Ruby on Rails on Rietta Cybersecurity

Government Rails Site Hit Hours After CVE Patch

Fri, 04 Sep 2026 12:55:00 -0400

After hours on Wednesday, July 29, 2026, Rietta executed our emergency hotfix procedure across our entire client base for sites impacted by a severe remote code execution vulnerability in ActiveStorage, a component of Ruby on Rails 8 and newer. We worked off the initial GitHub Security Advisory, published the same day the patch shipped. Ethiack, one of the research teams that discovered the flaw, dubbed it KindaRails2Shell (CVE-2026-66066) in their initial disclosure post that same day, July 29th, with a full technical deep-dive following the next day on July 30th.

Protect Production SQL Databases from AI/LLM Agentic SQL Query Risks

Wed, 04 Feb 2026 08:00:00 +0000

Overview Many are concerned with how to protect production databases from AI query agents, a subset of AI coding agents, designed to assist in writing SQL queries against a database using natural-language prompts. It is helpful to think about this new capability as a pseudo-deterministic compiler that takes a prompt, reads the schema of the database, and produces dynamic queries that are executed against the production database with minimal human intervention.

Use AI to Describe Images as a Background Job in Ruby on Rails

Fri, 23 Jan 2026 06:00:00 +0000

Recently I wrote about how I run a Local AI Setup with Ollama and Nvidia GPU on Ubuntu Linux, but today I want to touch a bit more about how one can fit Artificial Intelligence (AI) into your Ruby on Rails application. At the risk of oversimplication, let’s start with an example: you allow users to upload an image to your Ruby on Rails application and provide a place for them to enter alternative text (the ALT HTML attribute) for each image that describes the content.

A Journey From QBasic Random Access Files to PostgreSQL

Tue, 11 Jun 2024 08:00:00 +0000

As a practicing developer, I have a good bit of experience working with software that needed to store data. In this article I am going to recount a brief history of the world of databases, the long version would take a book, as I personally experienced working on code for the last 28 years. This should be informative to readers who want to understand more about just how powerful modern database systems are in comparison.

Streamlining Workflows With Docker

Tue, 09 Feb 2021 11:00:00 -0500

Every week, our team puts most of our hours towards helping our long term, stable client applications stay up to date. From dependency upgrades to changes in the code base, we make sure these older rails apps are kept secure and functioning. Some of our clients choose to hire us because the amount of time spent securely maintaining their app does not justify the cost of hiring a full-time developer, while others are looking for a trustworthy assistance after losing a key developer.

Learning Object-Oriented Programming in Ruby vs C/C++

Tue, 15 Dec 2020 10:00:00 -0500

As a newcomer to Ruby, the ease of using the language was a welcomed surprise. In the comp sci program at UC Davis, many of the core lower division courses, including those that introduce students to object-oriented programming (OOP), are taught in C/C++. Simultaneously learning the fundamentals for memory management and OOP, along with the unique C/C++ syntax, can quickly become a headache for those of us just starting out in computer science.

Remote Team Culture - Code Review and Style Guides

Sat, 12 Dec 2020 02:30:00 -0600

Code Review at Rietta When joining a new team, a developer can be nervous when making their first pull request or contribution to a codebase. The thought of your team going through your code and ripping it to shreds is both reasonable and scary. So how does a team eliminate this fear and instead, encourage newer developers to greet code reviews as a opportunity to not only improve their code, but to encourage a healthier environment to actually collaborate?

The convergence of Ruby on Rails and #AppSec Podcast Appearance

Wed, 07 Oct 2020 08:00:00 -0500

I recently appeared as a guest on the Application Security Podcast with Chris Romeo to talk about the convergence of Ruby on Rails and #AppSec. The discussion covered a range of topics including secure coding with Ruby on Rails, RoR vs other languages and culture, the importance of CI/CD, and more. Check it out!

Dependency Security and Hacking Rails with Jason Swett (Podcast)

Tue, 21 Apr 2020 10:00:00 -0500

I recently appeared in Episode 41 of The Rails with Jason Podcast for a wide-ranging discussion about Ruby on Rails security, the security value of keeping gems updated, the security risk of infrequent deployment, state-sponsored hacking, and practical tips on how to protect your organization. Give it a listen to better understand some common ways that production projects go south in their security practices and why solid test coverage, regular reviews of your dependencies, and frequent deploys help make you much more secure.

Dependency Management and Security

Thu, 06 Feb 2020 10:00:00 -0500

Security in web development touches all avenues of the field from requests, session hijacking, SQL injections and many more mentioned on the Open Web Application Security Project (OWASP). Many buffers now exist between developers and situations where malicious users can capitalize on dependency management oversights. Hackers are resourceful in their exploits of known (and sometimes unknown) vulnerabilities. As one of our developers Rob mentions on his blog post, “A Newer Dev’s Perspective on Learning OWASP”,

AppSec as a Requirement in the Development Process

Mon, 13 Jan 2020 09:30:00 -0500

We’re now well underway for the year 2020. People from time-to-time will make predictions about what is to come and when we look back, one has to laugh at how wrong they were. If you had asked me in 2005 if I thought we would be dealing with SQL injection 15 years later in 2020, I would have told you no, it will surely be solved by then. At the time I was still a student at Georgia Tech and wrote on this blog about SQL injection and presented a paper on application layer detection at the ACM South Eastern Conference.

Ruby Gems Supply Chain Vulnerability

Fri, 06 Sep 2019 11:00:00 -0400

Every Ruby on Rails application depends on Ruby Gems, the third party open source libraries that make development possible. A brand new Ruby on Rails 6 application, with default options, depends upon 75 Gems before the developer makes any customizations to the app! These Gems are produced by volunteer open source maintainers, many of whom are not paid anything to work on open source, and distributed for free via rubygems.org. This is a fantastic resource that makes it possible to create so many good Ruby-based applications with minimum effort re-inventing the wheel. However, how is a developer to know the Gems he or she has in a project are in fact safe.

There have been malicious backdoors distributed in multiple Gems this year. These supply chain attacks have been detected and remediated by the RubyGems community, but it will happen again. Let’s look at the patterns common among the malicious Gems and the how you can go about protecting your own application.

The Case for 2FA, Post Rest-client Gem CVE

Thu, 22 Aug 2019 10:00:00 -0400

Most CVEs occur as a result of a oversight in the architecture or mishandling of how libraries may interact with your application. In some cases like what had occurred with the Rest-client gem version 1.6.13, a package maintainer account on https://rubygems.org was hijacked and used to push malicious code that would compromise sensitive credentials for payment manager accounts, database access, repository access, and others that can cause irreparable damages. The hijacker conducted a series of releases - 1.

Are you accidentally storing private data in plain text?

Mon, 29 Apr 2019 16:15:00 -0400

Debug logs that chronicle data about errors and other exceptions on a web application are a vital tool for any web company. It enables engineering teams to troubleshoot problems - sometimes even before a customer reports an issue to support - and thus provide excellent service to customers. But the danger of over-logging is real. When sensitive data is logged, it becomes vulnerable to misuse and abuse. In this article, I’ll show you how to prudently minimize the data collected in logs.

New Interview on Drifting Ruby

Thu, 18 Apr 2019 03:15:00 -0400

Recently, our very own Frank Rietta (yes that Rietta) had a chance to sit down (virtually of course) with Dave Kimura (@kobaltz on Twitter) of the Drifting Ruby screencast. For those who don’t know, Drifting Ruby is an educational site, blog, and screencast with all things Ruby. Drifting Ruby offers premium training with example-based content to up your dev game to the next level.

Prevent an Outdated and Broken bin/setup with This Simple Trick

Tue, 27 Nov 2018 18:00:00 -0500

Having a good bin/setup is very essential to having a quick onboarding time as well as getting your environment back up and going in case of emergency.

But how often do you run this bin/setup if it’s only ran when you setup your repo? Most developers setup their environment only every once in awhile. What happens when changes to the codebase happen and the bin/setup isn’t modified as well?

Writing a good bin/setup

Thu, 06 Sep 2018 13:00:00 -0400

Nothing is better than cloning a code repository, running the bin/setup, and everything about the project just works. It’s the developer equivalent of waking up before your alarm goes off and realizing you can sleep for another two hours.

A good bin/setup can mean the difference between a frustrating on-boarding process and a fantastic one.

When you have a completed bin/setup, you have an easy way to get new and existing developers up and running quickly, stress-free. It can also streamline continuous integration setup and maintenance. A good bin/setup gives you peace of mind when setting up a new machine and offloads the mental work of project setup to a verifiable tool.

Automatically Migrate from Factory Girl to Factory Bot

Tue, 21 Aug 2018 18:30:00 -0500

Gem updates are tedious. Gem name changes are even more tedious. This quick script converts Factory Girl references to Factory Bot references.

Southeast Ruby Conference Recap

Sat, 07 Oct 2017 14:00:00 -0500

On the behalf of the entire Rietta team, I would like to give a huge shout out to Jason Charnes (@jmcharnes) for hosting the South East Ruby Conf in Nashville, TN this week. I was pleased to meet many members of the Ruby On Rails Link Slack Group.

Each and every talk was fantastic, I’d like to go into depth with a few highlights for anybody that was unable to participate in this conference.

Engine Yard's 17 Rails Security Tips

Tue, 05 Sep 2017 00:01:03 -0400

Christoper Rigor has posted a good set of Ruby on Rails Security 17-Item Checklist on Engine Yard’s blog. Check it out. He did a good job hitting the important ones without being overly verbose. If you’re looking for a standard to follow, check out the OWASP ASVS.

Rails: Set Max Length on Fields

Sat, 22 Oct 2016 00:00:00 +0000

I originally started drafting this post on January 14, 2012, but it sat unpublished since then. Its fun to look back at ones journey, 1743 days ago. In 2012, I was relatively new to the Ruby on Rails platform after having worked in PHP and SQL for years, as well as a little .NET. The platform has been a good choice that I enjoy working with still to this day. I was working in Rails 3 at the time and had completed at least three client websites in Rails in 2011.

Ruby Application Security Talk Featured in Ruby Weekly Issue # 268

Thu, 15 Oct 2015 12:40:53 -0400

A link to my talk on “Defending Against Data Breaches, as a Practicing Ruby Developer” at Rocky Mountain Ruby 2015 was featured in Issue # 268 of Ruby Weekly! Thanks Peter Cooper! I’m super glad to see the word getting out that security has to be part of the development process. Oh by the way, I learned at the ISSA International conference this week that Microsoft has a version of their Secure Development Lifecycle tailored for Agile development.

Uniqueness Validation Race Condition in Ruby on Rails applications

Mon, 04 May 2015 12:00:00 -0400

Are you a practicing Ruby on Rails developer? It doesn’t matter if you are called a junior developer, senior developer, or the janitor. It is surprisingly easy for race conditions to slip into your code and out into production. Some of these can lead to annoying duplicate e-mails in your database or they could lead to serious security issues that impact your company’s bottom line.

As you read on, I’m going to teach you a bit about race conditions, also called hazards in some engineering circles, and give you a practical example of how one can slip into a Rails application if you were to choose to enforce validation constraints only within an application’s models with a validates :field_name, uniqueness: true rather than through database constraints.

Before we begin, I do want to remind you about one thing. Preventing race conditions is not just something that can be added to Ruby on Rails because the methods for automatically detecting race conditions is an NP-hard problem in computer science. That’s why it’s so important that you understand something about spotting situations where they may occur so that you stand a better chance at leaving them out of your next deploy.

Adding a Rake Task for SQL Views to a Rails Project

Mon, 30 Mar 2015 12:00:00 -0400

I have previously written about Using Rails and SQL Views for a Report. A practical consideration when employing SQL views, which create wonderfully fast read-only tables that can be used by ActiveRecord models seamlessly, in a Ruby on Rails project is where to maintain them in a project.

One approach is to use migrations, since that’s where database stuff normally goes. But a big downside is that this approach is not DRY because changing the SQL view requires a new migration that drops the old view and replaces it with the updated version. Simply changing a field in the SQL view requires copying and pasting the entire definition over again. That’s just annoying!

The second, and in my opinion better approach, is to treat SQL views more like models.

Get the Current Year in the Ruby programming language

Fri, 13 Mar 2015 10:09:55 -0400

When learning Ruby on Rails, sometimes you just need to get the current year as a number. I posted one example on why this is a useful way on a real-life website in the 2011 post on how to automatically update copyright notices.

In this article, I will show you some methods for getting the current year, such as the number 2015. I will then show you how to benchmark the methods to determine which is the fastest method for you, given your machine and Ruby version.

Okay, just how do I get the Current Year in Ruby?

It’s easy. Just use any of the Date/Time objects and call the year method, like this:

   # Using the Time class
   current_year = Time.new.year  # or Time.now.year

   # Using the Date class
   current_year = Date.today.year

   # Using the DateTime class
   current_year = DateTime.now.year

New Video! Understanding & Defending Against Data Breaches

Thu, 19 Feb 2015 23:22:58 -0500

A few weeks ago, I spoke with the Ruby users’ group in Nashville, TN, about the importance of understanding the root cause of data breach security incidents and countermeasures that developers can put in place to help prevent them. It’s up on YouTube for your enjoyment at Understanding & Defending Against Data Breaches, as a Practicing Software Developer - Nash.rb.

Two new videos! How a Ruby on Rails developer can help prevent a Data Breach

Fri, 09 Jan 2015 11:12:44 -0500

Two new videos of the data breach talk and class that I lead in August and December are now up on YouTube! I hope that it helps you level up on your security knowledge because good software security needs to be a moral stance.

Next public talk

I am scheduled to give a presentation to this topic for the Nash.rb Users’ Group on Thursday, February 5, 2015 at the Emma office in Nashville, TN. If you are in town and can make it out, I would love to meet you.

Learn how Upworthy scaled a Ruby on Rails application to serve massive traffic

Fri, 19 Sep 2014 12:23:12 -0400

Luigi Montanez is the founding engineer of the viral content website http://upworthy.com and in this ATLRUG talk from July 9, 2014, he gives a fascinating insight into one approach to managing the growth of a startup’s web app in the face of very high traffic. Their backend is built upon Ruby on Rails with an effective use of the Fastly CDN to deliver very high performance at scale.

What a Ruby developer can do to help prevent a Data Breach - 2014

Thu, 05 Jun 2014 10:18:14 -0400

I was invited by Tech Talent South to give a guest lecture to their Spring 2014 class of students learning to become Ruby on Rails developers. These students are all adults looking to make a change in their career and are really bright and motivated individuals looking to better themselves with learning to code. In my view this is perfect because being a developer is the most trusted job position one can possibly hold in most organizations.

Joe Moore has Pair Programmed for 27,000 Hours

Tue, 20 May 2014 19:57:11 -0400

In Outliers, Malcolm Gladwell posited that 10,000 hours of practice are what it takes to achieve mastery in a field. Well, Joe Moore (@joem on Twitter), the owner of remotepairprogramming.com, has blown past that mark on the subject of pair programming practices and the impact those practices have on real software projects. He has pair programmed for 27,000 hours and the audience at RailsConf 2014 asked him anything! At Rietta, we do pair programming as a fundamental part of our development process.

Issue #6: February, 2014, Web Application Topics Newsletter

Tue, 18 Feb 2014 07:31:00 -0500

In this issue

Get and compare the current Git branch in BASH
New book of the month
- Don’t Make Me Think, 3rd Edition
In the news
- PaperClip (Ruby on Rails) Insecure Defaults
- Yahoo user accounts compromised through third party database breach
- Buffer database compromised through compromise of MongoHQ support credentials

How to use SQL views to Build Reports with Ruby on Rails

Thu, 28 Nov 2013 10:54:00 +0000

SQL views are a powerful capability of a relational database server. This functionality can be easily used to implement important reporting, data mining, and other functionality to a web application built with Ruby on Rails in a manner that may be faster and more concise than an implementation that uses only typical ActiveRecord patterns. The complexity of dealing with the relational data is abstracted away from the Rails application that is a consumer of the data, keeping the model, controllers, and Rails view concisely focused on their appropriate roles.

We Won a Hackathon with Scriptive! The Programmers' Perspective.

Thu, 14 Nov 2013 19:38:00 -0400

Brandon Dees and I travelled to Austin, Texas, to compete in the Code for the Kingdom Hackathon, a Christian-ministry related event that was held at the Acton School of Business. We joined the super talented Charles Roach, the founder of Scriptive, a non-profit organization, to compete in the 48 hour startup/programming competition. Our mission was to code something that will impact the Kingdom for Christ through new technology. Brandon has agreed to help co-author this post so that you can read both his and my perspective on what it was like to be a developer at the hackathon.

Want to Learn Ruby on Rails in Atlanta?

Sat, 28 Sep 2013 11:33:00 +0000

The Emerald City Programming Group has started back up for the fall, starting today, Saturday, September 28, 2013. The first class had an excellent turnout with twenty two local budding Rubyists in attendance. The environment is extremely friendly. The volunteer instructors this year are Anjan Das and Carlos Gonzalez. This free class is open to the public and will cover everything you need to go from zero to deploy, including:

Enhance Early Adoption with Mobile Friendly Themes

Thu, 06 Jun 2013 00:00:00 +0000

At Rietta, we’ve worked on many web application projects. We’re backend programmers and work with different design teams chosen by our clients. These projects tend to be rolled out in phases. Often the first phase is the desktop website with the intention to do a mobile application of some sort later. But, when the new business’ website is announced on Facebook and via an e-mail to the pre-launch mailing list, the majority of the first clicks are from iPhone and Android device users!

Default HTML Values with a Rails View Helper

Tue, 15 Jan 2013 00:00:00 +0000

Suppose you have the same image tag included frequently in a Rails application. One way to clean up the code a bit and to set defaults is to create a super simple view helper method that can receive a hash parameter and merge it with the defaults. Code Example In app/helpers/pages_helper.rb: def gui_tiny_icon(name, opts = {}) image_tag "gui/theme/icons/#{name}", {:class => "vm", width: 15, height: 15}.merge(opts) endThen in the usual place of the HTML.

Setting up Ubuntu for Rails Development - part 2

Wed, 24 Oct 2012 00:00:00 +0000

And here is the second video in the series on setting up Ubuntu Linux for Ruby on Rails development: http://www.youtube.com/watch?v=C_0dTp0Fzoo&feature=plcp

Setting up Ubuntu for Rails Development

Sun, 21 Oct 2012 00:00:00 +0000

Ruby on Rails is a really great platform for developing and releasing web applications. At my company, our developers are pretty evenly split between using Mac OS X and Ubuntu Linux desktops as their primary development systems. Setting up Ubuntu to develop in Ruby on Rails is pretty simple, but there are a few gotchas. To help you learn how to set this up, I have recorded a couple of real-time videos of me configuring from scratch Ubuntu Linux in a virtual machine.

WGET to Keep New Rails Site in Memory

Tue, 10 Jul 2012 00:00:00 +0000

A Ruby on Rails web application can be really fast in production. However, for a site that receives less traffic the application can be very, very slow on the first request after it has gone dormant. One way to make sure that your site is always fast and never goes dormant is to setup an automatic process to periodically fetches the home page. On an Linux, FreeBSD, or Mac OS X system it is easy to setup an automatic fetch using cron and wget.

New GIT Time Extractor Gem

Sun, 06 May 2012 00:00:00 +0000

I am happy to announce that the git_time_extractor project, released publicly on github.com in February, is now officially available as a RubyGem! git_time_extractor is a small command-line tool that produces a CSV time log for each developer/contributor to a project tracked in GIT. It uses the commit timestamps and three basic reasonable assumptions, approved by the developer’s accountant. It other words, computes the estimated time spent by developers working on code within a GIT repository.

mod_deflate: Dramatic website speed increase with Apache compression on Ubuntu Linux

Wed, 18 Apr 2012 00:00:00 +0000

It’s easy to dramatically improve the loading speed of your website by enabling compression support in your Apache web server. This works without needing to make any changes to your backend or database code no matter what programming platform your development team uses. I recently added this change to a Ruby on Rails-based web application running on a Ubuntu Linux dedicated virtual server. That particular page observed a 72% decrease in bandwidth required to deliver the homepage.

[Rails] Good Random Positive Integer

Fri, 03 Feb 2012 00:00:00 +0000

Tonight I needed a quick way to generate a good pseudo random number. The following statement in Ruby will generate a positive integer between 0 and the maximum integer supported on the system. SecureRandom.random_number((2**(0.size * 8-2)-1))Running that 10 times as a test on my system returned: 479960941838047707 4598189742420362323 4319555246297899788 79907720343840910 1019099276589074756 1753578159791031009 51485412595337811 3333462064391733874 2622897372121370782 4287564549349999056 That’s all for tonight. Sources Secure random number generator interface Ruby max integer

Rails: Point DNS to 127.0.0.1 to Test Wildcard Subdomains on WEBrick

Tue, 24 Jan 2012 00:00:00 +0000

Want quick method for testing domain/subdomain-based routing logic in your Rails applications? Point a subdomain and wildcard subdomain of your company’s DNS to 127.0.0.1, your localhost IP address. Then you can use that domain to access your local test web server on your local machine. For example, I added DNS “A” records for: test.rietta.com → 127.0.0.1 *.test.rietta.com → 127.0.0.1 Now Rietta’s developers can each access his local WEBrick server with:

Rails: Gmail Reply-To on Contact Form Email

Wed, 18 Jan 2012 00:00:00 +0000

Most websites have a contact form for visitors to fill out a message that is then e-mailed to the owner or support contact for the website. When working with a Rails app that will be hosted in a cloud environment that does not supply outbound email delivery it can be convenient to use a Gmail (or Google Apps) account at first for outbound delivery. The trouble is that Google’s SMTP server will rewrite the email address set in the email message to match the address of the account.

Rails: TypeError: nil can't be coerced into Float

Sat, 14 Jan 2012 00:00:00 +0000

When working on Ruby on Rails website some of the common errors that you need to check for is nil objects when something else was expected. For instance, suppose one of your ActiveRecord models has a price field. Further suppose that the user left this field blank instead of entering 0.0 as the price. This computation will fail: quantity = 3 # ... amount_to_charge = price_field * quantityIt fails with a “TypeError: nil can’t be coerced into Float” exception.

Integrate Blog Content with your Rails 3 Website with Pure Ruby Code and RSS

Mon, 02 Jan 2012 00:00:00 +0000

The full sample code used for this post is available as a Ruby on Rails 3.1 project at https://github.com/rietta/SimpleBlogFeed. Suppose you have built an amazing new website using Ruby on Rails 3. It has tons of features and some great content. However, one thing it is lacking is a solid blog section. You would like to avoid writing your own blog code in Rails since there are already tons of solid blog applications to choose from - Wordpress, Moveable Type, Typepad, Blogger.

Conditionally Including Resources on SSL or non-SSL to Avoid Mixed Content Security Warnings in Ruby on Rails

Wed, 21 Dec 2011 00:00:00 +0000

When building content that can be delivered on an encrypted HTTPS connection it is necessary to reference all of the embedded resources, 3rd party badge images, embedded YouTube videos, etc, from an HTTPS url. Otherwise a mixed content error will imply to your users that the website is not safe, ouch!