Ruby Web Application Security Defense in Depth

on YouTube ↗44m

" summary

Practical controls and measured outcomes: using separate database users limits SQL injection blast radius, deploying chroot + privilege drop and seccomp / pledge reduces post‑exploit abilities, and switching Unicorn to fork+exec (worker_exec) thwarts address‑space discovery. Support was added to unicorn and rack‑unloader to enable these modes; deployment yields three minor environment mismatches in the first four months and no security‑control–related incidents in the subsequent eight, with low ongoing maintenance.

AI-written summary · about

" chapters (11)

1. 0:00Start
2. 4:10Exploitation
3. 4:41Limit Exploit Damage
4. 5:50Admin/Public
5. 18:56autoload
6. 20:45Ruby HACK Development Environments
7. 22:36Testing
8. 25:45Limit Ability to Pivot
9. 31:26Privilege Escalation
10. 35:32minitest
11. 37:35Memory Protections

" related talks

• 36mUsing Ruby In Security Critical ApplicationsTom Macklin · RubyConf 2015
• 31mRails Application Security in PracticeBryan Helmkamp · Ruby Midwest 2013
• 27mLayered SecurityAaron Bedra · WindyCityRails 2016
• 42mSecuring Your Rails AppMike Nicholaides · Wicked Good Ruby 2013
• 32mSecuring Your Rails AppJim Weirich, Matt Yoho · MountainWest RubyConf 2011
• 34mThe World of Rails SecurityJustin Collins · RailsConf 2015
• 31mRails' Insecure DefaultsBryan Helmkamp · RailsConf 2013
• 43mSecuring Your Rails AppJim Weirich, Matt Yoho · Ruby on Ales 2011