Mike Dalessio

Mike Dalessio

@flavorjon.es

Mostly posts about gummi bears, space probes, and Ruby. OSS contributor, maintaining Nokogiri, SQLite3, Rails::Html::Sanitizer, Mechanize, and more in the Ruby ecosystem. Working at 37signals. Former Shopify, VMware, Pivotal, Bloomberg, various startups.

1.2K followers390 following166 posts

Mike Dalessio
@flavorjon.es

My conversation with the Ruby AI podcast folks about software security and Hot Cell (a new, more secure backend for Active Storage) is out! www.therubyaipodcast.com/2388930/epis...

therubyaipodcast.comFrom Maintenance to Rails Core: Security, Sandboxing, and Open Source Impact - The Ruby AI PodcastWhat happens when a conference talk becomes dangerously obsolete just one week before showtime? That urgent pivot tells you everything about the pace of modern security work in the Ruby ecosystem.Mike...
Mike Dalessio
@flavorjon.es

I'm honored and humbled to join the Rails core team. I'll be focusing on security and improvements to Active Storage and Action Text. Please reach out if you have thoughts on what would make your work easier.

Mike Dalessio reposted

Aaron Patterson
@tenderlove.dev

If you're worried about the recent Rails CVE, @flavorjon.es made a very good skill you can feed to your coding agent to help assess your apps. Read about it here! discuss.rubyonrails.org/t/cve-2026-6...

discuss.rubyonrails.org[CVE-2026-66066] Attack details, and tools to perform a forensic investigationHello there, I’m writing as a member of the Rails security team about CVE-2026-66066. As mentioned in the advisory, GHSA-xr9x-r78c-5hrm, we held back details about the attack vector to allow applicat...
Mike Dalessio
@flavorjon.es

The Rails security team published attack details and -- more importantly -- tools and agent skills to run a forensic investigation to help you determine if you were exploited. Be careful out there. discuss.rubyonrails.org/t/cve-2026-6...

discuss.rubyonrails.org[CVE-2026-66066] Attack details, and tools to perform a forensic investigationHello there, I’m writing as a member of the Rails security team about CVE-2026-66066. As mentioned in the advisory, GHSA-xr9x-r78c-5hrm, we held back details about the attack vector to allow applicat...
Mike Dalessio@flavorjon.es

Upgrade Rails immediately, kids, this is a big one. github.com/rails/rails/...

github.comPossible arbitrary file read and remote code execution in Active Storage variant processing### Impact In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process envi...
Mike Dalessio
@flavorjon.es

It was 20 years ago today that I emailed @tenderlove.dev my first Ruby open-source contribution, for client-side cert support in Mechanize. His enthusiasm and generosity on this occasion (and countless others!) was incredibly encouraging and I'm grateful to get to work with him so often.

Mike Dalessio
@flavorjon.es

I know it's hard right now to tell when there is a real human behind a pull request, but I am a living reminder that if you respond to potential future contributors with feedback and humanity, it is an investment that will (on occasion (maybe)) pay off.

Mike Dalessio
@flavorjon.es

The year is 2026. My pocket supercomputer can take algorithmically improved photos superior to professional cameras. I can view augmented reality and track my location down to the foot. Yet Dropbox's app still does not ship with a goddamn text editor.

Mike Dalessio
@flavorjon.es

A fun side effect of GitHub's current AI-generated demand is that Github Actions seem heavily throttled for open source projects ... even projects like mine that are core dependencies of GitHub itself. So here I am waiting on GitHub for a batch of PRs that would help improve GitHub ...

Mike Dalessio
@flavorjon.es

If anybody knows who the PM is at @github.com for private vulnerability reporting on projects, I'd love an intro. I've been leaning in hard and have a few ideas for small changes that will have outsized impact in making the system more usable and maintainer-friendly.

Mike Dalessio reposted

Alt18F
@alt18f.bsky.social

"Schofield said he is speaking publicly for the first time because he believes Americans need to understand how government data can be misused and, in some cases, already has been." Another courageous act from a civil servant choosing to honor their oath.

washingtonpost.comTrump officials planned to mark 2.7 million living people as dead, whistleblower claimsA former Social Security executive said the plan, which was not carried out, would have used a death database to pressure immigrants to leave the country.
View full thread
Mike Dalessio
@flavorjon.es

The House passed it! And it had enough support to pass in the Senate, except the Republican *majority* filibustered to avoid a vote they knew would pass. The Democratic party could and should have used the opportunity to change the rules in the Senate and get this passed but chickened out.

Mike Dalessio reposted

Paul Byrne
@theplanetaryguy.com

Last Monday I visited Capitol Hill with @planetarysociety.bsky.social to advocate for a healthy NASA budget. There's a long road ahead but early indications from both the House and the Senate is that they'll reject the brutal, unnecessary, and stupid cuts proposed by the White House.

Mike Dalessio reposted

Katie Mack
@astrokatie.com

Replying to @astrokatie.com

And just to be abundantly clear: NASA AND SCIENCE IN GENERAL HAVE MASSIVE RETURN ON INVESTMENT. Cutting this budget is a net financial LOSS in the medium- to long-term. It undermines our future -- intellectually, technologically, and economically.

Mike Dalessio reposted

mtsw
@mtsw.bsky.social

Re: nostalgia for VHS tapes and other analog media, I saw someone say like "a VHS tape never sold my information to a nazi" and yes that's true! But the reason it's true is actually because Congress passed a law in 1988 specifically making it illegal for video stores to sell your rental history

Mike Dalessio
@flavorjon.es

Seriously, Claude Opus 4.6 has been SO BAD for the last few weeks. INCREDIBLY dumb compared to how it behaved earlier in the year. I have been gut-checking this perception with many friends and co-workers and every one of them has been thinking this.

Mike Dalessio
@flavorjon.es

It is fucking stunning to me that computers, which are devices designed to literally follow fucking instructions, have become ... *gestures rudely* ... this. Things that can no longer fucking follow instructions. Codex is also pretty bad, but at least it usually follows instructions.

Mike Dalessio
@flavorjon.es

I'm excited that Rails 8.2 is going to have to_markdown for Action Text content. Given Markdown is the lingua franca for LLMs, this is going to make it dead easy to add markdown support to your Rails app API. github.com/rails/rails/...

github.comAdd `to_markdown` to Action Text, mirroring `to_plain_text` by flavorjones · Pull Request #56858 · rails/railsMotivation / Background Today, Rails supports two formats for "exporting" rich text content: HTML Plain text HTML is very verbose, and not always handled well (or cheaply) by LLM agents...

Mike Dalessio reposted

Cory Booker
@corybooker.com

Congressional Republicans have surrendered their power to the president they are constitutionally obligated to oversee. It is a startling abdication, rivaled only by the Trump’s lies to voters about what his foreign policy would be once he took office. Compare Candidate Trump to President Trump ⬇️

Mike Dalessio reposted

NY Times Pitchbot
@nytpitchbot.bsky.social

Whether it’s Donald Trump demanding Greenland from Denmark or Barack Obama asking for Dijon mustard from a hotdog vendor, both presidents made some highly unusual requests.

Mike Dalessio
@flavorjon.es

In case any of my friends in Europe or the UK need to hear it: all of this is fucking bullshit. All of it. I am a USian and I am incredibly embarrassed by all of it. Stephen Miller in particular can eat a fucking dick. I am 100% in favor of the rule of law as are all of the USians I respect. Fuuuck.

Mike Dalessio reposted

Paul Byrne
@theplanetaryguy.com

Open up this picture fully. Then look at the surface of Mars. Then look up to the top right. Spot Mars' moon Phobos high in the sky. Then notice the bright spot beside Phobos. That's Earth.

Mike Dalessio
@flavorjon.es

Never forget The Whale

Josh Kantor@jtkantor.bsky.social

I recorded this Christmas organ version of "Brass Bonanza." The original version was the official theme song of the Hartford Whalers, who played in the National Hockey League from 1979-1997.