---
title: "Latest reads"
description: "The engineering internet, summarised so you can actually read it."
---

# Latest reads
> The engineering internet, summarised so you can actually read it.

## Articles

### [How to Build and List Secure Cross App Access (XAA) Connections on Okta Integration Network (OIN)](https://yomu.fyi/post/how-to-build-and-list-secure-cross-app-access-xaa-connections-on-okta.md)
- Company: [Okta](https://yomu.fyi/company/okta.md)
- Author: Gagan Sikri
- Published: Jul 6, 2026
- Type: Tutorial

Cross App Access (XAA) provides an identity framework for securing token-based communication when software or AI agents access external ecosystems through trusted identity providers. It replaces long-lived API keys and hardcoded secrets with real-time identity propagation, while allowing enterprises to control connected apps, requested scopes, and user access. The guide explains prerequisites for requesting and resource apps, including OIDC or SAML SSO, authorization-server support, protected resources, scopes, an Okta Integrator Free Plan org, and tested workflows. It then describes token exchange testing: requesting apps obtain an ID token and mint an ID-JAG, while resource apps validate the ID-JAG and issue a scoped access token. To seek OIN listing and XAA enablement, applicants submit SSO integration details, metadata, testing evidence, and a questionnaire to Okta.


### [Introducing AI dashboard and workflow generation in ClickStack](https://yomu.fyi/post/introducing-ai-dashboard-and-workflow-generation-in-clickstack.md)
- Company: [Clickhouse](https://yomu.fyi/company/clickhouse.md)
- Published: Jul 6, 2026
- Type: Announcement

ClickStack now supports AI-generated dashboards and linked investigative workflows from natural-language prompts, targeting the effort required to understand telemetry, write queries, choose visualizations, and iterate. Rather than asking an LLM to return a finished artifact, ClickStack uses an AI Notebook with the same MCP tools available to external agents, where queries, visualizations, findings, and reasoning are captured in a persistent, editable investigation. The system explores telemetry, validates assumptions, assembles dashboards, and can connect overview and service-level dashboards through dashboard actions; generated charts remain editable. The same MCP server exposes these capabilities to agents such as Claude, Cursor, and Codex, so users can create, refine, and extend dashboards through one toolchain.


### [Claude's extended thinking](https://yomu.fyi/post/claude-s-extended-thinking.md)
- Company: [Anthropic](https://yomu.fyi/company/anthropic.md)
- Published: Jul 3, 2026
- Type: Explainer

Claude 3.7 Sonnet introduces extended thinking, letting users toggle deeper reasoning and developers set a thinking budget. The same model spends additional computation on sequential reasoning, while agent training supports iterative function calls, computer use, and open-ended tasks. The post examines visible thought processes, noting benefits for trust and research but also limitations around faithfulness, safety, and jailbreak risk; it therefore treats the feature as a research preview. Reported examples include stronger OSWorld performance, playing Pokémon Red through tens of thousands of interactions and progressing through three Gym Leaders, plus logarithmic math gains as thinking tokens increase. Safety work includes encrypted thoughts for some harmful content and computer-use prompt-injection mitigations that raise prevention from 74% to 88%.


### [Announcing Anthropic's Responsible Scaling Policy](https://yomu.fyi/post/announcing-anthropic-s-responsible-scaling-policy.md)
- Company: [Anthropic](https://yomu.fyi/company/anthropic.md)
- Published: Jul 3, 2026
- Type: Announcement

Anthropic announces its Responsible Scaling Policy (RSP), a set of technical and organizational protocols for managing catastrophic risks from increasingly capable AI systems, including deliberate misuse and autonomous behavior contrary to designers’ intent. The policy introduces AI Safety Levels (ASL), loosely modeled on biosafety levels, with requirements for safety, security, and operations increasing alongside a model’s potential for catastrophic risk; current LLMs, including Claude, are described as ASL-2. ASL-3 would require unusually strong security and no deployment when adversarial testing by world-class red-teamers finds meaningful catastrophic misuse risk, while ASL-4 measures remain unwritten and may depend on unresolved interpretability research. Approved by Anthropic’s board, the RSP is presented as an initial, revisable framework that may temporarily pause scaling when safety procedures cannot keep pace, while incentivizing solutions needed for further development and leaving current Claude uses and product availability unchanged.


### [More details on Fable 5’s cyber safeguards and our jailbreak framework](https://yomu.fyi/post/more-details-on-fable-5-s-cyber-safeguards-and-our-jailbreak-framework.md)
- Company: [Anthropic](https://yomu.fyi/company/anthropic.md)
- Published: Jul 3, 2026
- Type: Explainer

Claude Fable 5 has been redeployed globally, accompanied by additional detail about its cybersecurity safety classifiers and a proposed AI jailbreak severity framework. The classifiers distinguish prohibited use, high-risk dual use, low-risk dual use, and benign use, with intended responses ranging from blocking to allowing with monitoring; the model uses a larger safety margin than previous models, accepting more false positives to increase protection against harmful outcomes. Other safeguards include access controls, model safety training, and offline monitoring, while a HackerOne program invites researchers to submit potential cyber jailbreaks. The draft framework measures capability gain against the available baseline and illustrates scoring with Log4Shell cases, where severity changes as discoverability and existing tools change.


### [Enabling Cross App Access for SAML-Based Resource Apps](https://yomu.fyi/post/enabling-cross-app-access-for-saml-based-resource-apps.md)
- Company: [Okta](https://yomu.fyi/company/okta.md)
- Author: Updating authorization server metadata
- Published: Jul 3, 2026
- Type: Tutorial

Cross App Access (XAA) lets applications using existing SAML federation obtain API access without migrating to OpenID Connect (OIDC). An agent presents a short-lived Identity Assertion Authorization Grant (ID-JAG), which the resource authorization server validates, resolves to a user, and exchanges for its own access token; SAML processing remains upstream. For SAML identity resolution, implementations must validate the saml-nameid sub\_id and match issuer, NameID, and sp\_name\_qualifier rather than relying on NameID alone. The guide recommends binding iss to a registered SAML connection before verifying the JWT against that connection’s JWKS, then checking typ, aud, and client\_id and applying local scope policy. It also walks through Okta configuration and xaa.dev checks that redeem the ID-JAG, call the API, and export conformance results.


### [ClickHouse Release 26.6](https://yomu.fyi/post/clickhouse-release-26-6.md)
- Company: [Clickhouse](https://yomu.fyi/company/clickhouse.md)
- Published: Jul 3, 2026
- Type: Announcement

ClickHouse 26.6 is a release marking the 10-year anniversary of ClickHouse becoming open source, with 56 new features, 79 performance optimizations, and 366 bug fixes. Hypothetical skip indexes let users evaluate set indexes in a session without building them; on a 487.24-million-row UK property dataset, the example estimated skip ratios of 77.0% at granularity 128 and 92.2% at granularity 1. The release overhauls dependencies between refreshable materialized views, addressing schedule drift that could make dependent stages lag or miss a refresh cycle. It also introduces experimental continuous queries, the aiEmbed function, embedding quantization to 8 bits and below, and workload-level memory reservations.


### [Migrating Counter Service storage: Design choices and learnings](https://yomu.fyi/post/migrating-counter-service-storage-design-choices-and-learnings.md)
- Company: [Grab](https://yomu.fyi/company/grab.md)
- Author: Jia Long Loh
- Published: Jul 3, 2026
- Type: Problem & solution

Grab’s Counter Service supports time-windowed fraud queries at tens of thousands of QPS and about a billion requests per day, but an infrastructure review prompted migration from a wide-column database to Aerospike. The team first separated Rust business logic from storage, then added an enum-dispatched facade with Single, WithShadow, and WithSplit modes so traffic could be compared and shifted without downtime. They also redesigned the writer path around Aerospike, including a map-based schema and a single atomic increment, while testing index placement and reverting from an NVMe-backed primary index after hot-key p99 spikes. Production p99 read latency improved by roughly 50%, disk usage fell from about 3 TB to 1 TB, and per-node cost dropped 45–50%; the rollout reported zero downtime and no data-integrity issues.


### [Hardware-Rooted AI Security That Won’t Slow You Down](https://yomu.fyi/post/hardware-rooted-ai-security-that-won-t-slow-you-down.md)
- Company: [NVIDIA](https://yomu.fyi/company/nvidia-developer-blog.md)
- Author: Elizabeth Goodman
- Published: Jul 2, 2026
- Type: Benchmark

NVIDIA Confidential Computing secures enterprise data, proprietary model weights, and the model itself during active AI inference. The architecture integrates silicon-level private signing keys fused during manufacturing, encrypted multi-GPU NVLink, and remote attestation through the NVIDIA Remote Attestation Service alongside CPU Trusted Execution Environments. To mitigate overhead from secure work submission latency and encrypted host-to-device transfers, software optimizations incorporate CC-safe autotuner timing in FlashInfer, asynchronous copy workers in SGLang, and piecewise CUDA graph replay. Benchmarks on an HGX B300 system running the Qwen 3.5 397B-A17B model at FP8 precision show inference performance reaches up to 98% of non-confidential baselines across tested concurrency levels.


### [Presto® on Apache Kafka® At Uber Scale](https://yomu.fyi/post/presto-on-apache-kafka-at-uber-scale.md)
- Company: [Uber](https://yomu.fyi/company/uber.md)
- Published: Jul 2, 2026
- Type: Problem & solution

Uber connected Presto and Apache Kafka to provide lightweight, interactive SQL queries over Kafka topics for ad-hoc analysis of real-time data. The work addresses operational requests such as checking whether an order UUID appears in a service’s input or output streams, where streaming processors are poorly suited to historical point lookups and real-time OLAP requires onboarding and dedicated resources. The enhanced connector discovers Kafka clusters, topics, and schemas on demand, supports multiple Kafka clusters, caches metadata, enforces \_timestamp or \_partition\_offset filters, and uses a shared Kafka client ID with broker quotas to control consumption. After rollout, example lookups returned within a few seconds, daily usage reached 6,000 queries, and the teams reported improved productivity, while concurrent queries may take longer under quota control.


### [Building Zone Failure Resilience in Apache Pinot™ at Uber](https://yomu.fyi/post/building-zone-failure-resilience-in-apache-pinottm-at-uber.md)
- Company: [Uber](https://yomu.fyi/company/uber.md)
- Published: Jul 2, 2026
- Type: Problem & solution

Uber describes how it made Apache Pinot clusters resilient to zone failures while preserving query and ingestion availability for Tier-0 use cases. It maps Uber’s virtual resource isolation group IDs to Pinot server pools, uses pool-based instance assignment with replica-group segment assignment, and requires at least as many isolation groups as the table’s replication factor. During migration, automated pool registration, configuration backfills, granular APIs, selective rebalancing, and rollback support were used across more than 400 Tier 0-1 clusters and thousands of tables. An internal drill found that one remaining replica continued serving traffic without query degradation after a zone went down, while isolation-group-based claim and release policies enabled parallel restarts and sequential rollouts with baking time.


### [Introducing uFowarder: The Consumer Proxy for Kafka Async Queuing](https://yomu.fyi/post/introducing-ufowarder-the-consumer-proxy-for-kafka-async-queuing.md)
- Company: [Uber](https://yomu.fyi/company/uber.md)
- Published: Jul 2, 2026
- Type: Explainer

Uber introduces uForwarder, an open-source Consumer Proxy for Kafka Async Queue workloads, after deploying a push-based system across more than 1,000 consumer services. The proxy fetches messages through Kafka’s binary protocol, sends them individually to consumer services over gRPC, collects status codes and processing results, and commits offsets when safe. Production challenges included head-of-line blocking from messages that fail before reaching handlers, growing hardware costs, external data sources that are not ready when events arrive, and requirements for production/non-production and zone isolation. The implemented solutions include context-aware routing through message and gRPC headers, active blocking detection and mitigation, hardware-efficiency improvements, and DelayProcessManager, which pauses only delayed partitions and guarantees at-least delay rather than exact timing. The project is open source, with planned work on consumer-lag handling and direct Protobuf support.


### [The 3 questions to answer to take AI from experimentation to impact](https://yomu.fyi/post/the-3-questions-to-answer-to-take-ai-from-experimentation-to-impact.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Christy Maver
- Published: Jul 2, 2026
- Type: Explainer

The post argues that enterprises moving AI from experimentation to impact should answer three questions: whether employees and governance are ready, whether tools are accessible, and whether workers have the capabilities to use them. It recommends secure, governed AI agents that let employees experiment safely, apply consistent oversight across workloads, and build skills without compromising business security; the text notes that fewer than half of companies have formal governance for autonomous workloads. AI should appear inside natural workflows, including single chat interfaces and embedded intelligence dashboards, with access to company data, automated identity management, consistent governance, and business logic across engagements. Finally, agents should provide contextually accurate, actionable intelligence and automation, challenge users’ thinking, suggest next steps, and take action rather than only answer questions.


### [Inside the infrastructure strategies propelling AI leaders](https://yomu.fyi/post/inside-the-infrastructure-strategies-propelling-ai-leaders.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Christy Maver
- Published: Jul 2, 2026
- Type: Explainer

The post examines why enterprise AI efforts can become too expensive, slow, and difficult to scale, citing survey findings that 67% of organizations with disconnected data environments identify storage, movement, and duplication as their largest recurring AI cost. It presents three infrastructure considerations: delivering infrastructure at agentic speeds, streamlining data, and adopting systems built for AI scale. Examples include instant temporary environments with secure rollback and restoration, unified operational and analytical data stored separately from compute in low-cost cloud storage, and elastic scaling that can move from high concurrency to zero in seconds. The conclusion is that open, AI-ready, purpose-built databases can reduce pipeline complexity and costs, support experimentation, and let organizations align spending with unpredictable workloads while enabling faster AI innovation.


### [How we made ClickStack 5x faster for ClickHouse observability](https://yomu.fyi/post/how-we-made-clickstack-5x-faster-for-clickhouse-observability.md)
- Company: [Clickhouse](https://yomu.fyi/company/clickhouse.md)
- Published: Jul 2, 2026
- Type: Problem & solution

ClickStack’s inherited OpenTelemetry Collector schema was struggling with slow searches, Top N queries, and aggregations that could time out on large observability workloads. The team prioritized common log and trace access patterns, including exact-attribute searches, body-text queries, histograms, individual log lookups, and distinct-key or value introspection. They used fixed production-like workloads and iterative testing with ClickCannon, Kubernetes-managed environments, ephemeral ClickHouse Cloud instances, and controlled schema, query, and version comparisons. The resulting redesign combined primary-key changes, text indexes, query rewrites, alias columns, materialized views, and newer ClickHouse features, reducing representative query latency by more than 5× while balancing ingestion, storage, and operational efficiency.


### [Any Apple update can break our app. Here's how we find out first.](https://yomu.fyi/post/any-apple-update-can-break-our-app-here-s-how-we-find-out-first.md)
- Company: [Sentry](https://yomu.fyi/company/sentry.md)
- Author: Dan Mindru, Oleh Stasula
- Published: Jul 2, 2026
- Type: Problem & solution

Usage is an Apple ecosystem resource monitor that relies on undocumented APIs vulnerable to silent data structure changes across OS updates. To maintain stability across iPhone, iPad, and Mac without degrading device performance, the development team uses Sentry across separate component projects in a unified workspace. Beyond capturing standard crashes, the team wraps Swift errors with unexpected raw data payloads to quickly diagnose undocumented API structure drift while scrubbing sensitive user values. They also employ Sentry Size Analysis as a regression gate to monitor release payload deltas, preventing unintended asset omissions or bloat from slipping through code reviews. This multi-layered monitoring setup enables the team to detect and resolve platform-induced breakages before most end users encounter them.


### [How do you turn AI coding chaos into a repeatable playbook?](https://yomu.fyi/post/how-do-you-turn-ai-coding-chaos-into-a-repeatable-playbook.md)
- Company: [Stack Overflow](https://yomu.fyi/company/stack-overflow.md)
- Author: Eira May
- Published: Jul 2, 2026
- Type: Explainer

Software development dynamics are shifting as code generation costs decrease, requiring engineering organizations to adapt their leadership and processes. Snowflake addressed this transformation across its software lifecycle by first encouraging widespread, unrestricted experimentation with coding agents before formalizing successful practices. The engineering organization codified these practices into fourteen distinct AI design patterns, including strategies such as planning in markdown and isolating parallel agents. This structured approach, combined with dedicated focus weeks and a progress scale, allowed engineering teams to accelerate both inner and outer loops of development. Consequently, a team of three engineers leveraged coding agents to deliver a 40x improvement to Snowflake's query compiler while significantly shortening release validation times.


### [Ranch, Refills, and Viking Rows: Inside Football Fan Culture](https://yomu.fyi/post/ranch-refills-and-viking-rows-inside-football-fan-culture.md)
- Company: [Brandwatch](https://yomu.fyi/company/brandwatch.md)
- Author: Ksenia Newton
- Published: Jul 2, 2026
- Type: Explainer

Consumer Research tracked close to 32.6 million tournament-related mentions from June 10 to June 28 to examine how fans experienced the tournament through food, beverages, celebrations, and public events. International visitors reacted strongly to American staples: ranch dressing reached 70.3k mentions, free refills 45k, free or unlimited bread more than 30k, and barbecue nearly 64k, while Google interest in “ranch dressing” rose 586.4% and “ranch dressing ingredients” 600%. The experience also exposed friction, with stadium beers costing more than $20 and hydration breaks drawing negative sentiment in over 79% of sentiment-categorized mentions. Watch parties generated over 226k mentions, and New York held 22% of host-city watch-party conversation, offering alternatives to stadium prices. Norway’s “Viking Row” reached nearly 229k mentions, showing how organic fan rituals can spread across borders and create fast-moving opportunities for brands.


### [ClickHouse Agents is now available for Managed Postgres](https://yomu.fyi/post/clickhouse-agents-is-now-available-for-managed-postgres.md)
- Company: [Clickhouse](https://yomu.fyi/company/clickhouse.md)
- Published: Jul 2, 2026
- Type: Announcement

ClickHouse Agents is now available for all Managed Postgres services in ClickHouse Cloud, extending its plain-English agent interface to operational data. The beta service, powered by Claude and built on LibreChat, combines an agent builder and chat interface with a sandboxed code interpreter; it is read-only by default and supports MCP-compatible systems. Agents can inspect Postgres schemas, run read-only queries, return the SQL used, and reason across Postgres and ClickHouse by querying each engine independently before merging results. Additional skills guide migration from Postgres to ClickHouse through discovery, access-pattern analysis, schema design, type mapping, CDC ingestion, and validation, while other workflows use metrics, Query Insights, and EXPLAIN to rank performance fixes. Planned extensions include scheduled recommendations and safe automated remediation, but the current release focuses on exploration, analysis, monitoring, and guided database work.


### [Keeping funds where they belong: Implementing fund segregation in Stripe Connect](https://yomu.fyi/post/keeping-funds-where-they-belong-implementing-fund-segregation-in-strip.md)
- Company: [Stripe](https://yomu.fyi/company/stripe.md)
- Author: Andrew Robinson
- Published: Jul 2, 2026
- Type: Explainer

Marketplaces using Stripe Connect’s separate charges and transfers can pool seller funds with platform revenue, exposing them to payouts, unrelated disputes, fees, refunds, and operational mistakes. In response to anticipated PSD3 changes and tighter Commercial Agent Exemptions, Stripe introduced Segregated Separate Charges and Transfers, which places captured payment funds in an allocated balance that cannot fund payouts and can only be transferred to connected accounts. The integration enables allocated\_funds on PaymentIntents, transfer\_group tracking, source\_transaction-linked transfers, and application fees collected from the same allocation; balances are inspected through the API. The post also details split transfers, refund and reversal ordering, dispute handling, prerequisites, and limitations including card-only support, preview-header requirements, and sandbox-only testing, presenting segregation as a way to make fund flows traceable and operationally safer.


[Newer posts](https://yomu.fyi/posts/page/100.md) · [Older posts](https://yomu.fyi/posts/page/102.md)