# Latest reads
> The engineering internet, summarised so you can actually read it.

## Articles

### [Ready for Go 1.27 on Day One](https://yomu.fyi/post/ready-for-go-1-27-on-day-one.md)
- Company: [Jetbrains](https://yomu.fyi/company/jetbrains.md)
- Author: Artem Pronichev
- Published: Aug 20, 2026

GoLand 2026.2 introduces day-one support for Go 1.27 language features, tooling improvements, and profiling capabilities. The Go 1.27 release adds generic methods, promoted field names in struct composite literals, improved function type inference, and a dedicated profile for detecting goroutine leaks. To assist with code maintenance, GoLand integrates official go fix modernizers directly into editor inspections, the Problems tool window, and optional pre-commit checks. Developers can capture, visualize, and analyze goroutine leak profiles alongside existing CPU, memory, and mutex profiles within the IDE. Additionally, updated Modern Go Code Guidelines provide AI coding agents with Go 1.27 context and API changes aligned with the version specified in go.mod.


### [How we knew COVID was over (and what our models had to unlearn)](https://yomu.fyi/post/how-we-knew-covid-was-over-and-what-our-models-had-to-unlearn.md)
- Company: [Airbnb](https://yomu.fyi/company/airbnb.md)
- Author: Harrison Katz
- Published: Aug 19, 2026

Airbnb's forecasting team outlines their framework for managing production models that experience drift or external shocks. Rather than treating model updates as a generic retraining task, they distinguish between refitting with new data, respecifying the underlying model structure, and intentionally holding without changes. This discipline prevents teams from chasing temporary noise, carrying obsolete crisis assumptions, or over-engineering solutions during disruptions.


### [A revisit of remote Spectre attacks on Cloudflare Workers](https://yomu.fyi/post/a-revisit-of-remote-spectre-attacks-on-cloudflare-workers.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Martin Schwarzl
- Published: Aug 19, 2026

Cloudflare reassessed remote Spectre attack feasibility within Cloudflare Workers production workloads to evaluate defenses against modern stabilization techniques. The experimental proof of concept bypassed Dynamic Process Isolation (DyPrIs) by keeping invocations alive using WebSocket traffic, which also diluted hardware performance counter ratios below detection thresholds. By combining branch mistraining, cache line eviction, and speculative type confusion, researchers transiently accessed out-of-bounds memory via raw 64-bit TypedArray backing store pointers. This attack demonstrated cross-tenant data leakage reaching up to 12 bit/s with over 99% accuracy in production. In response, Cloudflare mitigated the vulnerability by integrating the V8 memory sandbox, deploying Memory Protection Keys for hardware-assisted in-process isolation, and redesigning DyPrIs to monitor active long-lived executions.


### [Improving infrastructure efficiency for growing demand in the age of AI](https://yomu.fyi/post/improving-infrastructure-efficiency-for-growing-demand-in-the-age-of-a.md)
- Company: [Dropbox](https://yomu.fyi/company/dropbox.md)
- Author: Ilya Yakovlev
- Published: Aug 18, 2026

Dropbox manages growing infrastructure demands from AI and standard workloads by maximizing the efficiency of its existing data centers rather than just building more capacity. Through a system-level approach spanning software, hardware, and physical facility design, the company dynamically manages power and balances workloads. These optimizations, combined with higher storage density and data-driven hardware lifecycle management, have significantly reduced energy use per unit of storage.


### [BGP Role model: tracking the adoption of RFC 9234](https://yomu.fyi/post/bgp-role-model-tracking-the-adoption-of-rfc-9234.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Bryton Herdes
- Published: Aug 18, 2026

Border Gateway Protocol route leaks occur when routing announcements propagate beyond their intended customer-provider or peer relationships, causing traffic misdirection and performance degradation. RFC 9234 embeds relationship awareness directly into BGP by establishing negotiated BGP Roles and attaching an Only to Customer (OTC) transitive path attribute to prevent unauthorized route propagation. To assess real-world adoption, Cloudflare monitored OTC attribute transmission across peer networks and discovered that 33.1 percent of IPv4 and 17 percent of IPv6 paths were missing the OTC attribute. Investigation revealed that Tier-1 transit providers AS1299 and AS3257 were stripping the attribute due to legacy defensive BGP error-handling configurations. Following direct engagement, AS1299 updated its configurations to preserve OTC propagation, whereas AS3257 continued stripping it, highlighting the necessity of broader vendor and carrier support across the Internet.


### [How to Evaluate Production AI Agents: Measure System Outcomes, Not Conversations](https://yomu.fyi/post/how-to-evaluate-production-ai-agents-measure-system-outcomes-not-conve.md)
- Company: [Salesforce](https://yomu.fyi/company/salesforce.md)
- Author: Scott Nyberg
- Published: Aug 17, 2026

Evaluating AI agents solely on conversational transcripts fails when agents must invoke tools to modify external production systems. Language models can convincingly narrate that an action occurred while completely omitting the underlying tool call, leaving database or billing records unchanged. Outcome-based evaluation addresses this divergence by treating external system mutations rather than generated dialogue as the actual source of truth. Frameworks such as CRMAgentBench implement persistent, stateful environments with strict all-or-nothing validation, verifying tool arguments, execution sequence, final record modifications, and the total absence of unauthorized actions. Furthermore, measuring repeated success across independent executions using pass^k metrics exposes operational variance and inconsistency that standard single-shot scores and pass@k metrics conceal.


### [How Cloudflare detects MCP traffic and helps secure it](https://yomu.fyi/post/how-cloudflare-detects-mcp-traffic-and-helps-secure-it.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: AJ Gerstenhaber
- Published: Aug 14, 2026

Traditional security boundaries assume human speed and judgment, but AI agents execute nondeterministic actions rapidly and can invoke unapproved Model Context Protocol servers through standard HTTPS traffic. To mitigate this shadow traffic, Cloudflare One introduces detection and inspection capabilities across clients, network boundaries, and MCP servers. Cloudflare Gateway leverages protocol-level headers and JSON-RPC inspection to identify direct MCP connections, verify managed paths, and enforce access through approved MCP Server Portals. Furthermore, Cloudflare Agents SDK v0.20.0 implements the stateless 2026-07-28 MCP specification while providing fallback handshakes for legacy servers. Organizations can combine Gateway traffic source rules with server middleware like WriteGuard to block unauthorized tool invocations before execution.


### [Secure all your internal vibe-coded applications — in one click](https://yomu.fyi/post/secure-all-your-internal-vibe-coded-applications-in-one-click.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Chythra Malapati
- Published: Aug 14, 2026

AI-assisted development enables employees to build applications rapidly, but unmanaged deployments can accidentally expose internal company data to the public Internet. Cloudflare introduced direct Cloudflare Access integration for Cloudflare Workers, allowing organizations to enforce authentication policies directly at the account or individual Worker level rather than per hostname. When enabled, incoming requests are authenticated before reaching application code across custom domains, routes, workers.dev subdomains, and preview environments. Developers can access authenticated identity data such as emails and groups directly via the Worker context object without manually validating JSON Web Tokens. This capability was implemented on Cloudflare's Rust-based FL2 proxy, which separated Worker routing from Worker execution so routing runs safely prior to Access policy enforcement.


### [Total eclipse of the Internet: traffic impacts in Iceland, Spain, and Portugal](https://yomu.fyi/post/total-eclipse-of-the-internet-traffic-impacts-in-iceland-spain-and-por.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Sabina Zejnilovic
- Published: Aug 13, 2026

On August 12, a total solar eclipse crossed the North Atlantic and Europe, passing directly over Iceland, northern Spain, and Portugal. Cloudflare Radar analyzed HTTP request volumes in five-minute intervals across affected countries, comparing the data against a baseline derived from the previous three Wednesdays. Traffic reductions aligned closely with peak solar obscuration, with totality regions recording drops between 15% and 30% and specific areas shifting by up to -46.7%. Once the sun reappeared, request volumes rebounded to normal levels within minutes as users resumed device activity. The observed traffic declines were driven by aggregate human behavior rather than network failures.


### [Certificate Transparency Monitoring is now generally available](https://yomu.fyi/post/certificate-transparency-monitoring-is-now-generally-available.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Jenny Yang
- Published: Aug 13, 2026

Cloudflare announced the general availability of Certificate Transparency Monitoring alongside a filtering mechanism to eliminate noisy alert emails. Previously, the monitoring system alerted domain owners for all Certificate Transparency log entries, including routine, automated renewals for Universal SSL, Advanced Certificate Manager, and backup certificates. Because the alerting flow and certificate ordering service operated independently, existing identifiers like TBSCertificate hashes arrived too late to verify pre-certificates. To resolve this race condition, the ordering service now computes an SHA-256 hash of the DER-encoded SubjectPublicKeyInfo structure at key generation. When the alerting service discovers a log entry, it recomputes this hash to verify ownership against the ordering database, suppressing alerts for Cloudflare-managed certificates while preserving alerts for external or unexpected issuances.


### [How Agentforce-Powered AI Security Workflows Accelerate Incident Response](https://yomu.fyi/post/how-agentforce-powered-ai-security-workflows-accelerate-incident-respo.md)
- Company: [Salesforce](https://yomu.fyi/company/salesforce.md)
- Author: Scott Nyberg
- Published: Aug 12, 2026

Salesforce engineers expanded Security Center from a basic conversational interface into an Agentforce-powered stateful investigations platform for incident response. Managing enterprise security incidents required handling long-running lifecycles, disparate telemetry formats, and finite LLM context windows that risk reasoning pocket collapse. To prevent overflowing context limits, the architecture partitions telemetry into contextual segments and uses AI-driven summarization pipelines before feeding data to the agent. Because non-deterministic LLM outputs break traditional deterministic testing, the team implemented AI-driven evaluation pipelines using simulated customer interactions to evaluate response behavior rather than exact wording. Ongoing work focuses on grounding public foundation models with curated, Salesforce-owned security knowledge to improve platform-specific remediation guidance.


### [Flexible Authentication: Reimagining authentication for millions of users at Airbnb](https://yomu.fyi/post/flexible-authentication-reimagining-authentication-for-millions-of-use.md)
- Company: [Airbnb](https://yomu.fyi/company/airbnb.md)
- Author: Jose Santos
- Published: Aug 12, 2026

Airbnb overhauled its login and registration architecture by transitioning to a server-driven framework called Flexible Authentication. The new system separates user identification from verification, using a backend policy engine to dynamically serve the optimal auth challenge and fallback options based on regional and user context. This shift eliminated dead ends, reduced client bundle sizes, and dramatically sped up experimentation velocity across Web, iOS, and Android.


### [How We’re Building Scam Alert on WhatsApp With End-to-End Encryption and Verifiability Guarantees](https://yomu.fyi/post/how-we-re-building-scam-alert-on-whatsapp-with-end-to-end-encryption-a.md)
- Company: [Meta](https://yomu.fyi/company/meta.md)
- Published: Aug 12, 2026

WhatsApp is introducing Scam Alert, an optional feature designed to detect scam messages from non-contacts while preserving end-to-end encryption guarantees. The system executes text classification entirely on-device using a machine learning model trained on conversational patterns from user reports, ensuring raw message content never leaves the client. To evaluate feature accuracy without compromising privacy, the client transmits minimal pre-aggregated telemetry—consisting only of warning and action counts—over Oblivious HTTP relays to Trusted Execution Environments. These confidential virtual machines securely aggregate metrics and apply differential privacy noise before exposing population-level statistics to servers. System integrity and non-targetability are maintained by requiring clients to attest backend binaries against public transparency ledgers before transmitting any telemetry.


### [Grab Bench: Evaluating AI on Grab-shaped production work](https://yomu.fyi/post/grab-bench-evaluating-ai-on-grab-shaped-production-work.md)
- Company: [Grab](https://yomu.fyi/company/grab.md)
- Author: Christian Coffrant
- Published: Aug 12, 2026

AI models evaluated on internal tasks often produce subtly plausible errors, such as altering metric definitions in SQL queries or missing hidden stateful invariants in code patches. To address this, Grab built Grab Bench, a configurable evaluation harness that executes model providers through specialized task plugins. The platform evaluates synthetic or redacted datasets that preserve production constraints across domains like query generation, tool use, passenger-profile reasoning, and agentic coding. By recording granular row-level outputs with deterministic scorers and LLM judges, the harness exposes failure modes rather than relying solely on aggregate leaderboards.


### [Cloudflare DDoS Threat Report H1 2026: 1 Tbps attacks soar as DNS floods and geopolitical tensions drive a new wave](https://yomu.fyi/post/cloudflare-ddos-threat-report-h1-2026-1-tbps-attacks-soar-as-dns-flood.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Cloudforce One
- Published: Aug 11, 2026

In the first half of 2026, network-layer DDoS attacks exceeding 1 Tbps surged by 519% quarter-over-quarter, with 935 mitigated attacks recorded across the period. Threat actors shifted their focus toward reflection and amplification methods, making DNS-based floods and CLDAP floods the dominant vectors. Despite the rise in hyper-volumetric traffic, 96.62% of network-layer attacks remained under 500 Mbps and 90.60% ended in under 10 minutes. Geopolitical conflicts and international events heavily influenced target selection, pushing the Media, Production & Publishing industry to the top position. Because brief multi-gigabit bursts trigger downstream routing instability and application timeouts before analysts can respond, automated, always-on edge mitigation has become critical.


### [How Standardizing Product Telemetry Reduced Time to Insight by 97%](https://yomu.fyi/post/how-standardizing-product-telemetry-reduced-time-to-insight-by-97.md)
- Company: [Salesforce](https://yomu.fyi/company/salesforce.md)
- Author: Scott Nyberg
- Published: Aug 11, 2026

Salesforce faced scaling bottlenecks when individual engineering teams maintained fragmented, custom telemetry pipelines requiring manual data transformations and dashboard creation every release. To resolve these silos, the engineering organization established the Product Data Platform (PDP) using a standardized custom schema built atop Monitoring Cloud infrastructure. This framework mandates core telemetry fields for consistent metric generation while offering governed optional attributes for product-specific flexibility. An AI-driven Model Context Protocol tool assists developers by recommending compliant instrumentation patterns directly within their workflows. Today, the unified platform processes 45 billion rows of data daily across 19,000 distinct events and 2,000 product features, reducing dashboard refresh latency by 97 percent from one month to daily updates.


### [Using the GitHub Copilot SDK for Java](https://yomu.fyi/post/using-the-github-copilot-sdk-for-java.md)
- Company: [Github](https://yomu.fyi/company/github.md)
- Author: Edward Burns
- Published: Aug 10, 2026

The GitHub Copilot SDK for Java offers a framework-agnostic client library to orchestrate AI agent sessions and tool execution directly from server-side Java code. Unlike framework-dependent alternatives, the SDK supports direct model providers such as OpenAI, Azure, and Anthropic through custom endpoint configurations without requiring a Copilot subscription. Developers can register tools declaratively using the experimental @CopilotTool annotation processor or dynamically through inline lambda definitions with ToolDefinition.from. When integrated into a Jakarta EE 11 application on Open Liberty, agent workflows run on container-managed virtual threads that propagate CDI and transaction contexts during blocking calls like sendAndWait. Real-time event subscriptions capture model execution steps and tool invocations to stream updates over WebSockets without exhausting platform threads.


### [Everything we launched during Agents Week](https://yomu.fyi/post/everything-we-launched-during-agents-week.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Shelley Jones
- Published: Aug 10, 2026

Agents Week introduced a series of products and primitives across Cloudflare to support an Agentic Internet where autonomous software and humans interact. Developing capable agents requires addressing technical challenges spanning identity, communication, orchestration, memory, observability, and security. Cloudflare introduced the Agent Development Lifecycle alongside tools like Cloudflare Agents for live tracing, replay, and human-in-the-loop approvals. The releases also included programmable CI/CD pipelines capable of repairing failures, Cloudflare Wallets for agent transactions, and Kitesurf, an agent-first browser running in V8 isolates. New protocols and tools like WebMCP, MCPv2, and Cloudflare AI Search aim to make web data and applications readable, discoverable, and searchable by autonomous software.


### [How and Why Netflix Built a Real-Time Distributed Graph: Part 3 — Querying the graph with gRPC…](https://yomu.fyi/post/how-and-why-netflix-built-a-real-time-distributed-graph-part-3-queryin.md)
- Company: [Netflix](https://yomu.fyi/company/netflix.md)
- Author: Netflix Technology Blog
- Published: Aug 7, 2026

Netflix designed a query execution serving layer for its Real-Time Distributed Graph to power sub-100ms responses across diverse graph traversal workloads spanning billions of nodes and edges. To prevent compounding network delays in multi-hop queries, the engine uses a breadth-first traversal model that batches entity lookups across entire frontier levels rather than tracing paths depth-first. The entire serving architecture relies on asynchronous composition across small thread pools of 16 to 24 threads, ensuring no thread blocks while waiting on remote storage or enrichment I/O. Selective caching via EVCache targets stable properties with volatility-matched TTLs, producing 70 to 80 percent cache hit rates and reducing backend storage calls by three to four times. A layered filtering hierarchy pushes depth and edge limits directly to the storage tier, eliminating bespoke code changes while isolating system resources against excessive fan-out.


### [Unveiling good and bad behaviors on the Agentic Internet](https://yomu.fyi/post/unveiling-good-and-bad-behaviors-on-the-agentic-internet.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Jin-Hee Lee
- Published: Aug 7, 2026

Web traffic increasingly shifts between human interaction and automated agents, rendering point-in-time security checks ineffective against sophisticated automation. Cloudflare addresses this shift through continuous behavioral analysis designed to evaluate trust across entire user sessions rather than relying on static point-in-time hurdles. Its CDN-injected client-side system, Precursor, tracks continuous behavioral indicators like cursor movements to catch mid-session automated takeovers. To counter rapid bot adaptation, Cloudflare is introducing self-adjusting machine learning models under Adaptive Intelligence and non-deterministic defenses such as the AI Labyrinth. These tools allow site owners to poison scraper training data, trap crawlers in synthetic webs, or queue legitimate agents while dynamically penalizing abusive traffic.


[Newer posts](https://yomu.fyi/index.md) · [Older posts](https://yomu.fyi/page/3.md)