Sign in

Mike Dalessio

@flavorjon.es
1.2K followers 390 following 159 posts

Mostly posts about gummi bears, space probes, and Ruby. OSS contributor, maintaining Nokogiri, SQLite3, Rails::Html::Sanitizer, Mechanize, and more in the Ruby ecosystem. Working at 37signals. Former Shopify, VMware, Pivotal, Bloomberg, various startups.

PostsRepliesMedia
Mike Dalessio @flavorjon.es · 27/09/2026
Hot Cell is ready to go if you're on Rails edge. Slides are up at mike.daless.io/prez/2026-09...
mike.daless.io
082
Mike Dalessio @flavorjon.es · 25/09/2026
I'm honored and humbled to join the Rails core team. I'll be focusing on security and improvements to Active Storage and Action Text. Please reach out if you have thoughts on what would make your work easier.
4547
Mike Dalessio @flavorjon.es · 22/09/2026
Teaser for my Rails World talk tomorrow. A brief history of time.
First, the earth cooled. Then dinosaurs roamed. Then humans built machines, and started writing software that was too trusting or didn't think through security corner cases. Now AI has made it easy to take advantage of those flaws. Where do we go from here?
052
Mike Dalessio @flavorjon.es · 04/08/2026
Well if you need to submit something urgently you can always get me on signal, too - email me for details
110
Mike Dalessio @flavorjon.es · 04/08/2026
There's a group of folks. I have access, if there's a particular report number that needs attn let me know!
110
Mike Dalessio @flavorjon.es · 03/08/2026
I did find someone in the leadership team, yes!
110
Reposted by Mike Dalessio
Aaron Patterson @tenderlove.dev · 31/07/2026
If you're worried about the recent Rails CVE, @flavorjon.es made a very good skill you can feed to your coding agent to help assess your apps. Read about it here! discuss.rubyonrails.org/t/cve-2026-6...
discuss.rubyonrails.org
[CVE-2026-66066] Attack details, and tools to perform a forensic investigation
Hello there, I’m writing as a member of the Rails security team about CVE-2026-66066. As mentioned in the advisory, GHSA-xr9x-r78c-5hrm, we held back details about the attack vector to allow applicat...
2207
Mike Dalessio @flavorjon.es · 31/07/2026
The Rails security team published attack details and -- more importantly -- tools and agent skills to run a forensic investigation to help you determine if you were exploited. Be careful out there. discuss.rubyonrails.org/t/cve-2026-6...
discuss.rubyonrails.org
[CVE-2026-66066] Attack details, and tools to perform a forensic investigation
Hello there, I’m writing as a member of the Rails security team about CVE-2026-66066. As mentioned in the advisory, GHSA-xr9x-r78c-5hrm, we held back details about the attack vector to allow applicat...
1215
Mike Dalessio @flavorjon.es · 29/07/2026
Upgrade Rails immediately, kids, this is a big one. github.com/rails/rails/...
github.com
Possible arbitrary file read and remote code execution in Active Storage variant processing
### Impact In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process envi...
14930
Mike Dalessio @flavorjon.es · 27/06/2026
I know it's hard right now to tell when there is a real human behind a pull request, but I am a living reminder that if you respond to potential future contributors with feedback and humanity, it is an investment that will (on occasion (maybe)) pay off.
0111
Mike Dalessio @flavorjon.es · 27/06/2026
It was 20 years ago today that I emailed @tenderlove.dev my first Ruby open-source contribution, for client-side cert support in Mechanize. His enthusiasm and generosity on this occasion (and countless others!) was incredibly encouraging and I'm grateful to get to work with him so often.
2221
Mike Dalessio @flavorjon.es · 27/06/2026
I had so much fun speaking with the Once a Maintainer folks about being an open source maintainer and some of the security work that's involved. I hope you give it a read and enjoy! ❤️ onceamaintainer.substack.com/p/once-a-mai...
onceamaintainer.substack.com
Once a Maintainer: Mike Dalessio
The nokogiri maintainer on how AI has changed security and on maintainer burnout
083
Mike Dalessio @flavorjon.es · 20/06/2026
Ah, nice, ok I do have that. But I didn't notice it because it disappears as soon as I scroll! Ok I can work with this! Thanks.
010
Mike Dalessio @flavorjon.es · 20/06/2026
I don't see anything like that on my phone. Keep in mind I'm not syncing to local folder. But I also feel like I shouldn't have to if it's a plain text file.
100
Mike Dalessio @flavorjon.es · 20/06/2026
The year is 2026. My pocket supercomputer can take algorithmically improved photos superior to professional cameras. I can view augmented reality and track my location down to the foot. Yet Dropbox's app still does not ship with a goddamn text editor.
140
Mike Dalessio @flavorjon.es · 17/06/2026
A fun side effect of GitHub's current AI-generated demand is that Github Actions seem heavily throttled for open source projects ... even projects like mine that are core dependencies of GitHub itself. So here I am waiting on GitHub for a batch of PRs that would help improve GitHub ...
070
Mike Dalessio @flavorjon.es · 10/06/2026
If anybody knows who the PM is at @github.com for private vulnerability reporting on projects, I'd love an intro. I've been leaning in hard and have a few ideas for small changes that will have outsized impact in making the system more usable and maintainer-friendly.
111
Reposted by Mike Dalessio
Alt18F @alt18f.bsky.social · 06/06/2026
"Schofield said he is speaking publicly for the first time because he believes Americans need to understand how government data can be misused and, in some cases, already has been." Another courageous act from a civil servant choosing to honor their oath.
washingtonpost.com
Trump officials planned to mark 2.7 million living people as dead, whistleblower claims
A former Social Security executive said the plan, which was not carried out, would have used a death database to pressure immigrants to leave the country.
18830
Mike Dalessio @flavorjon.es · 14/05/2026
It's only five weeks away! Are you going to be there? I'm talking, of course, about Brighton Ruby. I'm really excited to hang out with Rubyists near the ocean. Also, pubs. brightonruby.com
brightonruby.com
Brighton Ruby Conference
152
Mike Dalessio @flavorjon.es · 07/05/2026
The Democratic party could have stopped this madness if they had a little more courage. Alas.
010
Mike Dalessio @flavorjon.es · 07/05/2026
The House passed it! And it had enough support to pass in the Senate, except the Republican *majority* filibustered to avoid a vote they knew would pass. The Democratic party could and should have used the opportunity to change the rules in the Senate and get this passed but chickened out.
210
Mike Dalessio @flavorjon.es · 07/05/2026
This is the bill that was being debated. www.congress.gov/bill/117th-c... Which I'm pretty sure would have prevented what happened this week.
congress.gov
110
Mike Dalessio @flavorjon.es · 07/05/2026
Who could have seen this coming
Tweet from 2021:

I would really like the Democratic Party to stop playing not to lose, and instead eliminate the filibuster and start governing, and take some goddamn risks.

Dems saying "we'll lose much more than we'd gain" are missing that "playing to not lose" is completely the wrong strategy when the issue is voting rights.

What you do is put all your chips in on this one hand, this is it, this is the whole ballgame.
140
Reposted by Mike Dalessio
Paul Byrne @theplanetaryguy.com · 29/04/2026
Last Monday I visited Capitol Hill with @planetarysociety.bsky.social to advocate for a healthy NASA budget. There's a long road ahead but early indications from both the House and the Senate is that they'll reject the brutal, unnecessary, and stupid cuts proposed by the White House.
Why. So. Serious?
3848
Reposted by Mike Dalessio
Katie Mack @astrokatie.com · 23/04/2026
And just to be abundantly clear: NASA AND SCIENCE IN GENERAL HAVE MASSIVE RETURN ON INVESTMENT. Cutting this budget is a net financial LOSS in the medium- to long-term. It undermines our future -- intellectually, technologically, and economically.
7770141
Reposted by Mike Dalessio
mtsw @mtsw.bsky.social · 18/04/2026
Re: nostalgia for VHS tapes and other analog media, I saw someone say like "a VHS tape never sold my information to a nazi" and yes that's true! But the reason it's true is actually because Congress passed a law in 1988 specifically making it illegal for video stores to sell your rental history
3751971238
Mike Dalessio @flavorjon.es · 15/04/2026
OMG I enjoyed this essay SO MUCH. Bread fucking rules. www.theatlantic.com/magazine/202...
theatlantic.com
I Found It: The Best Free Restaurant Bread in America
Thirteen thousand miles. Infinite contenders. One beautiful loaf.
051
Reposted by Mike Dalessio
Mayor Zohran Kwame Mamdani @mayor.nyc.gov · 15/04/2026
Happy Tax Day, New York. We’re taxing the rich.
795362587596
Mike Dalessio @flavorjon.es · 10/04/2026
Science fucking rules. How can you not be inspired by Artemis II photos?
170
Mike Dalessio @flavorjon.es · 07/04/2026
I'm excited for this year's Brighton Ruby lineup! It'll be my first trip to Brighton. RUBYISTS ASSEMMMMBLE brightonruby.com
brightonruby.com
Brighton Ruby Conference
2182
Mike Dalessio @flavorjon.es · 07/04/2026
I'm not okay paying for opus and getting haiku results. My point is that it's regressed pretty badly since early March
000
Mike Dalessio @flavorjon.es · 06/04/2026
It is fucking stunning to me that computers, which are devices designed to literally follow fucking instructions, have become ... *gestures rudely* ... this. Things that can no longer fucking follow instructions. Codex is also pretty bad, but at least it usually follows instructions.
220
Mike Dalessio @flavorjon.es · 06/04/2026
Seriously, Claude Opus 4.6 has been SO BAD for the last few weeks. INCREDIBLY dumb compared to how it behaved earlier in the year. I have been gut-checking this perception with many friends and co-workers and every one of them has been thinking this.
200
Mike Dalessio @flavorjon.es · 06/04/2026
120
Mike Dalessio @flavorjon.es · 03/04/2026
Nice! Well done.
010
Mike Dalessio @flavorjon.es · 23/03/2026
So @jcn.bsky.social rescued some old GORUCO videos from 2010 and 2011 that I just posted up on rubyevents.org, including this killer talk from @sandimetz.bsky.social: www.rubyevents.org/talks/less-t... Enjoy the old school vibes!
rubyevents.org
Less - The Path to Better Design
GORUCO 2011: Less - The Path to Better Design (Sandi Metz)
1158
Mike Dalessio @flavorjon.es · 25/02/2026
I'm excited that Rails 8.2 is going to have to_markdown for Action Text content. Given Markdown is the lingua franca for LLMs, this is going to make it dead easy to add markdown support to your Rails app API. github.com/rails/rails/...
github.com
Add `to_markdown` to Action Text, mirroring `to_plain_text` by flavorjones · Pull Request #56858 · rails/rails
Motivation / Background Today, Rails supports two formats for "exporting" rich text content: HTML Plain text HTML is very verbose, and not always handled well (or cheaply) by LLM agents...
0140
Mike Dalessio @flavorjon.es · 17/02/2026
Who needs Pingdom? Upright is open-source, more featureful, integrates into your existing OTel infrastructure, and was made with love by my teammate Lewis. dev.37signals.com/introducing-...
dev.37signals.com
Introducing Upright: An Open Source Synthetic Monitoring System
We’re open-sourcing Upright, the synthetic monitoring system we built to watch over Basecamp, HEY, Fizzy and our many other services.
1103
Mike Dalessio @flavorjon.es · 14/02/2026
If you're interested in multi-tenancy in Rails apps, I talked a bit about my recent work on Active Record Tenanted here: dev.37signals.com/rails-multi-...
dev.37signals.com
Rails Multi-Tenancy
Lead Programmer Mike Dalessio shares the benefits of multi-tenant databases and how his work with Fizzy led to the the Active Record Tenanted gem.
0132
Mike Dalessio @flavorjon.es · 19/01/2026
"See what you made me do?" is what bullies and abusers say to try to make people compliant in the future. Fuck this complete asshole. www.theguardian.com/us-news/2026...
theguardian.com
‘I no longer feel an obligation to think purely of peace,’ says Trump amid Greenland threats | First Thing
Donald Trump links Greenland seizure threats to Nobel snub in letter to Norway’s prime minister. Plus, unseen home video of Martin Luther King Jr
0150
Mike Dalessio @flavorjon.es · 11/01/2026
It made me so sad and angry to see these scientific budget cuts. We're eating our intellectual seed corn. NASA has to operate on timelines longer than a presidential term, this feel unrecoverable. www.theatlantic.com/magazine/202...
theatlantic.com
An Act of Cosmic Sabotage
How Donald Trump tried to ground NASA’s science missions
0229
Reposted by Mike Dalessio
schwad @schwad.org · 06/01/2026
Over half the slots for Belfast RubyFest 2026 have gone in the first 24 hours since I announced the event. If you want to come to Belfast and have a great time with other fellow Rubyists, RSVP now!! luma.com/yl6v0cy9
luma.com
Belfast RubyFest 2026 · Luma
The first-ever Belfast RubyFest is here. It will be a celebration of community, creativity, and all the wonderful things you can build with Ruby. Three…
052
Reposted by Mike Dalessio
Cory Booker @corybooker.com · 07/01/2026
Congressional Republicans have surrendered their power to the president they are constitutionally obligated to oversee. It is a startling abdication, rivaled only by the Trump’s lies to voters about what his foreign policy would be once he took office. Compare Candidate Trump to President Trump ⬇️
97741284
Reposted by Mike Dalessio
NY Times Pitchbot @nytpitchbot.bsky.social · 07/01/2026
Whether it’s Donald Trump demanding Greenland from Denmark or Barack Obama asking for Dijon mustard from a hotdog vendor, both presidents made some highly unusual requests.
251184152
Mike Dalessio @flavorjon.es · 07/01/2026
In case any of my friends in Europe or the UK need to hear it: all of this is fucking bullshit. All of it. I am a USian and I am incredibly embarrassed by all of it. Stephen Miller in particular can eat a fucking dick. I am 100% in favor of the rule of law as are all of the USians I respect. Fuuuck.
0160
Reposted by Mike Dalessio
Paul Byrne @theplanetaryguy.com · 30/12/2025
Open up this picture fully. Then look at the surface of Mars. Then look up to the top right. Spot Mars' moon Phobos high in the sky. Then notice the bright spot beside Phobos. That's Earth.
A forlorn landscape of layered rocks in the foreground, with hills fading into the background haze. At upper top right, a small crescent moon, and a bright star.
7647351855
Mike Dalessio @flavorjon.es · 05/01/2026
Rubyists, I just updated the Nokogiri docs site nokogiri.org to use Zensical. Let me know if anything looks wonky! Shout out to @squidfunk.com and the @zensical.org crew! Good stuff.
nokogiri.org
Nokogiri - Nokogiri
The Official Tutorial Archive™ of Nokogiri®
063
Mike Dalessio @flavorjon.es · 03/01/2026
Oh, late last year I also published a post about universal precompiled native Rubygems! mike.daless.io/posts/2025/0... This might be interesting if you've been following along with the bundler performance conversations like this post by @tenderlove.dev: tenderlovemaking.com/2025/12/29/c...
mike.daless.io
Universal Rubygem Precompilation - mike.daless.io
1173