Something I must confess is that I absolutely hate writing these blog posts. It’s not quite as bad as having to give a conference talk, but it’s up there on the list of activities that feel like pulli...

With the removal of the insecure create_additions option, JSON.load and JSON.dump are now safe to use. Them being unsafe by default caused multiple security vulnerabilites in the past. If you did d...

As you may know, one area of Ruby performance optimization that particularly interests me is memory usage. Given that most Ruby deployments rely on fork, improving Copy-on-Write performance is general...

### Impact In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process envi...

It has now been about 18 months since I concluded my post series on optimising Ruby’s json.

read_all receives the file size when known, and does all the work to allocate a string of the right size and issue a single read call. However since the condition to check for EOF is read_bytes &lt...

Ref: rails/bootsnap#535 This only impact the app own code, and not dependencies. It is also possible to enable it for gems, but some old ones may still not be ready.

Ruby 4.0.4 has been released.

For quite a few years the Rails project has been working with the Internet Bug Bounty (IBB). The IBB is an organization that awarded cash to security researchers that reported issues to OSS projects p...

For FastCGI's 30th birthday, let's look at how it avoids the security problems inherent in HTTP reverse proxying

Britain's King Charles III used his speech at a state dinner at the White House on Tuesday to poke fun at US President Donald Trump who, in January, told European leaders that without US aid in World…

The 2026 Ruby on Rails Community Survey is now open. Add your voice to the community data. Brought to you by Planet Argon.

YouTube video by Ruby on Rails

Over the last few months, there has been a lot of talk about making Bundler faster, both by improving it directly, or by reimplementing it in another language, and while it may surprise some, that did...

Back in November last year, I started a new job at Intercom, and one of the first projects I got to work on was improving the Intercom monolith CI with some of my new colleagues.

Generate FFI bindings from Rust extensions. Contribute to tenderworks/roost development by creating an account on GitHub.

Ruby 4.0.2 has been released.

YouTube video by Euruko

Fix: #929 I don't know how it's possible, but somehow the self reference is optimized out of the stack. Perhaps because we inline so aggressively that the compiler end up spilling it on the...

We are stoked to share that the Rails Core team has announced Marco Roth as the 2025 Rails Luminary.

Learn about trends in Ruby development and opportunities for improving performance that many organizations are leaving on the table.

If you are a Rubyist, you’ve likely been writing # frozen_string_literal: true at the top of most of your Ruby source code files, or at the very least, that you’ve seen it in some other projects.

Some of my thoughts on the lessons we can learn from the RubyGems situation and how we can move forward.