Jean Boussier

Jean Boussier

@byroot.bsky.social

Rails core, Ruby committer, Senior Principal Engineer at Intercom.

1.8K followers177 following491 posts

Jean Boussier reposted

Drew Bragg
@drbragg.dev

Welp... Got laid off from Podia today. Kinda a lot to process for a Thursday. I'll have something more coherent to say eventually. For now, send Ruby/Rails leads. Or dog pictures.... Both are good.

Jean Boussier
@byroot.bsky.social

I realized it has been ~1.5 years since I concluded my series of post on JSON optimization. So I got curious how much faster it became since then. 2.7.2 was the last version before I took over maintainership. 2.9.0 was the version I released at the end of the blog series.

Jean Boussier
@byroot.bsky.social

Not sure if something changed recently, but I've received a stream of much higher quality security reports in the last few days, but there' still something off with them. I suspect they're AI assisted, but can't be certain. Unlike before, they're easy to read, concise, well explained etc. 1/3

Jean Boussier
@byroot.bsky.social

However it's clear the authors or tools still don't understand the context of the code, they're just searching for patterns. Typically I got reports of overflows and other not properly sanitized inputs in APIs that should never receive untrusted input. 2/3

Jean Boussier
@byroot.bsky.social

e.g. it's like getting a security vulnerability report for a buffer overflow in `eval`. Yes it's a bug and it will be fixed, but if an attacker is able to call `eval` with arbitrary input, that overflow doesn't really matter... 3/3

Jean Boussier reposted

Jean Boussier
@byroot.bsky.social

Replying to @sang.io

It's the Rails 8.2 default yes. No need for backporting, the feature is entirely in Bootsnap, so you can just upgrade to latest Bootsnap, and copy the couple configs: github.com/rails/rails/...

github.comEnable frozen string literal by default by byroot · Pull Request #57252 · rails/railsRef: rails/bootsnap#535 This only impact the app own code, and not dependencies. It is also possible to enable it for gems, but some old ones may still not be ready.

Jean Boussier reposted

Aaron Patterson
@tenderlove.dev

Made a new blurg post about AI + OSS security. I was going to just complain on here, but I figured a short blog post would be better for my complaining 😂 tenderlovemaking.com/2026/05/06/r...

tenderlovemaking.comRails Security, AI, and IBBFor quite a few years the Rails project has been working with the Internet Bug Bounty (IBB). The IBB is an organization that awarded cash to security researchers that reported issues to OSS projects p...
Jean Boussier
@byroot.bsky.social

Something I'm not yet clear on how to handle these days is what to do with obvious LLM PRs on Open Source projects. When a human submit a PR that needs some work, often enough I'll go through rounds of review to progressively get the PR in a mergeable state.

View full thread
Jean Boussier
@byroot.bsky.social

But nowadays I get some PRs that are clearly LLM generated, even the feedback I give is clearly directly pasted in the LLM and then sent back to me. It's basically LLM coding by proxy, which begs the question of what to do?

Jean Boussier
@byroot.bsky.social

So far I think reviewing these normally is a waste of my time, if the person on the other end isn't gonna learn anything, why bother? I might as well do it myself. No? But then what about attribution? Does the LLM wrangler deserve any credit on the final patch? I'm a bit lost...

Jean Boussier
@byroot.bsky.social

Something I'm not yet clear on how to handle these days is what to do with obvious LLM PRs on Open Source projects. When a human submit a PR that needs some work, often enough I'll go through rounds of review to progressively get the PR in a mergeable state.

Jean Boussier
@byroot.bsky.social

I'm not even sure why I do that, I guess it's a teaching opportunity? Sometimes it just needs a quick touch up, and I do it myself, as it's not worth the back and forth.

Jean Boussier
@byroot.bsky.social

Looks like I can procrastinate some more, I found a way to debug it without rr: github.com/ruby/json/pu...

github.comEnsure `Generator::State` is kept on the stack by byroot · Pull Request #930 · ruby/jsonFix: #929 I don't know how it's possible, but somehow the self reference is optimized out of the stack. Perhaps because we inline so aggressively that the compiler end up spilling it on the...
Jean Boussier@byroot.bsky.social

I need to stop procrastinating and buy myself a proper development machine that run on Linux, and learn how to use the rr debugger. I keep running into issues that would be way easier to debug that way...

Jean Boussier
@byroot.bsky.social

I need to stop procrastinating and buy myself a proper development machine that run on Linux, and learn how to use the rr debugger. I keep running into issues that would be way easier to debug that way...