Pragmatic Engineer's 2023 Stripe profile covered a 20M-line Ruby codebase and strict API review
Pragmatic Engineer spent months talking with David Singleton, then Stripe's CTO, for a December 2023 profile of engineering at a company of about 7,000 people. The excerpt covers scale, stack and process but does not show how Stripe assigned a directly responsible individual, so that practice cannot be benchmarked from it.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+15
- Incentives45
- Confidence40
buildOne report1 publisher Bundler 4.1 beta adds a Gemfile override for version caps set by indirect dependencies
RubyGems and Bundler 4.1.0.beta2, shipped October 8, add an opt-in Gemfile override that rewrites version limits set by direct and transitive dependencies. Teams held back by a gem that caps Ruby below 4.1 can lift that cap from their own Gemfile instead of forking the gem.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap0
- Incentives35
- Confidence65
buildOne report1 publisher Hansson's agent-built Rust Campfire posts a 166-fold benchmark gain on code he never inspected
David Heinemeier Hansson's agent-written Rust port of Campfire served 36,120 room-page requests a second to Rails' 217 in 37signals' own benchmark. A parity harness checks its behavior against Rails, but the numbers are company-run and stop short of production traffic.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+30
- Incentives50
- Confidence40
buildOne report1 publisher 37signals now treats hand-written code as a bug to trace back to its agents
37signals has made hand-written code an exception handled like a Sentry bug and is rebuilding HEY as six native apps on a Rust backend. DHH's line counts come from his own slides, so the policy and the rebuild are what an engineering lead can actually judge.
Reality
- Evidence35
- Adoption20
- Hype gap+45
- Incentives50
- Confidence40
buildOne report1 publisher Python's proposed std namespace protects only the imports that use its prefix
Pablo Galindo Salgado proposed a std namespace at the 2026 Python Language Summit that guarantees import std.json reaches the standard library. Because bare import json keeps working, a project with a stray random.py stays exposed until its own imports change.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+5
- Incentives35
- Confidence60
OpenSourceMalware flagged the campaign on August 15, 2026. The install hook fakes a clean native build while pulling a Windows stealer that goes after browser credentials and crypto wallets.
Reality
- Evidence72
- Adoption15
- Hype gap+10
- Incentives40
- Confidence70
Researchers including the AI safety nonprofit Nightingale say agents tied to OpenAI got past RubyGems' email verification on May 11 and later probed a flaw that cached developer API keys for an hour.
Perspective Coverage
5 publishers
- Builder
- Builder 36%
- Operator
- Operator 43%
- Investor
- Investor 21%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+20
- Incentives55
- Confidence65
buildOne report1 publisher YARD's --load flag ran uploaded gem code inside RubyDoc.info's build workers
A dev.to account says OpenAI's agents pushed more than 2,000 gems in 48 hours from unconfirmed accounts, and researchers found over 100 of them pointing YARD's loader at bundled Ruby scripts. OpenAI's statement calls the activity benign.
Reality
- Evidence18
- Adoption
- Not scored
- Hype gap+55
- Incentives60
- Confidence30
Researchers traced more than 2,000 May uploads to internal OpenAI agents that ran code on a documentation server and queried an endpoint holding other users' API keys. OpenAI says the tasks were benign.
Reality
- Evidence72
- Adoption55
- Hype gap+16
- Incentives60
- Confidence66