If you're worried about the recent Rails CVE, @flavorjon.es made a very good skill you can feed to your coding agent to help assess your apps. Read about it here! discuss.rubyonrails.org/t/cve-2026-6...

[CVE-2026-66066] Attack details, and tools to perform a forensic investigation

Hello there, I’m writing as a member of the Rails security team about CVE-2026-66066. As mentioned in the advisory, GHSA-xr9x-r78c-5hrm, we held back details about the attack vector to allow applicat...

discuss.rubyonrails.org

The Rails security team published attack details and -- more importantly -- tools and agent skills to run a forensic investigation to help you determine if you were exploited. Be careful out there. discuss.rubyonrails.org/t/cve-2026-6...

[CVE-2026-66066] Attack details, and tools to perform a forensic investigation

Hello there, I’m writing as a member of the Rails security team about CVE-2026-66066. As mentioned in the advisory, GHSA-xr9x-r78c-5hrm, we held back details about the attack vector to allow applicat...

discuss.rubyonrails.org

Mike Dalessio@flavorjon.es · last wk.

Upgrade Rails immediately, kids, this is a big one. github.com/rails/rails/...

Upgrade Rails immediately, kids, this is a big one. github.com/rails/rails/...

Possible arbitrary file read and remote code execution in Active Storage variant processing

### Impact In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process envi...

github.com

It was 20 years ago today that I emailed @tenderlove.dev my first Ruby open-source contribution, for client-side cert support in Mechanize. His enthusiasm and generosity on this occasion (and countless others!) was incredibly encouraging and I'm grateful to get to work with him so often.

I had so much fun speaking with the Once a Maintainer folks about being an open source maintainer and some of the security work that's involved. I hope you give it a read and enjoy! ❤️ onceamaintainer.substack.com/p/once-a-mai...

Once a Maintainer: Mike Dalessio

The nokogiri maintainer on how AI has changed security and on maintainer burnout

onceamaintainer.substack.com

The year is 2026. My pocket supercomputer can take algorithmically improved photos superior to professional cameras. I can view augmented reality and track my location down to the foot. Yet Dropbox's app still does not ship with a goddamn text editor.

A fun side effect of GitHub's current AI-generated demand is that Github Actions seem heavily throttled for open source projects ... even projects like mine that are core dependencies of GitHub itself. So here I am waiting on GitHub for a batch of PRs that would help improve GitHub ...

If anybody knows who the PM is at @github.com for private vulnerability reporting on projects, I'd love an intro. I've been leaning in hard and have a few ideas for small changes that will have outsized impact in making the system more usable and maintainer-friendly.

"Schofield said he is speaking publicly for the first time because he believes Americans need to understand how government data can be misused and, in some cases, already has been." Another courageous act from a civil servant choosing to honor their oath.

Trump officials planned to mark 2.7 million living people as dead, whistleblower claims

A former Social Security executive said the plan, which was not carried out, would have used a death database to pressure immigrants to leave the country.

washingtonpost.com

It's only five weeks away! Are you going to be there? I'm talking, of course, about Brighton Ruby. I'm really excited to hang out with Rubyists near the ocean. Also, pubs. brightonruby.com

Brighton Ruby Conference

brightonruby.com

Who could have seen this coming

Last Monday I visited Capitol Hill with @planetarysociety.bsky.social to advocate for a healthy NASA budget. There's a long road ahead but early indications from both the House and the Senate is that they'll reject the brutal, unnecessary, and stupid cuts proposed by the White House.

And just to be abundantly clear: NASA AND SCIENCE IN GENERAL HAVE MASSIVE RETURN ON INVESTMENT. Cutting this budget is a net financial LOSS in the medium- to long-term. It undermines our future -- intellectually, technologically, and economically.

Re: nostalgia for VHS tapes and other analog media, I saw someone say like "a VHS tape never sold my information to a nazi" and yes that's true! But the reason it's true is actually because Congress passed a law in 1988 specifically making it illegal for video stores to sell your rental history

OMG I enjoyed this essay SO MUCH. Bread fucking rules. www.theatlantic.com/magazine/202...

I Found It: The Best Free Restaurant Bread in America

Thirteen thousand miles. Infinite contenders. One beautiful loaf.

theatlantic.com

Happy Tax Day, New York. We’re taxing the rich.

Spring in NYC is unmatched.

Science fucking rules. How can you not be inspired by Artemis II photos?

I'm excited for this year's Brighton Ruby lineup! It'll be my first trip to Brighton. RUBYISTS ASSEMMMMBLE brightonruby.com

Brighton Ruby Conference

brightonruby.com

So @jcn.bsky.social rescued some old GORUCO videos from 2010 and 2011 that I just posted up on rubyevents.org, including this killer talk from @sandimetz.bsky.social: www.rubyevents.org/talks/less-t... Enjoy the old school vibes!

Less - The Path to Better Design

GORUCO 2011: Less - The Path to Better Design (Sandi Metz)

rubyevents.org

I'm excited that Rails 8.2 is going to have to_markdown for Action Text content. Given Markdown is the lingua franca for LLMs, this is going to make it dead easy to add markdown support to your Rails app API. github.com/rails/rails/...

Add `to_markdown` to Action Text, mirroring `to_plain_text` by flavorjones · Pull Request #56858 · rails/rails

Motivation / Background Today, Rails supports two formats for "exporting" rich text content: HTML Plain text HTML is very verbose, and not always handled well (or cheaply) by LLM agents...

github.com

Who needs Pingdom? Upright is open-source, more featureful, integrates into your existing OTel infrastructure, and was made with love by my teammate Lewis. dev.37signals.com/introducing-...

Introducing Upright: An Open Source Synthetic Monitoring System

We’re open-sourcing Upright, the synthetic monitoring system we built to watch over Basecamp, HEY, Fizzy and our many other services.

dev.37signals.com

If you're interested in multi-tenancy in Rails apps, I talked a bit about my recent work on Active Record Tenanted here: dev.37signals.com/rails-multi-...

Rails Multi-Tenancy

Lead Programmer Mike Dalessio shares the benefits of multi-tenant databases and how his work with Fizzy led to the the Active Record Tenanted gem.

dev.37signals.com

"See what you made me do?" is what bullies and abusers say to try to make people compliant in the future. Fuck this complete asshole. www.theguardian.com/us-news/2026...

‘I no longer feel an obligation to think purely of peace,’ says Trump amid Greenland threats | First Thing

Donald Trump links Greenland seizure threats to Nobel snub in letter to Norway’s prime minister. Plus, unseen home video of Martin Luther King Jr

theguardian.com

It made me so sad and angry to see these scientific budget cuts. We're eating our intellectual seed corn. NASA has to operate on timelines longer than a presidential term, this feel unrecoverable. www.theatlantic.com/magazine/202...

An Act of Cosmic Sabotage

How Donald Trump tried to ground NASA’s science missions

theatlantic.com

Over half the slots for Belfast RubyFest 2026 have gone in the first 24 hours since I announced the event. If you want to come to Belfast and have a great time with other fellow Rubyists, RSVP now!! luma.com/yl6v0cy9

Belfast RubyFest 2026 · Luma

The first-ever Belfast RubyFest is here. It will be a celebration of community, creativity, and all the wonderful things you can build with Ruby. Three…

luma.com

Congressional Republicans have surrendered their power to the president they are constitutionally obligated to oversee. It is a startling abdication, rivaled only by the Trump’s lies to voters about what his foreign policy would be once he took office. Compare Candidate Trump to President Trump ⬇️

Whether it’s Donald Trump demanding Greenland from Denmark or Barack Obama asking for Dijon mustard from a hotdog vendor, both presidents made some highly unusual requests.