Ruby Central

that.

From the perspective of Ruby Central, which is... managing and trying to secure RubyGems.

I mean, hilariously with OpenAI's help, you know, what is their recourse? Will they seek to use it? I should be clear here.

It's not like OpenAI is the only company that's helping RubyGems.

Two months later, the agents were hunting a vulnerability before the world knew it existed, and nobody has explained how they knew.

Ruby Central pulled more than 500 packages and says it found no evidence the key attempts succeeded.

And it compounded this week.

On Tuesday, Sentinel-1's research arm published findings identifying two Hugging Face accounts, ZeroTime and Nix9.

I think it is changing.

And actually, Jim actually told me a story about this in Ruby Central.

You have, uh, you had one of the open source LLMs running on your machine, right? That was helping you, uh, with a client at that time.

Sorry, at RubyConf, not Ruby Central.

Yeah

YeahWe've been playing around with open weight stuff for a little while at Flagrant.

So the question here is, with Rails and Ruby and RubyGems all needing emergency security fixes in the same week, is this just normal ecosystem maintenance working as intended? Or is it a sign that the Rails attack surface is growing faster than the people patch can keep up? And I honestly...

and i think that maybe my feelings are shaded a little bit by having spent some time with the ruby central security team at rubyconf but i actually think that they're they've always been working hard but their tools are much sharper than they were a year ago and i mean they know this too they've been writing about this i think that this is a sign of the community at large rising to the occasion, rising to the fact that, Hey, there's a lot more stuff out there.

And just like you said earlier, Oh man, we're already out of time.

Regardless of how sophisticated these models are, they're agents and they can run 24 hours a day and they're never going to stop trying to find these vulnerabilities.

Ractors was included in Ruby 4, of course, but still listed as experimental.

We decided to give it kind of just short shrift because really a lot of it was unproven.

And interestingly, when I was at RubyConf just a month or two ago, we had a Ruby Central or a RubyConf talk about Ractors.

And It was really interesting and it was informative, but it again was like, it's kind of not really ready for prime time.

Thank you so much for having me.

So one of the things that you've been doing, you and Flagrant have been heavily involved with Ruby Central, doing a lot of like the web work for Ruby Central for the conferences the last several years, but you've also got your own kind of conference line with XORuby that you've been doing.

Is this year two now? Yep.

This

So I just kind of would like to hear more about how it's going, how it's going for you, that type of thing.

I've been asked several times by people this year, like, how do I measure the success of XRuby? But we'll come back to that.

I think the inspiration for it really was, as you said, we'd spent a bunch of time working with Ruby Central and RubyConf and RailsConf, largely our impact there.

I was co-chair once, but really the thing that we were mostly focused on was getting a website built.