Security vulnerabilities, AI-powered coding, and a whole lot of pull requests take center stage this week on Remote Ruby! Chris, Andrew, and David kick things off with some alarming security exploits, including a critical Active Storage vulnerability and the growing risks of AI-driven attacks. They explore how Hot Cell could make Rails file uploads safer, share frustrations over security requirements for AI plugin submissions, and discuss practical ways to make AI-assisted development more manageable. Andrew reveals his new five-file rule for creating smaller, easier-to-review pull requests, while Chris considers how AI could fundamentally change software development and Rails releases. Plus, there's talk of Discord's move toward Rust, major Active Record performance improvements, and upcoming SF Ruby plans. Hit download now! 

[00:00:30] Chris, Andrew, and David discuss an alarming SSH vulnerability, social engineering attacks, and cryptocurrency theft.

[00:06:42] They review recent Rails security fixes, including Active Storage vulnerabilities, unsafe file processing, and potential mass assignment issues.

[00:09:57] Chris explains Hot Cell.

[00:12:32] Chris discusses content security policies (CSP), third-party JavaScript risks, and using AI to help secure Rails applications.

[00:14:56] They discuss a controversial incident involving a Railway employee's AI agent allegedly attacking another hosting provider's website.

[00:18:41] Andrew and Chris explore X-Forwarded-For errors, trusted proxies, and strategies for filtering suspicious traffic.

[00:23:59] Chris shares an unexpected change in Rails content negotiation that caused JSON error pages to appear instead of HTML.

[00:27:06] Andrew questions why OpenAI and Claude plugin review processes require production test accounts without multifactor authentication.

[00:30:23] Andrew explains his five-file rule for AI pull requests.

[00:37:10] Andrew and Chris discuss smaller projects, stacked PRs, and using multiple AI coding sessions to deliver features faster.

[00:41:01] They discuss reports of Discord reducing desktop memory usage by moving away from Electron.

[00:43:26] The conversation switches to RubyGems, Bundler, and Active Record improvements.

[00:44:40] Chris shares his excitement about delivering the closing keynote at SF Ruby.

[00:47:29] The episode ends with Andrew talking about using Claude and automated workflows to resolve security warnings, update dependencies, and increase development output.

Panelists:

• Chris Oliver
• Andrew Mason
• David Hill

Sponsors:

• Honeybadger
• Judoscale

Links:

• Andrew Mason Bluesky
• David Hill LinkedIn
• Judoscale- Remote Ruby listener gift
• Security Advisories-GitHub
• Hot Cell-GitHub
• Hot Cell v1.0: Securing Active Storage in the age of AI (by Mike Dalessio)
• SF Ruby 2026

• Chris Oliver X/Twitter
• Andrew Mason X/Twitter

Nate Berkopec returns to Remote Ruby joining Chris, Andrew, and David for a deep conversation about the latest wave of Ruby security vulnerabilities, AI-powered cybersecurity, and the rapidly changing role of software engineers. Nate shares his firsthand experience investigating a serious Ruby regex vulnerability, explains why developers need to take a more proactive approach to security, and challenges traditional development practices in an AI-driven world. From autonomous coding agents and dramatically faster development workflows to rethinking unit tests and code reviews, this episode explores why the future of programming may be less about writing code and more about building systems that deliver results. Hit download now! 

Links

• Chris Oliver X
• Andrew Mason Bluesky
• David Hill LinkedIn
• Judoscale- Remote Ruby listener gift
• Nate Berkopec Website
• Nate Berkopec X
• Ruby 4.0.9 Released
• Fin
• Intercom
• Lauren (@poteto) X
• Matt Pocock X

• Chris Oliver X/Twitter
• Andrew Mason X/Twitter

This week on Remote Ruby, Chris, Andrew, and David welcome Dan Manges, co-founder of RWX and former CTO of Braintree, to explore a new approach to continuous integration built for the age of AI coding agents. Dan explains how RWX uses intelligent caching, graph-based execution, and isolated agent sandboxes to dramatically improve development workflows. They dive into flaky tests, automated code validation, security concerns, and why traditional CI platforms may be struggling to keep up with AI-driven development. Plus, they discuss how engineering teams can test changes before opening pull requests, reduce infrastructure costs, and rethink the way software gets built and shipped. Hit download now to hear more! 

Links

• Chris Oliver X
• Andrew Mason Bluesky
• David Hill LinkedIn
• Judoscale- Remote Ruby listener gift
• Dan Manges (X)
• Dan Manges Website
• Dan Manges Email
• RWX
• RWX (X)
• Using AI agents with RWX
• Captain-GitHub
• ABQ-GitHub

• Chris Oliver X/Twitter
• Andrew Mason X/Twitter

Jeff Dickey is back on Remote Ruby, and he's been busy! Andrew and Chris catch up with Jeff to discuss the latest improvements to mise, including precompiled Ruby builds, automatic tool updates, and dotfile management. Jeff also introduces some of his newest projects, including packslip, a new standard designed to make software distribution more secure, and jactionlint, his modernized GitHub Actions linter. The conversation explores everything from managing secrets with fnox and cleaning up massive Rust build caches to running your own CI infrastructure at home. They also dive into AI-assisted development, the future of Ruby performance, and how AI is changing the way open source software gets built and maintained.

Links

• Chris Oliver X
• Andrew Mason Bluesky
• David Hill LinkedIn
• Judoscale- Remote Ruby listener gift
• Jeff Dickey Website
• Jeff Dickey X
• Entire 
• Remote Ruby-Episode 341: Jeff Dickey on Mise, Precompiled Rubies, and much more
• mise 
• Omarchy
• actionlint
• packslip
• jactionlint
• fnox
• mr boxington
• tak
• usage-rs 
• aqua
• hk

• Chris Oliver X/Twitter
• Andrew Mason X/Twitter

On this episode, Chris, Andrew, and David dive into the rapidly changing world of AI-assisted development, Ruby performance, and the future of building software. They kick things off with AI-powered coding workflows before exploring the Campfire benchmarking controversy and the exciting possibilities of Roundhouse, which could dramatically improve Ruby application performance. Andrew shares his experience launching a new AI agent inside Podia, including the challenges of getting its MCP integration approved by OpenAI, managing AI costs, and testing security. The conversation shifts to optimizing GitHub Actions, reducing CI expenses, and whether developers should start hosting their own runners. They also speculate about the future of all-in-one development platforms and how AI might reshape everything from writing code to deploying applications. Hit download now!

Links

• Chris Oliver X
• Andrew Mason Bluesky
• David Hill LinkedIn
• Judoscale- Remote Ruby listener gift
• What’s New in RubyGems/Bundler 4.1, Part 1: override and prune (by SHIBATA Hiroshi)
• Roundhouse-GitHub
• JP Camara X
• Matt Swanson X
• RWX
• Blacksmith
• Digger
• Street Fighter 
• Gears of War: E-Day (game)
• AnyPS5-GitHub

• Chris Oliver X/Twitter
• Andrew Mason X/Twitter

Fresh off Rails World 2026, Chris, Andrew, David, and returning guest John Athayde unpack the surprisingly emotional conversation surrounding AI, Ruby, Rails, and the future of programming. What starts as a discussion about Spinel, Roundhouse, Rust, and Rails performance quickly turns into a much bigger question: what happens to developers when writing code is no longer the main job? They dig into AI-assisted development, changing ideas around craftsmanship and creativity, the growing importance of testing and CI, and whether frameworks like Rails become more valuable in an AI-driven world. They also reflect on the mood at Rails World, autonomous cars, AI-generated design, and why the real value of conferences may increasingly be simply getting developers together in the same room. Hit download now!

Links

• Chris Oliver X
• Andrew Mason Bluesky
• David Hill LinkedIn
• Judoscale- Remote Ruby listener gift
• John Athayde Website
• John Athayde X
• Sanket Sahu X Post- GeekyAnts landing page
• Spinel- Ruby AOT Compiler-GitHub
• Rails World 2026 Talks 

• Chris Oliver X/Twitter
• Andrew Mason X/Twitter

Recorded live from Rails World 2026, Andrew, Chris, David, Jason Charnes, and eventually Andy Croll, unpack the strange mood surrounding this year’s conference. Much of the conversation centers on DHH’s keynote and the increasingly agent-driven future of software development: if AI can write, debug, and even understand the code for us, what happens to the value of frameworks, developer expertise, documentation, and even Ruby itself? They also dig into Hotwire, Active Search, Herb, Active Job Continuations, security concerns around AI-generated software, and what the Ruby community might rally around if the language becomes less central to how developers identify themselves. And because it’s Rails World, there’s plenty of barbecue, conference chaos, bad jokes, and Andy Croll crashing the podcast. Hit download now!

Links

• Chris Oliver X
• Andrew Mason Bluesky
• David Hill LinkedIn
• Judoscale- Remote Ruby listener gift
• Jason Charnes Website
• Andy Croll Website
• Buzzsprout
• Terry Black’s BBQ
• Burnt End BBQ
• PlanetScale
• RubyMine
• AppSignal
• Rails World 2026 Talks (YouTube)

• Chris Oliver X/Twitter
• Andrew Mason X/Twitter

Andrew and Chris are back with a packed episode covering everything from Rails World anticipation and Rails 8.2 to security, Ractors, AI-assisted development, and some ambitious new Ruby tooling. They dig into RubyGems recent spam-publishing incident and Trusted Publishing, look at Shopify’s push toward Ractor-safe Rails, and explore Roundhouse, a project experimenting with compiling Rails applications into entirely different target languages. They also talk about using Claude for project planning and open source maintenance, new approaches to AI beyond traditional LLMs, the surprisingly inexpensive architecture behind Turbopuffer, PlanetScale’s new TIN search extension, and Andrew’s move from a small Sinatra deployment service to Cloudflare Workers. Hit download now! 

Links

• Chris Oliver X
• Andrew Mason Bluesky
• David Hill LinkedIn
• Judoscale- Remote Ruby listener gift
• Automating Ruby Gem Releases with GitHub Actions (by Andrew Mason)
• Marc Benioff MOGGED Sam Altman (John Smith X Post)
• @graphtheory X Post
• Ractor-age Rails: A Hot-To Guide (Rails at Scale) 
• Roundhouse
• Introducing System One Models & Jev (TypeSafe AI blog post)
• Turbopuffer
• Ben Dicken X post (on inverted indexes)
• Planet Scale: Introducing TIN: full-text search for Postgres
• Cloudflare Workers

• Chris Oliver X/Twitter
• Andrew Mason X/Twitter

Chris, Andrew, and David are back with a conversation that starts with Rails World plans. They break down APIs, webhooks, and persistent connections, using everything from thermostats to Stripe to explain how systems communicate and recover when things go wrong. From there, Chris shares what caught his eye in PlanetScale’s new Postgres sharding work, before the conversation shifts heavily toward AI-assisted programming, where the tools are surprisingly capable one minute and making baffling architectural decisions the next. They also explore how AI is changing Chris’s work on Jumpstart and Hatchbox, improving Rails actionable errors, tackling years-old Android bugs, and potentially reshaping how open source projects are maintained. Press download now! 

Links

• Chris Oliver X
• Andrew Mason Bluesky
• David Hill LinkedIn
• Judoscale- Remote Ruby listener gift
• Introducing Neki (PlanetScale blog post)
• The lifecycle of a sharded Postgres query (blog post)
• PlanetScale Blog
• Rails is built for AI. 
• Agents on Rails: Stage 2. Can a model ship a feature? (Posted by Svyatoslav Kryukov, Artur Petrov, Alexander Baygeldin)
• Surfguard-GitHub
• Omachee
• Meat Proxy

• Chris Oliver X/Twitter
• Andrew Mason X/Twitter

Ryan Castillo returns to the show to catch everyone up on what’s changed since his last appearance…and a lot has changed. Ryan explains why he and his co-founder moved on from their web application firewall Wafris and built Knowatoa, a platform focused on helping companies understand how their brands appear in AI-powered search. From there, the conversation expands into GEO and AI search visibility, multi-agent coding workflows, AI skills as the future of content, and when developers should or shouldn’t delegate work to AI. Chris also gets candid about Hatchbox’s recent pricing increase, the financial pressure behind the decision, and why talking directly with customers may be just as important as shipping the next feature. Hit download now! 

Links

• Chris Oliver X
• Andrew Mason Bluesky
• David Hill LinkedIn
• Judoscale- Remote Ruby listener gift
• Ryan Castillo X
• Ryan Castillo LinkedIn
• Knowatoa
• Wafris
• Hatchbox
• How I Use Cursor by @poteto
• Skills from A Smart Bear by Jason Cohen
• Rocky Mountain Ruby-September 28-29, 2026, Boulder, Colorado
• Rails World, Sept 23-24, 2026, Austin, Texas
• Upcoming Ruby Events Calendar

• Chris Oliver X/Twitter
• Andrew Mason X/Twitter

This week, Chris, Andrew, and David dig into a packed mix of Rails news, developer tooling, and the increasingly complicated role AI is playing in everyday coding. They talk about Herb making its way into Rails, the realities of Rails upgrades and stacked PRs, new approaches to Git hosting and object storage, and how Rails is being evaluated in the age of AI agents. They also get into improvements coming to Action Text, Podia’s approach to “flavored” Markdown, the never-ending frustrations of HTML email, and why tools like ArchSpec and Rubydex could become especially useful as more code is generated by LLMs. Hit download now to hear more!

Links

• Chris Oliver X
• Andrew Mason Bluesky
• David Hill LinkedIn
• Judoscale- Remote Ruby listener gift
• Rails World-Sept 23-24, 2026, Austin, TX
• Add Herb as an HTML -aware ERB implementation #58552 (GitHub pull request)
• turbopuffer
• Agents on Rails: The LLM Benchmark Project (Rails Foundation)
• Agents on Rails : The First Benchmark Report
• Tiptap
• ArchSpec
• Rubydex

• Chris Oliver X/Twitter
• Andrew Mason X/Twitter