Sign in

Mike Dalessio

@flavorjon.es
1.2K followers 390 following 159 posts

Mostly posts about gummi bears, space probes, and Ruby. OSS contributor, maintaining Nokogiri, SQLite3, Rails::Html::Sanitizer, Mechanize, and more in the Ruby ecosystem. Working at 37signals. Former Shopify, VMware, Pivotal, Bloomberg, various startups.

PostsRepliesMedia
Mike Dalessio @flavorjon.es · 27/09/2026
Hot Cell is ready to go if you're on Rails edge. Slides are up at mike.daless.io/prez/2026-09...
mike.daless.io
081
Mike Dalessio @flavorjon.es · 25/09/2026
I'm honored and humbled to join the Rails core team. I'll be focusing on security and improvements to Active Storage and Action Text. Please reach out if you have thoughts on what would make your work easier.
4516
Mike Dalessio @flavorjon.es · 22/09/2026
Teaser for my Rails World talk tomorrow. A brief history of time.
First, the earth cooled. Then dinosaurs roamed. Then humans built machines, and started writing software that was too trusting or didn't think through security corner cases. Now AI has made it easy to take advantage of those flaws. Where do we go from here?
052
Reposted by Mike Dalessio
Aaron Patterson @tenderlove.dev · 31/07/2026
If you're worried about the recent Rails CVE, @flavorjon.es made a very good skill you can feed to your coding agent to help assess your apps. Read about it here! discuss.rubyonrails.org/t/cve-2026-6...
discuss.rubyonrails.org
[CVE-2026-66066] Attack details, and tools to perform a forensic investigation
Hello there, I’m writing as a member of the Rails security team about CVE-2026-66066. As mentioned in the advisory, GHSA-xr9x-r78c-5hrm, we held back details about the attack vector to allow applicat...
2207
Mike Dalessio @flavorjon.es · 31/07/2026
The Rails security team published attack details and -- more importantly -- tools and agent skills to run a forensic investigation to help you determine if you were exploited. Be careful out there. discuss.rubyonrails.org/t/cve-2026-6...
discuss.rubyonrails.org
[CVE-2026-66066] Attack details, and tools to perform a forensic investigation
Hello there, I’m writing as a member of the Rails security team about CVE-2026-66066. As mentioned in the advisory, GHSA-xr9x-r78c-5hrm, we held back details about the attack vector to allow applicat...
1215
Mike Dalessio @flavorjon.es · 29/07/2026
Upgrade Rails immediately, kids, this is a big one. github.com/rails/rails/...
github.com
Possible arbitrary file read and remote code execution in Active Storage variant processing
### Impact In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process envi...
14930
Mike Dalessio @flavorjon.es · 27/06/2026
It was 20 years ago today that I emailed @tenderlove.dev my first Ruby open-source contribution, for client-side cert support in Mechanize. His enthusiasm and generosity on this occasion (and countless others!) was incredibly encouraging and I'm grateful to get to work with him so often.
2221
Mike Dalessio @flavorjon.es · 27/06/2026
I had so much fun speaking with the Once a Maintainer folks about being an open source maintainer and some of the security work that's involved. I hope you give it a read and enjoy! ❤️ onceamaintainer.substack.com/p/once-a-mai...
onceamaintainer.substack.com
Once a Maintainer: Mike Dalessio
The nokogiri maintainer on how AI has changed security and on maintainer burnout
083
Mike Dalessio @flavorjon.es · 20/06/2026
The year is 2026. My pocket supercomputer can take algorithmically improved photos superior to professional cameras. I can view augmented reality and track my location down to the foot. Yet Dropbox's app still does not ship with a goddamn text editor.
140
Mike Dalessio @flavorjon.es · 17/06/2026
A fun side effect of GitHub's current AI-generated demand is that Github Actions seem heavily throttled for open source projects ... even projects like mine that are core dependencies of GitHub itself. So here I am waiting on GitHub for a batch of PRs that would help improve GitHub ...
070
Mike Dalessio @flavorjon.es · 10/06/2026
If anybody knows who the PM is at @github.com for private vulnerability reporting on projects, I'd love an intro. I've been leaning in hard and have a few ideas for small changes that will have outsized impact in making the system more usable and maintainer-friendly.
111
Reposted by Mike Dalessio
Alt18F @alt18f.bsky.social · 06/06/2026
"Schofield said he is speaking publicly for the first time because he believes Americans need to understand how government data can be misused and, in some cases, already has been." Another courageous act from a civil servant choosing to honor their oath.
washingtonpost.com
Trump officials planned to mark 2.7 million living people as dead, whistleblower claims
A former Social Security executive said the plan, which was not carried out, would have used a death database to pressure immigrants to leave the country.
18830
Mike Dalessio @flavorjon.es · 14/05/2026
It's only five weeks away! Are you going to be there? I'm talking, of course, about Brighton Ruby. I'm really excited to hang out with Rubyists near the ocean. Also, pubs. brightonruby.com
brightonruby.com
Brighton Ruby Conference
152
Mike Dalessio @flavorjon.es · 07/05/2026
Who could have seen this coming
Tweet from 2021:

I would really like the Democratic Party to stop playing not to lose, and instead eliminate the filibuster and start governing, and take some goddamn risks.

Dems saying "we'll lose much more than we'd gain" are missing that "playing to not lose" is completely the wrong strategy when the issue is voting rights.

What you do is put all your chips in on this one hand, this is it, this is the whole ballgame.
140
Reposted by Mike Dalessio
Paul Byrne @theplanetaryguy.com · 29/04/2026
Last Monday I visited Capitol Hill with @planetarysociety.bsky.social to advocate for a healthy NASA budget. There's a long road ahead but early indications from both the House and the Senate is that they'll reject the brutal, unnecessary, and stupid cuts proposed by the White House.
Why. So. Serious?
3848
Reposted by Mike Dalessio
Katie Mack @astrokatie.com · 23/04/2026
And just to be abundantly clear: NASA AND SCIENCE IN GENERAL HAVE MASSIVE RETURN ON INVESTMENT. Cutting this budget is a net financial LOSS in the medium- to long-term. It undermines our future -- intellectually, technologically, and economically.
7770141
Reposted by Mike Dalessio
mtsw @mtsw.bsky.social · 18/04/2026
Re: nostalgia for VHS tapes and other analog media, I saw someone say like "a VHS tape never sold my information to a nazi" and yes that's true! But the reason it's true is actually because Congress passed a law in 1988 specifically making it illegal for video stores to sell your rental history
3751991239
Mike Dalessio @flavorjon.es · 15/04/2026
OMG I enjoyed this essay SO MUCH. Bread fucking rules. www.theatlantic.com/magazine/202...
theatlantic.com
I Found It: The Best Free Restaurant Bread in America
Thirteen thousand miles. Infinite contenders. One beautiful loaf.
051
Reposted by Mike Dalessio
Mayor Zohran Kwame Mamdani @mayor.nyc.gov · 15/04/2026
Happy Tax Day, New York. We’re taxing the rich.
795362657595
Mike Dalessio @flavorjon.es · 10/04/2026
Science fucking rules. How can you not be inspired by Artemis II photos?
170
Mike Dalessio @flavorjon.es · 07/04/2026
I'm excited for this year's Brighton Ruby lineup! It'll be my first trip to Brighton. RUBYISTS ASSEMMMMBLE brightonruby.com
brightonruby.com
Brighton Ruby Conference
2182
Mike Dalessio @flavorjon.es · 06/04/2026
120
Mike Dalessio @flavorjon.es · 23/03/2026
So @jcn.bsky.social rescued some old GORUCO videos from 2010 and 2011 that I just posted up on rubyevents.org, including this killer talk from @sandimetz.bsky.social: www.rubyevents.org/talks/less-t... Enjoy the old school vibes!
rubyevents.org
Less - The Path to Better Design
GORUCO 2011: Less - The Path to Better Design (Sandi Metz)
1158
Mike Dalessio @flavorjon.es · 25/02/2026
I'm excited that Rails 8.2 is going to have to_markdown for Action Text content. Given Markdown is the lingua franca for LLMs, this is going to make it dead easy to add markdown support to your Rails app API. github.com/rails/rails/...
github.com
Add `to_markdown` to Action Text, mirroring `to_plain_text` by flavorjones · Pull Request #56858 · rails/rails
Motivation / Background Today, Rails supports two formats for "exporting" rich text content: HTML Plain text HTML is very verbose, and not always handled well (or cheaply) by LLM agents...
0140
Mike Dalessio @flavorjon.es · 17/02/2026
Who needs Pingdom? Upright is open-source, more featureful, integrates into your existing OTel infrastructure, and was made with love by my teammate Lewis. dev.37signals.com/introducing-...
dev.37signals.com
Introducing Upright: An Open Source Synthetic Monitoring System
We’re open-sourcing Upright, the synthetic monitoring system we built to watch over Basecamp, HEY, Fizzy and our many other services.
1103
Mike Dalessio @flavorjon.es · 14/02/2026
If you're interested in multi-tenancy in Rails apps, I talked a bit about my recent work on Active Record Tenanted here: dev.37signals.com/rails-multi-...
dev.37signals.com
Rails Multi-Tenancy
Lead Programmer Mike Dalessio shares the benefits of multi-tenant databases and how his work with Fizzy led to the the Active Record Tenanted gem.
0132
Mike Dalessio @flavorjon.es · 19/01/2026
"See what you made me do?" is what bullies and abusers say to try to make people compliant in the future. Fuck this complete asshole. www.theguardian.com/us-news/2026...
theguardian.com
‘I no longer feel an obligation to think purely of peace,’ says Trump amid Greenland threats | First Thing
Donald Trump links Greenland seizure threats to Nobel snub in letter to Norway’s prime minister. Plus, unseen home video of Martin Luther King Jr
0150
Mike Dalessio @flavorjon.es · 11/01/2026
It made me so sad and angry to see these scientific budget cuts. We're eating our intellectual seed corn. NASA has to operate on timelines longer than a presidential term, this feel unrecoverable. www.theatlantic.com/magazine/202...
theatlantic.com
An Act of Cosmic Sabotage
How Donald Trump tried to ground NASA’s science missions
0229
Reposted by Mike Dalessio
schwad @schwad.org · 06/01/2026
Over half the slots for Belfast RubyFest 2026 have gone in the first 24 hours since I announced the event. If you want to come to Belfast and have a great time with other fellow Rubyists, RSVP now!! luma.com/yl6v0cy9
luma.com
Belfast RubyFest 2026 · Luma
The first-ever Belfast RubyFest is here. It will be a celebration of community, creativity, and all the wonderful things you can build with Ruby. Three…
052
Reposted by Mike Dalessio
Cory Booker @corybooker.com · 07/01/2026
Congressional Republicans have surrendered their power to the president they are constitutionally obligated to oversee. It is a startling abdication, rivaled only by the Trump’s lies to voters about what his foreign policy would be once he took office. Compare Candidate Trump to President Trump ⬇️
97741284
Reposted by Mike Dalessio
NY Times Pitchbot @nytpitchbot.bsky.social · 07/01/2026
Whether it’s Donald Trump demanding Greenland from Denmark or Barack Obama asking for Dijon mustard from a hotdog vendor, both presidents made some highly unusual requests.
251184152
Mike Dalessio @flavorjon.es · 07/01/2026
In case any of my friends in Europe or the UK need to hear it: all of this is fucking bullshit. All of it. I am a USian and I am incredibly embarrassed by all of it. Stephen Miller in particular can eat a fucking dick. I am 100% in favor of the rule of law as are all of the USians I respect. Fuuuck.
0160
Reposted by Mike Dalessio
Paul Byrne @theplanetaryguy.com · 30/12/2025
Open up this picture fully. Then look at the surface of Mars. Then look up to the top right. Spot Mars' moon Phobos high in the sky. Then notice the bright spot beside Phobos. That's Earth.
A forlorn landscape of layered rocks in the foreground, with hills fading into the background haze. At upper top right, a small crescent moon, and a bright star.
7647371856
Mike Dalessio @flavorjon.es · 05/01/2026
Rubyists, I just updated the Nokogiri docs site nokogiri.org to use Zensical. Let me know if anything looks wonky! Shout out to @squidfunk.com and the @zensical.org crew! Good stuff.
nokogiri.org
Nokogiri - Nokogiri
The Official Tutorial Archive™ of Nokogiri®
063
Mike Dalessio @flavorjon.es · 03/01/2026
Oh, late last year I also published a post about universal precompiled native Rubygems! mike.daless.io/posts/2025/0... This might be interesting if you've been following along with the bundler performance conversations like this post by @tenderlove.dev: tenderlovemaking.com/2025/12/29/c...
mike.daless.io
Universal Rubygem Precompilation - mike.daless.io
1173
Mike Dalessio @flavorjon.es · 03/01/2026
Happy new year, Rubyists! I've just published a summary of the last few months of my open-source work here: mike.daless.io/posts/2026/0...
mike.daless.io
Open Source Update / 2025 Summary - mike.daless.io
0132
Mike Dalessio @flavorjon.es · 23/12/2025
Never forget The Whale
040
Mike Dalessio @flavorjon.es · 07/12/2025
Life with a professional baker part 22: Xmas cookie planning
A hand-written list of cookie names, paper clipped to a longer hand-written list of cookie names. "Gooey butter vanilla cake bars", "Glazed citrus ginger shortbread", "Cinnamon roll brownies", etc.
080
Mike Dalessio @flavorjon.es · 06/12/2025
It's finally happening. I'm going to Brighton Ruby next June! ti.to/goodscary/br...
ti.to
Brighton Ruby 2026
The single day, single track Ruby conference for folks who like to go to the seaside, learn things and hang out with fellow Rubyists.
4332
Reposted by Mike Dalessio
Dr. Stephanie @punkrockscience.bsky.social · 24/11/2025
Today’s xkcd made me cry. In a good way. xkcd.com/3172/
3664631961
Reposted by Mike Dalessio
Michelle Wu for President @wu4america.bsky.social · 13/11/2025
Jeffrey Epstein won’t see your post making fun of his comma usage but your friend who can’t figure out how to use a comma will
415514
Reposted by Mike Dalessio
Marc Hedlund @marcprecipice.bsky.social · 08/11/2025
From my friend Kyle. This is essential reading for all Americans. aphyr.com/posts/397-i-...
aphyr.com
I Want You to Understand Chicago
24237
Mike Dalessio @flavorjon.es · 05/11/2025
This looks awesome as the heir to MkDocs: squidfunk.github.io/mkdocs-mater... I'll be trying to convert nokogiri.org to it as soon as I can make time!
squidfunk.github.io
Zensical - A modern static site generator - Material for MkDocs
We are thrilled to announce Zensical, our next-gen static site generator that addresses and overcomes the technical limitations of MkDocs
030
Reposted by Mike Dalessio
Mikie Sherrill @mikiesherrill.bsky.social · 05/11/2025
New Jersey, it is the honor of my life to earn your trust to become this great state’s 57th Governor. I promise to listen, lead with courage, and never forget who I serve.
511174732276
Mike Dalessio @flavorjon.es · 05/11/2025
Finally, some good fucking news
0130
Reposted by Mike Dalessio
Dare Obasanjo @carnage4life.bsky.social · 02/11/2025
Scenes from the Great Gatsby Halloween Party at Mar-a-Lago on the eve of SNAP benefits expiring for 40 million Americans due to the federal government shutdown.
36815
Reposted by Mike Dalessio
Gillian Brockell @gillianbrockell.com · 02/11/2025
If you want to know more about ICE’s third-country removals, I keep what I believe is the only public tracker of all of them here: hardghistory.ghost.io/tracking-all... There are more than you probably think.
hardghistory.ghost.io
Tracking All of Trump’s Third-Country Removals (That We Know Of)
Bookmark this post, it will be updated.
5227125