
00:13:39.559 --> 00:13:42.080
general structure as far as like I have to loop
267
00:13:42.120 --> 00:13:44.120
over these things, or I have to make this kind
268
00:13:44.159 --> 00:13:47.039
of a request or you know, call into this API
269
00:13:47.679 --> 00:13:50.200
is generally correct, and then the rest of it it's
270
00:13:50.240 --> 00:13:53.879
it's it may as well have written pseudo code, right,
271
00:13:53.960 --> 00:13:57.960
And it's like it's like you guessed at the method
272
00:13:58.039 --> 00:14:01.000
name instead of looking it up what a human would do,
273
00:14:01.080 --> 00:14:05.080
they'd go look it up. How do I whatever? Anyway,
274
00:14:05.120 --> 00:14:06.759
we're off on a tangent I want to get back
275
00:14:06.799 --> 00:14:13.120
to security. So so the catabot is in there by default.
276
00:14:14.240 --> 00:14:17.559
You can use bundle audit if you want instead and
277
00:14:17.559 --> 00:14:18.559
put that into your CI.
278
00:14:19.200 --> 00:14:22.799
What else do we get on the change is really
279
00:14:22.799 --> 00:14:26.720
similar is Brakeman. It's also got a default CI file.
280
00:14:26.960 --> 00:14:30.519
So Breakman is a static code analyzer for security issues.
281
00:14:31.039 --> 00:14:34.080
It basically highlights code spots where you might do something
282
00:14:34.080 --> 00:14:38.000
which is insecure. I think that's also a great addition.
283
00:14:38.240 --> 00:14:40.879
It gives you false positives, you can ignore those, but
284
00:14:40.919 --> 00:14:43.879
it at least makes you aver of certain things. That
285
00:14:43.960 --> 00:14:46.080
saves you from sidy mistakes. It's so easy to make
286
00:14:46.120 --> 00:14:49.039
a silly mistake which you don't realize you use an
287
00:14:49.039 --> 00:14:52.600
insect an API and insecure way because you just forget
288
00:14:52.639 --> 00:14:55.919
about something, and it just saves you from those issues.
289
00:14:56.600 --> 00:14:59.320
I think that's also a great change or great addition.
290
00:15:00.840 --> 00:15:03.320
The thing I like about Breakman is that, yeah, it
291
00:15:03.320 --> 00:15:07.440
gives you false positives, but like all of the commonly
292
00:15:07.519 --> 00:15:11.200
understood bad things you can do, or the the traps
293
00:15:11.200 --> 00:15:13.639
that you more easily fall into, it's got all of
294
00:15:13.639 --> 00:15:15.679
that in there. And so yeah, I might give you
295
00:15:15.679 --> 00:15:17.720
a false positive and say this is insecure, and you
296
00:15:17.759 --> 00:15:19.279
look at it and you go, no, I'm not doing
297
00:15:19.320 --> 00:15:22.720
what you think I'm doing. But it catches the really
298
00:15:22.759 --> 00:15:23.799
easy dumb stuff.
299
00:15:24.360 --> 00:15:30.799
Yeah, yeah, definitely. And the next one is which is
300
00:15:30.840 --> 00:15:33.320
a new feature in this it's the rate limiting, the
301
00:15:33.399 --> 00:15:37.080
built in rate limiting. Sure you guys heard about that one.
302
00:15:37.480 --> 00:15:42.000
And I don't know how many times.
303
00:15:41.720 --> 00:15:44.039
But I don't know how many times I'm built rate limiting.
304
00:15:45.279 --> 00:15:49.440
I've got an app that I want to build to
305
00:15:49.600 --> 00:15:52.600
replace a process we went through last year. It's part
306
00:15:52.600 --> 00:15:55.679
of my political stuff, but letting people register for our
307
00:15:55.720 --> 00:15:58.840
caucus night in Utah, we get we having like nine
308
00:15:58.919 --> 00:16:03.159
hundred thousand party members that are eligible to attend our
309
00:16:03.159 --> 00:16:08.200
caucus meetings, and we got ddasked last year by somebody
310
00:16:08.200 --> 00:16:11.559
who doesn't like the party. And so I'm wondering if
311
00:16:11.600 --> 00:16:12.559
something like this will help.
312
00:16:14.159 --> 00:16:17.000
It could help, but it might not have for a
313
00:16:17.080 --> 00:16:20.159
DDA setech. I think it's a you would need something
314
00:16:20.240 --> 00:16:21.639
like cloud fare, which.
315
00:16:21.559 --> 00:16:23.679
That's what That's what I'm seriously looking at.
316
00:16:23.679 --> 00:16:26.600
But yeah, so for what this one is good for.
317
00:16:27.000 --> 00:16:29.120
The thing this one is good for eight limiting is
318
00:16:29.320 --> 00:16:32.399
save you from creditial stuff in attacks. For instance, you
319
00:16:32.440 --> 00:16:35.360
know when there is a league password database, and then
320
00:16:35.399 --> 00:16:38.759
a malicious ouctors will try to use all of those
321
00:16:38.840 --> 00:16:41.279
logging details on your side to see if the same
322
00:16:41.320 --> 00:16:44.240
person has an account with the same credentials and then
323
00:16:44.240 --> 00:16:46.720
they oh, I gotcha, and then they can take over
324
00:16:46.799 --> 00:16:50.320
doct and do whatever malicius things. And in my talk
325
00:16:50.399 --> 00:16:53.480
I highlighted a few examples from it's actually now the
326
00:16:53.639 --> 00:16:56.799
three years ago from twenty to twenty three, it was
327
00:16:56.840 --> 00:16:59.799
the year before, like twenty three, and Meter the DNA
328
00:17:00.600 --> 00:17:05.720
they analyze this side, they had an issue with this. Also,
329
00:17:06.039 --> 00:17:08.519
General Motors had a big issue. They had a bunch
330
00:17:08.519 --> 00:17:11.960
of account taken over and like Credit partially credit card
331
00:17:11.960 --> 00:17:16.599
details leaked, and Roku the streaming platform also had like
332
00:17:16.680 --> 00:17:20.559
half a million of their users access details were leaked
333
00:17:20.880 --> 00:17:25.720
because of our credentials stuff creditial stuff in attack. So
334
00:17:25.759 --> 00:17:27.960
I think there's a very good addition trails to prevent
335
00:17:28.000 --> 00:17:31.119
all of these issues. We already had wreck attack, which
336
00:17:31.160 --> 00:17:33.920
is a jam. It's a very old jam, but a
337
00:17:33.920 --> 00:17:36.440
lot of people don't know about that. And this is
338
00:17:36.440 --> 00:17:38.599
why I really like these changes in rails because once
339
00:17:38.640 --> 00:17:42.400
it's in rail score, a lot of people are becoming
340
00:17:42.480 --> 00:17:45.640
aware of these issues, which they these too solve and
341
00:17:45.720 --> 00:17:47.960
it might not be the best for that team or
342
00:17:47.960 --> 00:17:49.960
that person, but at least now they are oh, I
343
00:17:50.000 --> 00:17:53.599
need to think about credential stuffing, and then they find
344
00:17:53.640 --> 00:17:55.880
out a solution which works for them.
345
00:17:56.319 --> 00:17:59.039
So is this in RAILS seven to or is this
346
00:17:59.119 --> 00:17:59.799
in Rails eight.
347
00:18:00.559 --> 00:18:03.440
It's in Rael seven too. It got some improvements which
348
00:18:03.480 --> 00:18:08.720
only landed in Rals eight. And it's really simple. You
349
00:18:08.799 --> 00:18:12.119
add a single line to your controller and you just
350
00:18:12.200 --> 00:18:16.160
set the You set that the two parameter, which is
351
00:18:16.200 --> 00:18:18.720
how many requests you want to allow, and you set
352
00:18:18.799 --> 00:18:21.359
the wedding, which is like the timeframe. Let's say you
353
00:18:21.440 --> 00:18:24.599
want to allow ten requests within ten within three minutes
354
00:18:24.640 --> 00:18:28.000
from the same user, and then that's it, and then
355
00:18:28.039 --> 00:18:32.000
you have great limiting. You can also configure which actions
356
00:18:32.039 --> 00:18:34.359
you want it to be called on. It's like a
357
00:18:34.359 --> 00:18:37.440
before filter in the control aft. You can set if
358
00:18:37.440 --> 00:18:40.200
you want to exclude any actions or if you want
359
00:18:40.240 --> 00:18:44.440
to include only set in actions. You can also configure
360
00:18:44.559 --> 00:18:48.759
a custom response because by default it raised a four
361
00:18:48.839 --> 00:18:53.359
to nine header, and then you can change that and
362
00:18:53.519 --> 00:18:57.279
just redirect to a page, display a message or whatever
363
00:18:57.359 --> 00:19:02.960
you want to do. Also another important thing to mention initially,
364
00:19:03.119 --> 00:19:06.519
but the first implementation used reddis but then it's been
365
00:19:06.559 --> 00:19:10.640
rewritten and now this storage the back end is any
366
00:19:11.200 --> 00:19:15.400
rare cash compatible storage can work, so you can use
367
00:19:15.440 --> 00:19:20.000
the solid cash or whatever you want and you don't
368
00:19:20.039 --> 00:19:23.000
need to you don't need to have reddie as a dependency.
369
00:19:25.279 --> 00:19:27.759
I love that move away from reddis.
370
00:19:28.240 --> 00:19:31.519
The storage patterns across the border just really great to
371
00:19:31.519 --> 00:19:37.039
see it become more cohesive. I really like this byeline
372
00:19:37.079 --> 00:19:40.039
to give it a product and say like, hey, you
373
00:19:40.079 --> 00:19:43.480
know rate limited, biop or whatever you want to filter
374
00:19:43.799 --> 00:19:44.200
scope to.
375
00:19:45.839 --> 00:19:49.240
Yeah, if you would want to have something like cloud flare,
376
00:19:49.400 --> 00:19:52.119
you could achieve that using that parameter. So you would
377
00:19:52.119 --> 00:19:54.720
set a cookie and then you would rately meet by
378
00:19:54.759 --> 00:19:58.920
that cookie, and then you can handle more propell adidos
379
00:19:58.960 --> 00:20:01.200
attack as well. Otherwise, if you do it by the
380
00:20:01.240 --> 00:20:05.200
ip adidos is usually they use a whole range of ideas.
381
00:20:05.799 --> 00:20:07.799
It's one client, so if you set a cookie on
382
00:20:07.880 --> 00:20:10.960
that client, then you can identify the same client from
383
00:20:11.039 --> 00:20:11.880
a different idea.
384
00:20:13.799 --> 00:20:17.519
Yeah, I'm liking where this is going for sure. I
385
00:20:17.519 --> 00:20:20.039
think cloud flare is probably the best answer for what
386
00:20:20.039 --> 00:20:23.880
I'm looking for, but I like this to manage your
387
00:20:23.920 --> 00:20:26.079
credential stuffing and things like that.
388
00:20:27.119 --> 00:20:29.880
Yeah, my only problem with cloud Flare. I love them.
389
00:20:30.039 --> 00:20:34.279
They're really cool. It's very cheap, but I think now
390
00:20:34.279 --> 00:20:37.279
they are swallowing a big part of the Internet and
391
00:20:37.400 --> 00:20:39.599
maybe one day they will say, Okay, now we are
392
00:20:39.640 --> 00:20:45.440
greedy and now start an extortion amount on everybody. Let's
393
00:20:45.480 --> 00:20:49.680
hope they never do this, but it happened before, and
394
00:20:49.720 --> 00:20:52.000
they might say, yeah, now we want all the money
395
00:20:52.079 --> 00:20:54.839
and now you rely on us. There is nowhere else
396
00:20:54.920 --> 00:20:58.680
to go, or the small competitors are gone and I
397
00:20:58.799 --> 00:21:02.440
need to pay us a lot. But let's hope they
398
00:21:02.440 --> 00:21:03.319
are not going to do that.
399
00:21:04.240 --> 00:21:04.440
Yeah.
400
00:21:07.440 --> 00:21:09.839
Cool. And so the next thing I mentioned in the
401
00:21:09.920 --> 00:21:14.039
talk was the new authentication generator in rails.
402
00:21:14.279 --> 00:21:15.039
Oh I love this.
403
00:21:16.480 --> 00:21:20.079
Yeah, well, we had another one before. It's called Authentication zero,
404
00:21:20.359 --> 00:21:25.480
which is wasn't in reels. It was done by forget
405
00:21:25.519 --> 00:21:27.359
the name of the guy. He's a Brasadian guy. I
406
00:21:27.519 --> 00:21:31.960
probably can't even pronounce his name properly. Lazarro Nixon, I think,
407
00:21:32.279 --> 00:21:35.440
or something like that, but I'm sure my pronunciation is
408
00:21:35.480 --> 00:21:37.920
not correct, So sorry.
409
00:21:37.599 --> 00:21:39.359
For Yeah, it was an awesome project.
410
00:21:40.079 --> 00:21:43.200
Yes it's still it's still a great project and it
411
00:21:43.319 --> 00:21:47.200
does more. But the building in Rails generator. But the
412
00:21:47.240 --> 00:21:50.039
thing is, even though the generator was there, other people
413
00:21:50.079 --> 00:21:52.759
don't know about it. Now that res has a built
414
00:21:52.799 --> 00:21:54.720
in one, a lot of people are ever, oh, we
415
00:21:54.799 --> 00:21:57.640
can have an authentication generator, and they might say the
416
00:21:57.680 --> 00:21:59.880
build in Rails, but is not for me that they
417
00:22:00.039 --> 00:22:03.160
find the other one or other alternatives. So this is
418
00:22:03.200 --> 00:22:07.599
why I love getting these features into Rails. And the
419
00:22:08.000 --> 00:22:14.279
building one in Rails doesn't have registration and what else.
420
00:22:14.640 --> 00:22:17.880
It doesn't have a few features which you would expect
421
00:22:17.880 --> 00:22:21.759
from an authentication flow because I think the reason for
422
00:22:21.839 --> 00:22:24.079
that is the core team believes that they are custom
423
00:22:24.279 --> 00:22:28.279
for applications usually like sign up. It might it's very
424
00:22:28.279 --> 00:22:31.519
different for all of applications, so they expect you to
425
00:22:31.559 --> 00:22:35.680
implement that on your own. But this authentication zero, for instance,
426
00:22:35.720 --> 00:22:38.000
it generates all of those parts as well. If you
427
00:22:38.200 --> 00:22:41.480
are into a fully flashed you just want your own code,
428
00:22:41.680 --> 00:22:44.119
the code to sit in the repository, but you don't
429
00:22:44.160 --> 00:22:46.039
want to write a line of code. I think that's
430
00:22:46.079 --> 00:22:49.160
a better option. If you want to have something custom
431
00:22:49.279 --> 00:22:53.000
and use just Rails generated stuff, then go with the
432
00:22:53.000 --> 00:22:54.759
built in Rails one.
433
00:22:55.440 --> 00:22:57.680
Yeah, I'm working on a generator of my own that
434
00:22:58.240 --> 00:23:01.000
will generate the views. I don't like the views that
435
00:23:01.039 --> 00:23:05.319
I got when I ran the rails generator, But yeah,
436
00:23:05.359 --> 00:23:09.039
I mean just it's it's basically I would like to
437
00:23:09.039 --> 00:23:11.799
build the tool build things that run on top of
438
00:23:11.839 --> 00:23:14.720
the built in rails generator because I think it does
439
00:23:15.759 --> 00:23:16.720
a really good job.
440
00:23:17.519 --> 00:23:19.480
Yep, I'm curious here.
441
00:23:19.519 --> 00:23:23.000
I love your insight, Greg, I know it's it does
442
00:23:23.079 --> 00:23:28.000
like passwords as like the default for the generation. Uh,
443
00:23:28.960 --> 00:23:32.680
how do you feel about you know, passwords with users?
444
00:23:33.079 --> 00:23:34.920
Like I know there's a lot of talk around this,
445
00:23:35.160 --> 00:23:38.160
like do we go password lists pass keys for the
446
00:23:38.200 --> 00:23:41.079
future for a bit, like you know, where where do
447
00:23:41.160 --> 00:23:45.559
you see like the industry like coming together or is
448
00:23:45.599 --> 00:23:48.640
it still kind of like a little bit uncertain.
449
00:23:48.839 --> 00:23:52.240
Or the oaths that's the other one. Somebody else is
450
00:23:52.279 --> 00:23:56.000
managing your credentials and SAP or whatever it is. You
451
00:23:56.039 --> 00:23:58.000
have a token from them and you authenticate them on
452
00:23:58.039 --> 00:23:58.400
the token.
453
00:23:59.279 --> 00:24:03.119
Yeah. I on both of those cases, I think I
454
00:24:03.359 --> 00:24:06.440
might not be the mainstream with my opinion. So for
455
00:24:06.680 --> 00:24:09.240
pest keys, I love peskys. I use a ubiki for
456
00:24:09.359 --> 00:24:12.920
two factor authentication. I think it's amazing for that because
457
00:24:12.960 --> 00:24:16.000
for that you can have multiple options. For instance, I
458
00:24:16.160 --> 00:24:19.519
have a Ubiki, but I have two laptops, so sometimes
459
00:24:19.559 --> 00:24:22.799
I don't have my Ubiki with me, and I have
460
00:24:22.799 --> 00:24:24.640
two Ubi keys, but I keep on as a backup
461
00:24:24.640 --> 00:24:27.240
at home, so I never really that's not in a laptop.
462
00:24:27.279 --> 00:24:29.160
That's just if I if my brakes, I can use
463
00:24:29.160 --> 00:24:32.240
that one. So I have multiple authentication two factor autification
464
00:24:32.319 --> 00:24:34.519
set up at most services. I can use my phone
465
00:24:34.960 --> 00:24:37.279
within the app on my phone, or I can use
466
00:24:37.319 --> 00:24:40.440
the Uiki, which is much more convenient when I'm at home.
467
00:24:40.480 --> 00:24:44.319
I just touch it and then it's done. But for
468
00:24:45.039 --> 00:24:48.079
whole authentication, I think there are a bunch of things
469
00:24:48.119 --> 00:24:51.839
which are not so easily resolved, like what are you
470
00:24:51.960 --> 00:24:55.759
doing with the logging in on your iPhone and on
471
00:24:55.799 --> 00:25:00.640
your Windows laptop with the same pestky because you contantly
472
00:25:00.640 --> 00:25:03.359
transferred between divis. You can if you're on iOS and
473
00:25:03.480 --> 00:25:06.599
Mac with everything, it's it's amazing, it's fine, it's convenient,
474
00:25:06.720 --> 00:25:09.400
everything is in the whole ecosystem. But what if you
475
00:25:09.480 --> 00:25:12.960
have an Entrade phone and the MacBook or it's not
476
00:25:13.079 --> 00:25:17.160
so easy to transfer your credentials between different services. That's
477
00:25:17.200 --> 00:25:20.160
my main problem with pastkis. It will be probably solved
478
00:25:20.240 --> 00:25:23.640
eventually in the future, then I will be all for paskis.
479
00:25:23.640 --> 00:25:28.279
But since then, I think it's not so easy to
480
00:25:28.440 --> 00:25:30.319
handle all of those edge cases.
481
00:25:31.240 --> 00:25:34.079
Yeah. One thing that I'm wondering that along the lines
482
00:25:34.079 --> 00:25:37.279
of what Valentino's asking though, is that it seems like
483
00:25:37.559 --> 00:25:43.319
when folks credentials get compromised, it's it is the password, right,
484
00:25:43.359 --> 00:25:45.400
It's hey, here's a username and a password that'll get
485
00:25:45.440 --> 00:25:50.680
you into the website. So do you favor more passwordless options?
486
00:25:50.799 --> 00:25:53.480
I mean, that's what the past key is. But you've
487
00:25:53.480 --> 00:25:57.119
also got like magic links or you know, hey, here's
488
00:25:57.160 --> 00:25:59.480
an email and we're going to send you one time
489
00:25:59.519 --> 00:26:02.119
password or any of that. Like is that any more
490
00:26:02.160 --> 00:26:03.920
secure or is that just an illusion?
491
00:26:04.440 --> 00:26:06.799
In my opinion, not at all, because if I get
492
00:26:06.799 --> 00:26:09.119
access to your email account, I have the keys to
493
00:26:09.160 --> 00:26:13.559
all of your accounts, right, But usually so it's not
494
00:26:13.680 --> 00:26:16.960
that clear because also if all of the sites you
495
00:26:17.079 --> 00:26:20.119
signed up for support a password is set by email,
496
00:26:20.400 --> 00:26:22.960
then I can also take our right. So I think
497
00:26:22.960 --> 00:26:25.839
the solution for all of this is multi factor authentication,
498
00:26:27.119 --> 00:26:30.000
because even with pest keys, what if my laptop gets
499
00:26:30.039 --> 00:26:35.839
stolen and store in the state when it's open, and
500
00:26:35.880 --> 00:26:39.079
then they have access to all of my all I have, right,
501
00:26:39.519 --> 00:26:41.960
Usually this is why it should be something you know
502
00:26:42.200 --> 00:26:45.319
and something you have access to, because my one password
503
00:26:45.720 --> 00:26:48.400
shuts it down after five minutes or whatever. If someone
504
00:26:48.400 --> 00:26:50.440
gets access to my loptop, they can't get access to
505
00:26:50.440 --> 00:26:53.279
my passwords. They can access to my ubiki because it's
506
00:26:53.279 --> 00:26:55.440
plugged into the laptop, but they don't have the passwords.
507
00:26:55.440 --> 00:26:58.519
So I still have two things which they can only
508
00:26:58.519 --> 00:27:01.839
get one of them, save me the email. When someone's
509
00:27:01.880 --> 00:27:06.160
exited the email, they can take over your raccon. But
510
00:27:06.240 --> 00:27:08.720
this is the same if it's only pest words, So
511
00:27:09.720 --> 00:27:12.480
just pestwords on their own. I don't think they are
512
00:27:12.920 --> 00:27:13.519
good enough.
513
00:27:14.720 --> 00:27:20.640
So the other piece of this for me is how
514
00:27:20.640 --> 00:27:25.039
do I put this. I'm super cheap, and so like
515
00:27:25.160 --> 00:27:31.000
Riverside for example, right, I could set up an account
516
00:27:31.039 --> 00:27:32.960
for every single one of the hosts to be able
517
00:27:33.000 --> 00:27:36.440
to start the podcast, but realistically that's a lot more
518
00:27:36.480 --> 00:27:40.039
expensive than setting up, you know, a couple of generic
519
00:27:40.119 --> 00:27:44.240
host accounts. But then you know, how do you set
520
00:27:44.279 --> 00:27:48.720
up third party authentication for shared accounts or two factor
521
00:27:48.720 --> 00:27:52.200
authentication for shared accounts? That that's been the rub, right,
522
00:27:52.240 --> 00:27:55.240
and so I tend to not turn it on and
523
00:27:55.279 --> 00:27:58.440
then essentially just trust the people that I've shared the
524
00:27:58.440 --> 00:28:00.400
password out to because I don't have a better way
525
00:28:00.400 --> 00:28:00.839
to do it.
526
00:28:02.119 --> 00:28:06.640
You can do that. Actually, so I'm working on something
527
00:28:06.680 --> 00:28:09.039
with a team where we have the same problem and
528
00:28:09.319 --> 00:28:12.359
the wave has resolved it. You know, if you set
529
00:28:12.440 --> 00:28:16.400
up two factor authentication with an authenticator app, it's just
530
00:28:16.480 --> 00:28:18.480
you just need a seed and it generates it token
531
00:28:18.559 --> 00:28:20.759
based on that seed. So we have that saved and
532
00:28:20.799 --> 00:28:22.960
whenever you want to share that to favor with someone,
533
00:28:23.240 --> 00:28:25.519
he gets the seed and he can have the same
534
00:28:25.559 --> 00:28:31.039
setup on their phone. And then you have authenticate po
535
00:28:31.119 --> 00:28:33.720
multiple devices for multiple people so they can still have
536
00:28:33.759 --> 00:28:34.559
the second factor.
537
00:28:36.519 --> 00:28:37.359
That makes sense.
538
00:28:37.960 --> 00:28:38.720
That's really cool.
539
00:28:39.200 --> 00:28:41.559
That's that's been the piece that I've been missing is Yeah,
540
00:28:41.640 --> 00:28:45.000
it's like, okay, how do I share the second factor
541
00:28:45.000 --> 00:28:46.200
of two factor authentication?
542
00:28:46.680 --> 00:28:49.279
Or you can go down the other way, which I
543
00:28:49.319 --> 00:28:52.400
don't recommend, but it's quite popular. You use something like
544
00:28:52.440 --> 00:28:54.519
one password where you can share.
545
00:28:55.720 --> 00:28:58.119
That's essentially what I've been doing because I've been sharing
546
00:28:58.119 --> 00:28:59.799
the password out of one password.
547
00:28:59.759 --> 00:29:02.000
Pro and with dead then it's not too factor because
548
00:29:02.000 --> 00:29:04.640
you have the password and the second factor at the
549
00:29:04.680 --> 00:29:08.319
same place. Anybody gets access to that one, they have
550
00:29:08.839 --> 00:29:11.759
everything they need to look I like to separate these
551
00:29:12.000 --> 00:29:13.279
the factors from each other.
552
00:29:14.559 --> 00:29:18.599
Well that's the whole idea. Yeah, and may have preempted
553
00:29:18.640 --> 00:29:20.960
other questions from Valentino, so I'll let them keep.
554
00:29:23.039 --> 00:29:26.480
On the topic of outsourcing your authentication. I don't think
555
00:29:26.480 --> 00:29:28.960
that's a good idea. Actually the Q and A somebody
556
00:29:28.960 --> 00:29:32.880
asked me about this, and Octa is one of very
557
00:29:32.920 --> 00:29:36.400
popular service for outsourcinger authentication.
558
00:29:36.240 --> 00:29:39.160
Octa and zero but at zeros owned by Octa these days.
559
00:29:39.200 --> 00:29:42.559
So yes, So they had breaches in the past, and
560
00:29:42.599 --> 00:29:45.720
they just had a breach after my conference talk again,
561
00:29:46.319 --> 00:29:48.240
not a bridge with a security incident, but they had
562
00:29:48.240 --> 00:29:53.920
a proper breach a few months before the conference, And I.
563
00:29:53.759 --> 00:30:02.119
Think, yeah, i' kind of like the approach like single
564
00:30:02.119 --> 00:30:05.160
sign on took in that. It's like, at least there's
565
00:30:05.599 --> 00:30:08.759
a rollover approach, right, Like, Okay, if they if you've
566
00:30:08.799 --> 00:30:12.119
been identified of a breach, like you can invalidate everything
567
00:30:12.279 --> 00:30:16.079
that's in that, right, But.
568
00:30:16.039 --> 00:30:18.039
If you're a past word nagin and you have unique
569
00:30:18.039 --> 00:30:20.839
pestwords everywhere, if you are in a bridge, it doesn't
570
00:30:20.880 --> 00:30:22.920
really matter because they don't have the old.
571
00:30:22.759 --> 00:30:24.440
Password, right, That's true.
572
00:30:24.960 --> 00:30:28.039
And my problem with UKTA is their altitude. I think,
573
00:30:28.119 --> 00:30:31.000
even though they are a security company, they are more
574
00:30:31.480 --> 00:30:35.319
money and profit oriented than security oriented. That's what I
575
00:30:35.400 --> 00:30:38.799
see from their behavior. They might not like that opinion,
576
00:30:38.880 --> 00:30:42.079
but that's what I see, and I think they they
577
00:30:42.160 --> 00:30:46.240
care more about sales than actually making a security and
578
00:30:46.279 --> 00:30:48.119
you can see that from the secretitysies they had in
579
00:30:48.160 --> 00:30:50.920
the past, because some of them is I don't want
580
00:30:50.960 --> 00:30:53.920
to be rude, or just because everybody makes mistakes, but
581
00:30:54.000 --> 00:30:56.440
some of it you wouldn't expect from a security company.
582
00:30:57.640 --> 00:31:00.319
Yeah, I will say so. When I started building top
583
00:31:00.400 --> 00:31:04.039
end devs, I was using off zero and I had
584
00:31:04.079 --> 00:31:06.759
two problems. Well I had more than two problems, but
585
00:31:07.079 --> 00:31:09.720
a couple of the problems came into if they were down,
586
00:31:09.759 --> 00:31:13.799
I was down. It was one right because nobody could
587
00:31:13.839 --> 00:31:17.599
authenticate Y. The other issue that I ran into was
588
00:31:18.599 --> 00:31:22.720
it was way more complicated than just allowing people to
589
00:31:22.720 --> 00:31:27.200
have passwords in my own system using device or you know,
590
00:31:27.319 --> 00:31:29.480
building my own these days, I just rolled my own.
591
00:31:29.519 --> 00:31:33.160
I used the Rails generator and then I just put
592
00:31:33.200 --> 00:31:36.079
what I want on top of it and so so
593
00:31:36.160 --> 00:31:40.599
it was just overkill. And then the last issue was
594
00:31:42.720 --> 00:31:46.319
I mean literally literally anytime I had any kind of
595
00:31:46.359 --> 00:31:50.759
problem like it. Yeah, it wasn't just the complications, and
596
00:31:50.799 --> 00:31:52.640
it wasn't just that I was down when they were down,
597
00:31:52.960 --> 00:31:55.799
but but there were some other issues within just the
598
00:31:55.799 --> 00:31:59.160
way that I had things set up, and it was
599
00:31:59.200 --> 00:32:02.799
easy to fall into those problems and it affected everybody.
600
00:32:03.240 --> 00:32:07.000
So anyway, and sometimes if there's an issue, you can'try
601
00:32:07.079 --> 00:32:10.640
solve it because it's out of your hands. It's the
602
00:32:10.680 --> 00:32:12.920
way you implemented their integration.
603
00:32:13.920 --> 00:32:16.119
But they do a lot of things for you too,
604
00:32:16.519 --> 00:32:20.720
so you know, they do some level of authorization. They'll
605
00:32:20.759 --> 00:32:26.319
handle the third party like Google and Apple and Facebook,
606
00:32:26.599 --> 00:32:28.599
you know, whatever whoever you want to let people log
607
00:32:28.640 --> 00:32:31.720
in with gethub like, they do all of that, and
608
00:32:31.759 --> 00:32:33.039
so you don't have to go and jump through the
609
00:32:33.039 --> 00:32:36.240
hoops with an omnios right there. There are reasons why
610
00:32:36.279 --> 00:32:40.319
people go for it. You know, they're probably a little
611
00:32:40.359 --> 00:32:42.880
bit better at security than you are. But you know,
612
00:32:44.079 --> 00:32:48.799
as you're pointing out, Greg, yeah, you may not know
613
00:32:49.160 --> 00:32:52.359
the issues that they actually have because you're outsourcing it
614
00:32:52.400 --> 00:32:55.559
and trusting them instead of being in your own system
615
00:32:55.559 --> 00:33:00.960
where you can audit and verify it. So exactly, anyway,
616
00:33:01.119 --> 00:33:04.559
I see people use it. They seem to like it,
617
00:33:05.039 --> 00:33:08.519
but I think it's for those bigger apps where you're
618
00:33:08.559 --> 00:33:11.920
really looking for that enterprise level set of features. For
619
00:33:13.000 --> 00:33:14.880
the things that I was doing, it just didn't makes sense.
620
00:33:16.400 --> 00:33:19.480
Yeah. I also think it doesn't make sense for most organizations,
621
00:33:19.480 --> 00:33:22.440
but probably it does for some. I don't know. But
622
00:33:22.480 --> 00:33:24.400
even then I wouldn't go with doctor for shure. I
623
00:33:24.440 --> 00:33:27.160
haven't heard of Old zero, which is probably a good thing.
624
00:33:27.240 --> 00:33:33.400
Probably they didn't have any bread Cheese.
625
00:33:31.680 --> 00:33:34.000
Acquired zero like three or four years ago.
626
00:33:34.400 --> 00:33:36.480
So oh so it's basically the same company.
627
00:33:36.559 --> 00:33:40.039
Now it's more or less the same company. But for
628
00:33:40.799 --> 00:33:42.720
me and I think this is what you're saying too,
629
00:33:42.799 --> 00:33:46.519
is do your due diligence if you're going to pick one,
630
00:33:46.799 --> 00:33:51.279
and make sure that you know why you're going that
631
00:33:51.319 --> 00:33:53.680
way as opposed to building yourself.
632
00:33:54.519 --> 00:33:58.359
Yeah, definitely. And one more thing I wanted to mention
633
00:33:58.480 --> 00:34:02.400
about the Rails Authentication Generator is the reason I really
634
00:34:02.480 --> 00:34:05.559
like this one because res has a bunch of helpers
635
00:34:05.880 --> 00:34:10.519
which people don't know about, like has secured password. All
636
00:34:10.559 --> 00:34:15.239
of these new secure token generation methods and validation.
637
00:34:14.880 --> 00:34:18.360
Methods are so nice. Use them for here. So I'm
638
00:34:18.360 --> 00:34:20.119
going to back up for a second, because I love these,
639
00:34:20.559 --> 00:34:23.239
so I use them for all kinds of things. Right,
640
00:34:23.599 --> 00:34:26.119
People people think, oh, I have a secure token generator.
641
00:34:26.159 --> 00:34:28.679
That's you know, so I'm gonna put it in my cookie.
642
00:34:28.719 --> 00:34:31.760
Is some kind of authentication key or you know, I'm
643
00:34:31.760 --> 00:34:33.400
going to use it for this other ath and that
644
00:34:33.480 --> 00:34:37.440
other ath. But you can generate keys for anything, and
645
00:34:37.519 --> 00:34:40.599
so I've been using it. I'm trying to get to
646
00:34:40.639 --> 00:34:44.159
the point where I'm running my own premium podcast feeds,
647
00:34:44.159 --> 00:34:46.000
and it's like, hey, look, if you donate to the show,
648
00:34:46.039 --> 00:34:48.880
you'll get you know, ad free stuff, right, and so
649
00:34:48.920 --> 00:34:52.320
you can generate tokens for that. You can generate anyway.
650
00:34:52.719 --> 00:34:55.079
I don't mean to derail, but this is a really
651
00:34:55.119 --> 00:34:59.800
really handy feature. And if you if you need something
652
00:34:59.840 --> 00:35:04.039
that not guessable, then this makes it really easy to
653
00:35:04.119 --> 00:35:04.440
do it.
654
00:35:05.079 --> 00:35:08.639
Yep, and verified. It's just built in. It's just super
655
00:35:08.679 --> 00:35:14.199
easy everything. Yeah. Yeah, And I think that's why it's good,
656
00:35:14.199 --> 00:35:18.000
because you generate your authentication system and then you read
657
00:35:18.039 --> 00:35:20.639
through the code and you learn from it. You just say, oh, yeah,
658
00:35:20.679 --> 00:35:23.559
what is this helper? Never heard of this? I think
659
00:35:23.559 --> 00:35:25.480
this is also why it's good to have this. It's
660
00:35:25.519 --> 00:35:29.079
just traises, awareness of seftain Rails helpers and features which
661
00:35:29.199 --> 00:35:36.119
people wouldn't know about otherwise probably yep. And then the
662
00:35:36.119 --> 00:35:38.639
next thing I mentioned the talk is it's not really
663
00:35:38.639 --> 00:35:42.559
a technical change, but it's an important change. It's Raels
664
00:35:42.599 --> 00:35:48.039
has a new maintenance policy, which is I need to
665
00:35:48.039 --> 00:35:51.320
read this because I can't say that tell it from
666
00:35:51.360 --> 00:35:54.280
the top of my head. So every minor releases we
667
00:35:54.400 --> 00:35:57.599
receive security fixes for two years after the first ree
668
00:35:57.760 --> 00:36:01.679
is in its series, which means practically, if one point
669
00:36:01.679 --> 00:36:05.239
one point zero is really is January first in twenty
670
00:36:05.320 --> 00:36:08.199
twenty three, if we receive secretary fixes until January first,
671
00:36:08.320 --> 00:36:11.000
twenty twenty five, after that it will reach its end
672
00:36:11.039 --> 00:36:16.039
of life. So it's I think the maintenance period became shorter,
673
00:36:16.440 --> 00:36:20.079
which means that you should everybody should take upgrades seriously
674
00:36:20.159 --> 00:36:23.800
and don't stay on all versions of Rails because it's
675
00:36:23.960 --> 00:36:27.519
just it's not going to get secretary updates. They make
676
00:36:27.639 --> 00:36:32.320
exceptions sometimes, but you shouldn't rely on that. In my opinion,
677
00:36:32.360 --> 00:36:34.320
you should make sure your apps are up to date.
678
00:36:36.159 --> 00:36:38.880
Yeah, I think a lot of things have changed on
679
00:36:38.920 --> 00:36:43.920
that front. Two though, because I've worked on a handful
680
00:36:43.920 --> 00:36:45.920
of apps for clients where I had to upgrade from
681
00:36:45.920 --> 00:36:51.519
saying rails four or Rails five, right, and those upgrades
682
00:36:51.800 --> 00:36:57.599
were often rather painful for one. And the other thing
683
00:36:57.719 --> 00:37:01.880
is is that, yeah, it's just you know, it was
684
00:37:01.960 --> 00:37:03.679
kind of a giant thing and you had to take
685
00:37:03.679 --> 00:37:11.519
it on and you know, the maintenance cycle on things. Anyway, lately,
686
00:37:11.599 --> 00:37:16.599
with everything pasted about Rails six Rail seven, for sure,
687
00:37:17.079 --> 00:37:20.920
like the upgrades have not been nearly as bad. And
688
00:37:21.000 --> 00:37:26.199
so I, you know, you're mentioning the maintenance cycle, and hey,
689
00:37:26.239 --> 00:37:30.079
this encourages people to upgrade, and you know, maybe you
690
00:37:30.159 --> 00:37:33.320
have a different window to get security patches and stuff
691
00:37:33.360 --> 00:37:37.119
like that. But the other side of it is is that,
692
00:37:37.559 --> 00:37:39.760
like I have a whole bunch of Rail seven two
693
00:37:39.800 --> 00:37:41.679
apps that I need to get around to upgrading to
694
00:37:41.800 --> 00:37:43.800
Rails eight, and I've kind of been waiting for like
695
00:37:44.719 --> 00:37:47.480
a couple of patch versions to come out, right, so
696
00:37:47.519 --> 00:37:51.559
that whatever issues everybody else is finding, good on you folks,
697
00:37:51.599 --> 00:37:54.280
and I really appreciate the work you're doing and you know,
698
00:37:54.320 --> 00:37:57.559
and then I can go pick them up. But yeah,
699
00:37:57.679 --> 00:38:00.719
I from what I've seen like seven to seven to
700
00:38:00.760 --> 00:38:04.679
one to seven, two to eight, they really haven't been
701
00:38:04.679 --> 00:38:08.880
that bad. And so you know it's okay. I'll spend
702
00:38:08.880 --> 00:38:10.480
a few days on this or a week on this.
703
00:38:10.559 --> 00:38:12.639
If it's a really big app maybe it takes longer.
704
00:38:12.679 --> 00:38:16.440
But yeah, yeah, it's much better. I did Trails two
705
00:38:16.480 --> 00:38:20.280
to three upgrades as well, two point three to three.
706
00:38:20.880 --> 00:38:23.960
That was a big thing about it. A little bit easier,
707
00:38:24.159 --> 00:38:27.199
four to five, a little bit easier from five on.
708
00:38:27.440 --> 00:38:31.000
I think, yeah, it's much easier. It's except when you
709
00:38:31.079 --> 00:38:34.039
go rails eight, you need to ask yourself the question
710
00:38:34.079 --> 00:38:36.079
what am I gonna do with the front end stuff?
711
00:38:36.719 --> 00:38:40.039
Are you gonna keep that pocket or are you killing it?
712
00:38:40.079 --> 00:38:42.320
Because then it might be a bigger change.
713
00:38:42.480 --> 00:38:50.880
Yeah. The prop shaft, yeah, prop shaft, prop shaft, and uh,
714
00:38:51.519 --> 00:38:53.679
you know all the stuff that's there. The way that
715
00:38:53.760 --> 00:38:56.760
Rails eight and Rail seven two, frankly, in a lot
716
00:38:56.760 --> 00:39:00.239
of ways handles the front end stuff. It is. It
717
00:39:00.360 --> 00:39:03.800
is so nice, you know, I don't I don't miss
718
00:39:04.880 --> 00:39:10.320
what it'sprockets don't miss Webpacker. When I moved off of Webpacker,
719
00:39:10.440 --> 00:39:13.159
I wanted to throw a party because it was so
720
00:39:13.280 --> 00:39:18.079
much easier. I mean, the issue with Webpacker a lot
721
00:39:18.079 --> 00:39:20.280
of people had was just setting it up and knowing
722
00:39:20.320 --> 00:39:22.719
how to do it, but I found myself having to
723
00:39:22.760 --> 00:39:25.960
tinker with it a lot, and so prop Shaft I've
724
00:39:26.000 --> 00:39:27.480
just kind of said it and forget it. It's been
725
00:39:27.519 --> 00:39:29.039
really cool and the.
726
00:39:29.320 --> 00:39:31.719
Build step is always like, yes, something faz At the
727
00:39:31.760 --> 00:39:34.920
built step, it's like I need to deal with this. Yeah,
728
00:39:35.000 --> 00:39:37.480
it was just slowing things down. I also didn't like.
729
00:39:37.679 --> 00:39:39.480
The important maps. I love them.
730
00:39:40.239 --> 00:39:43.880
It's funny you don't you don't realize how stable like
731
00:39:44.039 --> 00:39:49.760
Rails and Ruby ecosystem has become because I mean going back,
732
00:39:49.880 --> 00:39:52.599
like you know, upgrades, Like you know, I was thinking
733
00:39:52.599 --> 00:39:54.760
of my first Raels upgrade. I did like a Rails
734
00:39:54.800 --> 00:39:57.960
one app that was on Ruby one eighty seven, which
735
00:39:58.000 --> 00:40:01.760
was like the nightmare Ruby upgrade because there were just
736
00:40:01.800 --> 00:40:05.239
so many drastic changes, right, and so like I don't
737
00:40:05.239 --> 00:40:08.000
think people realize like what the early stages of a
738
00:40:08.039 --> 00:40:11.480
framework or a language are, right like, because like the
739
00:40:11.519 --> 00:40:15.000
stability that we get now likes just a mind boggling
740
00:40:15.119 --> 00:40:18.559
right like you know, yes, there'll be some depreciation warnings
741
00:40:18.599 --> 00:40:20.400
and things like that, or like you know, the big
742
00:40:20.480 --> 00:40:23.119
changes like are really not that big in like the
743
00:40:23.119 --> 00:40:25.519
grand scheme of things, right, Like if you look at
744
00:40:25.559 --> 00:40:27.920
like some of the other libraries out there, you're like,
745
00:40:28.559 --> 00:40:31.480
you know, the whole like back end could get swapped
746
00:40:31.480 --> 00:40:33.559
out and you'll be like, well, what do I do
747
00:40:33.639 --> 00:40:36.480
with all this stuff I built? Like yeah, you know,
748
00:40:37.400 --> 00:40:41.400
it's like incredibly stable now, so it's it's just wild.
749
00:40:41.800 --> 00:40:44.039
Yeah. Yeah. And for the record, when Greg was talking
750
00:40:44.039 --> 00:40:46.639
about upgrading from Rails two to three to Rails three,
751
00:40:47.400 --> 00:40:52.360
that was when they merged another framework called merbr into Rails,
752
00:40:53.000 --> 00:40:58.119
and so there were just major major changes. I mean
753
00:40:58.280 --> 00:41:00.800
a lot of stuff got a lot better, but the
754
00:41:00.920 --> 00:41:02.360
upgrade was painful.
755
00:41:03.519 --> 00:41:06.719
Oct record was pretty much completely changed. It was a
756
00:41:06.800 --> 00:41:09.960
lot of Yeah.
757
00:41:08.840 --> 00:41:11.960
That's a shout out to, uh to Machondra who like
758
00:41:12.239 --> 00:41:14.760
maintains the Rails are lts.
759
00:41:15.079 --> 00:41:15.840
Oh stuff.
760
00:41:16.440 --> 00:41:19.199
Uh, if you're like honestly, if you're out there stuck
761
00:41:19.280 --> 00:41:21.400
on a Rails upgrade and it's just like not worth
762
00:41:21.440 --> 00:41:25.400
it to your business, like just pay the service. Rails
763
00:41:25.679 --> 00:41:29.039
LTS long term support and it's just like they make
764
00:41:29.119 --> 00:41:31.719
sure that like yeah, they give you the security patches
765
00:41:31.920 --> 00:41:34.480
and uh yeah, we use that for a couple of
766
00:41:34.519 --> 00:41:36.920
clients a long time ago, and it just like it
767
00:41:37.000 --> 00:41:41.800
works incredible out of the box, like turn key.
768
00:41:41.880 --> 00:41:44.199
Yeah, we have to get them on and ask them
769
00:41:44.239 --> 00:41:45.599
how that all goes.
770
00:41:47.840 --> 00:41:48.199
So long?
771
00:41:48.320 --> 00:41:54.599
Now, sometimes I'm sure it's very tricky to sow these shoes.
772
00:41:54.920 --> 00:41:57.679
Sometimes for them, I wouldn't want to be in their shoes.
773
00:41:59.159 --> 00:42:01.400
Yeah, But the same time, I mean it's got to
774
00:42:01.440 --> 00:42:04.559
be really because I just went to their page and
775
00:42:04.599 --> 00:42:09.239
they have LTS versions for RAILS too crazy, and so
776
00:42:09.320 --> 00:42:14.159
I'm going, boy, what what are you having to fix?
777
00:42:15.679 --> 00:42:15.880
You know?
778
00:42:16.119 --> 00:42:19.480
And how deep into the weeds do you have to get?
779
00:42:19.920 --> 00:42:22.599
Yeah, but from a security perspective, I think it's still
780
00:42:22.800 --> 00:42:26.840
risky to be on the tour to measure because nobody
781
00:42:26.880 --> 00:42:32.039
really tests. That's true thions. So there are no security
782
00:42:32.079 --> 00:42:35.519
patches or security issues made public. There might be some
783
00:42:36.119 --> 00:42:40.960
non public ones which people might abuse, you just don't
784
00:42:41.000 --> 00:42:43.400
know about them. So I think it's because, like the
785
00:42:43.480 --> 00:42:45.880
latest version of RAILS, a lot of companies are using
786
00:42:45.880 --> 00:42:49.280
to get patrition tests, and sometimes issues are upstreamed from
787
00:42:49.280 --> 00:42:51.920
the resort to a patration test. They find an issue,
788
00:42:51.920 --> 00:42:54.920
it turns out, oh, it's actually an issue inside of RAILS,
789
00:42:55.440 --> 00:42:58.360
so we upstream the patch and fix it for everybody.
790
00:42:59.559 --> 00:43:01.719
Yeah, that's true, But.
791
00:43:01.760 --> 00:43:04.800
Those old versions I think are not a good idea
792
00:43:04.840 --> 00:43:07.239
to use. Even though you get some support.
793
00:43:08.760 --> 00:43:09.000
Yeah.
794
00:43:10.719 --> 00:43:14.440
Yeah. And then the next thing I mentioned the talk
795
00:43:14.639 --> 00:43:18.280
is is a bit of a pretty small change, is
796
00:43:18.320 --> 00:43:23.639
that CBV and CBC was added to the parameter filter defaults.
797
00:43:23.840 --> 00:43:26.000
But the reason I wanted to mention that in the
798
00:43:26.079 --> 00:43:27.960
talk is because a lot of people don't know about
799
00:43:28.000 --> 00:43:31.920
the real parameter filtering, which is a very handy tool
800
00:43:32.039 --> 00:43:35.480
to filter out anything sensitive from your logs. Like you know,
801
00:43:35.559 --> 00:43:37.760
when a request comes in with a password in it,
802
00:43:37.920 --> 00:43:40.159
you don't want that to show up in your logs,
803
00:43:40.320 --> 00:43:43.840
or if you store social secretary numbers, you don't want
804
00:43:43.880 --> 00:43:47.119
them to show up in your logs before you encry them.
805
00:43:47.519 --> 00:43:51.400
And this feature is just amazing. For anything sensitive which
806
00:43:51.400 --> 00:43:53.159
you don't want to be in the logs, you can
807
00:43:53.280 --> 00:43:56.440
just study to your initializer and then it gets excluded.
808
00:43:57.360 --> 00:43:59.960
These are the things which I also think rares excess
809
00:44:00.519 --> 00:44:03.760
because a bunch of other frameworks don't really haven't an
810
00:44:03.760 --> 00:44:07.159
easy solution for this problem. But Rasia is just out
811
00:44:07.159 --> 00:44:09.639
of the books and for years it's it's amazing.
812
00:44:11.000 --> 00:44:12.760
Yeah. I did have this bite me in the rear
813
00:44:12.880 --> 00:44:20.079
end once, but yeah, I agree. The way it bit
814
00:44:20.159 --> 00:44:23.199
me in the rear end was I had a stripe
815
00:44:23.239 --> 00:44:26.519
web hook key that for some reason wasn't being set
816
00:44:28.039 --> 00:44:31.199
and it still showed it as filtered, and so I
817
00:44:31.239 --> 00:44:36.119
didn't know it was empty until I actually like forced
818
00:44:36.119 --> 00:44:37.239
it to log it out.
819
00:44:37.840 --> 00:44:38.519
Ah, I see.
820
00:44:38.840 --> 00:44:42.679
But yeah, this is definitely a best practice. And if
821
00:44:42.679 --> 00:44:47.239
you get into like hipA or what's the financial one,
822
00:44:47.320 --> 00:44:54.719
PCI or any of these, they they they will crucify
823
00:44:54.840 --> 00:44:57.480
you on this stuff if you're not doing it. And
824
00:44:57.480 --> 00:45:01.280
and the logs are usually an area of vulnerability that's.
825
00:45:01.159 --> 00:45:02.840
Overlooked, yep.
826
00:45:03.639 --> 00:45:06.000
And Rails does it by default for all the common
827
00:45:06.039 --> 00:45:08.039
sense stuff yep.
828
00:45:11.239 --> 00:45:14.360
Yeah. And then the second half of my talk was
829
00:45:14.400 --> 00:45:17.400
these are the new features, which wasn't that many, to
830
00:45:17.440 --> 00:45:21.519
be honest, but still there are spilled small progresses and
831
00:45:21.599 --> 00:45:23.960
that's all we need, I think. And the second half
832
00:45:24.039 --> 00:45:28.320
I wanted to highlight to people why I think somebody
833
00:45:28.360 --> 00:45:32.119
should choose Rails if they want a if they need
834
00:45:32.159 --> 00:45:36.239
an application with high security standards. And my main reason
835
00:45:36.280 --> 00:45:38.559
for that is there is a tool for everything you
836
00:45:38.639 --> 00:45:43.119
would need in the Rails and Ruby ecosystem, like parameter
837
00:45:43.199 --> 00:45:46.199
filtering which we just mentioned built into the framework, great
838
00:45:46.280 --> 00:45:51.119
limiting now built into the framework authentication. You have device
839
00:45:51.199 --> 00:45:54.960
and a bunch of other things, multifactor authentication, a bunch
840
00:45:55.000 --> 00:45:56.920
of gems you can choose from. It's super easy to
841
00:45:56.960 --> 00:46:01.960
implement all of these features or I have a list here.
842
00:46:02.760 --> 00:46:05.239
Or the other thing, which is scripting stuff.
843
00:46:05.920 --> 00:46:09.960
Oh yeah, yeah, you don't even need to think about it. Actually,
844
00:46:10.039 --> 00:46:14.440
cross side scripting you need, but cross sideicquest forgery for instance,
845
00:46:14.480 --> 00:46:17.199
it's just BILS the framework for I don't even know
846
00:46:17.199 --> 00:46:23.079
which version, like LS it's forever. Yeah, it's so we
847
00:46:23.119 --> 00:46:25.199
have a lot of things which you just get read
848
00:46:25.239 --> 00:46:29.800
it for free and granted it's amazing, and other things
849
00:46:29.800 --> 00:46:33.280
which are not built into the framework. Like if you're
850
00:46:33.320 --> 00:46:37.039
talking about compliance, one of the the requirements to be
851
00:46:37.119 --> 00:46:41.400
soked to or ISZO compliant, is that your developers shouldn't
852
00:46:41.440 --> 00:46:44.599
access anything in production without you knowing about it. So
853
00:46:44.840 --> 00:46:47.440
if you have a rogue employee, it's not like they
854
00:46:47.480 --> 00:46:51.760
can just steal whatever they want. They still usually they can,
855
00:46:52.159 --> 00:46:54.480
but at least you have an auditlog so you can
856
00:46:54.559 --> 00:46:58.840
pinpoint who was the the malicious actor and there are
857
00:46:59.159 --> 00:47:02.320
there is a gem from thirty seven Signals called Audit
858
00:47:02.920 --> 00:47:09.239
nineteen eighty four and Console nineteen eighty four, which is
859
00:47:09.519 --> 00:47:12.559
if you install that. Anybody who goes to the RES console,
860
00:47:12.719 --> 00:47:15.559
they need to authenticate themselves, so they need to say
861
00:47:15.599 --> 00:47:18.599
who they are and why are they accessing the data,
862
00:47:18.800 --> 00:47:22.480
and then you have an audit trail. So whenever somebody
863
00:47:22.559 --> 00:47:28.480
accesses production data, you have an audit trail. One important
864
00:47:28.519 --> 00:47:32.480
thing to know about this, though, is it's advised to
865
00:47:32.599 --> 00:47:36.800
store these data in a read only database. Sorry, I'll
866
00:47:36.840 --> 00:47:40.559
write only database, so they can't. Nobody can update the data.
867
00:47:41.000 --> 00:47:44.400
They can it only rights, but you can't update otherwise.
868
00:47:44.440 --> 00:47:47.519
If somebody wants to be really tricky, they can just
869
00:47:48.079 --> 00:47:50.239
Ruby is very dynamics. They can find a way. I
870
00:47:50.320 --> 00:47:53.079
found a bunch of ways. But now it's much more
871
00:47:53.119 --> 00:47:55.719
secure than the initial really was. You can find a
872
00:47:55.719 --> 00:47:58.639
bunch of ways to treat the system and overrite existing
873
00:47:58.679 --> 00:48:02.119
log entries. But if you store it in a database
874
00:48:02.159 --> 00:48:05.880
which is only you you block update commands on the
875
00:48:05.960 --> 00:48:09.400
database connection, then it's pretty secure and safe.
876
00:48:11.119 --> 00:48:13.840
When did they change that to ride only? That's really awesome.
877
00:48:15.760 --> 00:48:17.519
They didn't change it. You need to change that on
878
00:48:18.079 --> 00:48:20.360
change yourself. Yeah, you can't. You can't build it into
879
00:48:20.400 --> 00:48:22.679
the GEM because you do it on the database level.
880
00:48:22.719 --> 00:48:25.800
If you build it into the GEM, then you can.
881
00:48:25.920 --> 00:48:28.159
You might still find a way to override it. In Ruby,
882
00:48:28.280 --> 00:48:31.719
because it's a super dynamic language, you can do things
883
00:48:31.719 --> 00:48:34.920
that you shouldn't even think about. That's how I found
884
00:48:34.960 --> 00:48:40.039
a bunch of things to over to bypass it. Ah.
885
00:48:40.719 --> 00:48:45.000
But yeah, that's a really good tool for compliance reasons.
886
00:48:45.119 --> 00:48:47.639
Also startic CAD analysis. That is breakmen. There are other
887
00:48:47.760 --> 00:48:53.440
tools dependent vulnerable dependencies. We just mentioned bundle aud it
888
00:48:54.000 --> 00:48:56.840
depend a boat and probably there are others as well.
889
00:48:57.400 --> 00:49:02.760
CSP content security policies build into else opery directs OPERI
890
00:49:02.800 --> 00:49:06.920
direct protection is deffault built into THEIRS nowadays. So you
891
00:49:07.000 --> 00:49:11.599
have you have for every security requirement or need encryption
892
00:49:11.800 --> 00:49:14.760
active record encryption. It's really easy to do now. You
893
00:49:14.760 --> 00:49:18.679
don't even need to think about anything cryptography. It's just
894
00:49:20.000 --> 00:49:21.719
you set your keys and you are good to go,
895
00:49:21.800 --> 00:49:23.559
and everything is in gypted in the database.
896
00:49:25.320 --> 00:49:27.119
The only thing that's missing is secret scanning.
897
00:49:28.760 --> 00:49:35.199
Secret scanning you mean the repository.
898
00:49:34.559 --> 00:49:38.480
Like something like trouple hog. That's the best example.
899
00:49:39.159 --> 00:49:44.119
Uh yeah, Well, but you should do that on the repository,
900
00:49:44.199 --> 00:49:48.000
and there are services or there are tools for that
901
00:49:48.119 --> 00:49:53.119
for should even in Ruby. I don't know any from
902
00:49:53.159 --> 00:49:55.199
the top of my head, but I'm pretty sure that
903
00:49:55.639 --> 00:49:56.159
there are some.
904
00:49:57.719 --> 00:50:01.599
How do you feel about like storing encrypted real secrets
905
00:50:01.880 --> 00:50:02.480
in a repol?
906
00:50:03.679 --> 00:50:07.039
As long as your master key stores safely, it's a
907
00:50:07.199 --> 00:50:10.880
very hard to break encryption. It's quantum computing. We might
908
00:50:10.960 --> 00:50:14.719
get into trouble in a few years, but until then
909
00:50:14.800 --> 00:50:17.679
we are fine and safe. And then you figure out
910
00:50:17.760 --> 00:50:20.039
how to have to save that. I'm sure not us,
911
00:50:20.119 --> 00:50:22.599
but someone who's good with cryptography. Then you figure out
912
00:50:22.719 --> 00:50:26.199
the way. But I think that's perfectly fine. You just
913
00:50:26.239 --> 00:50:30.119
need to make sure your master key is safe and secure, right,
914
00:50:32.239 --> 00:50:34.480
and then it also it simplifies the whole process. You
915
00:50:34.519 --> 00:50:38.199
can use environment bariables, but then how do you handle
916
00:50:38.280 --> 00:50:40.559
that during the deployment flow? How are you going to
917
00:50:40.639 --> 00:50:46.480
pull those from secret storage? It all adds complications and complexity,
918
00:50:48.000 --> 00:50:48.480
a lot of that.
919
00:50:48.559 --> 00:50:51.159
I've just been doing what Kamal does, so it just
920
00:50:52.440 --> 00:50:56.239
sticks it on the container when it runs YEP and.
921
00:50:56.280 --> 00:51:00.400
Comera as good integration with one past word and others. Actually,
922
00:51:00.559 --> 00:51:02.960
secret storage is like a bit bucket.
923
00:51:04.599 --> 00:51:06.599
I haven't used any of that because I'm the only
924
00:51:06.639 --> 00:51:07.320
one that deploys.
925
00:51:08.320 --> 00:51:10.039
Yeah, then it's yeah, it's it's super easy. If it's
926
00:51:10.079 --> 00:51:12.079
only you. If it's a team, it gets a bit
927
00:51:12.159 --> 00:51:14.760
more complicated, but still it's it's not hard.
928
00:51:14.880 --> 00:51:18.960
So do you have like a a security checklist that
929
00:51:19.079 --> 00:51:22.360
you run through for REILS apps, they make sure, oh
930
00:51:22.880 --> 00:51:24.159
make sure all these things are.
931
00:51:25.360 --> 00:51:30.360
You know, not really to be honest, when I do
932
00:51:30.440 --> 00:51:33.119
a penetration test, I have a checklist which I go through,
933
00:51:33.199 --> 00:51:35.679
but it doesn't really depend on a rail step. I
934
00:51:35.800 --> 00:51:38.280
have some rare specific things which I know I would
935
00:51:38.320 --> 00:51:40.639
a real set then I need to check this and that,
936
00:51:41.519 --> 00:51:44.039
But a lot of it is only in my head, to.
937
00:51:44.159 --> 00:51:48.480
Be honest, I mean to that point, like you know,
938
00:51:49.800 --> 00:51:52.280
real is pretty secure out of the box, right, Like
939
00:51:53.519 --> 00:51:57.519
it's not exactly difficult to you know, break that, but
940
00:51:57.719 --> 00:52:00.280
like it's not easy either, right.
941
00:52:01.480 --> 00:52:01.679
Yeah.
942
00:52:01.880 --> 00:52:04.639
I feel like with the REILS new like it's going to.
943
00:52:04.639 --> 00:52:07.800
Be pretty hard to like do something insecure until you
944
00:52:07.880 --> 00:52:11.320
start actually like you know, adding new things.
945
00:52:12.119 --> 00:52:16.079
Yeah, most of the vulnerabilities I see now it's it's
946
00:52:16.159 --> 00:52:18.800
used to be excesses and it's still I would say
947
00:52:18.880 --> 00:52:22.119
that's kind of the second, but the top one nowadays
948
00:52:22.119 --> 00:52:25.480
is authorization. So because it's super easy to make a
949
00:52:25.559 --> 00:52:28.960
mistake to forget to authorize some endpoints and then it
950
00:52:29.639 --> 00:52:31.599
can be accessed by someone who shouldn't have access.
951
00:52:32.280 --> 00:52:32.400
Right.
952
00:52:33.000 --> 00:52:35.039
So, but I think if you are talking with a
953
00:52:35.079 --> 00:52:38.280
basic level of security, make sure your authentication is secure,
954
00:52:38.519 --> 00:52:42.280
make sure your authorization is secure, and then make sure
955
00:52:42.320 --> 00:52:45.679
that there are no excessises. And that's pretty much the
956
00:52:45.760 --> 00:52:48.960
rest like secret injections, really hard to have a secret
957
00:52:49.000 --> 00:52:52.559
injection issue in reals now because eighty percent of the
958
00:52:52.639 --> 00:52:56.239
APIs in reels in the octave record are safe and secure.
959
00:52:57.880 --> 00:53:01.119
And for authorization, what I always command is use a
960
00:53:02.079 --> 00:53:06.800
wideist approach rather than a blacklist a blacklist because it's
961
00:53:06.960 --> 00:53:10.760
always better to have someone complain about not having access
962
00:53:10.800 --> 00:53:14.119
to something they should have access to. They're realizing, oh shit,
963
00:53:14.239 --> 00:53:18.079
somebody has access to something they shouldn't, right, because then
964
00:53:18.119 --> 00:53:20.679
it's and you need to report it then to your customers.
965
00:53:20.760 --> 00:53:22.840
That said that, if you have a it's basically a
966
00:53:22.960 --> 00:53:26.119
data bridge. If somebody can access things they shouldn't.
967
00:53:27.159 --> 00:53:28.119
Well, one thing, I'm curious.
968
00:53:28.199 --> 00:53:30.480
I know we're short on time, but I'm curious to
969
00:53:30.519 --> 00:53:33.800
get your thoughts on Like one common pattern that reels
970
00:53:33.840 --> 00:53:37.760
doesn embrace this is this like RESTful resources like targeted
971
00:53:37.800 --> 00:53:40.599
by IDs and like part of The problem with that
972
00:53:40.920 --> 00:53:45.559
is just like guessable because they're like equally ordered ideas
973
00:53:47.400 --> 00:53:50.679
like do you do you feel like reels is like
974
00:53:50.840 --> 00:53:54.679
overdue for like a new pattern there, or like is
975
00:53:54.760 --> 00:53:56.119
it not worth the effort.
976
00:53:55.880 --> 00:53:59.400
To like, it doesn't matter even if it's guessing or
977
00:53:59.400 --> 00:54:03.000
not guessing. I found authorization issues with the u I
978
00:54:03.119 --> 00:54:07.000
ds because they are not secure. They can be guessed,
979
00:54:07.239 --> 00:54:09.400
they can be brute forced, and they can be leaked.
980
00:54:09.519 --> 00:54:11.760
That's the that's the most common thing that you have
981
00:54:11.960 --> 00:54:14.159
u I ds and you think, oh, it's safe, we
982
00:54:14.239 --> 00:54:17.840
don't need authorization, but somebody in your API you leak
983
00:54:18.800 --> 00:54:20.760
the u I d s and then people can just
984
00:54:20.880 --> 00:54:21.559
find them.
985
00:54:21.400 --> 00:54:24.280
And security through obscurity.
986
00:54:24.360 --> 00:54:27.400
Huh, exactly. You should. You should have autodation. That's why
987
00:54:27.440 --> 00:54:31.960
actually I think pnumeric ideas are better because then it
988
00:54:32.159 --> 00:54:35.039
forces you to think about authorization. If you're like, oh,
989
00:54:35.119 --> 00:54:38.159
it's hard to guess, we don't need authorization, Yeah, down
990
00:54:38.239 --> 00:54:41.039
the line, you see for sure you have issues.
991
00:54:42.320 --> 00:54:44.840
Well, the other thing is is that typically you're going
992
00:54:44.920 --> 00:54:48.679
to see your authorization at the controller level, and so
993
00:54:49.519 --> 00:54:52.119
if you've got good tests around either end to end
994
00:54:52.280 --> 00:54:55.840
or controller tests, you should be able to pick up.
995
00:54:57.320 --> 00:55:00.679
You know, a person has what whatever it is that
996
00:55:00.760 --> 00:55:03.360
credentials them, right, whether it's a membership or a role
997
00:55:03.519 --> 00:55:07.039
or something. Right, you should be able to test that
998
00:55:07.199 --> 00:55:12.440
and say, Okay, I with reasonable confidence running my tests
999
00:55:12.480 --> 00:55:16.360
every day or you know whatever twice a day or yeah,
1000
00:55:18.360 --> 00:55:21.199
or every time I check in. Right, I can say
1001
00:55:21.239 --> 00:55:24.000
with reasonable confidence people don't have access to stuff they
1002
00:55:24.000 --> 00:55:24.840
shouldn't have access to.
1003
00:55:25.880 --> 00:55:28.199
Yeah, but you can still make mistakes, and you can
1004
00:55:28.320 --> 00:55:31.440
use a feature and then you forgot forget to an
1005
00:55:31.519 --> 00:55:36.280
authorization to that. And like I found an issue recently
1006
00:55:36.480 --> 00:55:40.760
during a parent test where they were doing autolitions. The
1007
00:55:40.760 --> 00:55:44.599
same endpoint could fetch one record or a list of records,
1008
00:55:44.880 --> 00:55:47.280
so they were expecting either an ID or an array
1009
00:55:47.320 --> 00:55:50.880
of IDs, and they did the authorization on the on
1010
00:55:51.079 --> 00:55:54.760
the first item. So what you could do You could
1011
00:55:54.800 --> 00:55:58.519
set the ID to something which the user is authorized
1012
00:55:58.559 --> 00:56:00.119
to have access to, and then you get set the
1013
00:56:00.239 --> 00:56:03.360
ideas in the same request to something they don't have
1014
00:56:03.480 --> 00:56:07.320
access to. And then because it thought, oh, it's only
1015
00:56:07.400 --> 00:56:10.800
requesting one item, but actually it returned all of the
1016
00:56:10.880 --> 00:56:15.800
items because the second parameter, the autoidation check was successful.
1017
00:56:16.039 --> 00:56:18.639
But you could still get access to things which you shouldn't.
1018
00:56:19.400 --> 00:56:20.800
It's easy to make mistake, to be.
1019
00:56:20.840 --> 00:56:26.280
Honest, Yeah, I guess, I guess what I'm saying is
1020
00:56:26.360 --> 00:56:30.159
for kind of your baseline stuff if you're testing it,
1021
00:56:30.280 --> 00:56:33.360
you know, But yeah, you're right if your strategy isn't
1022
00:56:34.400 --> 00:56:38.039
well thought out and your test only tests that your
1023
00:56:38.079 --> 00:56:40.719
strategy works, yep.
1024
00:56:41.119 --> 00:56:44.840
Yeah, this is why I think gems like bundit is
1025
00:56:44.920 --> 00:56:49.000
really useful. Because it bunded, you can turn on a
1026
00:56:49.159 --> 00:56:53.639
feature which we eraise an exception if you don't call
1027
00:56:53.719 --> 00:56:56.760
the authories. I think it's called authorized the method in
1028
00:56:56.840 --> 00:56:59.920
a countra action, So it forces you to have out
1029
00:57:00.119 --> 00:57:03.400
ridition in every end point and if you don't, then
1030
00:57:04.280 --> 00:57:06.480
you might make a mistake and then it will warn you.
1031
00:57:08.280 --> 00:57:11.320
And also it really like you can do a widely
1032
00:57:11.320 --> 00:57:14.880
stopproach easily with that one. So nothing can be accessed
1033
00:57:14.920 --> 00:57:19.159
by anybody, and you explicitly grant access to certain records
1034
00:57:19.840 --> 00:57:23.000
right for certain conditions.
1035
00:57:24.800 --> 00:57:29.239
Yeah, all right, cool, Well, is there anything else you
1036
00:57:29.280 --> 00:57:31.159
want to make sure that people know before we do
1037
00:57:31.280 --> 00:57:31.760
our picks?
1038
00:57:34.719 --> 00:57:37.760
I think that's it. Basically is still a great choice
1039
00:57:37.880 --> 00:57:42.199
for security in my opinion. But still you need to
1040
00:57:42.280 --> 00:57:45.599
be aware all the time and be on the lookout
1041
00:57:45.719 --> 00:57:48.559
because it's easy to make a mistake. Nobody to blame
1042
00:57:48.639 --> 00:57:51.880
for that. We all make mistakes and we should learn
1043
00:57:51.920 --> 00:57:53.280
from them and get better.
1044
00:57:54.480 --> 00:57:58.920
Yeh, all right, well let's go ahead and do some picks. Valentino,
1045
00:57:59.039 --> 00:57:59.920
you got some picks for us?
1046
00:58:01.000 --> 00:58:01.440
Oh yeah.
1047
00:58:03.000 --> 00:58:06.559
So I was at the last New York City Ruby
1048
00:58:06.760 --> 00:58:09.280
AI meet up in a happy hour and demo night,
1049
00:58:10.039 --> 00:58:14.039
which has now been consolidated into a nice Artificial Ruby event.
1050
00:58:15.400 --> 00:58:18.920
So I gave a talk on a project I'm working
1051
00:58:18.960 --> 00:58:22.239
on called ruby Tuner to try and fine tune an
1052
00:58:22.480 --> 00:58:24.519
ll M specifically for Ruby code generation.
1053
00:58:25.599 --> 00:58:26.119
And I.
1054
00:58:28.440 --> 00:58:32.079
Have this whole framework built that wraps Python basically to
1055
00:58:32.199 --> 00:58:36.400
start with the idea of over time moving it away
1056
00:58:36.440 --> 00:58:39.960
from Python as the new Ruby features start to become available.
1057
00:58:40.679 --> 00:58:44.039
And so I showed showcase kind of like the whole
1058
00:58:44.119 --> 00:58:46.880
process and to end of fine tuning a very specific
1059
00:58:47.320 --> 00:58:50.800
contrived example of turning a u r L into markdown
1060
00:58:51.880 --> 00:58:53.039
and then getting.
1061
00:58:52.920 --> 00:58:56.480
A response out of it. So it's a lot of fun.
1062
00:58:57.159 --> 00:58:59.400
There's a new event in March.
1063
00:58:59.440 --> 00:59:02.559
I recommend signing up for at Artificial Movie dot AI
1064
00:59:03.920 --> 00:59:07.800
and check out Ruby sooner and then just like something
1065
00:59:07.880 --> 00:59:11.840
really fun and because I always share something very specifically ai.
1066
00:59:12.199 --> 00:59:12.320
Uh.
1067
00:59:13.360 --> 00:59:16.400
Peter Cooper has been like diving deep uh and he
1068
00:59:16.559 --> 00:59:17.639
runs the Ruby Weekly.
1069
00:59:18.320 --> 00:59:18.440
Uh.
1070
00:59:18.719 --> 00:59:19.920
He shared this really.
1071
00:59:19.800 --> 00:59:27.480
Fun and kind of hilarious prompting strategy for basically creating
1072
00:59:27.559 --> 00:59:32.280
a group of specific authors of software. So he has
1073
00:59:32.400 --> 00:59:37.199
like Paul Graham and Linus Torvald and David Hannamer Hansen
1074
00:59:37.320 --> 00:59:39.559
and like kind of made personas for each of these
1075
00:59:39.679 --> 00:59:43.159
characters and then got them into a prompt to like
1076
00:59:43.440 --> 00:59:47.719
argue over very specific implementation strategy at a very detailed level.
1077
00:59:48.079 --> 00:59:48.480
And then.
1078
00:59:49.880 --> 00:59:51.559
And he shared the prompt that he used for it,
1079
00:59:51.679 --> 00:59:54.719
and like it's it's kind of fun to uh, to
1080
00:59:54.800 --> 00:59:57.440
play with this, and it like brings in kind of
1081
00:59:57.559 --> 01:00:00.880
like the a combination of mixture of agent or a
1082
01:00:00.960 --> 01:00:04.599
mixture of experts as well as like planning execute, like
1083
01:00:04.760 --> 01:00:07.440
combination of those two. It's just like really fun to
1084
01:00:07.519 --> 01:00:11.119
see that kind of stuff of all. And like see
1085
01:00:11.119 --> 01:00:15.039
a panel of judges, judge thinks in a simulated way.
1086
01:00:16.159 --> 01:00:17.440
I recommend checking that out.
1087
01:00:17.679 --> 01:00:23.920
It's just fun. That sounds that sounds so funny. I'm
1088
01:00:23.920 --> 01:00:26.320
gonna go ahead and throw in some picks. So first
1089
01:00:26.360 --> 01:00:28.480
of all, I do a board game pick or a
1090
01:00:28.519 --> 01:00:31.960
card game pick this week. I'm gonna be picking a
1091
01:00:32.039 --> 01:00:41.199
card game. It's called The Gang. It is essentially it's
1092
01:00:42.119 --> 01:00:48.719
Texas Holding Poker. Cooperative Texas Holding Poker. So what you're
1093
01:00:48.760 --> 01:00:52.800
trying to do is you are trying to sorry, I'm
1094
01:00:52.800 --> 01:00:54.760
trying to copy and paste the link and while I talk,
1095
01:00:56.039 --> 01:00:58.440
you're so you're all playing Texas hold them. So you
1096
01:00:58.519 --> 01:01:00.840
have two cards, you flip over the all that stuff
1097
01:01:00.920 --> 01:01:11.280
right that you're normally do, right, So, and then what
1098
01:01:11.400 --> 01:01:14.440
you do is, once you have your cards, you can
1099
01:01:15.480 --> 01:01:17.800
there are tokens out. There's one for each player, right,
1100
01:01:18.199 --> 01:01:20.039
so if you have five players, there's a five star
1101
01:01:20.119 --> 01:01:22.159
token of four star, three star, two star, one star.
1102
01:01:22.840 --> 01:01:25.039
And so what you're trying to do is there's no
1103
01:01:25.159 --> 01:01:27.039
bluffing in this game, because what you're trying to do
1104
01:01:27.199 --> 01:01:30.800
is you're trying to get the tokens to the right people.
1105
01:01:31.400 --> 01:01:33.920
So the five star token is with the person that wins,
1106
01:01:34.880 --> 01:01:36.880
and the four star token is with the person that
1107
01:01:37.360 --> 01:01:41.400
would come in second, right, third, fourth, fifth. We played
1108
01:01:41.400 --> 01:01:43.280
it with three players, so we you know, it was
1109
01:01:43.400 --> 01:01:47.320
just you know, three tokens. So anyway, so you grab
1110
01:01:47.400 --> 01:01:51.360
the token that you think you deserve and then somebody
1111
01:01:51.440 --> 01:01:53.719
may say no, I think I think I have that, right,
1112
01:01:53.840 --> 01:01:57.400
And so usually it's the top one that gets passed
1113
01:01:57.440 --> 01:01:59.480
around them a lot in the bottom one that gets
1114
01:01:59.480 --> 01:02:01.559
passed around a lot. Right. So it's like, you know,
1115
01:02:01.719 --> 01:02:05.079
I look at my cards. I can't remember the pocket cards.
1116
01:02:05.079 --> 01:02:07.480
I think is the term? Right, I have a two
1117
01:02:07.559 --> 01:02:10.079
and a three. I know that I'm you know, I'm
1118
01:02:10.159 --> 01:02:12.719
probably not going to win, right, But as you flip
1119
01:02:12.760 --> 01:02:15.280
over the river, maybe you flip over a two and
1120
01:02:15.440 --> 01:02:17.800
a three, right, So now I have two pair. Now
1121
01:02:17.880 --> 01:02:20.400
I have a good hand, and so you know, then
1122
01:02:20.440 --> 01:02:23.000
I may be more aggressively grabbing the top or next
1123
01:02:23.039 --> 01:02:25.920
to the top, you know, and so and you can't
1124
01:02:26.119 --> 01:02:29.519
talk about what you have, but you know, so somebody has,
1125
01:02:29.639 --> 01:02:32.199
you know, three of a kinding kings, right, they may
1126
01:02:32.280 --> 01:02:35.440
more aggressively take that five star token back when I
1127
01:02:35.559 --> 01:02:37.679
grab it, and but I can take it back from them,
1128
01:02:37.679 --> 01:02:39.039
and then they can take it back from me, and
1129
01:02:39.119 --> 01:02:40.800
so then I may be looking at it and going, well,
1130
01:02:40.880 --> 01:02:43.679
I have two pair, but they're kind of crappy pairs,
1131
01:02:43.920 --> 01:02:46.480
so maybe they do have something better. And then as
1132
01:02:46.519 --> 01:02:50.320
you flip over cards, you every time you flip over cards,
1133
01:02:50.360 --> 01:02:53.280
you put more tokens out, and so you can see
1134
01:02:53.320 --> 01:02:56.519
where people are changing what they want to do. And
1135
01:02:56.679 --> 01:02:58.760
so a lot of times, right you'll flip over a
1136
01:02:58.880 --> 01:03:02.599
ten and some who was kind of not sure where
1137
01:03:02.639 --> 01:03:05.039
they were all of a sudden is really aggressively saying
1138
01:03:05.159 --> 01:03:08.159
I should get the top one. And it means that,
1139
01:03:09.400 --> 01:03:12.639
you know, my hand went from having nothing to having
1140
01:03:12.679 --> 01:03:15.559
a pair or something like that, and so you're kind
1141
01:03:15.599 --> 01:03:17.480
of trying to read the table and figure out what
1142
01:03:17.639 --> 01:03:20.360
it is. And the way you win is you get
1143
01:03:20.400 --> 01:03:22.400
three in a row or not three in a row,
1144
01:03:22.400 --> 01:03:24.559
but you get three correct before you get three incorrect,
1145
01:03:25.320 --> 01:03:27.960
and that's pretty much it. And then there's a deck
1146
01:03:28.000 --> 01:03:30.199
of cards, and we only played with a handful of these,
1147
01:03:30.559 --> 01:03:33.119
but there's a bunch of cards that put restrictions on
1148
01:03:33.199 --> 01:03:35.679
what you can do right, and so maybe it takes
1149
01:03:36.119 --> 01:03:39.280
away a round of tokens where you know you would
1150
01:03:39.320 --> 01:03:41.400
get more information or things like that. So anyway, it
1151
01:03:41.480 --> 01:03:45.079
was a lot of fun. The gang board game Geek
1152
01:03:45.159 --> 01:03:47.920
has it as a weight of one point sixty four,
1153
01:03:48.800 --> 01:03:55.719
so it's pretty approachable for you know, most gamers. I
1154
01:03:55.880 --> 01:03:59.079
think my kids, you know, I don't know if i'd
1155
01:03:59.079 --> 01:04:01.039
play it with my kids. Because I'd have to explain
1156
01:04:01.079 --> 01:04:07.559
poker to them, and mostly it's that I would have to, like,
1157
01:04:07.679 --> 01:04:11.239
you have to explain the statistics and why this hand
1158
01:04:11.320 --> 01:04:15.440
beats that hand and how to figure out right. So anyway,
1159
01:04:15.920 --> 01:04:18.239
that's where it gets complicated, is just knowing which hand
1160
01:04:18.280 --> 01:04:21.480
beach which hand and then recognizing I have a straight
1161
01:04:21.639 --> 01:04:23.800
or I have a flush or I have you know, whatever.
1162
01:04:24.039 --> 01:04:28.400
So anyway, fun fun, fun fun stuff. We played it
1163
01:04:28.599 --> 01:04:31.199
after it was readily apparent that the Eagles were going
1164
01:04:31.239 --> 01:04:32.559
to win the Super Bowl, so we played it for
1165
01:04:32.679 --> 01:04:38.039
like an hour. By the way, go birds anyway, So
1166
01:04:38.920 --> 01:04:41.639
that's my pick there, and then the other pick I
1167
01:04:41.760 --> 01:04:45.920
have is I'm pretty aggressively pulling together Ruby geniuses. I
1168
01:04:46.079 --> 01:04:49.920
have meetups planned starting on the twenty fifth of February.
1169
01:04:51.119 --> 01:04:54.679
We're going to be getting into all kinds of stuff.
1170
01:04:55.400 --> 01:04:56.800
There's going to be a book club at the end
1171
01:04:56.840 --> 01:05:00.880
of March, and we're reading the O'Reilly book on prompt
1172
01:05:00.960 --> 01:05:07.159
engineering for AI, you know, so just diving into a
1173
01:05:07.159 --> 01:05:12.880
whole bunch of stuff. Basically, it's meetups. I'm gonna set
1174
01:05:12.960 --> 01:05:15.239
up a discord channel for each of them, right so
1175
01:05:15.360 --> 01:05:17.880
we can collaborate with that. You get discounts on summits
1176
01:05:18.239 --> 01:05:20.320
that I'm putting together. Right, They're not doing Ruby comp
1177
01:05:20.400 --> 01:05:22.119
this year, so I plan to put on a summit
1178
01:05:22.119 --> 01:05:24.679
about when they would do that, and I have people
1179
01:05:24.760 --> 01:05:29.000
show up and speak at that, you know, So just
1180
01:05:29.159 --> 01:05:32.480
just stuff like that. I'm trying to think because ultimately,
1181
01:05:35.000 --> 01:05:36.760
I guess the other thing is is if you sign
1182
01:05:36.880 --> 01:05:39.320
up by the end of the week, which means that
1183
01:05:40.199 --> 01:05:44.599
I guess people we didn't go live. So anyway, I
1184
01:05:44.800 --> 01:05:49.440
was also offering if you had questions, you could text
1185
01:05:49.719 --> 01:05:51.960
or send me a voice message and I would get
1186
01:05:52.039 --> 01:05:54.199
back to you and you would get that for six months.
1187
01:05:55.719 --> 01:05:58.440
But anyway, so yeah, so it's it's the book club,
1188
01:05:58.480 --> 01:06:01.840
it's the meetups, it's the the collaboration with other people.
1189
01:06:02.679 --> 01:06:04.559
Just the ability to kind of get feedback on what
1190
01:06:04.639 --> 01:06:07.719
you're doing or get help when you need it. These
1191
01:06:07.760 --> 01:06:09.639
are the things that really came through for me when
1192
01:06:09.639 --> 01:06:14.840
I was newer programmer. And what I found is that
1193
01:06:15.039 --> 01:06:18.000
even as a senior developer, I'm craving that kind of
1194
01:06:18.039 --> 01:06:21.599
interaction anyway, and so you know, getting a bunch of
1195
01:06:21.639 --> 01:06:24.400
people in and Okay, what's new, what's going on, things
1196
01:06:24.480 --> 01:06:27.480
like that, and then finally I'm also lining up. Some
1197
01:06:27.639 --> 01:06:29.280
of the meetups are going to be with people that
1198
01:06:29.360 --> 01:06:32.880
are on the show, right, so you know, I've asked
1199
01:06:32.920 --> 01:06:35.480
some of our past guests to do them, and we're
1200
01:06:35.480 --> 01:06:37.960
going to start doing some of those in March or April.
1201
01:06:38.280 --> 01:06:41.159
So the first handful, I just wanted stuff on the
1202
01:06:41.239 --> 01:06:44.480
calendar that people were asking me for that I could teach,
1203
01:06:45.239 --> 01:06:47.000
and that way I didn't have to worry about whether
1204
01:06:47.079 --> 01:06:49.960
or not I could fill those meetups with other presenters.
1205
01:06:50.199 --> 01:06:52.719
But yeah, we're going to have a lot more of
1206
01:06:52.760 --> 01:06:54.000
that because there are a lot of people who know
1207
01:06:54.079 --> 01:06:56.280
a lot more about stuff than I do. So anyway,
1208
01:06:57.159 --> 01:07:02.079
you can go get at rubygeniuses dot com and yeah, Greg,
1209
01:07:02.159 --> 01:07:02.760
what are your picks?
1210
01:07:04.119 --> 01:07:08.639
I have two picks. One is a gem got Pundit,
1211
01:07:08.719 --> 01:07:10.760
which we just mentioned because I think it's really good
1212
01:07:10.800 --> 01:07:15.440
for outright to handle authorization rails app. It's a good
1213
01:07:15.559 --> 01:07:18.000
help and it helps you to solve a bunch of
1214
01:07:18.199 --> 01:07:22.960
issues easily or a bunch of problems. So that's one
1215
01:07:23.000 --> 01:07:24.639
of the picks. And the other pick is a bit
1216
01:07:24.679 --> 01:07:27.960
of a self plug, which is I'm working on a
1217
01:07:28.079 --> 01:07:32.960
course for almost a year about security for rals developers,
1218
01:07:33.360 --> 01:07:36.519
and now I'm close to get it ready and publish it.
1219
01:07:36.679 --> 01:07:40.320
And it's already in on free sale, and once I
1220
01:07:40.480 --> 01:07:43.599
record the video videos fit it's basically the written version
1221
01:07:43.679 --> 01:07:45.360
is pretty much done. I just need to record the
1222
01:07:45.440 --> 01:07:49.440
videos and then I will publish it. And I hope
1223
01:07:49.480 --> 01:07:51.800
it's going to be useful for people to learn more
1224
01:07:51.840 --> 01:07:56.199
about the caveats of security things in rails.
1225
01:07:58.079 --> 01:07:59.280
Cool. Where do people find it?
1226
01:08:00.360 --> 01:08:02.400
Uh? Just go on my website. There is a link
1227
01:08:02.480 --> 01:08:05.360
somewhere on it. Probably I should I should put the
1228
01:08:05.400 --> 01:08:07.559
bonner on it, but you can find it on my website.
1229
01:08:07.559 --> 01:08:09.559
There is a link I think at the top somewhere
1230
01:08:10.400 --> 01:08:10.800
some great.
1231
01:08:14.280 --> 01:08:16.439
All right, cool, we'll put a link in the show
1232
01:08:16.520 --> 01:08:18.720
notes too, and that way people can go and keep
1233
01:08:18.720 --> 01:08:19.399
an eye out for it.
1234
01:08:20.199 --> 01:08:20.439
Great.
1235
01:08:20.520 --> 01:08:22.880
Thank you, Yeah, thanks for coming.
1236
01:08:24.199 --> 01:08:26.520
Thanks for having me. It was fun again.
1237
01:08:28.079 --> 01:08:31.439
Yeah all right, Well we'll go ahead and stop here,
1238
01:08:31.640 --> 01:08:34.800
wrap it up until next time, folks, Max out