From Maintenance to Rails Core: Security, Sandboxing, and Open Source Impact
Show notes
What happens when a conference talk becomes dangerously obsolete just one week before showtime? That urgent pivot tells you everything about the pace of modern security work in the Ruby ecosystem.
Mike Dalessio, newly inducted Rails core team member, joins Joe Leo for a conversation that is genuinely packed and genuinely important. Mike's path to the core team runs directly through his maintenance work at 37signals, where his security-focused tooling helped Rails handle the enormous volume of vulnerability reports the team receives. Efficiently and thoughtfully, rather than in a constant state of panic.
Perhaps the most concrete thing Mike shares is Hot Cell, an architectural solution he built after discovering that Rails applications pull in approximately 100 image libraries through libvips. Instead of endless reactive patching, Hot Cell isolates image processing inside a sandboxed sidecar container with no application code, secrets, or network access. When a new arbitrary file read vulnerability appeared after deployment, attackers could only access the sandbox itself (which is exactly the point).
How should the broader developer community think about security when AI agents have dramatically expanded every application's attack surface?
Mike also reflects on his longtime Nokogiri maintenance, the CVE assignment delays leaving systems dangerously exposed, and his plans to democratize these security tools for gem maintainers everywhere.