Loading…
Latest reads
Every post, summarised
Grounded summaries of engineering blogs, newest first. Each links to the original.
- 4,671 posts
- 20 companies
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Latest posts
Securing Stripe API Keys in AWS with automatic rotation
The article presents a production-grade approach to securing Stripe API keys in AWS, motivated by the risks and operational limits of basic secret storage for payment processing. It compares AWS Parameter Store with Secrets Manager, emphasizing built-in rotation, CloudTrail audit trails, IAM integration, larger secrets, and cross-account access despite higher cost. The implementation uses environment-specific secret paths, tags, and IAM conditions to isolate development, staging, and production credentials, with separate rotation schedules. For zero-downtime rotation, applications refresh cached credentials after authentication failures while both old and new keys remain valid during a transition. The design also covers CloudWatch monitoring, emergency rotation procedures, cross-region replication, region-specific schedules, and cost considerations, concluding that ongoing review is necessary for secure and reliable payment operations.
Grab AI Gateway: Connecting Grabbers to multiple GenAI providers
Grab AI Gateway is a central access layer connecting Grabbers’ applications to multiple GenAI providers, including OpenAI, Azure, AWS Bedrock, and Google VertexAI. Built as a set of reverse proxies, it centralizes provider authentication, authorization, rate limiting, auditing, and capacity management while presenting a unified OpenAI-style API; users can switch models by changing the model parameter. Exploration keys support short-lived staging experiments, while reviewed use cases can use longer-term service keys, and the gateway exposes embedding, image, audio, fine-tuning, search, and in-house open source models. Shared capacity, dynamic routing, monitoring, cost attribution, and usage records support governance and efficiency, although batch traffic can interfere with latency-sensitive services and provider-specific SDK edge cases require integration testing. More than 3,000 Grabbers have requested exploration keys, and the gateway powers applications including ride-safety audio analysis, content moderation, SQL generation, incident automation, and Slack support.
Tracking customer spend in an omnichannel or multiprocessor environment
Merchants operating across websites, mobile apps, physical stores, and multiple payment processors struggle to connect spending because customers use physical cards, digital wallets, and tokenized methods. Payment Account Reference (PAR), a 29-character alphanumeric identifier introduced by EMVCo, provides a non-financial, non-reversible reference that maps one PAN to multiple tokens without exposing sensitive payment data. Because the PAR is independent of payment method and processor, merchants can link transactions across channels and preserve continuity when a card is replaced with a new PAN. The post presents an omnichannel retail example and describes potential benefits including unified customer profiles, personalization, cross-channel reconciliation, reduced PAN-related PCI burden, and processor flexibility.
We Were Wrong About GPUs
Fly.io’s GPU bet was intended to give internet-facing apps fast AI/ML inference through Fly GPU Machines, which pair a hardware-mapped Nvidia GPU with a Fly Machine. Building them required dedicated GPU servers, Intel Cloud Hypervisor with PCI passthrough, driver work, orchestrator changes, security assessments, and handling large model-weight files. The product has not found product-market fit because most software developers want LLM APIs and services such as OpenAI, Anthropic, Claude, GPT, Replicate, or RunPod rather than raw GPUs, while serious GPU users seek much larger clusters and lightweight users may be too uncertain a market. L40S demand exists, but those GPUs are not driving the core business. Fly.io will keep existing GPU Machines but does not plan a near-term v2, concluding that the bet was worth making without compromising its isolation or developer experience.
The Exit Interview: JP Phillips
JP Phillips leaves after four years at Fly.io, saying the company’s increasing focus on Managed Postgres and LLMs does not match the direction he hoped to see: a move toward cloud provision and larger established customers. He says his original goal—building Fly Machines to replace HashiCorp Nomad—has been accomplished, with the platform now capable of supporting the next iteration of products. His central engineering contribution was the Fly Machines API and flyd, an independently running orchestrator whose finite-state-machine invocations use deterministic, durable execution and log each step in BoltDB. He also discusses corrosion2, a Rust service that uses SWIM gossip and a CRDT-structured SQLite database to distribute near-real-time machine state. Phillips criticizes GraphQL, Elixir, inconsistent communication and shifting priorities, while defending BoltDB and praising Rust’s productivity.
Turbo-Charging ML Development
Ramp describes Turbo, a YAML-based configuration system created to reduce the time and engineering effort required to deploy machine-learning models while preserving reproducibility and explainability. Its abstraction represents end-to-end feature and model pipelines, datasets, and shared train and predict jobs; Python entities and aggregates built with Pydantic are materialized through JobSpec and executed locally or remotely before models are stored. A developer can run a training workflow with a YAML file and a few lines of code, then adapt the same schema for prediction by changing a few configuration lines. The first Credit Risk model required nearly four months and more than 3,000 lines of deployment code; with Turbo, new models deploy in under five minutes using about 40 YAML lines on average. The system also standardizes practices such as holiday alignment in time-series models and supports nearly 20 deployed models built by nine developers.
Did Semgrep Just Get A Lot More Interesting?
Thomas Ptacek considers whether LLM-driven coding agents could make Semgrep more useful by closing the loop between code generation, execution, and automated repair. He describes Semgrep as a semantics-aware code-search tool whose symbolic variable placeholders and ordinary code can express vulnerability patterns, while noting that teams rarely have time to build extensive rule libraries. Drawing on Cursor’s rules feature, including rules that help organize or generate other rules, he proposes having an agent observe runtime errors, generalize fixes into unit tests, and generate Semgrep rules for the underlying bug. The proposed workflow would test each rule with positive and negative controls, save it, scan the codebase, and fix newly found instances. The post concludes that this adaptive process may be more compelling than predicting every failure in advance.
A Blog, If You Can Keep It
Thomas Ptacek announces that Fly.io is moving away from tightly choreographed EffortPosts and toward a more conventional blog. Its Hacker News strategy used technical pieces over 2,000 words, runnable code, research surveys, minimal promotion, selected topics, and style rules, making publishing a primary outreach tool. The process became an impediment because an editorial function serialized the team, writers endlessly refined drafts, and fear of wearing out their welcome limited them to perhaps one or two Hacker News opportunities per month. After Kurt pushed him to publish BFAAS, involving 500 lines of Go code and a 4,500-word draft, Ptacek reconsidered that theory and plans more frequent, less optimized posts with room for other team members.
VSCode’s SSH Agent Is Bananas
VSCode’s remote-editing flow over SSH is examined as a concern for running LLM-driven agent workflows on remote machines. The motivation is to keep iterative code generation and execution away from a development laptop, ideally on a clean-slate Linux instance that starts instantly and cannot damage the host. Unlike Emacs Tramp, which operates through commands on the remote connection, VSCode uses a Bash snippet stager to download an agent, including a binary Node installation. That agent communicates over port-forwarded SSH through a WebSockets connection to the VSCode front end and can browse the filesystem, edit arbitrary files, launch shell PTYs, and persist itself. The author says this raises concerns for development servers and especially production incident work, while noting a custom Fly Machine connection avoids needing this mechanism.
Building rock-solid Stripe integrations: A developer's guide to success
The guide presents ten practices for building production-ready Stripe integrations, covering payment forms, subscriptions, and operational concerns. It recommends verifying webhook signatures with the Stripe-Signature header and endpoint secret, recording event IDs for idempotency, and returning a fast 2xx response while processing asynchronously. Test and live API keys, webhook endpoints, logs, and monitoring should remain separate, while error handling should distinguish card, request, and API failures and use exponential backoff for retries. The guide also recommends testing successful, declined, insufficient-funds, and 3DS scenarios with Stripe test cards, alongside simulated webhook events. Its conclusion emphasizes edge-case planning, logging, monitoring, and ongoing review as foundations for reliable, secure payment processing that can scale with business needs.
AI Core Team Lead Mike Schuster on How to Get the Most From LLMs
Mike Schuster, Head of the AI Core Team at Two Sigma, advocates for grounding large language model adoption in practical tasks rather than speculative industry hype. Realistic enterprise applications focus on accelerating data processing, running faster experiments, and extracting domain-specific features from transcripts such as earnings calls and Federal Reserve speeches via prompt engineering. Because financial data faces inherent volume limits across trading days, successful deployments require multidisciplinary human teams to balance rapid technical experimentation with rigorous domain expertise and analytical reasoning. Schuster also dismisses predictions that programming will become obsolete, comparing coding to learning a musical instrument that cultivates structured thinking, problem decomposition, and scientific common sense essential for building complex predictive models.
Building resilient webhook handlers in AWS: Implementing DLQs for Stripe events
Reliable Stripe webhook processing must account for lost deliveries from network or service outages, out-of-order events, and duplicates caused by Stripe retries. The proposed AWS architecture uses API Gateway for signature validation and throttling, an SQS FIFO queue for ordered delivery and content-based deduplication, Lambda for processing, DynamoDB for event-ID idempotency, and an SQS DLQ for failed messages. In the CloudFormation example, the main queue has a 300-second visibility timeout and sends messages to the FIFO DLQ after three receives; DynamoDB records expire through a seven-day TTL. Lambda retries failures with exponential backoff, while CloudWatch monitors queue depth, latency, and errors. The design is presented as a scalable foundation, with multi-region failover available at added cost and complexity, though single-region deployment may suffice for many applications.
Sharing Tinder’s latest contributions to the open source community
Tinder open-sourced several iOS development repositories, including Layout, Nodes Architecture Framework, and CombineUI, to share the engineering patterns supporting its iPhone application. As the app expanded across diverse device profiles and scale, engineering teams faced reliability, consistency, and memory challenges under their legacy architecture. In response, Tinder developed Nodes, a plugin-based architecture framework using compile-time dependency injection and lifecycle hooks that enforce complete memory release upon feature dismissal. For interface construction, Tinder created Layout, a domain-specific Auto Layout wrapper offering declarative syntax for UIKit views to eliminate storyboard merge conflicts while preserving native capabilities. The resulting stack enables isolated testing of business logic, native reactive event binding, and incremental adoption of SwiftUI across the codebase.
New to Stripe? Learn the key concepts for software developers.
The guide introduces software developers to Stripe’s main objects and workflows for integrating payments, recurring billing, and related account activity. It begins with Payment Intents, which specify an amount and currency, track a payment’s lifecycle, and produce a client secret for completing the frontend flow, then covers Payment Methods and Customers, including Setup Intents and attaching a default payment method. For subscriptions, it distinguishes Products, Prices, and Subscriptions, and explains using events and webhooks to react to asynchronous payment and subscription changes while verifying webhook signatures. It also describes Disputes, refunds, and expanded API responses, including retrieving related resources in one call. The guide recommends starting in test mode and using dashboard logs while consulting Stripe’s documentation and changelog as the platform evolves.
Adopting Jetpack Compose for Etsy’s Android App
Etsy adopted Jetpack Compose as its preferred way to build Android app UIs, after a staged program that culminated in rewriting the Shop screen. Because UI toolkits are central to development, engineers created a curriculum, rebuilt internal design-system components, and used Compose’s interoperability with XML Views to migrate gradually. They then tested a full internal screen with navigation, system UI, coroutines for API data fetching, and Kotlin Flows supporting unidirectional data flow alongside Macramé. After Compose bottom sheets reached real buyers and sellers, the Shop rewrite took about three months and entered an A/B experiment against the old implementation. The new screen improved initial rendering time by 5%, made interactions more fluid, and improved several user actions, while engineers reported fewer lines of code, easier testing, greater business-logic coverage, and higher satisfaction.
Image replacement in Canva designs using reverse image search
Canva needed an automated way to replace media in design templates, such as when third-party licensing partnerships expire across more than 150 million images. Existing recommendation engines, perceptual hashing, and text metadata searches failed to capture visual similarity hierarchies or ensure replacement relevance. To build a reverse image search system, engineers evaluated embedding models including CLIP, ViTMAE, DreamSim, CaiT, and DINOv2 alongside an external vector database supporting metadata filtering. Evaluation on sample datasets identified DINOv2 as the best model for preserving subjects, background context, and color tones in photos. Integrated into the Template Assistant as a human-in-the-loop tool, the automated suggestions increased image replacement speeds by 4.5 times during initial pilot testing.
How the leading AI companies are using AI tools
The article examines how companies on the Forbes AI 50 list are adopting AI for knowledge work, noting that research with Harvard Business Review found only three percent of organizations use AI for knowledge management. Examples from Synthesia and Wiremind favor small, practical wins, including onboarding videos, data visualizations, staging-versus-production comparisons, and complex dataset validation. Adoption is supported through experimentation, departmental AI champions, sandbox hours, documented guidelines, colleague-led training, and feedback systems rather than forced rollout. To measure impact, the companies track usage, new use cases, employee satisfaction, time savings, and output quality; Pinecone reports an 8× increase in sales activity after implementing AI tools. The article concludes that AI may initially expand team capability instead of immediately reducing costs, while repeated experiments can build lasting work habits and support innovation.
Announcing a New Collaboration Between eBay and OpenAI
eBay announces a collaboration with OpenAI as part of its strategy to shape agentic ecommerce and redefine online discovery and shopping for enthusiasts. The company is among the first to collaborate on the research preview of Operator, an AI agent that acts as a virtual assistant and autonomously performs tasks across the internet, including online shopping. Operator directs users to eBay for unique inventory finds, a model eBay anticipates will expand sellers’ reach by giving more buyers exposure to that inventory. The announcement also places the work within eBay’s broader effort to evolve internal AI agent capabilities and deepen strategic partnerships while learning how these technologies can empower buyers and help sellers grow their businesses.
What is a Good Engagement Rate on TikTok for 2025?
The guide explains how to assess TikTok engagement rate, noting that follower count, industry, content type, and audience demographics all affect the benchmark. It reports an average platform-wide rate of 4.07%, while citing 6–10% as a typical good range and higher figures for smaller accounts, including about 10%+ for micro-influencers and 4–6% for mega-influencers. It defines engagement through likes, comments, shares, views, and saves, then gives formulas based on total engagements, followers, and number of posts, including worked examples producing 6.66% and 5.5%. Industry figures range from 9.5% for schools and sports teams to 2.51% for fashion, with niche-specific targets recommended. TikTok Analytics and third-party tools such as Brandwatch are presented as ways to track trends, compare benchmarks, and refine strategy; the guidance comes from external research rather than original platform research.
Scaling Large Language Models for e-Commerce: The Development of a Llama-Based Customized LLM
eBay developed e-Llama, customized 8B and 70B language models, by adapting Meta’s Llama 3.1 models to e-commerce rather than training entirely from scratch. The approach uses continued pretraining on filtered public listings, product reviews, classifier-selected open-source examples, replay data, and 10% non-English general-domain data to add domain knowledge while limiting catastrophic forgetting. Training ran on 480 NVIDIA H100 GPUs using Megatron-LM, 3D parallelism, flash-attention-2, a 1:1 general-to-e-commerce sampling ratio, a learning-rate maximum set to 10% of the original, and one trillion tokens. The 70B model required about one month and 340,000 GPU-hours. E-commerce benchmarks improved approximately 25% in English and 30% in non-English, while general-domain NLU degraded 1% for e-Llama 70B; subsequent instruction tuning added safety and instruction-following guardrails.
Top topics
- Architecture834
- Performance816
- LLMs660
- Machine Learning622
- Open Source563
- AI Agents553
- AI470
- Developer Experience448
Weekly digest
The best engineering reads, once a week.