Jean Boussier
@byroot.bsky.social
Rails core, Ruby committer, Senior Principal Engineer at Intercom.
Upgrade Rails immediately, kids, this is a big one. github.com/rails/rails/...
Possible arbitrary file read and remote code execution in Active Storage variant processing
### Impact In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process envi...
github.com
While it has been 18 months since I blogged about it, the json gem performance has improved quite significantly since, so now is a good time to add a few more parts to my JSON serie: byroot.github.io/ruby/json/20...
Optimizing Ruby’s JSON, Part 8
It has now been about 18 months since I concluded my post series on optimising Ruby’s json.
byroot.github.io
Just went two streets away, my eyes are literally burning.🥵
When reading one extra byte saves a lot of extra work: github.com/ruby/ruby/pu...
io.c: read files in a single pass by byroot · Pull Request #17418 · ruby/ruby
read_all receives the file size when known, and does all the work to allocate a string of the right size and issue a single read call. However since the condition to check for EOF is read_bytes <...
github.com
I realized it has been ~1.5 years since I concluded my series of post on JSON optimization. So I got curious how much faster it became since then. 2.7.2 was the last version before I took over maintainership. 2.9.0 was the version I released at the end of the blog series.
Not sure if something changed recently, but I've received a stream of much higher quality security reports in the last few days, but there' still something off with them. I suspect they're AI assisted, but can't be certain. Unlike before, they're easy to read, concise, well explained etc. 1/3
It's the Rails 8.2 default yes. No need for backporting, the feature is entirely in Bootsnap, so you can just upgrade to latest Bootsnap, and copy the couple configs: github.com/rails/rails/...
Enable frozen string literal by default by byroot · Pull Request #57252 · rails/rails
Ref: rails/bootsnap#535 This only impact the app own code, and not dependencies. It is also possible to enable it for gems, but some old ones may still not be ready.
github.com
This one feels good. No more stupid comments at the top of files. At least in one repo.
Ruby 4.0.4 Released www.ruby-lang.org/en/news/2026... This is a routine update that includes bugfixes. We recommend upgrading your Ruby version at your earliest convenience.
Ruby 4.0.4 Released | Ruby
Ruby 4.0.4 has been released.
ruby-lang.org
Made a new blurg post about AI + OSS security. I was going to just complain on here, but I figured a short blog post would be better for my complaining 😂 tenderlovemaking.com/2026/05/06/r...
Rails Security, AI, and IBB
For quite a few years the Rails project has been working with the Internet Bug Bounty (IBB). The IBB is an organization that awarded cash to security researchers that reported issues to OSS projects p...
tenderlovemaking.com
I thought this was interesting and makes sense www.agwa.name/blog/post/fa... I might add implementing FCGI support in Pitchfork on my infinite pile of things to do eventually.
FastCGI: 30 Years Old and Still the Better Protocol for Reverse Proxies
For FastCGI's 30th birthday, let's look at how it avoids the security problems inherent in HTTP reverse proxying
agwa.name
I chuckled www.france24.com/en/americas/...
'You'd be speaking French': King Charles pokes fun at Trump during state dinner
Britain's King Charles III used his speech at a state dinner at the White House on Tuesday to poke fun at US President Donald Trump who, in January, told European leaders that without US aid in World…
france24.com
I sat down with Brian Scanlan to explore what “AI-first” development actually looks like inside Intercom’s 15-year-old Rails monolith. www.youtube.com/watch?v=ADBs...
Brian Scanlan: Building AI-First at Intercom
YouTube video by Ruby on Rails
youtube.com
What are the odds to find a beer from your favorite Québec brewery in a random Hakodate bar ?
I wrote some more as a way to fight jet lag, hopefully it's still readable 😅: byroot.github.io/ruby/bundler...
The Missing Bundler Features
Over the last few months, there has been a lot of talk about making Bundler faster, both by improving it directly, or by reimplementing it in another language, and while it may surprise some, that did...
byroot.github.io
With the new job, I didn't get much time or energy to blog lately, but I figured I'd use the various downtime while traveling to Ruby Kaigi to write about some of the things I worked on recently: byroot.github.io/ruby/perform...
Optimizing Ruby Path Methods
Back in November last year, I started a new job at Intercom, and one of the first projects I got to work on was improving the Intercom monolith CI with some of my new colleagues.
byroot.github.io
It's just a proof of concept, but this is how I wish Rust extensions for Ruby were written: github.com/tenderworks/...
GitHub - tenderworks/roost: Generate FFI bindings from Rust extensions
Generate FFI bindings from Rust extensions. Contribute to tenderworks/roost development by creating an account on GitHub.
github.com
Ruby 4.0.2 Released www.ruby-lang.org/en/news/2026... This is a routine update that includes a bugfix in YJIT for NoMethodError on Puma. We recommend upgrading your Ruby version at your earliest convenience.
Ruby 4.0.2 Released | Ruby
Ruby 4.0.2 has been released.
ruby-lang.org
Something I'm not yet clear on how to handle these days is what to do with obvious LLM PRs on Open Source projects. When a human submit a PR that needs some work, often enough I'll go through rounds of review to progressively get the PR in a mergeable state.
Looks like I can procrastinate some more, I found a way to debug it without rr: github.com/ruby/json/pu...
Ensure `Generator::State` is kept on the stack by byroot · Pull Request #930 · ruby/json
Fix: #929 I don't know how it's possible, but somehow the self reference is optimized out of the stack. Perhaps because we inline so aggressively that the compiler end up spilling it on the...
github.com
Jean Boussier@byroot.bsky.social · 6mo agoI need to stop procrastinating and buy myself a proper development machine that run on Linux, and learn how to use the rr debugger. I keep running into issues that would be way easier to debug that way...
I need to stop procrastinating and buy myself a proper development machine that run on Linux, and learn how to use the rr debugger. I keep running into issues that would be way easier to debug that way...
🎤Meet our next speaker: @byroot.bsky.social — Senior Principal Engineer @ Intercom, Rails & Ruby Core team member, Ruby Prize 2022 finalist. With 10+ years on large Ruby apps, he’s a long-time committer shaping the community. 🗓️ 15-16 May, 2026 📍 Sofia: balkanruby.com/talks/32
We were very proud to present @marcoroth.dev with the Rails Luminary Award 2025. And yes, I was on a secret mission to Zurich 😀. rubyonrails.org/2025/12/17/m...
Congrats Marco Roth: 2025 Rails Luminary
We are stoked to share that the Rails Core team has announced Marco Roth as the 2025 Rails Luminary.
rubyonrails.org
