iiinova — where your digital self keeps evolving

Jason Meller @jmeller.bsky.social · 13/04/2026

How many people interacted @1password.bsky.social when they did their taxes this year? How did it go? Want the good and the bad.

Jason Meller @jmeller.bsky.social · 12/02/2026

Here is Jesse's piece for those that missed it. blog.fsck.com/2026/01/30/L...

blog.fsck.com

Latent Space Engineering

I used to write more

000

Jason Meller @jmeller.bsky.social · 12/02/2026

I was inspired by @s.ly 's recent piece on Latent Space Engineering. I wanted to see if his observations also applied to the security domain. What started as small experiment turned into a full blown agentic AI benchmark that I'm releasing as OSS at 1Password. 1password.github.io/SCAM/

1password.github.io

SCAM — How safe is your AI agent?

An open-source benchmark by 1Password that tests whether AI agents can handle real security threats during everyday tasks. View the leaderboard, watch replays, and try the security skill.

171

Jason Meller @jmeller.bsky.social · 22/01/2026

Getting phished is both scary & humiliating and with AI its happening more often. As we've said, the long-term answer is passkeys, but not everyone uses them. Today, 1Password is shipping a deceptively simple change that massively improves the situation for passwords. 1password.com/blog/as-ai-s...

020

Jason Meller @jmeller.bsky.social · 17/10/2025

Great news for all who depend on a Ruby ecosystem that's healthy and secure.

040

Reposted by Jason Meller

Robby Russell @robbyonrails.com · 17/10/2025

Good news for the Ruby ecosystem. RubyGems now has the same governance as Ruby itself. Matz and Ruby Core as stewards. If Ruby Core has authority over where gems (by default) install from, this alignment makes sense. Viva la Ruby! www.ruby-lang.org/en/news/2025...

ruby-lang.org

The Transition of RubyGems Repository Ownership

0172

Jason Meller @jmeller.bsky.social · 10/10/2025

The reason legal stuff is so important when first setting up entities, is that’s when everyone is in alignment and there are smiles all around the table. Once that’s gone, it turns into a knife fight and it becomes impossible. Now courts will need to ultimately litigate.

Jason Meller @jmeller.bsky.social · 10/10/2025

Let’s be clear this post shows that operationally, this whole set up is a mess. You have creds all over the place, a confused OSS manager, and no clear cut docs that establish clear ownership. No IT inventory. Ruby Central and Ruby Together set this up to only work if everyone perfectly got along.

130

Jason Meller @jmeller.bsky.social · 10/10/2025

Arko in this post says he’s in control of a second 1Password account. One thing he should do is check if he’s the only owner. If he is, no one can evict him and regain the account. IMO he should have disclosed this access to them in his original email, esp if it’s how he got AWS root access.

120

Jason Meller @jmeller.bsky.social · 03/10/2025

I got so excited thinking about banana splits that I typoed!

Jason Meller @jmeller.bsky.social · 03/10/2025

Congrats, I can’t eat banana splits nearly that fast, but I similar heart rate though.

Yep became a member last year and yes I was at Rails world and spoke about passkeys.

000

A great start for Andre is to sign an affidavit attesting he didn’t abuse his access to the systems or retain any PII from that access either during his contracted employment or afterwards. That would be a great start rebuilding trust.

000

Andre is entitled to have an IP dispute. What I won’t do is watch silently as he erodes the public trust in the only legal entity capable of running all of Rubygems.[org] so that he has an monitor advantage in the IP dispute. That’s an existential threat to the Ruby community.

400

How do you know Andre didn’t use it? You continue to assert things you can’t possibly know. I truly hope he didn’t use it and I hope Ruby Central investigates to make sure. I also hope he didn’t retain copies of any PII. Someone should look into that.

200

Literally the exact opposite of the definition of responsible disclosure.

120

I frankly do not care (and did not care) about GH repos. What I care about is Arko had (has?) access to prod systems with my PII in it after being terminated & didn’t responsibly disclose it by virtue of telling you. This is all the evidence I need to know something is extremely wrong here.

220

If I left any company (fired or otherwise) and still had access to prod systems and told them and also told the press or social media about it I would rightfully be permanently unhirable. I would NEVER do what he just did to my worst enemy. It’s just not done.

132

You are allowed to point it out and deal with the consequences when the full story comes out. It usually always does. You are placing your entire reputation in this community on the line based on incomplete info. Hope you know what you doing.

It is simply no longer relevant if Arko is right or not. The whole ecosystem is at risk and you are contributing to the risk. If you are successful and Ruby Central can’t the service, who exactly wins? Not anyone. Let’s get it functional and deal with this Arko thing when the stakes are lower.

This is a big deal. Ruby Central is running this service and if they fail to do so, it will have dire consequences that far eclipse the minor spat. I speak for many when I say we need to get Ruby Central healthy. Them failing is threat to the whole Ruby community.

211

I agree they should have locked him out right away. Them not doing so doesn’t prove they don’t think of him as a risk. It shows they aren’t prepared to do access revocation. They need help not mudslinging. His actions of putting them on blast paint him unfavorably to in the know security folks.

140

> He email them to disclose that he still had access. Yes and then he told you so you can be manipulated into covering it. I agree it's not great that Ruby Central didn't revoke access. I wouldn't have a job if orgs got that right every time, let alone a resource constrained non-profit.

You have no way of knowing what Ruby Central knows about Arko. How could you possibly know they lied?

Jason Meller @jmeller.bsky.social · 18/11/2024

This settles it. Based on this blog post, I believe Ruby Central acted correctly in parting ways with Arko I'm eager to hear Ruby Central's side. Arko is not in charge of RubyGems[.]org. Him using the info of lingering access as a wedge to win in the court of public opinion is clear manipulation.

130

Clearly not always true, but it’s a good sign that you did something right.

020

Jason Meller @jmeller.bsky.social · 18/11/2024

How can you tell if non-tech leadership understood your tech idea? Their first questions are about patent status.

Jason Meller @jmeller.bsky.social · 17/11/2024

“Shine a flashlight into the soup. If the beam bends slightly, it’s properly seasoned.”

020

Jason Meller @jmeller.bsky.social · 17/11/2024

3 things I found are always true when making SaaS. 1. To know what you need to build, you must first build it. 2. A fast and cost-effective way to find and fix bad bugs is to ship them to production. 3. If you're nervous about deploying to production, the solution is to deploy more frequently.

050

Jason Meller @jmeller.bsky.social · 05/07/2023

The taste…it’s like mothballs coated in chlorine and then soaked in a solution of aspartame and Binaca.

000

Jason Meller @jmeller.bsky.social · 05/07/2023

Here it is! The toothpaste that most accurately simulates brushing your teeth with dirty swimming pool water!

Jason Meller @jmeller.bsky.social · 04/07/2023

How I used ChatGPT today. This saved me at least 20 minutes because I always (ALWAYS) mess up stuff when it comes to time.

Boris @bmann.ca · 04/07/2023

Reposted by Jason Meller

We’ve got more “small teams” than ever before. They’re all mostly B2B SaaS. I think B2C is the big upset. How do we explain to people that they should “shop local” when it comes to software. And pay for it!

021

Jason Meller @jmeller.bsky.social · 04/07/2023

I'm still hanging on with side-loading a modified version, but it's likely just a small stay of execution. bsky.app/profile/jmeller.bsky.socia…

Jason Meller @jmeller.bsky.social · 04/07/2023

Happy Fourth of July! …or as it is better known in the UK, “Urgent Support Ticket Submission Day”

000

What do you do on a day like today? You write docs.

I love our channel on the #macadmins Slack and I love the passionate people who build things with our API. Thanks Thomas. ❤️ www.macadmins.org/slack

100

Update! He's on the mend. No more follow-ups needed. RSV is no joke though. Lucy brought it home from daycare for sure.

000

I am one of those people! Zeitwerk completely eliminated one of the most unpredictable and hard to explain parts of Rails development. Thank you for everything you do. It makes what I do possible.

Sadly, little Roman (on the left) caught a case of RSV and needs to go to the doc at 9 today just to make sure he's on the mend. Feel better Roman!

100