Loading…
Latest reads
Every post, summarised
Grounded summaries of engineering blogs, newest first. Each links to the original.
- 4,668 posts
- 20 companies
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Latest posts
AI GPU Clusters, From Your Laptop, With Livebook
Livebook, FLAME, and the Nx stack combine Elixir notebooks, elastic execution, and GPU-backed machine learning into a workflow that can move from a laptop to remote infrastructure. Livebook can start runtimes on Fly Machines, connect to existing Erlang/Elixir applications, and synchronize notebook dependencies and modules across nodes while preserving access to private resources within a Fly organization. FLAME wraps arbitrary code in Flame.call, manages executor pools, controls node limits and concurrency, streams results, and shuts down idle nodes or the cluster after disconnection. In the demonstrated AI workflow, video stills are processed on GPU Fly Machines with Llama, then Mistral summarizes the returned descriptions. The same setup also drives a 64-GPU hyperparameter run for BERT, with each L40s node preparing dependencies, loading data, fine-tuning, and streaming chart results to Livebook.
Bringing Grab’s Live Activity to Android: Enhancing user experience through custom notifications
Grab designed an equivalent to iOS Live Activities for Android to provide real-time order tracking outside the app. Because Android lacks Apple's native ActivityKit push token system, the team substituted push tokens with placeholder values to maintain technical consistency across platforms and preserve backend push targeting via their Hedwig service. For the user interface, engineering selected custom notifications over floating views because custom notifications avoid intrusive screen usage and do not require the 'Draw over other apps' permission. The client implementation separates responsibilities across dedicated classes: LiveActivityIntegrationManager handles token registration across business verticals, LiveActivityAttributes encapsulates UI configuration, and LiveActivityManager maps payloads to Android NotificationManager instances. The solution launched for Food, Mart, Express, and Transport verticals.
Upgrading your Stripe plugin security
Stripe plugins commonly authenticate merchants’ accounts with unrestricted secret API keys, but those keys grant full access and can expose payment, customer, and subscription operations if mishandled or compromised. The post presents restricted API keys (RAK) and OAuth 2.0 as zero-trust alternatives that apply identity verification and least-privilege permissions to third-party integrations. RAKs let developers define narrowly scoped permissions, while OAuth 2.0 uses Stripe’s interface for tokenized, one-click authorization and lets merchants revoke access without sharing a secret key. For existing plugins, it outlines migration through Stripe Apps, Stripe Connect, or manual RAK setup, and states that Stripe will require RAK or OAuth 2.0 authentication from October 29, 2024, with possible fees for merchants still using full-access keys after June 2025.
Avoiding test mode tangles with Stripe Sandboxes
Stripe integrations can become difficult to test when an account has only one test mode, because unrelated work can interfere and sensitive configuration must remain protected. The post presents Stripe Sandboxes as separate testing areas and shows a Node.js Express application authenticating with a sandbox secret key stored in a .env environment variable. It creates payment intents through /create-payment-intent and retrieves account details through /account, then uses Jest and supertest to verify the sandbox identity, including the expected display name dev-sandbox. A GitHub Actions workflow injects STRIPE_API_KEY from repository secrets, installs dependencies, and runs tests on pushes to the main branch, while .gitignore excludes environment files. The conclusion is that isolated sandboxes and automated checks reduce test tangles and help prevent calls to the wrong environment.
Secure OAuth 2.0 Access Tokens with Proofs of Possession
Bearer access tokens grant whoever possesses them access, making theft especially risky for public clients such as SPAs and mobile apps. DPoP, an OAuth 2.0 extension, binds a token to a client’s public key and uses signed proofs so authorization and resource servers can verify requests. The tutorial migrates an Angular single-page application from bearer tokens to DPoP while building on the Authorization Code flow, inspecting token exchanges, request headers, replay protection, and calls to Okta’s APIs; React and Vue variants are also noted. It recommends IndexedDB with non-exportable WebCrypto keys, cleanup during sign-in, and browser capability checks, while noting that the preserved setup instructions no longer work exactly as written after Okta’s May 2025 account changes.
Unveiling the process: The creation of our powerful campaign builder
Grab details the event processing architecture behind Trident, its internal marketing campaign platform that evaluates If This, Then That (IFTTT) logic over Kafka streams. The core processing unit is a treatment consisting of an event, optional conditions, and actions. Complex campaign capabilities—such as counters, limits, and delays across multiple hours via recursive SQS message scheduling—are assembled from multiple coordinated treatments. To simplify campaign creation, Grab introduced a flowchart-like visual builder represented as a JSON node tree that compiles recursively into treatments while persisting node-to-treatment mappings to reconcile edits over time.
Tinder API Style Guide — Part 1
Tinder’s rapid growth and expansion into domain-centric teams produced inconsistent API practices across services, including mixed error conventions, fragmented schemas, uneven versioning, unclear URIs, and weak API contracts. Part 1 presents standards for the RESTful APIs used across the platform, beginning with the URI pattern https://service-mesh-host-name/[version]/[service-name]/[resource]/[sub-resource] and guidance on concise, plural, kebab-cased paths. It defines path-prefix versioning, retaining the previous version until clients migrate and creating new versions only for breaking changes such as removing fields, changing types, or renaming fields. The guide also covers HTTP methods, standard and custom request headers, the X-Tinder- naming convention, and request tracing through MDC-populated identifiers and centralized logging. Request and response bodies, status codes, and enforcement tools are reserved for Part 2.
Elevate Access Token Security by Demonstrating Proof
Bearer access tokens let anyone holding a valid token call a resource server, creating risk when tokens are stolen. Existing protections include secure coding, short expiration, and origin restrictions, but the post presents OAuth 2.0 Demonstrating Proof of Possession (DPoP) as a way to bind tokens to client-generated cryptographic proof. The client creates a JWT containing request details, issue time, unique identifier, and public key; the authorization server uses it to bind a key hash and request information to the returned token. For sensitive requests, authorization or resource servers can require a nonce, prompting a new proof and limiting lifetime and replay risk. Resource servers must validate both proof and access token properties, with a vetted OAuth library recommended.
Advanced error handling patterns for Stripe enterprise developers
The post presents advanced error-handling patterns for Stripe integrations that face high request volumes, temporary API slowdowns, connectivity problems, and webhook delivery failures. It uses Stripe Workbench to inspect account-level API activity, traffic spikes, error rates, API versions, and webhook activity; one example links a 429 response to a scheduled job that created usage records across thousands of accounts simultaneously. The implementation combines request spacing with Limiter, a p-queue concurrency cap of five, and a token bucket configured for 100 tokens per 60 seconds. Stripe’s stated limits are 100 read and 100 write operations per second in live mode and 25 of each in test mode, with stricter limits for some resources. The reported before-and-after results show the combined controls processing high API-call volume within those limits, reducing errors and producing more predictable interaction.
Simple error handling strategies with Stripe Workbench
Stripe Workbench addresses the difficulty of finding and understanding errors produced by Stripe API invocations. It gives developers a view of recent errors, groups repeated failures, shows their frequency, and links summaries to request logs and actionable resolution guidance. The article describes Stripe error categories such as StripeCardError, StripeInvalidRequestError, and StripeConnectionError, then demonstrates Node.js try/catch handling that branches on the error type. It also covers webhook responses for payment_intent.payment_failed events, including retrieving event.data.object.last_payment_error, and explains how objects such as PaymentIntents, Setup Intents, Invoices, Setup Attempts, Payouts, and Refunds retain failure information for later inspection. Combined, these mechanisms support targeted responses, troubleshooting through detailed request and response data, and more reliable Stripe integrations.
Iterating with shadow workspaces
Cursor’s shadow workspace addresses the problem of letting AI agents iterate on code without disrupting a developer’s active workspace. The design prioritizes LSP usability—especially lints, definition navigation, and language-server interaction—while also requiring independence, privacy, concurrency, universality, maintainability, and speed. A copied in-memory TextModel was rejected because sharing the user’s language server could introduce copied files into references, duplicate declarations, or miss errors. The implemented approach uses a reusable hidden Electron window for the workspace, routing AI edits through Cursor’s processes and returning lints independently of the visible editor. The post treats runnability as a harder future extension, with folder-proxy designs, platform limitations, and network-level independence still open questions.
Stripe Developer Digest (August 2024): Workbench is now available to everyone
Stripe’s August 2024 developer update announces that Workbench is available to everyone across every Dashboard surface, addressing developers’ request for in-context guidance and debugging tools during API integration work. Workbench is a developer home in the Dashboard that provides an at-a-glance view of integration behavior, lets users inspect API and event history, prototype integrations, and receive critical account alerts. As developers build, it highlights errors, helps resolve them, and recommends ways to improve integration efficiency; it can be opened with a single keystroke. The update also places Sandboxes and Event Destinations in public beta, expands Tap to Pay on iPhone with Stripe to seven countries, and notes community resources for Stripe Tax, the Stripe CLI, Payment Links, and related integrations.
Bringing your Stripe objects to life with Workbench
The post demonstrates how Stripe Workbench’s Inspector can be used to examine a PaymentIntent throughout its lifecycle and diagnose payment workflow issues. It maps states including requires_payment_method, processing, requires_action, succeeded, and canceled, showing how the status property changes as inputs and decisions move the object through a state machine. The walkthrough creates and confirms test PaymentIntents with Stripe Shell commands, including a 3DS-required card that produces a requires_action state and a use_stripe_sdk next_action. It also describes reacting to state changes through webhook endpoints or Amazon EventBridge, using the Inspector to identify friction such as PaymentIntents stalled at requires_action and to debug abandoned payments.
Debugging your Stripe Invoicing integration with Workbench
The post demonstrates how to debug and fix Stripe Invoicing integration errors with Workbench, a context-aware tool available throughout the Stripe Dashboard. It uses the Overview and Errors tabs to locate a recent parameter_missing error, then examines the failed Invoice create request and identifies the missing Customer object that prevented invoice creation. The Shell and API Explorer let developers list customers, supply a Customer ID, construct and run the corrected create command, and generate an SDK request from the configured fields. Workbench’s Inspector then exposes the invoice’s JSON data map, logs, and lifecycle events; the example confirms successful payment for a zero-dollar invoice and explains that non-zero charges require Invoice Items tied to products and prices.
The Complete Social Media Content Plan Guide
The guide presents social media content planning as a focused process for choosing channels, understanding audiences, setting goals, and organizing content around a brand’s marketing objectives. It recommends auditing existing activity, comparing competitors, and examining demographics, interests, pain points, engagement, followers, and conversions before deciding where improvement is needed. The proposed strategy combines channel-specific planning with varied content, including evergreen, educational, visual, video, livestream, poll, quiz, and user-generated material, while emphasizing permission and credit for UGC. A content calendar, planning or management tools, analytics, hashtag research, and direct audience interaction support execution and measurement. The guide concludes that continuous testing, schedule adjustments, trend monitoring, and regular updates keep the approach responsive as audience preferences and the brand evolve.
Chimera Sandbox: A scalable experimentation and development platform for Notebook services
Grab's Chimera team built Chimera Sandbox to address resource accessibility challenges and enable rapid machine learning experimentation across technical and non-technical teams. The platform runs on multi-cluster Kubernetes infrastructure capable of scaling to thousands of nodes per cluster during peak loads. Users can provision customizable Docker environments with varying CPU and GPU configurations, collaborate in real time, and query data using Spark-on-Kubernetes integrations and helper magic cells. The workspace integrates with Grab's AI Gateway for LLM access alongside tools like MLflow, Optuna, RStudio, and LabelStudio on shared storage, backed by user-level cost attribution.
Peeking under the hood of Stripe Invoicing
Stripe Invoicing’s no-code workflow hides the API calls and invoice state transitions that developers may need to inspect when debugging payment failures. Using Stripe Workbench’s Inspector, Logs, and Events tabs, the walkthrough maps object hierarchies, requests, event payloads, and previous_attributes across an invoice lifecycle. Creating an invoice in the Dashboard produces a draft Invoice, a separate Invoice Item, an automatically generated Invoice Line Item, and related creation or update events. Sending it creates a Payment Intent and finalizes the invoice from draft to open; charging captures the Payment Intent, creates a Charge, and changes the invoice to paid. Draft invoices can be deleted, while open invoices can be voided, preserving the record and canceling the Payment Intent, and the same Workbench method can be applied to other Stripe API areas.
Tophat: Crafting a Delightful Mobile Developer Experience
Shopify built Tophat to reduce the time and friction involved in manually testing mobile pull requests, where switching branches, stashing changes, and waiting for Xcode or Android Studio builds slowed review. The macOS menu-bar application links GitHub pull requests to iOS and Android artifacts produced by CI and stored in Google Cloud Storage, allowing contributors to install builds on simulators or real devices with one click. Tophat parallelizes tasks such as downloading applications and booting devices, and its Quick Launch feature retrieves builds with up-to-date native code for React Native development. The project also addressed real-device iOS installation and signing challenges, integrated with Shipit Mobile, and provided automated setup guidance. After the latest improvements, daily usage doubled, and Tophat was later made open source.
Observing immediate versus delayed payments with Stripe Workbench
Stripe payment methods differ in how quickly they confirm attempted payments, with cards reporting status immediately and bank debits, bank transfers, and cash-based vouchers requiring additional processing time. The post uses Stripe Workbench and its in-browser CLI shell to create Checkout sessions in test mode, submit card and ACH Direct Debit payments, and inspect emitted events. For cards, charge.succeeded and payment_intent.succeeded signal successful payment, while integration code must inspect checkout.session.completed payment_status rather than confuse it with the session status. With delayed methods, checkout.session.completed can show unpaid before checkout.session.async_payment_succeeded or checkout.session.async_payment_failed arrives; the former changes payment_status to paid, and production processing can take days.
Series A and Magic
Cursor announces milestones in its effort to change software development with AI, describing a shift from slow, cumbersome building and modification toward greater lightness and control. The company says its tool replaces searches for primitives with instant answers, turns mechanical refactors into single “tabs,” expands terse directives into working source, and applies thousand-line changes in seconds. It reports more than 40,000 customers and an initial team that has built SOTA next-edit-prediction models, multi-billion-file retrieval systems, and fast code rewrites using speculative inference. The announcement also says Cursor raised $60m in Series A funding from Andreessen Horowitz, Thrive Capital, OpenAI, Jeff Dean, Noam Brown, founders of Stripe, GitHub, Ramp, Perplexity, and OpenAI, and others, while inviting people excited about coding’s future to consider joining the company.
Top topics
- Architecture834
- Performance815
- LLMs659
- Machine Learning621
- Open Source563
- AI Agents553
- AI469
- Developer Experience448
Weekly digest
The best engineering reads, once a week.