---
title: "Latest reads"
description: "The engineering internet, summarised so you can actually read it."
---

# Latest reads
> The engineering internet, summarised so you can actually read it.

## Articles

### [How the Tinder iOS App reduced the size of our localizations by 95% using Emerge](https://yomu.fyi/post/how-the-tinder-ios-app-reduced-the-size-of-our-localizations-by-95-usi.md)
- Company: [Tinder](https://yomu.fyi/company/tinder.md)
- Author: Tinder
- Published: Feb 26, 2025

Supporting over 50 languages across numerous statically linked targets led to a substantial build size footprint in Tinder's iOS application. Because Apple's code signing mandates a minimum 4KB per file, shipping dozens of localized files per target inflated the final application package. Tinder addressed this by stripping comments and whitespace, merging localized strings into a single file per language via custom Bazel rules and Aspects, and compressing the strings using Emerge's SmallStrings tool into LZFSE files. The runtime decompresses these files dynamically through existing code-generated string accessors. Consequently, Tinder reduced download size by 10.7MB and install size by 51.3MB with no impact on developer workflows.


### [Behind the scenes of Canva's DesignDNA campaign](https://yomu.fyi/post/behind-the-scenes-of-canva-s-designdna-campaign.md)
- Company: [Canva](https://yomu.fyi/company/canva.md)
- Author: Divya Patel
- Published: Feb 24, 2025

Canva launched DesignDNA in December 2024 as a personalized year-in-review campaign to highlight user achievements and showcase generative AI capabilities. Because internal privacy rules strictly prohibited inspecting personal designs, the engineering and creative teams inferred user preferences from the style and theme metadata tags on public templates. An initial keyword-matching algorithm paired 95% of users with one of seven emerging design trends, while generative AI keyword expansion increased coverage to 99%. The team also synthesized over one million localized poems and distinct design personalities using tools like Magic Write and Dream Lab. Finally, dynamic Canva template elements populated through URL parameters assembled 95 million distinct multi-page stories across nine locales.


### [Securing Stripe API Keys in AWS with automatic rotation](https://yomu.fyi/post/securing-stripe-api-keys-in-aws-with-automatic-rotation.md)
- Company: [Stripe](https://yomu.fyi/company/stripe.md)
- Author: James Beswick
- Published: Feb 21, 2025

The article presents a production-grade approach to securing Stripe API keys in AWS, motivated by the risks and operational limits of basic secret storage for payment processing. It compares AWS Parameter Store with Secrets Manager, emphasizing built-in rotation, CloudTrail audit trails, IAM integration, larger secrets, and cross-account access despite higher cost. The implementation uses environment-specific secret paths, tags, and IAM conditions to isolate development, staging, and production credentials, with separate rotation schedules. For zero-downtime rotation, applications refresh cached credentials after authentication failures while both old and new keys remain valid during a transition. The design also covers CloudWatch monitoring, emergency rotation procedures, cross-region replication, region-specific schedules, and cost considerations, concluding that ongoing review is necessary for secure and reliable payment operations.


### [Grab AI Gateway: Connecting Grabbers to multiple GenAI providers](https://yomu.fyi/post/grab-ai-gateway-connecting-grabbers-to-multiple-genai-providers.md)
- Company: [Grab](https://yomu.fyi/company/grab.md)
- Author: Bjorn Jee
- Published: Feb 19, 2025

Grab built the AI Gateway to centralize access, cost control, and security across external and open-source Generative AI providers such as OpenAI, Azure, AWS, and Google. Designed as a set of lightweight reverse proxies, the gateway manages authentication, rate limiting, and authorization while translating payloads into a unified OpenAI-compatible interface. The platform archives request metadata and calculated per-call costs into a central data lake for auditing and showback, dynamically routing traffic across shared reserved capacity and regions to mitigate quota throttling. Supporting over 300 internal use cases, the system integrates directly with internal development notebooks and deployment tools to power applications ranging from real-time audio safety analysis to automated content moderation.


### [Tracking customer spend in an omnichannel or multiprocessor environment](https://yomu.fyi/post/tracking-customer-spend-in-an-omnichannel-or-multiprocessor-environmen.md)
- Company: [Stripe](https://yomu.fyi/company/stripe.md)
- Author: Andrew Robinson
- Published: Feb 19, 2025

Merchants operating across websites, mobile apps, physical stores, and multiple payment processors struggle to connect spending because customers use physical cards, digital wallets, and tokenized methods. Payment Account Reference (PAR), a 29-character alphanumeric identifier introduced by EMVCo, provides a non-financial, non-reversible reference that maps one PAN to multiple tokens without exposing sensitive payment data. Because the PAR is independent of payment method and processor, merchants can link transactions across channels and preserve continuity when a card is replaced with a new PAN. The post presents an omnichannel retail example and describes potential benefits including unified customer profiles, personalization, cross-channel reconciliation, reduced PAN-related PCI burden, and processor flexibility.


### [Building rock-solid Stripe integrations: A developer's guide to success](https://yomu.fyi/post/building-rock-solid-stripe-integrations-a-developer-s-guide-to-success.md)
- Company: [Stripe](https://yomu.fyi/company/stripe.md)
- Author: James Beswick
- Published: Feb 6, 2025

The guide presents ten practices for building production-ready Stripe integrations, covering payment forms, subscriptions, and operational concerns. It recommends verifying webhook signatures with the Stripe-Signature header and endpoint secret, recording event IDs for idempotency, and returning a fast 2xx response while processing asynchronously. Test and live API keys, webhook endpoints, logs, and monitoring should remain separate, while error handling should distinguish card, request, and API failures and use exponential backoff for retries. The guide also recommends testing successful, declined, insufficient-funds, and 3DS scenarios with Stripe test cards, alongside simulated webhook events. Its conclusion emphasizes edge-case planning, logging, monitoring, and ongoing review as foundations for reliable, secure payment processing that can scale with business needs.


### [AI Core Team Lead Mike Schuster on How to Get the Most From LLMs](https://yomu.fyi/post/ai-core-team-lead-mike-schuster-on-how-to-get-the-most-from-llms.md)
- Company: [Two Sigma](https://yomu.fyi/company/two-sigma.md)
- Author: Joy Looney
- Published: Feb 4, 2025

Mike Schuster, Head of the AI Core Team at Two Sigma, advocates for grounding large language model adoption in practical tasks rather than speculative industry hype. Realistic enterprise applications focus on accelerating data processing, running faster experiments, and extracting domain-specific features from transcripts such as earnings calls and Federal Reserve speeches via prompt engineering. Because financial data faces inherent volume limits across trading days, successful deployments require multidisciplinary human teams to balance rapid technical experimentation with rigorous domain expertise and analytical reasoning. Schuster also dismisses predictions that programming will become obsolete, comparing coding to learning a musical instrument that cultivates structured thinking, problem decomposition, and scientific common sense essential for building complex predictive models.


### [Building resilient webhook handlers in AWS: Implementing DLQs for Stripe events](https://yomu.fyi/post/building-resilient-webhook-handlers-in-aws-implementing-dlqs-for-strip.md)
- Company: [Stripe](https://yomu.fyi/company/stripe.md)
- Author: James Beswick
- Published: Jan 30, 2025

Reliable Stripe webhook processing must account for lost deliveries from network or service outages, out-of-order events, and duplicates caused by Stripe retries. The proposed AWS architecture uses API Gateway for signature validation and throttling, an SQS FIFO queue for ordered delivery and content-based deduplication, Lambda for processing, DynamoDB for event-ID idempotency, and an SQS DLQ for failed messages. In the CloudFormation example, the main queue has a 300-second visibility timeout and sends messages to the FIFO DLQ after three receives; DynamoDB records expire through a seven-day TTL. Lambda retries failures with exponential backoff, while CloudWatch monitors queue depth, latency, and errors. The design is presented as a scalable foundation, with multi-region failover available at added cost and complexity, though single-region deployment may suffice for many applications.


### [Sharing Tinder’s latest contributions to the open source community](https://yomu.fyi/post/sharing-tinder-s-latest-contributions-to-the-open-source-community.md)
- Company: [Tinder](https://yomu.fyi/company/tinder.md)
- Author: Tinder
- Published: Jan 29, 2025

Tinder open-sourced several iOS development repositories, including Layout, Nodes Architecture Framework, and CombineUI, to share the engineering patterns supporting its iPhone application. As the app expanded across diverse device profiles and scale, engineering teams faced reliability, consistency, and memory challenges under their legacy architecture. In response, Tinder developed Nodes, a plugin-based architecture framework using compile-time dependency injection and lifecycle hooks that enforce complete memory release upon feature dismissal. For interface construction, Tinder created Layout, a domain-specific Auto Layout wrapper offering declarative syntax for UIKit views to eliminate storyboard merge conflicts while preserving native capabilities. The resulting stack enables isolated testing of business logic, native reactive event binding, and incremental adoption of SwiftUI across the codebase.


### [New to Stripe? Learn the key concepts for software developers.](https://yomu.fyi/post/new-to-stripe-learn-the-key-concepts-for-software-developers.md)
- Company: [Stripe](https://yomu.fyi/company/stripe.md)
- Author: James Beswick
- Published: Jan 29, 2025

The guide introduces software developers to Stripe’s main objects and workflows for integrating payments, recurring billing, and related account activity. It begins with Payment Intents, which specify an amount and currency, track a payment’s lifecycle, and produce a client secret for completing the frontend flow, then covers Payment Methods and Customers, including Setup Intents and attaching a default payment method. For subscriptions, it distinguishes Products, Prices, and Subscriptions, and explains using events and webhooks to react to asynchronous payment and subscription changes while verifying webhook signatures. It also describes Disputes, refunds, and expanded API responses, including retrieving related resources in one call. The guide recommends starting in test mode and using dashboard logs while consulting Stripe’s documentation and changelog as the platform evolves.


### [Image replacement in Canva designs using reverse image search](https://yomu.fyi/post/image-replacement-in-canva-designs-using-reverse-image-search.md)
- Company: [Canva](https://yomu.fyi/company/canva.md)
- Author: Sam Jacobs
- Published: Jan 28, 2025

Canva needed an automated way to replace media in design templates, such as when third-party licensing partnerships expire across more than 150 million images. Existing recommendation engines, perceptual hashing, and text metadata searches failed to capture visual similarity hierarchies or ensure replacement relevance. To build a reverse image search system, engineers evaluated embedding models including CLIP, ViTMAE, DreamSim, CaiT, and DINOv2 alongside an external vector database supporting metadata filtering. Evaluation on sample datasets identified DINOv2 as the best model for preserving subjects, background context, and color tones in photos. Integrated into the Template Assistant as a human-in-the-loop tool, the automated suggestions increased image replacement speeds by 4.5 times during initial pilot testing.


### [The foundations of Canva’s continuous data platform with Snowpipe Streaming](https://yomu.fyi/post/the-foundations-of-canva-s-continuous-data-platform-with-snowpipe-stre.md)
- Company: [Canva](https://yomu.fyi/company/canva.md)
- Author: Jack Caperon
- Published: Jan 6, 2025

As Canva expanded to over 200 million monthly active users, ingestion throughput reached 25 billion records daily, causing AWS Data Firehose costs to consume nearly half of the product analytics platform budget. To reduce these expenses and eliminate intermediate file staging, the engineering team integrated Snowflake's Snowpipe Streaming directly with their Java-based Kinesis Data Streams pipeline. The architecture streams records directly into Snowflake tables using logical channels with offset checkpoints while configuring client buffering up to a five-minute maximum lag. In handling Kinesis Client Library edge cases, record processors coordinate with the LeaseCoordinator to drop leases when channels become unhealthy. Operating in production for over six months, the system ingested more than 20.35 petabytes of data, decreased query latency to roughly ten minutes, and reduced overall cloud spend by 45 percent.


### [Embracing passwordless authentication with Grab’s Passkey](https://yomu.fyi/post/embracing-passwordless-authentication-with-grab-s-passkey.md)
- Company: [Grab](https://yomu.fyi/company/grab.md)
- Author: Ocean Nguyen
- Published: Dec 26, 2024

Grab introduced Passkey to replace vulnerable traditional passwords and cumbersome multi-factor methods with a seamless, phishing-resistant alternative based on the FIDO standard. The architecture relies on an authenticator located on the user's device, a frontend client, and a backend storing only public keys and metadata. During registration and login, the frontend invokes WebAuthn APIs such as navigator.credentials.create and navigator.credentials.get using server-generated challenges to prevent replay attacks. Passkeys synchronize across ecosystems via Google Password Manager and Apple iCloud Keychain, allowing users to authorize logins with their device lock screen. This implementation improves user experience, eliminates the need to store secrets in backend databases, and cuts third-party communication costs associated with OTP delivery.


### [Canva incident report: API Gateway outage](https://yomu.fyi/post/canva-incident-report-api-gateway-outage.md)
- Company: [Canva](https://yomu.fyi/company/canva.md)
- Author: Brendan Humphreys
- Published: Dec 20, 2024

On November 12, 2024, canva.com suffered an outage lasting approximately one hour due to cascading API Gateway failures. The disruption began when a stale Cloudflare routing rule induced severe latency and packet loss between Ashburn and Singapore during an editor asset deployment. Cloudflare's concurrent streaming mechanism consolidated over 270,000 user requests for a single delayed JavaScript chunk; when the asset finally loaded, clients simultaneously generated a 1.5 million requests-per-second thundering herd to Canva's API Gateway. This surge collided with a telemetry performance regression involving lock contention on Netty event loop threads, exhausting off-heap memory and causing the Linux Out Of Memory Killer to terminate API Gateway containers. Canva mitigated the failure by temporarily blocking all traffic at the CDN level, stabilizing replacement Amazon ECS tasks, and gradually restoring traffic under strict rate limits.


### [Crush errors with Sandbox testing](https://yomu.fyi/post/crush-errors-with-sandbox-testing.md)
- Company: [Stripe](https://yomu.fyi/company/stripe.md)
- Author: David Edoh-Bedi
- Published: Dec 19, 2024

Payment integrations can encounter errors caused by external events, such as network issues or outages, or by bugs in application code, and unhandled failures can stall checkout. The post presents Stripe Sandboxes as isolated environments for reproducing live-integration failures without changing live payment settings or traffic, optionally copying settings when a sandbox is created. Developers can use Workbench’s Errors and Logs views to diagnose a card\_declined response, then route test requests through sandbox keys and a test card. On the Python backend, a try/except implementation catches Stripe errors and generic exceptions and returns an error response instead of leaving the payment page stalled. Sandboxes remain separate after creation, but each Stripe account can have at most five, so unused environments may be deleted or have their test data cleared while settings are preserved.


### [Testing Connect onboarding with Sandboxes](https://yomu.fyi/post/testing-connect-onboarding-with-sandboxes.md)
- Company: [Stripe](https://yomu.fyi/company/stripe.md)
- Author: David Edoh-Bedi
- Published: Dec 19, 2024

Stripe Connect testing can become unwieldy as platforms cover payment methods, US states, international countries, and merchant verification conditions, while the existing test mode stays synchronized with live settings. Sandboxes provide an isolated environment that can replicate a platform’s live configuration without affecting live payment traffic. The workflow covers creating a Sandbox, confirming that Connect settings such as negative-liability handling were preserved, and onboarding test connected accounts through Stripe-provided or custom flows. To reproduce a website-verification failure, a custom account can use “https://inaccessible.stripe.com”; after testing an update to “https://accessible.stripe.com” in the Sandbox, the platform can apply the fix to its production onboarding flow.


### [Developing a modern architecture for energy utilities with embedded finance](https://yomu.fyi/post/developing-a-modern-architecture-for-energy-utilities-with-embedded-fi.md)
- Company: [Stripe](https://yomu.fyi/company/stripe.md)
- Author: Rajan Patel
- Published: Dec 17, 2024

Energy utilities can use embedded finance to create marketplace-like experiences for tariffs, solar installations, smart-home devices, storage, and related services while capturing more energy-related revenue. The proposed foundation combines Stripe Online Payment Flows, Billing, Payments, Connect, and Data Pipeline with AWS serverless services, including Lambda, EventBridge, DynamoDB, Redshift, S3, and QuickSight. A tariff enrollment or payment can trigger webhooks and real-time event processing, while transaction and customer data support dashboards, usage insights, personalized recommendations, subscriptions, and broader partner offerings. The architecture also describes PCI Level 1 security, encryption, Radar, Strong Customer Authentication, AWS IAM, KMS, Shield, WAF, Config, Security Hub, and CloudWatch for compliance and monitoring. It concludes that this integrated payment, analytics, and security foundation can help utilities improve customer engagement, support sustainable programs, and develop new revenue streams.


### [How do I store inventory data in my Stripe application](https://yomu.fyi/post/how-do-i-store-inventory-data-in-my-stripe-application.md)
- Company: [Stripe](https://yomu.fyi/company/stripe.md)
- Author: Ben Smith
- Published: Dec 16, 2024

The DevRel Swag Store uses Stripe payments and AWS services to keep product inventory accurate and visible in near real time. Stripe products retain core payment information, while Amazon DynamoDB stores inventory and other attributes, keyed by Stripe product ID and store ID; EventBridge routes payment events to Lambda, which atomically decrements stock and publishes updates through AWS IoT Core to the frontend. DynamoDB condition expressions prevent decrements when stock is insufficient, while post-payment validation and refunds address the delay before a Stripe Payment Link is disabled, although Stripe fees may be non-refundable. A custom Payment Intent flow can check stock before payment, authorize funds with manual capture for up to seven days, update inventory after payment success, and then capture the charge.


### [Japan community highlights: Effective testing and security](https://yomu.fyi/post/japan-community-highlights-effective-testing-and-security.md)
- Company: [Stripe](https://yomu.fyi/company/stripe.md)
- Author: Hidetaka Okamoto
- Published: Dec 13, 2024

This article reports practical lessons from two September 2024 JP\_Stripes events in Aizuwakamatsu and Sapporo for developing and operating Stripe-integrated services more efficiently and at lower cost. Sandboxes let teams create up to five separate test environments, reproduce payment failures and state transitions through Stripe's API, and use CI-specific workspaces without production access. Stripe Connect examples show how a three-person codoc team launched in nine months by staggering account creation and embedding payout and payment-management interfaces. For fraud prevention, the article recommends Radar or Radar for Teams with webhook automation, including early-fraud-warning events and preemptive cancellation or refunds when dispute fees exceed transaction value. Together, these cases emphasize using managed Stripe capabilities and community-shared implementation experience to reduce testing effort, UI work, and fraud-related costs.


### [Turbocharging GrabUnlimited with Temporal](https://yomu.fyi/post/turbocharging-grabunlimited-with-temporal.md)
- Company: [Grab](https://yomu.fyi/company/grab.md)
- Author: Michel Parreno
- Published: Dec 12, 2024

GrabUnlimited experienced scaling bottlenecks, corrupted membership states, and elevated production incidents after its subscriber base grew by over 1000%. The original architecture relied on Amazon SQS state machines, 5-minute Redis locks, and daily batch cron jobs that overwhelmed the database and lacked granular idempotency during upstream retries. To eliminate these failure modes, the engineering team migrated the core membership lifecycle to Temporal's workflow orchestration engine. Replacing batch cron jobs with Temporal Timers distributed renewal operations throughout the day, while matching workflow IDs prevented race conditions between renewals and cancellations. This architectural transition resolved database bottlenecks and yielded an 80% reduction in open production incidents.


[Newer posts](https://yomu.fyi/page/34.md) · [Older posts](https://yomu.fyi/page/36.md)