Rubyland

news, opinion, tutorials, about ruby, aggregated
Sources About
Ruby on Rails 

Announcing the 2024 Rails Luminary Winners: Akira Matsuda & Yukihiro Matsumoto

This year we were joined by two special guests at Rails World: Akira Matsuda and Yukihiro “Matz” Matsumoto.

Each was awarded a 2024 Rails Luminary award to acknowledge and celebrate the significant mark they have each made on the Rails ecosystems, shaping the tools we use and the community around them.

Rails Lifetime Award 2024: Yukihiro “Matz” Matsumoto

For the Rails Lifetime Award, DHH bestowed this year’s honor on none other than the creator of Ruby himself, Yukihiro “Matz” Matsumoto. Matz’s vision of a programming language that is both powerful and enjoyable has us all to where we are today. His kindness, passion for Ruby, and impact on software development have inspired generations…

Julia Evans 

Some Go web dev notes

I spent a lot of time in the past couple of weeks working on a website in Go that may or may not ever see the light of day, but I learned a couple of things along the way I wanted to write down. Here they are:

go 1.22 now has better routing

I’ve never felt motivated to learn any of the Go routing libraries (gorilla/mux, chi, etc), so I’ve been doing all my routing by hand, like this.

	// DELETE /records:
	case r.Method == "DELETE" && n == 1 && p[0] == "records":
		if !requireLogin(username, r.URL.Path, r, w) {
			return
		}
		deleteAllRecords(ctx, username, rs, w, r)
	// POST /records/<ID>
	case r.Method == "POST" && n == 2 && p[0] == "records" && len(p[1]) > 0:
		if…
John Nunemaker 

Acquiring Fireside

First, let's set the scene. It's Saturday, July 20th in South Bend, Indiana. My kids are playing in the driveway (yes they left their toys out) while my wife and I work on some tweaks to our camper.

My phone dings. Just kidding. My phone never dings. It's always on silent. Let's pretend is buzzes. And please pretend I actually feel it in my shorts pocket (hint: I never feel it buzz, ask my wife).

It's a text from Garrett...

The Text

Garrett: Wanna buy fireside?
Me: What is it? Is that the podcast thing? I mean I’m interested in all things that make money haha.
Garrett: Yes. Fireside.fm. Will do an intro. Dan’s down to talk.
Me: Called Dan. Went well. We’ll catch up soon. 🤷‍♂️ 😬

Ok, now let's fast…

Once a Maintainer 

Once a Maintainer: Nate Berkopec

Welcome to Once a Maintainer, where we interview open source maintainers and tell their story.

This week we’re talking to Nate Berkopec, maintainer of the Ruby web server Puma and expert on Rails performance. Nate lives in Tokyo where he runs Speedshop, a Rails performance consultancy.

Once a Maintainer is written by the team at Infield, a platform for managing open source upgrades.

How did you become a software developer?

I was going to school in New York, and I kind of knew I wanted to be involved in tech startups. I was just interested in the whole scene, but I didn’t really know how to get involved. So I was just going to meetups and stuff like that in college. And I had a professor…

Ruby on Rails 

Rails 8.0 Beta 1: No PaaS Required

Deploying modern web apps – with all the provisions needed to be fast and secure while easily updateable – has become so hard that many developers don’t dare do it without a PaaS (platform-as-a-service). But that’s ridiculous. Nobody should have to pay orders of magnitude more for basic computing just to make deployment friendly and usable. That’s a job for open source, and Rails is ready to solve it.

That was the premise of my keynote here at Rails World, and it’s the mission for Rails 8. So we are thrilled to release the first beta release of this new version in celebration with Rails World here in Toronto.

Despite being a beta release, the vast majority of everything that’s included…

Mintbit 

Positional and Keyword Arguments in Ruby on Rails

Method parameters can be passed in different ways, allowing for flexible and readable code. Understanding the difference between positional arguments and keyword arguments is essential for writing clean and maintainable code.

To illustrate how these types of arguments can be used in practice, we’ll take a look at an example using an initialize method. This example will help clarify the distinction between positional arguments and keyword arguments in the context of a class constructor. While this initializer serves as a concrete example, the concepts apply broadly across Ruby methods.

Let’s break down these two types of arguments using the following example of an initialize method:

1
2
3…
Ruby on Rails 

Rails 8 beta, DHH keynote, fresh error pages, and more!

Hi, it’s zzak. Let’s jump into This Week in Rails!

Rails 8.0 beta 1 has been released!
The first beta of Rails 8 is out! While the release notes are getting ready, have a look at the changes and give it a go.

DHH keynote from Rails World
The first talk recording from Rails World is up, and David goes over everything that went into Rails 8 and beyond.

Tidy up the error pages
The error pages built into Rails have been updated, here’s a preview of the new look: Screenshot 2024-09-26 at 10 46 56 AM

Drop support to Ruby 3.1
Rails 8 will require Ruby 3.2.0 or newer.

Add TaggedLogging#logger constructor for more pleasant logging interface
This updates the default logger in production to use ActiveSupport::TaggedLogging.logger(S…

Make Active Model Serialization…

DEV Community: Brandon Weaver 

Let's Read - Eloquent Ruby - Ch 19

Perhaps my personal favorite recommendation for learning to program Ruby like a Rubyist, Eloquent Ruby is a book I recommend frequently to this day. That said, it was released in 2011 and things have changed a bit since then.

This series will focus on reading over Eloquent Ruby, noting things that may have changed or been updated since 2011 (around Ruby 1.9.2) to today (2024 — Ruby 3.3.x).

Chapter 19. Save Blocks to Execute Later

This chapter wraps up the book's tour into block functions with the idea that we can save blocks to be used later. That may sound abstract, as the previous concepts also did, but you'll find that it's very common to see around Ruby especially for…

Nithin Bekal 

Rails: Benchmark.ms deprecated

Today I stumbled upon this PR which deprecates the Benchmark.ms monkeypatch in Rails, without a replacement. It’s a handy method for instrumenting different parts of the code. Here’s how you might use it:

time_in_ms = Benchmark.ms { sleep 0.5 }
#=> 501.8

This will no longer work in Rails 8.1 (8.0 beta was just released today, so it will still work for some time). However, if you use it, you will see this deprecation warning in the logs:

`Benchmark.ms` is deprecated and will be removed in Rails 8.1 without replacement.

But if you look at the original implementation, all it does is call Benchmark.realtime, and multiply the time in seconds by 1000.

def ms(&blk)
  1000 * realtime(&blk)
e…

I think the easiest way…

37signals Dev 

Kamal 2.0 released

We’ve just released version 2 of Kamal, our deployment tool for running web apps directly on VMs or bare metal servers.

Kamal 1.0 was designed with 37signal’s use case in mind — deploying an application across multiple hosts, served with an external load balancer.

With Kamal 2.0 we’ve focused on making it simpler to use at any scale, whether you are deploying your app to 50 servers or deploying 5 apps to a single server.

What’s new?


New proxy

Kamal uses a proxy to seamlessly switch between application versions.

Previously we used Traefik, but its declarative discovery model made it a poor match for…

Awesome Ruby Newsletter 

💎 Issue 436 - Design Patterns in Ruby

RubySec 

CVE-2024-46488 (sqlite-vec): Heap-based Buffer Overflow in sqlite-vec

sqlite-vec v0.1.1 was discovered to contain a heap buffer overflow via the npy_token_next function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file. Workaround for CVE in release 0.1.3.
Ruby Central 

September 2024 Newsletter

Hello! Welcome to the September newsletter. Read on for announcements from Ruby Central and a report of the OSS work we’ve done from the previous month.

In August, Ruby Central's open source work was supported by Ruby Shield sponsor Shopify, AWS, the Sovereign Tech Fund (STF), and Ruby Central memberships from 29 other companies, including Partner-level member Sidekiq. In total, we were supported by 185 members. Thanks to all of our members for making everything that we do possible. <3

Ruby Central News

RubyConf 2024

RubyConf 24 is just around the corner! November 13-15 at the Chicago Hilton downtown. Join your #RubyFriends and fellow Ruby enthusiasts for keynotes, breakout sessions, workshops,…

Planet Argon Blog 

Engineering Leadership in Action: Highlights from LeadDev New York 2024

Engineering Leadership in Action: Highlights from LeadDev New York 2024

Explore Ben Parisot's key takeaways from LeadDev New York 2024, covering topics like leadership, versatile management, AI in coding, and cultivating team ownership- plus more valuable insights for engineering managers and tech leaders.

Continue Reading

Toxic Elephant 

How I want to handle the removal of gems from Ruby's standard library

I think a good process is something like this:

  1. Add the standard library gems to the dependencies so the warnings go away. For gem projects I think it’s fine to put them in the development dependencies because the published gems don’t need these dependencies right now
  2. Figure out which gems load the standard library gems
  3. File bug reports for those gems to make them add the standard library gems as dependencies
  4. Wait for those gems to be updated and then update the dependencies on those gems in my project
  5. Remove the standard library gems from the dependencies again

To be honest, I think I have only ever gotten as far as point 2.

Rails Designer 

RailsDesigners.com, Elite Ruby on Rails Product Engineers & UI Designers

Over the past decade I have, besides running various SaaS as a solo founder, always made some time to help other teams with their UI, product engineering and so on. With a background in design (I designed my first website in 1997), I quickly learned that my front to back skill set is super productive, valuable and fairly unique.

But also not thát unique! There are easily thousands of others all over that not only know how to make beautiful and functional design, but are just as comfortable working with Service Objects, Decorators and APIs.

Truly 10× developers.

I want to get them all together, in a directory, ready for companies to reach out for small ongoing projects, as their only…

Ruby Weekly 

The community survey results are in

#​721 — September 26, 2024

Read on the Web

Ruby Weekly

The Ruby on Rails Community Survey 2024 Results — Every two years, Planet Argon has run this well received survey and now the results from over 2700 Rubyists are here to enjoy, complete with comparisons over time. We get to learn what Rubyists' favorite podcasts are, popular livestreamers, top gems, and also that Stimulus has Stimulus has overtaken React as the #1 JavaScript library used.

Planet Argon

Ruby’s New Parser: Why Prism is the Future of Ruby Development — A summary of ▶️ a 25-minute podcast interview with the creator of Kevin Newton, the…

Jared Norman

🔥 In the interview, we learn that…

Mintbit 

Understanding Struct in Ruby on Rails

Ruby is known for its elegant syntax and flexibility, which allows developers to create concise and readable code. One of the lesser-known but powerful tools in Ruby is Struct, a built-in class that provides a simple way to group related attributes without the overhead of defining a full class. While not as commonly used as ActiveRecord models or POROs (Plain Old Ruby Objects), Struct can be incredibly useful in Rails applications for certain scenarios.

What is Struct?

Struct in Ruby is a shortcut to defining simple classes that bundle together a few attributes, providing getter and setter methods for those attributes automatically. It creates a new class that behaves like a lightweight…

37signals Dev 

Solid Queue 1.0 released

We’ve just released Solid Queue v1.0.0, right before speaking about it at Rails World. This version has come a long way since we published the first version, 0.1.1, back in December 2023, with 132 merged pull requests and 126 closed issues, and the help of multiple contributors.

Apart from fixing many bugs and edge cases, we’ve enhanced Solid Queue with the following:

  • Safe and atomic batch operations to discard, retry and unblock jobs, used from Mission Control – Jobs.
  • Enqueueing jobs in bulk (enqueue_all for Active Job’s perform_all_later).
  • Recurring (cron-style) jobs.
  • Proper logging and instrumentation.
  • Lifecycle hooks for the supervisor and workers.
  • A better installation,…

More importantly, we’ve completely migrated HEY, our email and calendar service, over from Resque. In fact, HEY Calendar was launched in January directly using Solid Queue for…

Write Software, Well 

If You're a WordPress Developer, Learn Ruby and Rails

If You're a WordPress Developer, Learn Ruby and Rails

With the ongoing drama in the WordPress ecosystem (so sad to see decades of trust and reputation getting destroyed in a matter of days), many developers might be genuinely feeling concerned about the platform's future.

Personally, I don't think WordPress (.org) is going anywhere, but if you're a WP developer who wants to diversify your skill set by investing in other technologies, or just looking for a solid, developer-friendly framework to build awesome websites, I highly recommend investing time in learning Ruby on Rails.

At first glance, learning Ruby & Rails might seem a bit daunting, especially if you're new to programming or you're used to the comforts of working with visual website…

DEV Community: Brandon Weaver 

Let's Read - Eloquent Ruby - Ch 18

Perhaps my personal favorite recommendation for learning to program Ruby like a Rubyist, Eloquent Ruby is a book I recommend frequently to this day. That said, it was released in 2011 and things have changed a bit since then.

This series will focus on reading over Eloquent Ruby, noting things that may have changed or been updated since 2011 (around Ruby 1.9.2) to today (2024 — Ruby 3.3.x).

Chapter 18. Execute Around with a Block

The focus of this chapter is how we start using block functions to wrap our code and transport around values. Sound abstract? Don't worry, we'll get into the examples soon which will make it a lot clearer, and once you see it you'll see it fairly…

Rails Designer 

Drag & Drop Images with Preview using Stimulus Outlets

In a previous article I explored a way to preview images before uploading with Stimulus.

I now want to extend its functionality by adding drag & drop. Along the way I am also using Stimulus outlets to tie the two functionalities together. Showcasing more advanced use of small Stimulus controllers.

I assume you walked through all the steps of the previous mentioned article.

Let’s start with the HTML. It’s using the other HTML with just a few attributes added.

<div data-controller="image-preview dropzone" data-action="dragover->dropzone#dragOver dragleave->dropzone#dragLeave drop->dropzone#drop">
  <img data-image-preview-target="canvas" hidden class="object-cover size-48">

  <input type=

Let’s create the dropzone_controller.js.

import { Controller } from "@hotwired/s…
Super Good Blog 

Ruby’s New Parser: Why Prism Is the Future of Ruby Development

Ruby devs, hold on to your keyboards. The Ruby’s language tooling is unifying around a new parser called Prism.

In the latest episode of Dead Code, I spoke with Kevin Newton, Staff Software Engineer at Shopify, and the driving force behind Ruby’s brand-new parser, Prism. If you’ve ever cursed at Ruby’s quirks or struggled with its complex syntax, this conversation will hit home.

Before we get into the technical nitty-gritty, let’s start with the big question: Why does Ruby need a new parser in the first place? 🤔

The Ruby Parser Problem No One Talks About

Most of us have used Ruby’s parser without even thinking twice. But here’s the thing—Ruby’s original parser, first built in 1993, was…

37signals Dev 

Announcing Hotwire Native

As Rails World 2024 is about to begin, we have an exciting Hotwire announcement! We’re launching a brand new, yet familiar, framework for building hybrid mobile apps.

Hotwire Native apps

Background

But first, let me provide some context. Last year, shortly before Rails World 2023, we open sourced Strada, which allows you to build high fidelity native features in your hybrid Turbo Native apps. The launch was met with a lot of excitement and development. However, there was a consistent piece of feedback that we heard: the relationship between the Hotwire umbrella of libraries, Turbo + Stimulus + Strada, was quite confusing.

Strada is meant…

RubySec 

GHSA-8fx8-3rg2-79xw (camaleon_cms): Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184)

A stored cross-site scripting has been found in the image upload functionality that can be used by normal registered users: It is possible to upload a SVG image containing JavaScript and it's also possible to upload a HTML document when the format parameter is manually changed to [documents][1] or a string of an [unsupported format][2]. If an authenticated user or administrator visits that uploaded image or document malicious JavaScript can be executed on their behalf (e.g. changing or deleting content inside of the CMS.) [1]: https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/uploaders/camaleon_cms_uploader.rb#L105-L106 [2]:…
naildrivin5.com - David Bryant Copeland's Website 

Achieve Static Typing Benefits in Ruby with Keywords Args and Class Constants

Noel Rappin wrote an article on static typing in Ruby that does a great job outlining the various techniques to achieve the benefits often ascribed to static typing. I have two more techniques that address the 80% case of typing problems in Ruby: keyword arguments and class constants.

In my experience, most typing issues in Ruby and Rails apps are the result of overuse of hashes as data structures, coupled with the use of symbols to refer to classes instead of using the class itself. Both of these patterns result in indirection between intention and behavior. When you get it wrong—use the wrong hash key, call the wrong dynamically-created method—you get errors that don’t make sense.

K…

katafrakt’s garden 

Lightweight introduction to mruby

I knew that mruby existed for a long time. I knew it’s a lightweight version of Ruby, designed mostly to be embedded in other programs. I knew that DragonRuby has some kind of relation to mruby - be it written in it or using some kind of fork of it. But that’s pretty much it.

Prompted by a few discussions here and there lately, I decided to take a closer look at it.

Installation

If you are using a Ruby version manager - and you should - installing mruby should be very simple. In my case, in asdf, it is as much as running:

asdf install ruby mruby-3.3.0

Wait a couple of seconds and we’re ready for the test drive.

Getting around

And interactive REPL for mruby is called mirb and that’s…

Evil Martians 

Designing Tegon: a signature vision for the AI-driven issue tracker

Authors: Roman Shamin, Head of Design, Anton Lovchikov, Sr. Product Designer, and Travis Turner, Tech EditorTopics: Case Study, Design, Martian Design Sprint, Machine Learning Development, LLMs, Deep Learning, Neural Networks

Tegon, the open source, AI-first issue tracker for engineering teams, needed a UI and UX to distinguish it from other issue trackers. Evil Martians took charge of this transformation, redesigning the core experience and bringing new ideas for AI-first features to elevate the issue tracker UX.

Tegon, the open source, AI-first issue tracker for engineering teams, faced the challenge of changing its UI and UX to set the product apart from other issue trackers. Evil…

Hanami 

Hanami 2.2.0.beta2

We’re back to round out the brand new database layer we introduced in our previous beta release. This time around, we’re adding MySQL, introducing a powerful new way of working with multiple databases, and bringing you a little treat at the same time: full validation contract support in actions!

MySQL support

Now you can generate a new Hanami app with hanami new my_app --database=mysql and have a ready-to-go MySQL-backed Hanami app! All hanami db commands (like db prepare, db migrate, etc.) have been updated to manage your MySQL database over the lifecycle of your app.

Multiple gateways

With beta1, we introduced the idea of…

The Ruby on Rails Podcast 

Episode 524: Writing Code Using AI with Landon Gray

Large language models are everywhere now. They’re changing the way we work, from tools code completion tools like Copilot, to audio generation apps like Suno.ai. Apple recently announced huge updates with generative AI for all of their platforms. Adobe, Canva, and Google have all added AI to their products. It seems like every vendor is building these features. So how will this change the way we write and think about code. Landon Gray joins the show to tell us how AI will change software development.

Show Notes
https://www.linkedin.com/in/thedayisntgray/.
https://gem-mice-15c.notion.site/Build-your-startup-prototype-in-less-than-3-hours-25de8fcd84dc44e8b3d0df0c4862a9de?pvs=74

Mintbit 

Lazy Loading vs. Eager Loading

When working with Ruby on Rails, managing how your application loads data from the database is crucial for performance optimization. Two common techniques used to handle this are lazy loading and eager loading. Understanding the differences between them and knowing when to use each can help improve both the speed and efficiency of your Rails application.

In this blog post, we’ll dive into what lazy loading and eager loading are, how they work in Rails, and when to use them—complete with code examples.

What is Lazy Loading?

Lazy loading is a strategy where data is only loaded when it’s explicitly needed. Instead of fetching all related data upfront, Rails waits until you access an…

Code Otaku 

Leveraging Falcon and Rails for Real-Time Interactivity

My RubyKaigi 2024 talk on how to use Falcon and Rails together to build real-time interactive applications.
RubyGems Blog 

3.5.20 Released

RubyGems 3.5.20 includes enhancements.

To update to the latest RubyGems you can run:

gem update --system

To install RubyGems by hand see the Download RubyGems page.

## Enhancements:

  • Installs bundler 2.5.20 as a default gem.

SHA256 Checksums:

  • rubygems-3.5.20.tgz
    211e0b0fa5313620e1d4a2b352deaf60687c3549ba35f89cdb604f993ff69f83
  • rubygems-3.5.20.zip
    959e711271f1e41c502be4752af77af8e729c26e8df15ef4bfb198ca5578405f
  • rubygems-update-3.5.20.gem
    722ac315f9fd9413fcbadd35a001e8760ab31cbec3ee3cd8de26d65745940a1b
Gusto Engineering - Medium 

Gusto Eng Spotlight Series: Maham Boghani

This blog series is dedicated to celebrating our Black, Latinx, and Women Engineers who are making an impact in the lives of our Gusties and Gustomers (Gusto customers) every day.

Today, we’re spotlighting Maham Boghani, who has been with Gusto for 3 years. She spent two years on the Big Friendly Payroll Team before transitioning to the Time Tools team last year.

Maham sitting in the grass in front of some purple tulips

Kevin: How did you join Gusto?

Maham: Prior to being at Gusto, I was at UKG (formerly Ultimate Software), where I interned. When I transitioned to full time, the person who helped me through that process, Shawn, actually moved to Gusto shortly after. And, following him, two or three more people from my team also made the move!

Even…

BigBinary Blog 

Standardizing frontend routes and dynamic URL generation in Neeto products

We often benefit from the ability to easily identify which component is renderedby simply examining the application UI. By consistently defining routes andmapping them to components, we can easily locate the rendered component bysearching for the corresponding route. This practice also helps us understandthe component's behavior, including when it is rendered and the events leadingup to it.

This blog post explores a standardized approach to defining frontend routes. Thegoal is to enhance the searchability of components based on the URL structure.Neeto has adopted a structured and hierarchicalapproach to defining frontend routes, prioritizing navigational clarity andensuring consistency and…

RubyGems Blog 

August 2024 RubyGems Updates

Welcome to the RubyGems monthly update! As part of our efforts at Ruby Central, we publish a recap of the work that we’ve done the previous month. Read on to find out what updates were made to RubyGems and RubyGems.org in August.

RubyGems News

In August, we released RubyGems 3.5.17 and 3.5.18 along with Bundler 2.5.17 and 2.5.18. These releases bring a series of enhancements and bug fixes designed to improve the overall developer experience with RubyGems. Notable improvements include fixing an issue where gem uninstall <name>:<version> would fail on shadowed default gems, enabling lockfile checksums in future Bundler 3 even when there’s no previous lockfile, and fixing an issue where bund…

Some other important accomplishments…

Radan Skorić's website 

Gilded Rose Kata and the value of explicit requirements in the code

I came upon the Gilded Rose coding kata by reading Victor Shepelev’s (a.k.a. Zverok) blog post about it. I liked it, especially the part about not immediately reaching for the OOP solution. Ruby is an expressive multi-paradigm language that offers various tools beyond classic OOP. However, looking at Victor’s solution I felt like something is missing. After some head scratching I realised I’m ...
Mintbit 

Applying the Law of Demeter in Object-Oriented Programming with Rails

In object-oriented programming (OOP), adhering to principles that promote loose coupling and encapsulation is essential for building maintainable, scalable systems. One such principle is the Law of Demeter, also known as the Principle of Least Knowledge. This principle helps prevent objects from knowing too much about the internal workings of other objects, which is a common issue in OOP.

In this blog post, we’ll explore the Law of Demeter and demonstrate how you can apply it in a Ruby on Rails application. By the end, you’ll understand how this principle can simplify your code and make your application easier to maintain.

What is the Law of Demeter in Object-Oriented Programming?

In obj…

dmitrytsepelev.dev 

Terminal–based game in 150 lines

In this article we will write a terminal–based real–time dungeon crawler. I will to keep it under 150 lines with idiomatic (no code golfing!) Ruby code.

Result game

Main game loop

I want to start with something basic. We need a class that will contain our game state and draw the screen. Let’s create a game.rb with the following content:

class Game
  SLEEP_INTERVAL = 0.2

  def run
    loop do
      draw_screen
      sleep SLEEP_INTERVAL
    end
  end

  private

  def draw_screen
    system "clear"

    puts Time.now
  end
end

Game.new.run

Source is here

Run it (using ruby ./game.rb) and you see that it updates the current time every SLEEP_INTERVAL seconds. Nothing fancy yet!

Rendering…

The Bike Shed 

441: The Pickaxe Book with Noel Rappin

For a long time, Programming Ruby was the authority in the developing world. Now, a much-needed update has been published. During this conversation, we are joined by Noel Rappin, who shares how his frustration at the idea of static type in Ruby motivated him to investigate why he felt this way, as he published his findings in The Pickaxe Book. We discuss how this book differs from previous material he has published, explore a recent blog post series that explored the idea of failing fast, and address the widespread opinion that developers should take a simpler approach that is more accessible. Noel also explores the responsibility of understanding how readers consume material and…

Josh Software 

Transform Your Code: Discover the map() Function’s Secret Power!

In the diverse world of JavaScript, whether working on frontend or backend projects, the map function is a commonly used function. I’ve been using it for years to transform arrays in a clean and efficient way, making it a key part of my JavaScript development. However, it wasn’t until recently that I realized I had … Continue reading Transform Your Code: Discover the map() Function’s Secret Power!
DEV Community: Brandon Weaver 

Let's Read - Eloquent Ruby - Ch 17

Perhaps my personal favorite recommendation for learning to program Ruby like a Rubyist, Eloquent Ruby is a book I recommend frequently to this day. That said, it was released in 2011 and things have changed a bit since then.

This series will focus on reading over Eloquent Ruby, noting things that may have changed or been updated since 2011 (around Ruby 1.9.2) to today (2024 — Ruby 3.3.x).

Chapter 17. Use Blocks to Iterate

Blocks, or as I prefer to call them block functions, are an exceptionally distinct part of Ruby. If you've used Javascript or languages with a more functional bend they're going to look very familiar, but if not they can be a bit of a foreign concept.

As the…

Island94.org 

Seeing like a Rails and Ruby platform team

When I’m not hacking on GoodJob, I work at GitHub, where I’m the engineering manager of the “Ruby Architecture” team, which is filled with fantastic rubyists. Our team mission is to:

Make it easy for GitHub engineers to create, deliver, and operate best-of-class Ruby and Rails applications, and share the best of it with the world.

This is an adaptation of a post I published internally at GitHub, and its ensuing discussions, to explain what a team like ours does when we’re supporting other teams and giving technical feedback. I imagine this is similar to other big companies’ Rails and Ruby platform teams, like Shopify’s “Ruby Infrastructure” team. I hope this is useful in thinking…

RubySec 

CVE-2024-47220 (webrick): HTTP Request Smuggling in ruby webrick

An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., "GET /admin HTTP/1.1\r\n" inside of a "POST /user HTTP/1.1\r\n" request. NOTE: the supplier''s position is "Webrick should not be used in production."
Giant Robots Smashing Into Other Giant Robots 

Turning the page on some of our Open Source projects

After auditing our Open Source projects, we have decided to archive some of them.

Although deprecating a library might seem like a bad thing, it’s not actually. The languages/frameworks are evolving, and they implement most of these features nowadays. This is a great thing! Less dependencies to maintain in your app. It’s also part of a project lifecycle: sometimes it just doesn’t make sense to keep it anymore.

We love Open Source and still maintain many other libraries such as FactoryBot, Clearance, Administrate, along with other newly created libraries such as Belt, Superglue, CapybaraAccessibilityAudit, and more.

The decision of archiving the following projects was a combination of:

RubySec 

GHSA-7x4w-cj9r-h4v9 (camaleon_cms): Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185)

The [actions](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L51-L52) defined inside of the MediaController class do not check whether a given path is inside a certain path (e.g. inside the media folder). If an attacker performed an account takeover of an administrator account (See: GHSL-2024-184) they could delete arbitrary files or folders on the server hosting Camaleon CMS. The [crop_url](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L64-L65) action might make arbitrary file writes (similar impact to…
RubySec 

GHSA-r9cr-qmfw-pmrc (camaleon_cms): Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184)

A stored cross-site scripting has been found in the image upload functionality that can be used by normal registered users: It is possible to upload a SVG image containing JavaScript and it's also possible to upload a HTML document when the format parameter is manually changed to [documents][1] or a string of an [unsupported format][2]. If an authenticated user or administrator visits that uploaded image or document malicious JavaScript can be executed on their behalf (e.g. changing or deleting content inside of the CMS.) [1]: https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/uploaders/camaleon_cms_uploader.rb#L105-L106 [2]:…
Ruby Rogues 

The Sounds of Silence: Lessons From an API Outage with Paul Zaich - RUBY 652

Paul Zaich from Checkr tells us about a critical outage that occurred, what caused it and how they tracked down and fixed the issue. The conversation ranges through troubleshooting complex systems, building team culture, blameless post-mortems, and monitoring the right things to make sure your applications don't fail or alert you when they do.

Links
Picks

Become a supporter of this podcast: https://www.spreaker.com/podcast/ruby-rogues--6102073/support.
RoRvsWild's blog 

One-on-one anyone?

We had a wonderful time in Bucarest, Romania, and we are thankful to Adrian, Lucian, and the rest of the team for making it happen. Friendly.rb really deserves its name.

It was the first time we had a booth at a conference with RoRvsWild. We are getting out of our comfort zone. Like most developers, we prefer coding and building features instead of talking and convincing people to try our product. It was a great experience, and we couldn’t have chosen a better place to start than Friendly.rb.

With the friendly Yaro, we’ve installed our monitoring gem on SupeRails and had a quick overview of the data collected for his application. We shared insights and discussed how he could eventually…

Mintbit 

Mastering Rails Params: with_defaults

Handling parameters in Ruby on Rails is a common task, especially when working with forms and strong parameters. A lesser-known but powerful method that can simplify this process is with_defaults. This method allows you to provide default values for any missing keys in a hash, making your code cleaner and more efficient. Let’s explore how with_defaults works and how you can use it effectively with strong parameters.

What is with_defaults?

with_defaults is an alias for the reverse_merge method in Rails. It allows you to merge two hashes, where the values from the given hash are only applied if they don’t already exist in the receiver hash. It’s particularly useful when you want to ensure…

Hotwire Weekly 

Week 38 - Turbo Morphing in Practice, Ultimate Rails PWA Guide, and more!

Hotwire Weekly Logo

Welcome to Hotwire Weekly!

Welcome to another issue of Hotwire Weekly! Next week, Rails World 2024 takes place in Toronto, Canada, September 26-27, featuring some Hotwire and Hotwire-adjacent talks and lightning talks:

  • The Empowered Programmer - Justin Searls
  • Making accessible web apps with Rails and Hotwire - Bruno Prieto
  • Progressive Web Apps for Rails developers - Emmanuel Hayford
  • Rails as a real-time, multiplayer game engine - Paweł Strzałkowski
  • React to Hotwire migration - Carlos Marchal
  • Ruby on Rails on WebAssembly - Vladimir Dementyev
  • Turbo Native: Turn any Rails app into a mobile (iOS/Android) app - Yaroslav Shmarov

Enjoy the content and hope to see you at Rails World 2024! 🚀✨


📚 …

Greg Molnar 

FriendlyRb 2024 Recap

I want to put down my thoughst about FriendlyRb while they are fresh.

Notes to self 

A brief look at the new Kamal Proxy replacing Traefik

Kamal 2 is coming with a brand new custom proxy that’s replacing Traefik. Let’s have a look at why is that and what it means.

Why Kamal needs a proxy

Kamal is a simple deployment tool built around Docker containers. While Docker itself has a Swarm mode allowing for more robust deploys, Kamal keeps things simple by running the containers with straightforward docker run calls. But starting and stopping containers this way comes without their automatic replacement. Kamal needs a way to handle zero-downtime deployment for web containers so it originally incorporated Traefik.

Why Traefik

While there are many HTTP proxies around, Kamal was in the market for something of the auto-discovery of…

Rails Inside Out 

Securing your Rails application with Action Policy and Rabarber

There is lot of yapping going on in this article if you just want to see the implementation you can jump to the Setup section

Recently, when I was building Pulse, I wanted an admin dashboard of sorts, I wanted to be able to manually create startups other users can then claim later, I also wanted to see a list of registered users, some basic stats, etc.

The problem now, I didnt want every Joe and Jill to access the admin dashboard and do whatever they want simply because they registered an account.

To solve this, I did a deep dive, found solutions like cancan and its derivatives, and a bunch of other gems. However I wanted a setup that was a bit automatic that I could setup once and…

RubySec 

CVE-2024-7254 (google-protobuf): protobuf-java has potential Denial of Service issue

### Summary When parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash. Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team Affected versions: This issue affects all versions of both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime. ### Severity [CVE-2024-7254](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7254) **High** CVSS4.0 Score 8.7 (NOTE: there may be a delay in publication) This is a potential Denial of Service. Parsing nested groups as unknown fields with…
RubySec 

CVE-2024-45614 (puma): Puma's header normalization allows for client to clobber proxy set headers

### Impact Clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users trusting headers set by their proxy may be affected. Attackers may be able to downgrade connections to HTTP (non-SSL) or redirect responses, which could cause confidentiality leaks if combined with a separate MITM attack. ### Patches v6.4.3/v5.6.9 now discards any headers using underscores if the non-underscore version also exists. Effectively, allowing the proxy defined headers to always win. ### Workarounds Nginx has a…
Saeloun Blog 

Rails 7.1 Adds Support For Logging Background Job Enqueue Callers.

ActiveJob is used to run tasks in the background, helping us offload long-running tasks to the background job and keep our application responsive.

However, when a job fails, whether due to network issues or database unavailability, it can sometimes be difficult to trace the source of the problem.

Before

When a job is enqueued using ActiveJob, the logs provide information about the job being added to the queue, but they lack detailed context about where the job was enqueued in the codebase for effective backtracking.

This lack of visibility made debugging more difficult, especially in large codebases where jobs might be enqueued from various places.

After

Rails 7.1 adds support for…

Ruby on Rails 

Kamal 2, Bye-bye Sprockets, and so much more!

Hi, it’s zzak. Let’s explore this week’s changes in the Rails codebase.

Rails World 2024 is next week
Safe travels to everyone heading to Toronto! All sessions will be recorded and published on the Rails YouTube channel, so subscribe to get notified.

[RF Guides] Active Record Validations
The Foundation is still hard at work on updating the guides, this time they have made a pass through the Active Record Validations guide. Give it a look and help them spot any issues!

Add ability to use multiple rate limits per controller
With this PR, you can now add multiple rate_limit definitions in your controller.

Remove Sucker Punch Active Job adapter
Sucker Punch existed before ActiveJob, but…

Mintbit 

Understanding HashWithIndifferentAccess in Ruby on Rails

In the Ruby on Rails framework, there’s a little-known feature called HashWithIndifferentAccess that can make handling hash keys more convenient and error-free. If you’ve ever found yourself frustrated by having to remember whether a hash key is a string or a symbol, this feature is for you!

What is HashWithIndifferentAccess?

HashWithIndifferentAccess is a special kind of hash that allows you to access its keys using either strings or symbols interchangeably. This means that whether you use a symbol (:key) or a string ("key") to reference a value, you’ll get the same result.

Why Use HashWithIndifferentAccess?

In a typical Ruby hash, the keys are case-sensitive and type-sensitive. This…

Joy of Rails 

Add your Rails app to the Home Screen - the Ultimate Guide

I‘m currently obsessed with installing web apps to my desktop and on my home screen. Using Command+Tab on macOS to switch between "sites" is built in to my DNA. Rails apps in a macos DockMost of the apps shown here are Progressive Web Apps built with Rails

As it turns out, several web apps I have installed are built with Rails, including GitHub, Feedbin, Mastodon, Hatchbox, Campfire, and the Rails Discourse forum. These Rails apps are installable because they are Progressive Web Apps.

Rails 8 💜 PWAs

Rails 8 is coming soon which means, by default, a new Rails app will be installable as a Progressive Web App (PWA). A PWA can do a lot of things a normal web app can’t:

like receive Web…

Awesome Ruby Newsletter 

💎 Issue 435 - Ruby-SAML pwned by XML signature wrapping attacks

Island94.org 

The secret to perfectly calculate Rails database connection pool size

Ruby on Rails maintains a pool of database connections for Active Record. When a database connection is needed for querying the database, usually one per thread (though that’s changing to per-transaction), a connection is checked out of the pool, used, and then returned to the pool. The size of the pool is configured in the config/database.yml. The default, as of Rails 7.2, is pool: <%%= ENV.fetch("RAILS_MAX_THREADS") { 5 } %>.

The database connection pool size is frequently misconfigured. A lot. How to calculate the database connection pool size is one of the most common questions I get on GoodJob (Hi! I’m the author of GoodJob 👋). I have spent an embarrassingly large amount of time…

Ruby Weekly 

Here be Ruby dragons

#​720 — September 19, 2024

Read on the Web

Ruby Weekly

DragonRuby: A Ruby-Based 2D Game Engine — Targeting Windows, Mac, Linux, WASM, iOS, Android and even consoles, DragonRuby is an interesting variant of Ruby coupled with a 2D game engine, meaning you can create striking games or demos with a language you already know. Apparently DHH hadn’t heard of it, so we wanted to feature it again, especially as it’s available for free for the next 36 hours (though it is commercial).

DragonRuby LLP

💡 Konnor Rogers' Rendering 2.5 Million Tiles in DragonRuby Without Dropping Frames shows off some of DragonRuby's power…

Rails +…

avdi.codes 

How to cope with technology FOMO

Eight years ago Ray Bango wrote:

…many web developers who have been able to hang their hat on a specific technology for “x” years are incredibly concerned by the rate of churn in the JavaScript (and web development) world. They can’t just pick a specific framework and feel that they’ll be in a good spot for the next 5 years. And when you factor in the rate of churn on tooling and workflow technologies, you increase the anxiety of feeling “left behind”.

I would say that the situation hasn’t changed substantially since then.

I can relate. A lot of developer angst grows from anxiety over technical churn. It shows itself in different ways for different people:

  • Personal projects…
zverok's space 

“Gilded Rose” refactoring kata in Ruby — as if it is 2024

A “stories-first” approach to refactor a small yet complicated piece of business code

Recently, I didn’t have time or resource for serious writing. I had plans for several long articles for the summer that gone, but unfortunately not many have came of that. But last night I have stumbled upon famous (so it seems, though I have never seen it before) refactoring kata, and had an impulse for trying my hands on that, writing down some thoughts on my ways of writing code along the way.

The kata

Gilded Rose” is a famous refactoring kata that is available in many languages. It goes like this:

First an introduction to our system:

  • All items have a SellIn value which denotes the…
Rails Designer 

Conditionally Style Turbo Frame Content

I like to explore a little technique I have been using for some time to reuse HTML and change it styles based if it is shown in a turbo-frame or not.

For inspiration I am going to use Letterboxd log in flow.

I assume you have an up-to-date Rails app ready with Hotwire set up. This example is also using Tailwind CSS.

Let’s create the navigation component first (partial at app/views/shared/_navigation.html.erb).

<div class="w-full max-w-2xl py-40 mx-auto">
  <nav class="flex items-center justify-between px-6 py-2.5 bg-white/70 backdrop-blur-md rounded-md shadow-xl ring-1 ring-offset-0 ring-gray-200">
    <%= link_to "Rails Designer", "#", class: "font-bold tracking-tight text-gray-900" %
Ryan Bigg's Blog 

Use classes to represent data

Accessing JSON structures through strings is an anti-pattern and a sign of lazy programming.

When we write Ruby code, we use classes to represent data within our own applications. Typically, these are models from within the Rails application. But I’ve seen a repeated pattern of Rubyists consuming JSON data without first casting that to an object.

It opens the door for mistakes to be made, especially when it comes to typos in strings. It’s too easy to get muddled up and think things are different to what they are — for example, a string that’s under_scored is different to one that’s camelCased. Accessing values in a JSON payload with the wrong key will result in a nil value.

Take for…

Benoit Tigeot's blog 

As Rails developers, why we are excited about PostgreSQL 17

At the time of writing this article, PostgreSQL 17 is nearly out. On September 5th, the first release candidate was published. The final release is expected on September 26th, but we can already explain why we’ve been eagerly awaiting this release since 1 year.

At Lifen, we’ve loved Rails from the beginning. We have several Rails applications, each with different scopes and teams, all using PostgreSQL as the main database. Some of these applications handle a significant amount of traffic, and their databases need to be properly monitored. This is done by the infrastructure team and the developers themselves using PgAnalyze, Grafana and sometimes AWS console with "Performance Insight".

More…

Aha! Engineering Blog 

How we upgrade major Rails versions

img { max-height: 400px; margin-right: auto; margin-left: auto; } table, th, td { font-family: Red Hat Display, "Helvetica Neue", Arial, "Noto Sans", sans-serif; border: 1px solid var(--aha-gray-400); } th { background-color: var(--aha-gray-100); color: var(--aha-gray-900); text-align: left; } td img { margin: 0.5em auto !important; }
by Shane Tully

As a company whose product is built on top of Ruby on Rails, conducting a major version upgrade of the underlying framework is just about the biggest upkeep item we regularly undertake. The whole process takes months — with multiple cycles of development work, rounds of automated and…

Greg Molnar 

FriendlyRB Slides

I gave a talk about OWASP Top 10 at FriendlyRb in September 2024. These are the slides from my talk:

This browser does not support PDFs. Please download the PDF to view it: Download PDF.

</embed>
Mintbit 

Basic Array Methods: A Practical Guide

Arrays are one of the most versatile and commonly used data structures in Ruby. They allow you to store and manipulate collections of elements efficiently. Ruby provides a rich set of methods for working with arrays, making it easy to add, remove, sort, transform, and filter data. In this blog post, we’ll explore some essential Ruby array methods, complete with examples and practical applications.

1. push

The push method adds elements to the end of an array.

1
2
3
arr = [1, 2, 3]
arr.push(4)
# => [1, 2, 3, 4]

Use push to grow an array dynamically, such as adding user inputs to a list.

2. delete

The delete method removes all occurrences of a specified element from an array.

1
2
3
arr
RubySec 

CVE-2024-8796 (devise-two-factor): Devise-Two-Factor Authentication Uses Insufficient Default OTP Shared Secret Length

### Summary Under the default configuration, Devise-Two-Factor version >= 2.2.0 & < 6.0.0 generate TOTP shared secrets that are 120 bits instead of the 128-bit minimum defined by [RFC 4226](https://datatracker.ietf.org/doc/html/rfc4226). Using a shared secret shorter than the minimum to generate a multi-factor authentication code could make it easier for an attacker to guess the shared secret and generate valid TOTP codes. ### Remediation Devise-Two-Factor should be upgraded to version v6.0.0 as soon as possible. After upgrading, the length of shared secrets and TOTP URLs generated by the library will increase since the new shared secrets will be longer. If upgrading is not possible, you…
Evil Martians 

Creating a winning sales flow with authentic writing from engineers

Authors: Olga Rusakova, Head of Communications, and Travis Turner, Tech EditorTopic: Business

Authentic content from engineers can promote your startup's product or service. Here's how to motivate them and set up a winning flow for your team.

Over the years, we’ve been able to generate a significant amount of our leads through our blog posts and events, not to mention spreading the word about our open source contributions. Can you do it too? Read on to see how to create a winning flow of useful material that will have real results!

RubyGems Blog 

3.5.19 Released

RubyGems 3.5.19 includes enhancements, bug fixes and performance.

To update to the latest RubyGems you can run:

gem update --system

To install RubyGems by hand see the Download RubyGems page.

## Enhancements:

  • Standardize pretty-print output for Gem::Source and subclasses. Pull request #7994 by djberube
  • Update vendored molinillo to master and vendored resolv to 0.4.0. Pull request #7521 by hsbt
  • Installs bundler 2.5.19 as a default gem.

## Bug fixes:

  • Fix bundle exec rake install failing when local gem has extensions. Pull request #7977 by deivid-rodriguez
  • Make gem exec use the standard GEM_HOME. Pull request #7982 by deivid-rodriguez
  • Fix gem fetch always exiting with…
Performance Action Pack - a cost effective way to audit and optimize your Rails app 

How I've built an unprofitable MEV Bot in Rust

MEV bots are money-printing machines. At least in theory. For the last ~year, I’ve been working on the MEV crypto bot for Ethereum EVM-compatible chains. In this blog post, I’ll describe the ins and outs of trying to get into the MEV game with a limited web3 skillset and relatively small capital.

Disclaimer: The information provided in this blog post is for educational purposes only and should not be treated as financial advice. MEV is extremely risky, and you’re likely to lose all the funds that you allocate.

MEV bots 101

This post is not a “GEt rIch iN cRyptO pASsivE inCOmE” story. So far, I have not managed to scale my MEV strategies. But I hope to provide a hands-on perspective on…

Ruby Magic by AppSignal 

Ruby’s hidden gems: Sorbet

The debate between static and dynamically typed languages has long been a subject of contention among developers. Each approach offers its own set of advantages and disadvantages, significantly influencing the software development process.

Dynamically typed languages like Ruby provide flexibility by allowing variables to be declared without corresponding types. This approach fosters rapid development and promotes an agile process.

Yet, the absence of strict typing can lead to challenges, such as runtime errors that may be harder to debug and maintain in larger codebases. For example, in a dynamically typed language like Ruby, attempting to divide an array by a string only results in an…

BigBinary Blog 

Why we switched from Cypress to Playwright

Until early 2024, Cypress used to be the most downloadedend-to-end (e2e) testing framework in JavaScript. Since then, it has seen asteep decline in popularity and Playwright hasovertaken it as the most downloaded end-to-end testing framework.

We at BigBinary also switched from Cypress to Playwright in late 2023. In thisarticle, we will see some critical reasons for this change in trends and ourpersonal views on why we think Playwright is the superior JavaScript testingframework.

<div style="width:100%;max-width:600px;margin:auto;display:grid;grid-template-columns:auto auto;gap:2rem;align-items:end;"><figure…

Rails Inside Out 

Implementing Event-Driven Architecture in Rails with Active Support Instrumentation

TL:DR; You can skip to setup if you just to see the implementation

Background

When I was building Pulse by Welodge I wanted to notify a user when they submit a startup for approval, when its accepted/rejected. I also wanted to notify the admins that someone has submitted a startup. The first implementation I simply dispatched a noticed Notifier in the controller when startup was submitted, but this did not have some rails magic into it.

After a quick search I found a few articles online about event driven architectures in rails but they all seem to be overly complicated for what I wanted and they seem to rely on 3rd party packages, which is fine but eventmachine wanted to run a separate event…

Gusto Engineering - Medium 

How a Communication Breakdown with Stakeholders Nearly Derailed My Project — And What I Did About…

How a Communication Breakdown with Stakeholders Nearly Derailed My Project — and What I Did About It

Effective communication with stakeholders is crucial for the success of any project. As an engineer at Gusto, I often collaborate with other engineers, designers, and product managers to build high-quality products. Stakeholders provide essential feedback and approval that guide the development process. In this post, I’ll share a recent experience where I faced a communication challenge with a stakeholder and the steps I took to navigate the situation.

A while ago, I began developing a new footer that would include legal and social information about the company. While this feature wasn’t the…

RubySec 

CVE-2024-32034 (decidim-admin): Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin activity log

### Impact The admin panel is subject to potential XSS attach in case an admin assigns a valuator to a proposal, or does any other action that generates an admin activity log where one of the resources has an XSS crafted. ### Patches N/A ### Workarounds Redirect the pages /admin and /admin/logs to other admin pages to prevent this access (i.e. `/admin/organization/edit`) ### References OWASP ASVS v4.0.3-5.1.3
RubySec 

CVE-2024-39910 (decidim): Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin panel with QuillJS WYSWYG editor

### Impact The WYSWYG editor QuillJS is subject to potential XSS attach in case the attacker manages to modify the HTML before being uploaded to the server. The attacker is able to change e.g. to if they know how to craft these requests themselves. ### Patches N/A ### Workarounds Review the user accounts that have access to the admin panel (i.e. general Administrators, and participatory space's Administrators) and remove access to them if they don't need it. Disable the "Enable rich text editor for participants" setting in the admin dashboard. ### References OWASP ASVS v4.0.3-5.1.3
Graceful.Dev 

Site News #22: NEW_LOGO=Yes

Hi there graceful devs! Here’s what’s new in the garden…

Content Updates

90% of the episodes I’ve made were inspired by recent experiences either with consulting clients or with my own projects, and that’s definitely the case with the episode on Boolean Environment Flags. I found myself once again implementing an environment-variable true/false flag, and I decided to capture some better practices around making environment flags with a positive developer/operator experience. Check it out on the site!

Site Improvements

Graceful.Dev has always been, and will probably always be, a banana stand. I’ve prioritized getting content out there over checking off all the boxes for…

Saeloun Blog 

Rails Adds The Ability To Ignore Counter Cache Columns While They Are Backfilling

In typical Rails applications, developers often encounter the N+1 query problem, where multiple queries are executed to retrieve counts for associated records.

class Task < ApplicationRecord
  belongs_to :project
end

class Project < ApplicationRecord
  has_many :tasks
end

For instance, if we want to display the number of tasks for each project, a naive approach would result in a separate query for each project to count its tasks.

<% @projects.each do |project| %>
    <%= project.tasks.count %>
<% end %>

This can significantly slow down the application as the number of projects increases.

Counter cache

Rails counter_cache is a powerful feature designed to optimize performance by…

Mintbit 

ActiveSupport::Concern Explained

When building complex Ruby on Rails applications, code organization and modularization become crucial. As your application grows, so does the need to break down logic into smaller, manageable parts. This is where ActiveSupport::Concern comes into play.

ActiveSupport::Concern is a Rails module that makes it easier to include modules into your classes, especially when those modules have dependencies or require specific hooks to be executed. It provides a clean, idiomatic way to create mixins that enhance your application’s functionality.

Why Use ActiveSupport::Concern?

Here are some key benefits of using ActiveSupport::Concern:

  1. Cleaner Code Organization: It helps in organizing code by…
RubyMine : Intelligent Ruby and Rails IDE | The JetBrains Blog 

The RubyMine 2024.3 Early Access Program Is Open!

Hello everyone!

We’re starting the RubyMine 2024.3 Early Access Program today. In this blog post, we’ll inform you about the upcoming features and updates in this release cycle.

What’s coming in RubyMine 2024.3?

AI Assistant

For RubyMine 2024.3, we’re working on several Ruby-specific AI features, focusing on context improvements for AI-powered unit test generation, explanation of exceptions in the test environment, and a new AI model for multiline code completion.

Support for Ruby 3.4

With the upcoming release of RubyMine 2024.3, you can look forward to Ruby code insight improvements to accommodate Ruby 3.4 features.

Remote development experience

Another…

BigBinary Blog 

Dropping tables, dropping columns and renaming columns in a safe way in Ruby on Rails

We are building NeetoCal which is a Calendlyalternative. Recently, we deployed the latest code to production. The codechange involved deleting a table. To our horror, during the deployment, wenoticed that some users experienced errors with status code 500 for a fewminutes. This happened because the migration to drop the tables ran quickly andthe tables got deleted. However, the old code was still referring to thosetables.

This kind of issue is pretty common with schema migrations, especially whenyou're dropping tables or columns. If the migration finishes before the codedeployment catches up, you end up with old process still trying to access tablesor columns that no longer exist. This…

code.dblock.org | tech blog 

OpenSearch Project Joins the Linux Foundation

Yesterday, the Linux Foundation (LF) announced the new OpenSearch Software Foundation, with Amazon transferring the 3½ year old open-source project to LF (RT). This outcome ensures the long term viability of this technology in a vendor-neutral way, under the most enterprise-friendly open-source Apache License v2. It is the result of the work of hundreds of people, but is also something I am personally very proud of, because I worked on the 6-page proposal to move OpenSearch to a neutral foundation at Amazon, and then my team and I sat at a table across from Adam Selipsky, then AWS CEO who took time to carefully read the doc, opened the floor for some tough questions from the AWS executive…

This…

The Bike Shed 

440: When we stray from Rails defaults

When does it make sense to step away from Rails conventions? What are the limits of convention over configuration? While Rails conventions provide a solid foundation, there are times when customization is necessary to meet specific project needs. In this episode, Joël and Stephanie dive into the tradeoffs of breaking away from Rails defaults. They explore the limits of convention over configuration and share their experiences with customizing beyond the typical Rails setup. Joël offers insights from a recent project where the client opted for all dry-rb objects, and they unpack the benefits and potential challenges of this approach. Stephanie talks about why people tend to shy away…

Blogs on Noel Rappin Writes Here 

How Not To Use Static Typing In Ruby

How To Not Use Static Typing In Ruby

Last time, I took a short example and examined in some detail what you would gain by adding static typing to it and what it would cost to use static typing.

What I didn’t do was explain how I might handle the problem without static typing.

For reference, Here’s the example again. Consider this to be part of a larger system and don’t worry too much about the rest of the world:

class CheckoutService
  def checkout(user, items, amount, status)
    # do some things
    ManagePayment.new.manage_payment(user, items, amount, status)
  end
end

class ManagePayment
  def manage_payment(user, items, amount, status)
    # make the user pay
    HandleShipping.new.ha…

The problem, as originally presented to me, was:

“Even though address isn’t used until the third…

a-chacon 

Local LLM: Running Ollama and Open WebUI with Docker Compose.

Assuming you use ChatGPT constantly and have probably heard of some of the latest open-source language models (LLMs), such as Llama 3.1, Gemma 2, and Mistral, I’m going to show you how to run one of these on your local machine using Docker and Docker Compose.

Ollama is defined as an open-source application that allows you to locally run, create, and share large language models with a command-line interface on macOS and Linux. And Open WebUI is an extensible self-hosted WebUI, feature-rich and user-friendly, designed to operate completely offline.

Advantages

The benefits of running your LLM locally can include:

  • Customization: Running models locally gives you full control over the…

Once a Maintainer 

Once a Maintainer: Adrià Mercader

Welcome to Once a Maintainer, where we interview open source maintainers and tell their story.

This week we’re talking to Adrià Mercader, maintainer of CKAN, an open source data management system powering the data portals of governments and corporations around the world, including the US government’s portal, data.gov. Adrià spoke with us from Spain.

Once a Maintainer is written by the team at Infield, a platform for managing open source upgrades.

How did you get into software development?

I have a degree in biology, and once I finished my degree I did some coursework that required Excel macros, very basic commands. Everybody hated it, but I didn’t mind it. And then I did a masters in Geographic…

justin․searls․co - Digest 

📄 Drive-by Active Storage advice

I'm working on a conference talk and there won't be time for me to detail each and every piece of advice I've accrued for each technical topic, so I'm going to dump some of them here and link back to them from the slides.

Today's topic is Active Storage, the Ruby on Rails feature that makes it easy to store user-generated assets like photos and videos in the cloud without clogging up your application or database servers.

Before you do anything, read this absolutely stellar post describing how to get the most out of the feature and avoid its most dangerous foot-guns.

Here goes.

Wrap each attachment in a model

You never know when an attachment will need the other trappings of a model…

Jekyll • Simple, blog-aware, static sites 

Jekyll 4.3.4 Released

Hello Jekyllers!

Publishing a small bug-fix release with the following patches:

  • Relax version-constraint on gem wdm in Gemfile created by jekyll new.
  • Patch Jekyll::Drops::ThemeDrop#root to render absolute path to theme-gem only if JEKYLL_ENV is explicitly set to string development.

That is all for now. Happy Jekyllin’!!

Radan Skorić's website 

EuRuKo 2024 conference reflection

I love Sarajevo. It’s one of my favourite cities. A unique mix of cultures in this part of the world. I’ve visited it multiple times and have many fond memories. Unfortunately, it’s been many years since the last time I visited. Because, well, life. Not a great excuse. Apologies to my Sarajevo friends. I’m sorry I needed the European Ruby Conference to be in Sarajevo to visit again. Some of you...
Rails Designer 

Fix Any CSS Z-index Issue With This One Trick

(apologies in advance for the title… 😉)

Z-index controls the stacking order of elements, to determine which elements appear on top of others in the visual layout. It allows you to create interesting UI’s and visual designs by creating depth (literally).

But create web-apps or sites for long enough and soon you come across a z-index issue. Over the years I’ve explored and used many techniques to battle them. From z-index maps (back in the SCSS days) to throwing in the towel and just adding z-index: 99999. (╯°□°)╯︵ ┻━┻

Let’s look at a common example.

<nav class="sticky top-0 z-10">
  Sticky Nav (z-index: 10)
</nav>

<div class="">
  <div class="relative z-20">
    Z-index content…

The Z-index content will scroll “on top” of the nav

Rémi Mercier 

What if your private method was a public method? A practical tip to identify bad design

Today, we’re going to review a badly designed piece of code I once wrote, and think about a practical tip we can use to reveal its flaws, and how to make it better.

Let’s consider the following:

A lender can lend an object to a borrower through a rental. At the end of the rental, we need to know the transactions related to a rental: where should we debit the money, and where should we credit it?

  class Rental
    def initialize
      @transactions = []
    end

    def transactions
      return @transactions if @transactions.any?

      debit_transactions + credit_transactions

      @transactions
    end

    private

     def debit_transactions
      @transactions << Transaction.new(

Let’s…

Mintbit 

Exploring the Power of none?

When working with arrays or enumerables in Ruby (and by extension, Rails), you often need to check whether certain conditions are met for the elements within a collection. The none? method provides a clean and expressive way to verify if no elements in a collection satisfy a condition. It’s especially useful when you want to ensure that a collection is either empty or that none of its elements match a particular condition.

In this post, we’ll take a closer look at how none? works, and explore some practical examples involving nil, 0, and strings.

What is none?

The none? method returns true if none of the elements in an array or enumerable meet a given condition. It also returns true if…

Jake Zimmerman 

Using my iPhone as a travel laptop

A while back I picked up a tiny, folding, wireless keyboard to turn my phone into a passable laptop replacement when traveling. It's already incredible, and only one or two features are missing from iOS which would make it really amazing.
Hotwire Weekly 

Week 37 - Solid Cable in Rails 8, Morphable Web Components, and more!

Hotwire Weekly Logo

Welcome to Hotwire Weekly!

Welcome to another issue of Hotwire Weekly! Next week, Friendly.rb 2024 kicks off in Bucharest, September 18-19, featuring some Hotwire and Hotwire-adjacent talks:

  • Make a Massively Multiplayer Ruby Game with Dragon Ruby and AnyCable - Julian Cheal
  • Building for web and mobile in 2024: Production story and brighter future with Rails 8 - Hana Harencarova
  • SQLite on Rails: Everything you need to know - Stephen Margheim

Enjoy the content and hope to see you at Friendly.rb! 🚀✨


📚 Articles, Tutorials, and Videos

The Rails Renaissance - Jack Rosa and Matt Polito explore the resurgence of Rails, particularly with the upcoming Rails 8 and Turbo 8. It highlights how Turbo,…

Alchemists: Articles 

Git Attributes

Cover
Git Attributes

Git Attributes, if you’ve never worked with them before, provide the following benefits:

  1. File Handling Customization: Allow you to specify how different file types should be treated, enabling precise control over your repository.

  2. Line Ending Normalization: Ensure consistent line endings across different operating systems, preventing unnecessary diffs.

  3. Diff and Merge Strategies: Allow customization of specific file types, improving the handling of non-text files when managing diffs and/or merges.

  4. Binaries: Provide handling of binary files (or large files in general) more efficiently. An example would be with Git LFS (Large File Storage).

  5. Language Specific…

I won’t detail all features — because there is a lot you can do — but will provide with you with a few helpful customizations that I use (or sometimes use) in my Dotfiles.

Configuration

There are multiple…

justin․searls․co - Digest 

🎙️ Breaking Change podcast v20 - Mandatory Stealth

Direct link to podcast audio file

There have now been 20 major versions since the initial release of Breaking Change, but this is one of the less bad ones. It was substantially improved by friend of the show, Eric Doggett, who helped out with mixing!

If you have strong feelings about anything you hear, you know where to stuff those feelings (other than "deep, deep down"): podcast@searls.co.

Spicier-than-usual show notes follow:

  • Kin Euphorics are usually non-alcoholic overpriced cocktails
  • Squarespace kinda sucks now and a lot of people are worried the new PE overlords are gonna kill it
  • Build with Becky soft-launched, but it's stealth so you're on your own to figure out the sign-up…
Ruby Rogues 

The Hidden Gems of Ruby - RUBY 651

Valentino Stoll takes us on a tour of the "gems" of features built into the core Ruby language. We explore tips and tricks for using irb that can also improve your Rails console.


Links

Picks
Karl’s blog 

Turbo Native iOS custom keyboard toolbar

While using Turbo Native, I wanted to customize the toolbar shown above the keyboard on iOS when interacting with a text field on the website I was wrapping. By default, the toolbar displays an up arrow, down arrow, and a Done button. My goal was to remove this default toolbar.

To make sure we’re on the same page, here is a screenshot of the toolbar I was trying to remove:

Screenshot showing the default iOS keyboard toolbar

For this demonstration, I’ll use the excellent turbo-ios demo project. If you’d like to follow along, clone the repo and get it running locally in the iOS simulator.

To do that, run the following commands in your terminal:

git clone https://github.com/hotwired/turbo-ios.git
open turbo-ios/Demo/Demo.xcodeproj

Once…

RubySec 

GHSA-cvp8-5r8g-fhvq (omniauth-saml): omniauth-saml vulnerable to Improper Verification of Cryptographic Signature

ruby-saml, the dependent SAML gem of omniauth-saml has a signature wrapping vulnerability in <= v1.12.0 and v1.13.0 to v1.16.0 , see https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2 As a result, omniauth-saml created a [new release](https://github.com/omniauth/omniauth-saml/releases) by upgrading ruby-saml to the patched versions v1.17.
Rails Inside Out 

Securing Rails Active Storage Direct Uploads

TL;DR; if you just want the code, head over to the bottom of this article

I noticed something odd with Active Storage direct uploads. Did you know there is literally no authentication at all by default! The idea scared me.

From the docs, it doesnt say how to secure that endpoint either. Theres a way to use token auth for API apps but for traditional apps thats still pretty much open season.

Lets look at how that can be problematic, First we have CSRF protection so no one can just fire up curl and start uploading files from a script, however that can be easily solved by first making a legit request, grabbing the CSRF token and voila! We also have security by obfuscation assuming that a…

katafrakt’s garden 

This post is written in org

Recently I found myself doing more and more things using org-mode. Not surprisingly, I also wanted to use it to write articles here. With some time on my hands this weekend, I decided to give it a try and see how hard would it be to add org support to BridgetownWhich this blog uses as an SSG.

Even though Bridgetown supports adding own formats via converters, they have one big limitation:

Bridgetown will only convert files that have a YAML or Ruby Front Matter header at the top, even for converters you add using a plugin.

Of course, I could just add front-matter on top of my org file, but let's be honest: how silly it would look? I had to find a way to force Bridgetown to ignore its own rule…

Posts on Kevin Murphy 

RSpec Stubs The Object In Memory

Publish or Perish 🔗

Let’s say we’ve been sitting on a handful of blog posts that are ready to publish, but we haven’t released yet. This is a fictional story that in no way mirrors reality of any particular writer. Certainly not the author writing this post now. In a spirit of inspiration, we decide to write a small class to publish all these posts that exist in our system.

class DraftPost  def self.publish_all    Post.draft.map(&:publish)  endend

Rather than actually publish them, we’ve successfully procrastinated. We have a way to publish them, eventually. While we’re busy not actually publishing them, let’s test this method works.

Prolonged Publication Procrastination 🔗

We want to verify that…

Mintbit 

Customizing Rails Forms with a Custom FormBuilder

When building forms in Rails, we often need to add custom behavior or default styles to form fields. While Rails provides a flexible FormBuilder through form_for and form_with, there are times when you want to streamline repetitive tasks, such as adding CSS classes to every form input. This is where creating a custom FormBuilder comes in handy.

In this blog post, we’ll explore how to create a CustomFormBuilder that automatically applies a CSS class to form fields, ensuring consistent styling without redundant code. We’ll also see how to implement it using form_for.

Why Use a Custom FormBuilder?

A FormBuilder in Rails helps generate form elements like text fields, password fields, and…

Ruby on Rails 

Solid Cable as default, 2 new Guides PRs, and much more!

Hey everyone, Happy Friday the 13 🎃

Vipul here with the latest updates for This Week in Rails, from the very awesome EuRuKo this week! Let’s dive in.

New Guides Pull Request for review
Two new Guides Pull Requests are up for community review this week. If you are well versed in Action Mailer, or Error Reporting please review and submit your feedback here:

Add Solid Cable
This change starts to use Solid Cable as the default Action Cable adapter in production, configured as a separate queue database in config/database.yml. It keeps messages in a table and continuously polls for updates.

This makes it possible to drop the…

Remote Ruby 

Rocky Mountain Ruby 2024

In this episode, Jason, Chris, and Andrew are joined by the organizers of the Rocky
Mountain Ruby Conference, including Bekki Freeman, Spike Ilacqua, and Marty
Haught, discuss their experiences and the journey of building and sustaining the vibrant Ruby community in Colorado. They delve into the challenges and triumphs of organizing the Rocky Mountain Ruby conference, the importance of community meetups, and the inspiration behind their commitment to fostering connections among Ruby developers.

They also share their personal motivations, the intricacies involved in conference
planning, and the vital role of Ruby Central in supporting regional conferences. Hit
download now to hear more!