Page 1 of 23
On Virtualtrails I check features through a Pundit policy. Views call feature?(:staff_tools), feature?(:secret_site), or feature?(:native_bridge, context: app), and FeaturePolicy has a method that returns true or false. The first version put the whole answer in that method: def staff_tools? user&.admin? end Fine for “admins only”. Then I needed a boolean I could flip without a deploy, and a minimum app...
Last night, I was building a print view for physical sticker tags, which included rendering SVG assets uploaded to ActiveStorage. I ran into a problem I’ve run into a few times before but haven’t written about yet when I added the uploaded SVG into a <img> tag, the browser downloaded the file instead of showing it. When I checked the...
On Virtualtrails, route and journey pages are a sidebar next to a map. On a phone, that used to stack all the copy first, with the map in a rounded square below the fold. I wanted the map full-bleed instead, with the sidebar content in a sheet that peeks up from the bottom. I knew there were some CSS options...
I was wiring a handful of API routes on a Cloudflare Worker and didn’t want a framework for it. I’d usually reach for a regex, or split the pathname and switch on segments. I didn’t know there was a web-standard way to do this, but there is! URLPattern matches parts of a URL with a syntax that looks a lot...
I’ve been overhauling (see: adding) backups for all the stuff I run in Docker at home. I used Backrest, which uses restic, and it’s been a pleasant experience. The trick I found was to mount named Docker volumes in the docker-compose so they can be backed up as regular filesystems, rather than just wholesale backing up Docker volumes without naming...
I wanted ⌘P to open Chrome’s Tab Search to leverage my muscle memory from VS Code. Chrome doesn’t let you rebind its built-in shortcuts — ⌘P is wired to Print, Tab Search is wired to ⌘⇧A, and neither shows up in Chrome’s shortcut settings (chrome://settings/shortcuts). On macOS you can get there with App Shortcuts. You’re not changing Chrome’s internal bindings,...
Note: Using tmux and other more-or-less built for agent multiplexers is a slightly different approach to the one I describe here - I’m talking about using tmux from an agent instead of the agent running shell commands directly. Just saying that upfront to avoid confusion! Coding agents spawn a fresh shell by default. That shell is usually set up slightly...
I’ve written before about passion projects and how taking care of them feels more like tending a garden than running a product. Mowing the lawn and weeding, with the occasional prune. That metaphor still feels right to me, but I’ve started thinking more concretely about what happens when a project reaches the point where I actually use it most days,...
Aotearoa, Again is a Rails app that publishes a daily colourised photo edition and fans it out to email, Instagram, Facebook, YouTube Shorts, and now Bluesky. I wanted those Bluesky posts to pick up the enhanced link cards Bluesky renders for Standard.site documents, instead of a plain Open Graph preview. Standard.site is a set of AT Protocol lexicons for publications...
I patched Virtualtrails for GHSA-xr9x-r78c-5hrm (CVE-2026-66066), the Active Storage arbitrary file read via libvips. The fix has Active Storage call Vips.block_untrusted(true) at boot, which turns off libvips loaders marked “unfuzzed” (unsafe for untrusted content). That includes SVG. On Virtualtrails I render share cards as SVG and convert them to PNG with libvips. After the upgrade, that conversion failed with a...