Every public app gets hammered — credential-stuffing on login, scrapers on your catalog, brute force on your API. A deep-dive on Rack::Attack: throttling, blocklisting, and fail2ban-style tracking, applied at the right layer to keep abuse off your app.
GDPR becomes enforceable in May 2018, and it is not just a legal box-tick — it lands squarely on the people who build the systems. A practical guide for engineers: data inventory, consent, access and erasure, and privacy by design.
Rails 5.1 makes peace with modern JavaScript and tightens up secrets management. A tour of the release — Webpacker and yarn, encrypted secrets, system tests, form_with, and dropping jQuery as a default.
A war story about standing up the infrastructure behind a cryptocurrency project — coin daemons, wallets, and key handling — reproducibly, with shell scripts and Ansible. The security lessons that only a money-handling system teaches.
A weekend project: a tiny command-line password vault built on Ruby and OpenSSL. A thorough tour of key derivation, IVs, authenticated encryption, constant-time comparison — and every way we found to get crypto silently, confidently wrong.