{"slug": "ruby-landlock", "name": "ruby-landlock", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 2, "commenters": 2, "warners": 0, "score": 1.946, "rising": 2.0, "first": "2026-09-18", "latest": "2026-09-18", "why": "highly recommend all Rubyists out there consider this", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 2, "neutral": 0, "compare": 0, "warn": 0}, "spark": [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0], "listed": false, "loved": [], "caveat": "", "short_quote": "highly recommend all Rubyists out there consider this", "icon": false, "domain": null, "github_repo": "github.com/discourse/ruby-landlock", "official_url": "https://github.com/discourse/ruby-landlock", "pricing": "", "aliases": ["ruby-landlock"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 796029632, "item_id": 49751852, "url": "https://news.ycombinator.com/item?id=49751852", "by": "kawsper", "date": "2026-09-18", "stance": "recommend", "quote": "I use ruby-landlock as well for image processing.", "excerpt": "I use ruby-landlock as well for image processing. I can recommend setting VIPS_BLOCK_UNTRUSTED=1 when you switch to vips, it blocks untrusted image decoders. Not setting that value caught the rails team off guard just recently, maybe it should be the default.", "context": "Ruby developer", "use_case": "sandboxing image processing", "switched_from": "", "story": "A heap overflow and SSO misconfiguration to compromise OpenAI internal repos"}, {"id": 796009632, "item_id": 49750602, "url": "https://news.ycombinator.com/item?id=49750602", "by": "sams99", "date": "2026-09-18", "stance": "recommend", "quote": "highly recommend all Rubyists out there consider this", "excerpt": "Update on the Discourse side, we now run all external binaries, including magick via a landlock sandbox. The gem we use is here: https://github.com/discourse/ruby-landlock highly recommend all Rubyists out there consider this. We are also in the process of moving away from Magick to Vips (which also runs in a sandbox, not in process) HEIF is patched, but I doubt this is the last buffer overflow in HEIF, I will not be", "context": "Discourse developer", "use_case": "sandbox external binaries", "switched_from": "", "story": "A heap overflow and SSO misconfiguration to compromise OpenAI internal repos"}]}], "caveats": [], "who": [{"by": "kawsper", "context": "Ruby developer", "url": "https://news.ycombinator.com/item?id=49751852", "date": "2026-09-18"}, {"by": "sams99", "context": "Discourse developer", "url": "https://news.ycombinator.com/item?id=49750602", "date": "2026-09-18"}], "tags": [], "use_cases": ["sandboxing image processing", "sandbox external binaries"], "compared": [{"slug": "libvips", "name": "libvips", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "imagemagick", "name": "ImageMagick", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=49749656", "title": "A heap overflow and SSO misconfiguration to compromise OpenAI internal repos", "mentions": 2}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {}, "2026-02": {}, "2026-03": {}, "2026-04": {}, "2026-05": {}, "2026-06": {}, "2026-07": {}, "2026-08": {}, "2026-09": {"recommend": 2}, "2026-10": {}}, "quotes": [{"id": 796029632, "item_id": 49751852, "url": "https://news.ycombinator.com/item?id=49751852", "by": "kawsper", "date": "2026-09-18", "stance": "recommend", "quote": "I use ruby-landlock as well for image processing.", "excerpt": "I use ruby-landlock as well for image processing. I can recommend setting VIPS_BLOCK_UNTRUSTED=1 when you switch to vips, it blocks untrusted image decoders. Not setting that value caught the rails team off guard just recently, maybe it should be the default.", "context": "Ruby developer", "use_case": "sandboxing image processing", "switched_from": "", "story": "A heap overflow and SSO misconfiguration to compromise OpenAI internal repos"}, {"id": 796009632, "item_id": 49750602, "url": "https://news.ycombinator.com/item?id=49750602", "by": "sams99", "date": "2026-09-18", "stance": "recommend", "quote": "highly recommend all Rubyists out there consider this", "excerpt": "Update on the Discourse side, we now run all external binaries, including magick via a landlock sandbox. The gem we use is here: https://github.com/discourse/ruby-landlock highly recommend all Rubyists out there consider this. We are also in the process of moving away from Magick to Vips (which also runs in a sandbox, not in process) HEIF is patched, but I doubt this is the last buffer overflow in HEIF, I will not be", "context": "Discourse developer", "use_case": "sandbox external binaries", "switched_from": "", "story": "A heap overflow and SSO misconfiguration to compromise OpenAI internal repos"}]}