Tessera
Folgen

John Hawthorn

@jhawthorn.com

Writing code for @Shopify, Rails, and Ruby. Previously @GitHub. he/him | Victoria, BC | jhawthorn.com

58 Posts1164 Follower228 Folgt
John Hawthorn@jhawthorn.com · 4mo ago

Proud of this patch I landed to Ruby this week which makes constants inside of `class << self` scopes faster both in the interpreter and JITs. It's not the most complicated or even impactful, but something I've wanted to fix for years github.com/ruby/ruby/pu...

Use compile-time flag to determine when a singleton CREF is dynamic by jhawthorn · Pull Request #16604 · ruby/ruby

This aims to allow constant cache accesses inside a singleton CREF to use the same fastpath as most constant caches, without needing to re-check the CREF on every access. class Foo def self.foo1 ...

github.com

hsbt@hsbt.org · 7mo ago

Development of Ruby 4.1.0 started ``` ruby 4.1.0dev (2025-12-26T00:31:28Z master 290fa0d8b4) +YJIT +MN +PRISM [arm64-darwin25] ```

John Hawthorn@jhawthorn.com · 11mo ago

I have a hard time placing exactly what it is, but something about `bat` and other "modern" TUI tools really rubs me the wrong way. They're clearly well made, I think it's more of an aesthetic thing where that is exactly what I was running away from by using command line tools.

Aaron Patterson@tenderlove.dev · last yr.

One of the AI generated security reports attached a bunch of MD files, and this screenshot was taken from the end of one of them. This gives me lots of feelings, and none of them are good

## 🚀 SUBMISSION STRATEGY ### Approach: "Professional Context-Dependent Security Issue" - Not claiming pure remote RCE - Focusing on real-world deployment risks - Honest about context requirements - Emphasizing practical security impact ### Expected Response: ``` "While not directly exploitable in default configuration, this represents a significant security risk in common deployment scenarios. We'll investigate and implement appropriate mitigations." ``` ### Success Probability: 75% - Technical merit: Clear vulnerability in core Rails - Real-world relevance: Common deployment scenarios - Professional quality: Comprehensive documentation - Honest assessment: Context-dependent, not oversold --- ## ✅ READY TO SUBMIT! **All information prepared for professional Rails bug bounty submission.** **Expected Outcome:** - Rails Team Response: 1-2 weeks - Fix Development: 2-8 weeks - Security Release: 8-12 weeks - IBB Bounty: $1,040-1,600 (80% of $1,300-2,000) **Next Step:** Copy information above into HackerOne form and submit!
John Hawthorn@jhawthorn.com · last yr.

I'm a nervous flier, but fortunately I've downloaded the new season of Nathan Fielder's show "The Rehearsal" to distract me. No spoilers please, I want to go in blind