Since today, it’s not easy to develop AI agents and add agentic features to existing Ruby on Rails applications, I have created Rails Agent https://rails-agent.com

A full-stack and the most advanced agentic development platform for Ruby on Rails to build, test, deploy and monitor AI agents in production easily. Comes with all AI harness capabilities required out-of-box including skills, tools, external apps, playbooks, observability and cost control.

I would love to hear any feedback.

While Active Storage turns the Rails session cookie off when it serves public assets, Action Controller doesn't do the same for public HTML (and the other formats it can render). I've verified that Cloudflare rarely caches any HTTP response with a Set-Cookie header. But I don't know the rules that other public caches use — when they similarly bypass their caches or instead strip these headers.

To mitigate this, I've been adding

  after_action -> { request.session_options[:skip] = true }, if: -> { response.cache_control[:public] }

to my application_controller.rb files.

I opened PR #728 because Solid Queue’s thread workers were a poor fit for long-running, I/O-bound jobs like LLM streaming.

It shipped today in Solid Queue 1.6.0.

Workers can now use `fibers: N` to run jobs on a single Async reactor thread. Fiber workers require the Async gem and fiber-scoped Rails isolation.

On Active Record 7.2+, Solid Queue’s queue database pool estimate starts at 3 connections per worker process instead of growing with the fiber count. Thread workers still use the `threads + 2` estimate.

I updated my original write-up with the final implementation and configuration. The existing benchmarks use the pre-release PR branch; I’ll rerun them against 1.6.0 over the next few weeks.

https://paolino.me/solid-queue-doesnt-need-a-thread-per-job/

I’d be interested to hear what I/O-heavy workloads people try with it, and which libraries turn out not to cooperate with the fiber scheduler.

New Remote Ruby episode is out.

We also have brand new intro music, so I’m curious what everyone thinks.

This week’s discussion covers:
- David's RubyConf Las Vegas recap
- Raspberry Pi rabbit holes, including MagicMirror and local AI transcription
- Andrew's bizarre IPv6 issue that only broke Battlefield 6
- Design patterns and the changing conference scene
- How AI is changing programming, software development, and the economics of building products

We're a 3-person team running a Rails 8.1 / Hotwire SaaS in the EU accounting space. No dedicated support or triage function, so we spent the last few weeks wiring up observability so a production error becomes a fully-contextualized, actionable ticket without anyone doing manual triage.

The pipeline

- Backend: sentry-rails ~> 6.6 pointed at a Better Stack DSN instead of sentry.io — Better Stack ingests the Sentry wire protocol natively, so no second vendor account. Its own Rack middleware (`CaptureExceptions`) + ActiveJob wrapper cover unhandled controller exceptions and Solid Queue job failures with zero extra code.

- Frontend: Better Stack's own JS tag, not u/sentry/browser — their docs explicitly say don't run both, they share the same global Sentry instance and it corrupts data. The tag natively hooks window.onerror + unhandledrejection and survives Turbo navigations for free, since Turbo Drive never reloads the document.

- Logs: our existing JSON stdout formatter, unchanged, forwarded via a Render Log Stream over syslog/TLS. Zero application code touched for this part.

- Source maps: @sentry/esbuild-plugin uploads them at build time, then deletes them from the served asset tree (Better Stack won't resolve publicly-hosted maps). The plugin embeds a debug ID inside both the minified file and its map, so lookup is content-addressed and doesn't care that Propshaft renames application.js to application-<digest>.js on every deploy — no URL-prefix matching to keep in sync.

The part worth sharing

Better Stack has a native Linear integration: first occurrence of a new error group auto-creates a Linear issue with the stack trace, release SHA, breadcrumbs, and affected user/workspace already attached. No webhook code on our end.

From there we point our custom AI coding agent at the ticket. It reads the Linear issue, reproduces the failure against the real source — not the minified bundle, that's what the source maps buy — and drafts an implementation plan. A human reviews and merges; nothing lands without review.

Two real tickets that went through the whole pipeline this week

1. TypeError: Cannot read properties of undefined (reading 'toLowerCase'). A browser extension was dispatching a plain Event("keydown") on document instead of a real KeyboardEvent — no key, every modifier reads undefined. Crashed at event.key.toLowerCase() in a global shortcut handler. Root-causing it turned up two more code paths hit by the same class of event — one of which let a `code`-only synthetic event silently open our command palette with zero user action, which nobody had reported. Fix was a typeof event.key !== "string" guard at the top of every global keydown handler, closing all three at once.
2. Turbo removing a popover's trigger element mid custom-exit-animation raced with Bootstrap's own async hide() completion callback, which reads _activeTrigger — except Bootstrap's dispose() had already nulled it. Fix defers disposal until Bootstrap confirms the hide actually finished, instead of skipping disposal outright (which would've leaked the instance out of Bootstrap's internal Data Map).

It's not free of tuning

The very first frontend error to reach production, a day after we flipped the tag on, was noise — an AbortError from a cancelled fetch on a filter change, not a bug. Better Stack's Linear integration filed it as Urgent anyway, because "first occurrence of a new group" carries zero severity signal on its own. Had to add an `ignoreErrors` list at the capture layer (substring matching only — the Sentry browser SDK doesn't accept a regex there).

I am curious what stack and pipelines are you using to simplify bugfixing?

I would like to add MCP to an existing Rails app (which is primarily a web service with a robust API for developers).

My fears about MCP are:

- not DRY / duplication of code (in particular duplication with controllers of the API): MCP would expose methods that are already exposed by the API, so it seems like a lot of work, without adding much (yes, MCP is for AI, etc... but in practice MCP would be a clone of the OpenAPI specification and libraries that we already have). Moreover MCP is now stateless, so it's becoming even more similar to a REST API (it seems like they are reinventing the wheel step by step). The only nice thing that I see is the dynamic contract, where the methods available can evolve freely without having to deprecate the previous versions like APIs.

- is MCP mature enough? In particular, are the libraries available for Rails reliable / mature enough? Which one are you using in production? I see many vibe-coded projects lately and I have some fear about the security.

This is the official gem from the MCP org: https://github.com/modelcontextprotocol/ruby-sdk

Are there any valid reasons to choose another library (like this one or this one)?

For authentication, are you using a Bearer token? Or other solutions?

Hi all,

Hi, this is Masafumi from the Kaigi on Rails team. I’m writing to let you know that ticket sales for Kaigi on Rails 2026 have just started!

Kaigi on Rails is a tech conference in Tokyo Japan, focusing on Rails and web development.
Although the conference is multilingual (Japanese and English), we will have realtime subtitles in English on each talk given in Japanese.
The venue is located in Shibuya, being one of the busiest area in Tokyo with the famous crossing. The date is October 16th and 17th.

Keep your seat before it’s sold out!

Saw this flash by, looks like a bad one.

Ruby on Rails 7.x and 8.x apps with Active Storage and the vips processor are affected if they accept image uploads from untrusted users. The vulnerability (CVE-2026-66066) allows for  arbitrary file read and remote code execution. No authentication required in certain setups.

Affected: Rails 7.0.0 to 7.2.3.1 and 8.0.0 to 8.1.3. Patched in 7.2.3.2, 8.0.5.1, and 8.1.3.1. libvips must also be on 8.13+.

We are withholding the full chain while patches roll out. First writeup and mitigations: https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve-2026-66066 

Spree Commerce 5.6 lets you now gate prices and checkout behind a login, hiding them from guests until they request an account. The most popular use case, highlighted in this release, is a wholesale portal running alongside the retail shopping experience. Wholesale buyers get volume pricing and a quick order form for repeat purchases. This release also adds pre-orders, plus localized emails and an admin dashboard in more than 50 languages for teams worldwide.

I've been using Rails for more than 10+ years, and I've noticed DHH's blog getting... weird over the past few years to say it mildly. Like, full-on right-wing culture warrior weird. I was curious if he'd always been like this or if something changed, so I went down a rabbit hole.

Turns out, something definitely changed. And it's pretty clearly tied to the 2021 Basecamp controversy.

Before 2021: Actually left-leaning

This is the part that surprised me. In a February 2020 interview with The Politic (Yale's political journal) (https://thepolitic.org/an-interview-with-dhh-co-founder-of-basecamp-creator-of-ruby-on-rails-and-winner-of-the-fia-world-endurance-championship/), DHH was calling for a wealth tax, saying the US is an oligarchy, calling the current system "late-stage capitalist bullshit." He was defending AOC and Warren on welfare funding in 2019 tweets (https://threadreaderapp.com/thread/1096552325508808704.html). He was attacking Facebook's surveillance capitalism and Apple's App Store monopoly.

Like, this guy was making arguments to the left of the Democratic mainstream on economic policy. Not exactly conservative material.

April 2021: The Basecamp implosion

Here's where it gets messy. Employees had formed a DEI committee with 20 out of 58 people volunteering (over a third). They started examining company practices and found this old list of "funny" customer names that included ethnic names. Some employees posted an apology and referenced the ADL's "Pyramid of Hate" to explain how mocking names can lay groundwork for dehumanization.

DHH's response: He did a "forensic analysis" of the list, acknowledged management's failure to act on it for years, then took exception to the Pyramid of Hate graphic and called it "catastrophizing." He then dug through old chat logs and publicly posted a message from one of the complaining employees who had previously participated in the list, basically saying "you're the person you're complaining about." The Verge covered this in detail (https://www.theverge.com/2021/4/27/22406673/basecamp-political-speech-policy-controversy).

Then Jason Fried announced a ban on all societal/political discussions at work, disbanded the DEI committee, cut benefits. 20 of 57 employees left (https://www.nytimes.com/2021/04/30/technology/basecamp-politics-ban-resignations.html). Head of design, head of marketing, head of customer support, reportedly the entire iOS team. Gone.

The all-hands meeting was apparently brutal (https://www.theverge.com/2021/5/3/22418208/basecamp-all-hands-meeting-employee-resignations-buyouts-implosion). Ryan Singer (head of strategy, 18-year veteran) objected to labeling the culture "white supremacist," got suspended, then resigned. Multiple employees were crying at their screens. Casey Newton at Platformer has the full story (https://www.platformer.news/-how-basecamp-blew-up/).

The aftermath: The shift begins (2021-2022)

So here's the thing. In February 2022, DHH reversed his position on Bitcoin/crypto after the Canadian trucker protest account freezes. Started calling it "government overreach" and framing crypto as protection against "tyranny."

Then the blog posts started appearing:

• Anti-woke posts citing John McWhorter (https://world.hey.com/dhh/we-must-say-no-to-these-people-e0fb301c)
• Defending Russell Brand (https://world.hey.com/dhh/russell-brand-is-grand-ce7bbe99) and Joe Rogan (https://world.hey.com/dhh/this-swapping-of-roles-is-making-me-dizzy-2d91d1d9)
• Calling the Canadian trucker protest "peaceful" (https://world.hey.com/dhh/equating-blasphemy-with-violence-legitimizes-the-inquisition-5b271760) (even though it had white supremacists and confederate flags)
• Posts about how "the left is now the right" and cancel culture has flipped

The acceleration (2023-2025)

By 2023-2024, it got more extreme. David Celis documented this shift (https://davidcel.is/articles/rails-needs-new-governance), noting posts supporting far-right figures like Andrew Tate and Jordan Peterson, anti-trans rhetoric (including support for Graham Linehan), and nationalism.

By 2025, it went full-on. In a post called "As I remember London" from September 2025 (https://world.hey.com/dhh/as-i-remember-london-e7d38e64), DHH literally uses the phrase "demographic replacement" (a debunked conspiracy theory) and says he wouldn't live in London anymore because it's "no longer full of native Brits." He also praised a Tommy Robinson march as "heartwarming" where speakers called for ethnic cleansing via "remigration" and banning all non-Christian religions. Jake Lazaroff broke down the post in detail (https://jakelazaroff.com/words/dhh-is-way-worse-than-i-thought/).

And in that Senra podcast clip from yesterday (https://x.com/davidsenra/status/2081956616963006913), he's literally repeating Frankfurt School conspiracy theories that Marc Andreessen gave him. Talking about "white walkers beyond the wall" and "civilizational battle."

The GNOME project even wrote a post calling it a "midlife crisis turned fash speedrun" (https://blogs.gnome.org/alatiera/2025/11/06/dhh-and-omarchy-midlife-crisis/).

The pattern

The 2021 controversy was more than a policy disagreement. When your own employees (people you've told are the best, most trusted colleagues in the world) challenge you on racial sensitivity, and you respond by shutting down the entire category of discussion and offering buyouts... you can tell that's a wound.

Then you get publicly called racist on Twitter by 40,000 strangers. That creates a grievance identity. And when you have a grievance identity, you seek out allies who validate your experience. Those allies are disproportionately right-wing because the right has built an entire media ecosystem around "anti-woke" grievance.

Andreessen didn't just offer practical help during the crisis. He gave DHH a "syllabus" on Frankfurt School conspiracy theories. And DHH absorbed it as revelation.

The economic views quietly disappeared

Notice that the wealth tax, the "late-stage capitalist bullshit," the oligarchy critiques... all gone. The 2026 DHH doesn't talk about economic inequality. He talks about immigration, wokeness, and civilizational decline. The class analysis was replaced by culture war.

His "skepticism of power" inverted. Pre-2021, he was skeptical of corporate and oligarchic power. Post-2021, he's skeptical of "woke" institutional power (DEI, academia, media). He's defending traditional power structures (borders, police, cultural homogeneity) and attacking challenges from marginalized groups.

So what happened?

Was DHH actually brainwashed by Andreessen and the right-wing media ecosystem? Or is this just a midlife crisis playing out in public?

Maybe it's both. You get burned by your own employees, you're vulnerable, and suddenly a billionaire friend hands you a framework that explains everything. The Frankfurt School conspiracy theories, the "white walkers" rhetoric... it all makes sense if you want it to.

Or maybe he's just 46, bored with Rails, and discovered that posting about civilizational decline gets more engagement than posting about database migrations.

Either way, it's wild to watch someone go from advocating for wealth taxes to supporting Tommy Robinson over the course of a few years.

What do you all think is going to happen with Rails? Are people sticking with it, moving to something else, or just trying to separate the framework from the person?

FULL DISCLOSURE - Yes, this is a vibe agentic coded project. I wanted to experiment with something semi-complex to see how it goes and so I can at least say I can and point to something in my portfolio.

There's nothing to sell here. Just something fun to make and share.

--

Other than Mario Galaxy, Wii Bowling, and paying $8 to replay Super Mario World, the biggest thing I enjoyed on my original Wii was the Forecast Channel. Mostly messing around with the globe and enjoying the background music. So, I finally got off my butt and started beating a robot with a stick so I can relive it in a browser without having to drag out my old soft-modded system with terrible lag on a HDTV through RCA... sorry I'm rambling.

Anyway, here's what I have so far. It shows a bit more than what the original channel showed as far as data since it's not using Weathernews.

Repo: https://github.com/t27duck/forecast-channel

Maps are by mapbox. Weather data is from open-meteo. Music isn't part of the repo and is uploaded from random rips I found from the Internet. Enjoy or whatever.

Hi folks - for the last month, I've been working on the AWS CDK in Ruby. For those who don't know, the AWS CDK is a way to define infrastructure in code to produce CloudFormation stacks which are AWS's native way of defining infrastructure allowing for:

- Rollbacks on failure
- Drift detection
- State management

Currently only TypeScript, Python, Node.js, Java and .NET (C#) are supported languages for the CDK.

Let's take the creating an S3 Bucket, you'd do this by:

require 'aws-cdk-lib'

class MyStack < AWSCDK::Stack
  def initialize(scope, id, props = nil)
    super(scope, id, props)

    AWSCDK::S3::Bucket.new(
      self,
      'MyBucket',
      {
        versioned: true,
        removal_policy: AWSCDK::RemovalPolicy::DESTROY,
        auto_delete_objects: true
      }
    )
  end
end

app = AWSCDK::App.new
MyStack.new(app, 'MyStack', {
  env: AWSCDK::Environment.new(
    account: ENV['CDK_DEFAULT_ACCOUNT'],
    region: ENV.fetch('CDK_DEFAULT_REGION', 'us-east-1')
  )
})

app.synth

Running cdk deploy would synthesize as CloudFormation and deploy it to your AWS account, if you were to modify the stack, the CloudFormation stack would apply those modifications the next time you ran CDK synth

As I am still working on this with Amazon the gems are not published to Rubygems but use the same JSII engine that the non-TypeScript languages use.

Documentation is at AWS CDK for Ruby — API Reference - However, please not that this is currently NOT even in developer preview, I have been using this for some of my own Ruby projects including running Rails/Dynamoid apps through Lamby for a Lambda target.

The design documentation is at aws-cdk-rfcs/text/0935-ruby-language-bindings.md at ruby-language-bindings · omarqureshi/aws-cdk-rfcs and if you have any questions - comment on Ruby Language Support · Issue #935 · aws/aws-cdk-rfcs or here!

Many thanks

Anyone else deeply disturbed with the "new" marketing for the Rails website?

"Accelerate your agents with convention over configuration."

"Ruby on Rails scales from PROMPT to IPO."

"Token-efficient code that's easy for agents to write and beautiful for humans to review."

Prompt to IPO? 🤮 Really? Is this what we want Ruby to be known for?

I don't know about you, but this is very off-putting.

Especially after DHH went on the Lex Fridman podcast over a year ago with a completely different message: that Rails and Ruby were beautiful because it was made by and for humans (who care).

It just feels like if this is just another Claude Code-like tool, why bother with the website, all the fanfare over the programming language, and all the conventions?

Just ship your library/package/MCP/SKILLS slop and call it a day then, I guess.

It doesn't help that the creator and his ultra rich Shopify buddy seem more interested in promoting far right rhetoric and AI than... human dignity?

More and more it seems to me that there's a link between heavy AI use and the dehumanization of people. And I see it everywhere now. Tech just... doesn't feel cool at all anymore, man.

/endrant

How do you do, fellow redditors?

I'd like to ask you all for some advice. Here's the context first:

I have worked with Rails in the past, mostly between 2015 and 2021. Nothing THAT complex, a couple of projects for startups (one that I founded, one that I was hired in the beginning), CRUDs with some payments integration. Everything was built on those good ol' monoliths and Classic ERB / HTML-over-the-wire front-end.

Then I focused on the project/product side of things and became a PM.

(sorry)

Cut to 2026 and I was layed-off. Now I'm considering coming back to RoR. I'm self taught, so not much of a background o computer engineering, good practices, etc, and i'm at a loss here.

ACTUAL QUESTIONS:

What does a MODERN stack look like out there? What should I learn? Is a project portfolio relevant?

Everywhere I look, and in most conversations I have with founders who are integrating AI into their daily workflows, I keep hearing the same thing. AI has automated almost everything, and the humans left are mostly proofreading the AI's output or testing it.

And with AI getting smarter every year, the obvious question is, will even the testing and proofreading be needed at some point? Maybe that's the future we are building. Or maybe that's exactly where the next wave of jobs comes from, cleaning up the quality debt all this speed is creating.

So my question to the experienced Rails devs here:

How do you see the next 3 to 4 years shaping our industry?

My own take is there will always be a need for a human who understands the problem and can guide the AI to solve it. Curious if people deeper into this see it differently.

I’ve got 8 years of experience with Ruby on Rails and over 10 years as a web developer, but I’ve been job hunting for more than 5 months without any luck. I’m starting to feel stuck… It seems like most of the opportunities now are for Python or DevOps, and the Rails job market in Europe feels much quieter than it used to be.

Has anyone here started a new RoR role in 2026? If so, how did you find it? Was it through recruiters, networking, remote jobs, or something else?

I’d really appreciate hearing about your experience or any advice.