81: Is This Really a CVE?

FromThe Bike Shed

Start listening View podcast show

81: Is This Really a CVE?

FromThe Bike Shed

ratings:

Length:

27 minutes

Released:

Sep 28, 2016

Format:

Podcast episode

Description

Derek and Sean talk through how to handle a security vulnerability that was reported for Clearance, a user authentication library.

Released:

Sep 28, 2016

Format:

Podcast episode

Titles in the series (100)

On The Bike Shed, hosts Chris Toomey and Steph Viccari discuss their development experience and challenges with Ruby, Rails, JavaScript, and whatever else is drawing their attention, admiration, or ire this week.

Skip carousel

10: I Don't Get Functional Programming: Pat Brisbin joins Derek to discuss the many advantages of Haskell programming. by The Bike Shed
41 min listen
4: Put Everything on the Front End: Derek and Sean discuss hunting Rails performance regressions and techniques for improving performance in your web applications. by The Bike Shed
38 min listen
2: Rails 4.2: Derek and Sean discuss Sean's commit access to Rails, what's coming in Rails 4.2, and how to go about making Rails code better. by The Bike Shed
36 min listen
20: Intentionally Excruciatingly Painful: We're joined by Josh Clayton to discuss our differing strategies on testing view behavior, strategies for dealing with brittle feature specs, and what types of tests each of us favor. by The Bike Shed
41 min listen
8: Attributes API, Relation#or, Paid Open Source: Derek and Sean discuss what the Attributes API enables, the addition of Relation#or and paid open source. by The Bike Shed
37 min listen
27: I've Got 29.97 Problems (and codecs are some): Sean and Derek circle back on HTTP before diving into unsafe rust, and finally the merits of a small standard library. by The Bike Shed
44 min listen
18: This Podcast is Rigged (But Not Animated): Sean and Derek discuss rails asset dependencies before diving into an overview of animation techniques and C extensions. by The Bike Shed
39 min listen
7: At the Car Wash: Derek and Sean talk trade schools, sneaky bugs, bad method names, before_filters, and the Superbowl. by The Bike Shed
49 min listen
22: No Capes! (Eileen Uchitelle): Eileen Uchitelle joins the show to discuss performance improvements to ActiveRecord, speeding up integration tests, and contributing to or running open source projects. This episode of The Bike Shed is sponsored by Code School. Entertaining online learni by The Bike Shed
38 min listen
3: Flipping the Script: Sean and Derek take a fresh look at the tradeoffs in writing CoffeeScript and whether we should be using an ES6 transpiler instead. by The Bike Shed
26 min listen
16: Wizards Are Hard to Kill: Grab Bag! Derek and Sean talk about math, augmented reality, RailsConf wrap up, Minimum Viable Products, Accessibility... by The Bike Shed
37 min listen
49: A More Practical Haskell: How can an ORM be faster than a SQL String? Laila and Sean discuss the latest happenings in Diesel and why it is that a systems language needs an ORM, anyway. by The Bike Shed
35 min listen
19: The Oncoming Storm (Sam Phippen): Derek and Sean are joined by Sam Phippen from the RSpec core team to discuss RSpec mocks, testing strategies, and minitest. by The Bike Shed
29 min listen
6: Shh! Library Under Maintenance: Sean and Derek discuss thoughtful deprecations, backwards compatibility, and other joys of library maintenance. by The Bike Shed
42 min listen
9: Monorails, For the Kids: Sean and Derek discuss Monoliths, Service Oriented Architecture, and the new Adapter Specific Type Registry in Rails 5. by The Bike Shed
35 min listen
11: Form-ing Opinions: Sean and Derek talk about the state of Android tooling, refactoring journeys, and an approach to rails form objects. by The Bike Shed
37 min listen
1: Sandi & Derek's Rules: Sean and Derek discuss lessons learned from following Sandi Metz' rules on a project and the overall impact of rules on code. by The Bike Shed
28 min listen
32: Bug For Bug Compatibility: Derek and Sean discuss Microsoft's interest in open source, improving the Rails development story on Windows, and Sean's progress implementing an ORM in Rust. by The Bike Shed
51 min listen
21: The "Best" Canada (Godfrey Chan): Rails Core Team member Godfrey Chan joins the show to demystify rails bug hunting and contributing. by The Bike Shed
24 min listen
14: An Acceptable Level of Hassle (David Heinemeier Hansson): This week, we're joined by DHH and discuss microservices, monoliths, shared abstractions, and the fate of Action Cable. by The Bike Shed
55 min listen
46: Don't Breathe, Save the Planet: We discuss the maintenance burden of ActionCable and its dependencies on Rails 5, follow-up on Scenic issues, and discuss implementing migrations anew in Diesel. by The Bike Shed
34 min listen
34: README.md: Derek is joined by Laila Winner to discuss Neo4j, the importance of fantastic documentation, and the different types of documentation a project requires. by The Bike Shed
39 min listen
24: You Look Good in a Lab Coat (Richard Schneeman): Richard Schneeman joins The Bike Shed to discuss ruby memory use, horizontal scaling, and tackling open source issues big and small. This episode of The Bike Shed is sponsored by Code School. Entertaining online learning for existing and aspiring develop by The Bike Shed
41 min listen
12: A Poor Man's binding.pry: Derek and Sean talk about naming, debugging, and the anxiety of conference talks. by The Bike Shed
32 min listen
5: Rails is Not Your Architecture: Derek and Sean discuss various ways of taking the Rails out of your Ruby on Rails application, what folder to put your files in, and the difficulties and rewards of learning new programming languages. by The Bike Shed
39 min listen
23: Why Did They Call it Rust?!: Sean gives Derek a tour of Rust, a new systems language from Mozilla. This episode of The Bike Shed is sponsored by Code School. Entertaining online learning for existing and aspiring developers. Leave a review on our iTunes page to be entered to win a f by The Bike Shed
43 min listen
36: Python Unchained: Derek and Laila talk about learning Python and Django and discuss how thoughtbot adopts new languages, frameworks, and libraries. What factors influence adoption? How do we share what works and doesn't work? by The Bike Shed
50 min listen
40: ActiveRecord Deprecated Persistence: The ActiveRecord update API is a mess of methods that confuse even ActiveRecord’s maintainer. What are the problems and is there any hope for a solution? by The Bike Shed
34 min listen
28: Minisode 0.1.1: Did you know Rails has no integration test suite? What could go wrong? by The Bike Shed
9 min listen
17: Railing About Performance (Sam Saffron): We chat with Sam Saffron about performance, benchmarking, and database migration strategies. by The Bike Shed
47 min listen

More Episodes from The Bike Shed

Skip carousel

424: The Spectrum of Automated Processes for Your Dev Team: Joël shares his experience with the dry-rb suite of gems, focusing on how he's been using contracts to validate input data. Stephanie relates to Joël's insights with her preparation for RailsConf, discussing her methods for presenting code in slides and weighing the aesthetics and functionality of different tools like VS Code and Carbon.sh. She also encounters a CI test failure that prompts her to consider the implications of enforcing specific coding standards through CI processes. The conversation turns into a discussion on managing coding standards and tools effectively, ensuring that automated systems help rather than hinder development. Joël and Stephanie ponder the balance between enforcing strict coding standards through CI and allowing developers the flexibility to bypass specific rules when necessary, ensuring tools provide valuable feedback without becoming obstructions. by The Bike Shed
37 min listen
423: Cognitive Strategies for Coders: Stephanie is back with a book recommendation: "Thinking in Systems" by Donella Meadows. This book has helped to bolster her understanding of complex systems in environmental, organizational, and software contexts, particularly through user interactions and system changes. Joël describes his transformative experience watching last week's total solar eclipse. Together, they explore how systems thinking influences software development and team dynamics by delving into practical applications in writing and reading code, suggesting that understanding complex systems can aid developers in navigating and optimizing codebases and team interactions. by The Bike Shed
40 min listen
422: Listener Topics Grab Bag: Joël conducted a thoughtbot mini-workshop on query plans, which Stephanie found highly effective due to its interactive format. They then discuss the broader value of interactive workshops over traditional talks for deeper learning. Addressing listener questions, Stephanie and Joël explore the strategic use of if and else in programming for clearer code, the importance of thorough documentation in identifying bugs, and the use of Postgres' EXPLAIN ANALYZE, highlighting the need for environment-specific considerations in query optimization. by The Bike Shed
35 min listen
421: The Idealistic vs. Pragmatic Programmer: Stephanie revisits the concept of "spiking"—a phase of exploration to determine the feasibility of a technical implementation or to address unknowns in feature requests—sharing her recent experiences with a legacy Rails application. Joël brings a different perspective by discussing his involvement with a client project that heavily utilizes the dry-rb suite of gems, highlighting the learning curve associated with adapting to new patterns and libraries. Joël used to be much more idealistic and has moved to be more pragmatic. Stephanie has moved the other way. So together, Stephanie and Joël engage in a philosophical discussion on being an idealistic versus a pragmatic programmer. They explore the concept of programming as a blend of science and art, where technical decisions are not only about solving problems but also about expressing ideas and building shared understandings within a team. by The Bike Shed
41 min listen
420: Test Database Woes: Joël shares his recent project challenge with Tailwind CSS, where classes weren't generating as expected due to the dynamic nature of Tailwind's CSS generation and pruning. Stephanie introduces a personal productivity tool, a "thinking cap," to signal her thought process during meetings, which also serves as a physical boundary to separate work from personal life. The conversation shifts to testing methodologies within Rails applications, leading to an exploration of testing philosophies, including developers' assumptions about database cleanliness and their impact on writing tests. by The Bike Shed
28 min listen
419: What's New in Your World? (Extended Edition): Stephanie introduces her ideal setup for enjoying coffee on a bike ride. Joël describes his afternoon tea ritual. Exciting news from the hosts: both have been accepted to speak at RailsConf! Stephanie's presentation, titled "So, Writing Tests Feels Painful. What now?" aims to tackle the issues developers encounter with testing while offering actionable advice to ease these pains. Joël's session will focus on utilizing Turbo to create a Dungeons & Dragons character sheet, combining his passion for gaming with technical expertise. Their conversation shifts to artificial intelligence and its potential in code refactoring and other applications, such as enhancing the code review process and solving complex software development problems. Joël shares his venture into combinatorics, illustrating how this mathematical approach helped him efficiently refactor a database query by systematically exploring and testing all potential combinations o by The Bike Shed
37 min listen
418: Mental Models For Reduce Functions: Joël talks about his difficulties optimizing queries in ActiveRecord, especially with complex scopes and unions, resulting in slow queries. He emphasizes the importance of optimizing subqueries in unions to boost performance despite challenges such as query duplication and difficulty reusing scopes. Stephanie discusses upgrading a client's app to Rails 7, highlighting the importance of patience, detailed attention, and the benefits of collaborative work with a fellow developer. The conversation shifts to Ruby's reduce method (inject), exploring its complexity and various mental models to understand it. They discuss when it's preferable to use reduce over other methods like each, map, or loops and the importance of understanding the underlying operation you wish to apply to two elements before scaling up with reduce. The episode also touches on monoids and how they relate to reduce, suggesting that a deep understanding of functional programming by The Bike Shed
43 min listen
417: Module Docs: Stephanie shares about her vacation at Disney World, particularly emphasizing the technological advancements in the park's mobile app that made her visit remarkably frictionless. Joël had a conversation about a topic he loves: units of measure, and he got to go deep into the idea of dimensional analysis with someone this week. Together, Joël and Stephanie talk about module documentation within software development. Joël shares his recent experience writing module docs for a Ruby project using the YARD documentation system. He highlights the time-consuming nature of crafting good documentation for each public method in a class, emphasizing that while it's a demanding task, it significantly benefits those who will use the code in the future. They explore the attributes of good documentation, including providing code examples, explaining expected usage, suggesting alternatives, discussing edge cases, linking to external resources, and detailing inputs, outputs, and pote by The Bike Shed
40 min listen
416: Multi-Dimensional Numbers: Joël discusses the challenges he encountered while optimizing slow SQL queries in a non-Rails application. Stephanie shares her experience with canary deploys in a Rails upgrade. Together, Stephanie and Joël address a listener's question about replacing the wkhtml2pdf tool, which is no longer maintained. The episode's main topic revolves around the concept of multidimensional numbers and their applications in software development. Joël introduces the idea of treating objects containing multiple numbers as single entities, using the example of 2D points in space to illustrate how custom classes can define mathematical operations like addition and subtraction for complex data types. They explore how this approach can simplify operations on data structures, such as inventories of T-shirt sizes, by treating them as mathematical objects. by The Bike Shed
40 min listen
415: Codebase Calibration: Stephanie has a delightful and cute Ruby thing to share: Honeybadger, the error monitoring service, has created exceptionalcreatures.com, where they've illustrated and characterized various common Ruby errors into little monsters, and they're adorable. Meanwhile, Joël encourages folks to submit proposals for RailsConf. Together, Stephanie and Joël delve into the nuances of adapting to and working within new codebases, akin to aligning with a shared mental model or vision. They ponder several vital questions that every developer faces when encountering a new project: the balance between exploring a codebase to understand its structure and diving straight into tasks, the decision-making process behind adopting new patterns versus adhering to established ones, and the strategies teams can employ to assist developers who are familiarizing themselves with a new environment. by The Bike Shed
31 min listen
414: Spike Tasks: Joël shares his recent experience with Turbo, a JavaScript framework that simplifies adding interactivity to websites without extensive JavaScript coding. Stephanie gives an update on her quest to work from her office more, and the birds have arrived—most notably, chickadees. Stephanie and Joël address a listener question from Edward about the concept of a "spike" in software development. They discuss the nature of spikes, emphasizing that they are typically throwaway work aimed at learning and de-risking rather than producing final code, and explore how spikes can lead to better decision-making and prioritization in software development, especially in complex codebases. by The Bike Shed
32 min listen
413: Developer Tales of Package Management: Stephanie shares her task of retiring a small, internally-used link-shortening app. She describes the process as both celebratory and a bit mournful. Meanwhile, Joël discusses his deep dive into ActiveRecord, particularly in the context of debugging. He explores the complexities of ActiveRecord querying schemas and the additional latency this introduces. Together, the hosts discuss the nuances of package management systems and their implications for developers. They touch upon the differences between system packages and language packages, sharing personal experiences with tools like Homebrew, RubyGems, and Docker. by The Bike Shed
34 min listen
412: Vertical Slices: Joël shares a unique, time-specific bug he encountered, which causes a page to crash only in January. This bug has been fixed in previous years, only to reemerge due to subsequent changes. Stephanie talks about her efforts to bring more structure to her work-from-home environment. She describes how setting up a bird feeder near her desk and keeping chocolates at her desk serve as incentives to work more from her desk. Together, Stephanie and Joël take a deep dive into the challenges of breaking down software development tasks into smaller, more manageable chunks. They explore the concept of 'vertical slice' development, where features are implemented in thin, fully functional segments, contrasting it with the more traditional 'horizontal slice' approach. This discussion leads to insights on collaborative work, the importance of iterative development, and strategies for efficient and effective software engineering. by The Bike Shed
32 min listen
411: Celebrating and Recapping 2023!: Stephanie is hosting a holiday cookie swap. Joël talks about participating in thoughtbot's end-of-the-year hackathon, Ralphapalooza. We had a great year on the show! The hosts wrap up the year and discuss their favorite episodes, the articles, books, and blog posts they’ve read and loved, and other highlights of 2023 (projects, conferences, etc). by The Bike Shed
39 min listen
410: All About Documentation: Joël shares his experiences with handling JSON in a Postgres database. He talks about his challenges with ActiveRecord and JSONB columns, particularly the unexpected behavior of storing and retrieving JSON data. Stephanie shares her recent discovery of bookmarklets and highlights a bookmarklet named "Check This Out," which streamlines searching for books on Libby, an ebook and audiobook lending app. The conversation shifts to using constants in code as a form of documentation. Stephanie and Joël discuss how constants might not always accurately reflect current system behavior or logic, leading to potential misunderstandings and the importance of maintaining accurate documentation. by The Bike Shed
32 min listen
409: Support & Maintenance and Rotating Developers: Stephanie recommends "Blue Eye Samurai" and d a new ceramic pot (donabe) for cooking. Joël talks about the joy of holding a warm beverage in a unique mug. Stephanie discusses her shift to a part-time support and maintenance role at thoughtbot, contrasting it with her full-time development work. She highlights the importance of communication, documentation, and workplace flexibility in this role. Stephanie appreciates the professional growth opportunities and aligns this flexible work style with her long-term career goals. by The Bike Shed
28 min listen
408: Work Device Management: Joël recaps his time at RubyConf! He shares insights from his talk about different aspects of time in software development, emphasizing the interaction with the audience and the importance of post-talk discussions. Stephanie talks about wrapping up a long-term client project, the benefits of change and variety in consulting, and maintaining a balance between project engagement and avoiding burnout. They also discuss strategies for maintaining work-life balance, such as physical separation and device management, particularly in a remote work environment. by The Bike Shed
33 min listen
407: Tech Opinions Online with Edward Loveall: Stephanie interviews Edward Loveall, a former thoughtbotter, now software developer at Relevant Healthcare. Part of their discussion centers around Edward's blog post on the tech industry's over-reliance on GitHub. He argues for the importance of exploring alternatives to avoid dependency on a single platform and encourages readers to make informed technological choices. The conversation broadens to include how to form opinions on technology, the balance between personal preferences and team decisions, and the importance of empathy and nuance in professional interactions. Both Stephanie and Edward highlight the value of considering various perspectives and tools in software development, advocating for a flexible, open-minded approach to technology and problem-solving in the tech industry. by The Bike Shed
37 min listen
406: Working Solo: Joël got to do some pretty fancy single sign-on work. And when it came time to commit, he documented the ridiculous number of redirects to give people a sense of what was happening. Stephanie has been exploring Rails callbacks and Ruby debugging tools, using methods like `save_callbacks` and `Kernel.caller`, and creating a function call graph to better understand and manage complex code dependencies. Stephanie is also engaged in an independent project and seeking strategies to navigate the challenges of solo work. She and Joël explore how to find external support and combat isolation, consider ways to stimulate creativity, and obtain feedback on her work without a direct team. Additionally, they ponder succession planning to ensure project continuity after her involvement ends. They also reflect on the unique benefits of solo work, such as personal growth and flexibility. Stephanie's focus is on balancing the demands of working independently while maintaining a con by The Bike Shed
32 min listen
405: Retro: Sandi Metz Rules: Stephanie discovered a new book: The Staff Engineer's Path! Joël's got some D&D goodness. Together, they revisit a decade-old blog post initially published in 2013, which discussed the application of Sandi Metz's coding guidelines and whether these rules remain relevant and practiced among developers today. by The Bike Shed
32 min listen
404: Estimation: Joël was selected to speak at RubyConf in San Diego! After spending a month testing out living in Upstate New York, Stephanie is back in Chicago. Stephanie reflects on a recent experience where she had to provide an estimate for a project, even though she didn't have enough information to do so accurately. In this episode, Stephanie and Joël explore the challenges of providing estimates, the importance of acknowledging uncertainty, and the need for clear communication and transparency when dealing with project timelines and scope. by The Bike Shed
23 min listen
403: Productivity Tricks: Stephanie is engrossed in Kent Beck's Substack newsletter, which she appreciates for its "working thoughts" format. Unlike traditional media that undergo rigorous editing, Kent's content is more of a work-in-progress, focusing on thought processes and evolving ideas. Joël has been putting a lot of thought into various tools and techniques and realized that they all fall under one umbrella term: analysis. From there, Stephanie and Joël discuss all the productivity tricks they like to use in their daily workflows. Do you have some keyboard shortcuts you like? Are you an Alfred wizard? What are some tools or mindsets around productivity that make YOUR life better? by The Bike Shed
38 min listen
402: Musings on Mentorship: Joël describes an old-school object orientation exercise that involves circling nouns in a business problem description. The purpose is determining which nouns could become entities or objects in a system. Stephanie shares she's working from the Hudson Valley in New York as a trial run for potentially relocating there. She enjoys the rail trails for biking and contrasts it with urban biking in Chicago. The conversation between Joël and Stephanie revolves around mentorship, both one-on-one and within a group setting. They introduce a new initiative at thoughbot where team members pair up with principal developers for weekly sessions, emphasizing sharing perspectives and experiences. by The Bike Shed
38 min listen
401: Making the Right Thing Easy: Stephanie has another debugging mystery to share. Earlier this year, Joël mentioned that he was experimenting with a bookmark manager to keep track of helpful and interesting articles. He's happy to report that it's working very well for him! Together, they discuss tactics to ensure the easiest route also upholds app health and aids fellow developers. They explore streamlining test fixes over mere re-runs and how to motivate desired actions across teams and individuals. by The Bike Shed
31 min listen
400: How To Search: Joël shares he has been getting more into long-form reading. Stephanie talks about the challenges she faced in a new project that required integrating with another company's system. Together, they delve into the importance of search techniques for developers, covering various approaches to finding information online. by The Bike Shed
36 min listen
399: Scaling Code Ownership and Accountability: Stephanie experienced bike camping. Joël describes his experience during a week when he's in between projects. Stephanie and Joël discuss the concept of code ownership, the mechanisms to enforce it, and the balance between bureaucracy and collaboration. They highlight the challenges and benefits of these systems in large codebases and emphasize that scaling a team is as much a social challenge as it is a technical one. by The Bike Shed
34 min listen
398: Developing Heuristics For Writing Software: Want a cool cucumber salad? Joël's got you covered. Stephanie has evolved and found some pickles she enjoys. Experienced programmers use a lot of heuristics or "rules of thumb" about what makes their code better. These aren't always true, but they work in most situations. Stephanie and Joël discuss a range of heuristics, how to use them, how to come up with them, how to know when to break them, and how to teach them to more junior devs. by The Bike Shed
34 min listen
397: Dependency Graphs: Stephanie is consciously trying to make meetings better for herself by limiting distractions. A few episodes ago, Joël talked about a frustrating bug he was chasing down and couldn't get closure on, so he had to move on. This week, that bug popped up again and he chased it down! AND he got to use binary search to find its source–which was pretty cool! Together, Stephanie and Joël discuss dependency graphs as a mental model, and while they apply to code, they also help when it comes to planning tasks and systems. They talk about coupling, cycles, re-structuring, and visualizations. by The Bike Shed
43 min listen
396: Build vs. Buy: Joël has been fighting a frustrating bug where he's integrating with a third-party database, and some queries just crash. Stephanie shares her own debugging story about a leaky stub that caused flaky tests. Additionally, they discuss the build vs. buy decision when integrating with third-party systems. They consider the time and cost implications of building their own integration versus using off-the-shelf components and conclude that the decision often depends on the specific needs and priorities of the project, including how quickly a solution is needed and whether the integration is core to the business's value proposition. by The Bike Shed
34 min listen
395: Human Connection in a Virtual (Work) World: Stephanie had a small consulting win: saying no to a client. GeoGuessr is all the rage for thoughtbot's remote working culture, which leads to today's topic of forming human connections in a virtual (work) environment. by The Bike Shed
31 min listen

Discover this podcast and so much more

81: Is This Really a CVE?

81: Is This Really a CVE?

Description

Titles in the series (100)

More Episodes from The Bike Shed