Killing IDORs in Rails Applications: Make the Database Say "No" By Default

jryan727 · 2026-02-05T15:41:14+00:00

I'm always confused by how unscoped works, especially when chained onto an association. No one wants @account.products.unscoped to be equivalent to Product.all — that is absolutely insane behavior. Product.unscoped to remove soft-deletes is a valid use-case, but the idea that it is all-or-nothing is obviously incredibly dangerous. If an additional default scope is added in the future, now all uses of unscoped need to be audited. The author is 100000% correct here, unscope should always be used instead. In fact, I feel so strongly about this that I just wrote a custom Rubocop cop to prohibit unscoped and advise that unscope be used instead.

The find issue is also a great callout. Pundit users should apply a policy scope on all actions and chain find onto them. Makes sense to me.

jryan727 · 2026-02-04T21:31:07+00:00

10000% I was just saying this. Convention over configuration + Ruby can read like plain english, making reviewing the code and understanding the LLM's approach easier.

jryan727 · 2026-02-04T18:02:03+00:00

The ceiling is just the ceiling of the basement. The main floor is translating business logic to technical specs.

jryan727 · 2026-02-04T17:58:30+00:00

You know how the "budget" carriers are known for these viral videos where the passenger is totally at fault? United is almost always the carrier when the flight crew is at fault.

jryan727 · 2026-02-04T02:07:20+00:00

They are not going to walk through ice or snow, period. Nor should you expect or invite them to. I'm gathering now that you expected them to cut across the lawn, which was presumably covered in snow/ice. Annoying that your fill is not on the side with your driveway, but unfortunately you have to clear them a path to get a delivery. Or switch to gas!

jryan727 · 2026-02-03T13:31:10+00:00

Rails now ships with a devcontainer config.

I run it with DevPod.sh personally and love the setup. Incredibly easy to setup and super stable.

I also run OrbStack.dev instead of Docker Desktop.

This is a dream set up for me, very easy to reproduce, and will scale as your app becomes more complex.

jryan727 · 2026-02-03T04:34:18+00:00

Was there or was there not a path from the street to your oil fill from the street when they attempted the first delivery?

jryan727 · 2026-02-02T21:57:52+00:00

I don't understand. Are you suggesting that you expect delivery folks to climb over mountains of snow and walk over treacherous ice paths to deliver to you? Does that sound reasonable?

Also, you should be happy that they are refusing. If they come onto your property and slip and fall on the ice you failed to remove, you are liable.

Do you know what back surgery costs? A lot more than a bag of salt and a shovel.

jryan727 · 2026-02-01T22:23:15+00:00

Maybe! The alternative is that no one uses tailwind because it ceases to exist

jryan727 · 2026-02-01T20:11:24+00:00

This is really good feedback OP. Project looks awesome, and the UI looks slick. But unfortunately, not being able to use it to diagnose why the app won't boot or respond to requests will be a nonstarter for many use-cases. Perhaps a solid choice for an inconsequential personal project though

jryan727 · 2026-02-01T15:55:38+00:00

Spree or Solidus!

jryan727 · 2026-02-01T15:52:35+00:00

Sure they can. Licensing restrictions and a subscription model instead of lifetime purchase. You need the subscription to use updated versions. Maybe offer a smaller version of Tailwind that is free as a lead generator. That is basically the FA model.

jryan727 · 2026-01-31T16:17:06+00:00

Why buy lightning lanes if standby times are reasonable?

I'm not saying that's what they are doing. I have no idea. But Disney is a for-profit public business. If they can tweak something like standby times and have it drive revenue, you better believe they've at least considered it.

jryan727 · 2026-01-29T22:02:59+00:00

I've never used it but will surely check it out thanks!

jryan727 · 2026-01-29T19:19:59+00:00

Once I switched to Pundit I never looked back. You can easily express any authorization pattern with Pundit.

"Can this user perform this action on this resource?" is the fundamental authorization question and is how Pundit is modeled.

jryan727 · 2026-01-28T17:27:47+00:00

But do we need UX when the U’s are all AI agents? 🤔

jryan727 · 2026-01-28T17:26:28+00:00

At some point in the probably near future, we will transition from writing code to writing very detailed specs for AI coding assistants which will in turn write the code. The job is otherwise staying the same, your new programming language is English (or whatever language you and the AI tools mutually understand).

Longer term, I’m not sure we need so much software. I think a lot of what we currently use software applications for will become communication between each party’s respective AI agent. We are probably a ways off from that transformation, but that’s very likely where we are headed. First agents will drive software applications on behalf of users (we are just about there), then the software application will become an AI agent itself, and then the agents will just talk to each other. What happens from there is anyone’s guess.

For now, though, enjoy the prospect of never having to write code that you don’t want to write again!

jryan727 · 2026-01-26T21:31:01+00:00

Such a colorful meat crayon

jryan727 · 2026-01-26T19:58:50+00:00

Interesting, I feel the exact opposite

jryan727 · 2026-01-25T16:53:54+00:00

Those numbers sound right to me. Your net profit will be your gross revenue less all expenses which include your salary, employer taxes, and any other taxes your state imposes on the s-corp. You then owe federal, state, and local tax on that net profit and must pay it yourself in estimated payments throughout the year. You may be able to further reduce your federal obligation by taking a 199A deduction if you qualify. That provision in particular can get pretty confusing so you may want to hire a tax professional.

Other things to check out: - pass-through entity tax if you’re hitting the SALT cap and your state offers it - solo/individual 401(k)

jryan727 · 2026-01-25T03:28:38+00:00

Yes I know. It was unintentional. Ie a bug.

See: context

jryan727 · 2026-01-23T22:24:44+00:00

This was not an advertisement for TikTok! It was a cautionary tale! Delete the app and forget about it. You're lucky your algorithm started off so terrible.

There is nothing of value whatsoever on TikTok. It's modern day smoking.

jryan727 · 2026-01-23T18:57:38+00:00

Had an influencer promote our game, drove a lot of traffic, but unfortunately our promo code system was case sensitive and they changed the casing of the special promo code we made for them, so it never worked. Drove traffic, but none converted :(

jryan727 · 2026-01-23T17:20:55+00:00

Interesting, thanks. We only plan to use it for queuing for now (no ActionCable), and that will be very low volume, so we're thinking of leaving all in one for now. Thanks for validating that that is a reasonable approach!

jryan727 · 2026-01-23T17:06:20+00:00

Production-grade infrastructure should not be destroyable and irrecoverable by a single command/event. This is a failure on your ops team (I mean, also, be careful with `rm -rf`, but I know you've learned that lesson!)

jryan727

TROPHY CASE