Things I've written down.
Ruby, Rails, performance, security and applied machine learning. Updated when something feels finished.
Where SQL injection still lives in Rails
Active Record parameterises almost everything. The gaps are specific, well known, and exactly where people write raw fragments.
Your model didn't degrade, the world did
Model weights are frozen the day you deploy. Everything they were fitted to keeps moving, and nothing tells you unless you look.
Time zones: store UTC, and know which "now" you called
Most time-zone bugs come from two nearly identical methods and one place where dates are not really times.
Rate limiting the endpoints that actually get abused
Blanket limits annoy real users and barely inconvenience attackers. The endpoints worth protecting are a short, specific list.
The tests worth writing
Coverage measures which lines ran, not whether anything is verified. What actually catches regressions is narrower and cheaper than a coverage target.
One task running for an hour while 199 sit idle
Skew is the most common reason a Spark job is slow, and it looks exactly like a job that is nearly finished.
YJIT is free performance, until you read the memory graph
15–30% faster for a flag you probably already have on. What it costs per worker, and the one case where you should turn it down rather than off.
Processing a million rows without loading a million rows
`map` builds an array. On a large collection that array is the problem, and the fix is usually one method name.
The model was fine. The features were different.
A model that scores well offline and poorly in production usually isn't seeing the same inputs it was trained on.