Making it on your own and the pitfalls of gem dependencies
summary
Claim: blindly adding gems brings surprises — an average Gemfile.lock lists 118 gems on average ±58, and roughly four gems per lock have known security issues. Tools and failures named: Sprockets has history of file disclosure, Active Record had SQL injection, Bundler once arbitrarily installs gems (patched in 1.7.0), Redcarpet/sidekiq/therubyracer show memory leaks. An attempted API using Grape forces turned off strong params and wastes days, so writing a simple in-app API ends up working better.
AI-written summary · about
chapters (29)
- 0:00Introduction
- 1:27Nikki Murray
- 1:54Labor Voices
- 2:39Overview
- 3:07Assessment
- 6:42Defining your problem
- 8:07Why use gems
- 8:51Misuse of gems
- 10:09Why can this happen
- 11:21Security risks
- 13:15Memory leaks
- 13:52Claustrophobia
- 15:12Gem Assessment
- 16:18Contribution Process
- 17:40Code of Conduct
- 18:02Contributing
- 18:55Assess
- 19:22Its okay
- 19:43Needs Assessment
- 22:00Build
- 23:06Consider
- 24:27Habits of Highly Effective Gems
- 25:45Maintenance
- 27:44Not a gem maintainer
- 28:12You are not the maintainer
- 28:40Questions
- 28:53Frequent misuse
- 29:29Using APIs
- 31:54Scanning for vulnerabilities
