I use ruby-landlock as well for image processing. I can recommend setting VIPS_BLOCK_UNTRUSTED=1 when you switch to vips, it blocks untrusted image decoders.
Not setting that value caught the rails team off guard just recently, maybe it should be the default.
They can just add an http header that browsers and browser plugins can listen for, they already add `cf-cache-status: HIT`, so they could add this too:
cf-http-endpoint: 1
or if you want it to match their own terminology[0], it could be:
I think to an American, a roundabout is this thing that only works for cars and don't take pedestrians or bicyclists into account, with no paths or crosswalks or anything, so hence "Worse for pedestrians". I don't blame them, both roundabouts and care for pedestrians seems uncommon over there, so of course their experience will point towards roundabouts being worse overall.
I will say 2 lanes roundabouts as a cyclist are a little intimidating when you need to take the inside lane. Drivers are not looking for cyclists the way they look for cars or will rush to get ahead of you or just try to bully you out of the way by entering the roundabout across you illegally and daring you to take the right of way. At particularly busy examples I will dismount and take the pedestrian crossing.
Junctions have their own problems though: Usually drivers will not permit a cyclist to merge in front of them while traffic is not stopped, which means if the stream of traffic is continuous you need to plan your lane change when traffic is stopped by lights.
As a pedestrian, roundabouts with islands (aka all roundabouts here) are vastly superior.
(UK experience) If you're trying to cross the road leading onto one, it's much harder to tell if a vehicle is going to hit you at speed. I often observe people turning quickly, without indicating, and had I chosen to cross at that time, there would have been some kind of accident. Junctions tend to not have this problem since cars turning out of them are usually going much slower.
Correct, which is how the ActiveStorage gem was patched. After this, Rails raises a Vips::Error: VipsForeignLoad exception on an attempted variant render of a malicious file. I plan on writing a technical detail post soon with some more code level details and "indicators of compromise" but this one was getting long. This is more for management to understand why wait to patch is a major issue. The discovery to active exploit attempt timeline is the story here.
Not setting that value caught the rails team off guard just recently, maybe it should be the default.
reply