---
title: "Latest reads"
description: "The engineering internet, summarised so you can actually read it."
---

# Latest reads
> The engineering internet, summarised so you can actually read it.

## Articles

### [Cursor Agent CLI](https://yomu.fyi/post/cursor-agent-cli.md)
- Company: [Cursor](https://yomu.fyi/company/cursor.md)
- Author: Lukas Möller, Ian Huang & Balta Ruiz
- Published: Aug 7, 2025
- Type: Announcement

Cursor has made its Agent available through a command-line interface (CLI) and in headless environments, extending it beyond the editor, web, mobile, and Slack. The release targets customers using Neovim, JetBrains, and other IDEs, while allowing Agent to run alongside those tools or as multiple parallel agents in a terminal or remotely. The CLI supports any model included with a Cursor subscription, and users can start it after installing with curl https://cursor.com/install -fsSL | bash and invoking agent chat with a prompt. Agent can generate files, run terminal commands, search a codebase, and now read, modify, or delete files and execute approved shell commands. The CLI is in beta, with evolving security safeguards and use limited to trusted environments.


### [GPT-5 is now available in Cursor](https://yomu.fyi/post/gpt-5-is-now-available-in-cursor.md)
- Company: [Cursor](https://yomu.fyi/company/cursor.md)
- Author: Aman Sanger
- Published: Aug 7, 2025
- Type: Announcement

Cursor has made OpenAI’s GPT-5 available to users, presenting it as a coding-focused model based on an initial internal evaluation. Five engineers report using it for long-running tasks with Background Agents, parallel foreground agents, complex debugging, and Stripe-query latency optimization, while noting that explicit instructions improved its steerability. One engineer adjusted GPT-5’s verbose default style and follow-up behavior through rules. In a monorepo with separate frontend and backend submodules, GPT-5 built a backend API endpoint and corresponding React component, regenerated protobufs, and corrected resulting type errors in one shot. During launch week, paying users receive free credits, and the announcement characterizes GPT-5 as well suited to coding and tool calling.


### [From Intern Project to Production: How I Shipped the Draw Tool for Canva's Present Mode](https://yomu.fyi/post/from-intern-project-to-production-how-i-shipped-the-draw-tool-for-canv.md)
- Company: [Canva](https://yomu.fyi/company/canva.md)
- Author: Edwina Adisusila
- Published: Aug 6, 2025
- Type: Problem & solution

Canva engineers developed and shipped a real-time drawing tool for presentation mode after user feedback highlighted it as a highly requested feature. Integrating the existing editor-bound draw functionality into presentations required resolving tight package coupling, dual-window scaling mismatches, and performance regressions. To overcome architectural boundaries, core draw logic was extracted into a shared common package using interface abstractions. Coordinate normalization resolved positioning and scaling differences across presenter and audience views, while code-splitting deferred loading the core engine until activation. As a result, presentation load time regression dropped from 7% to 0.24%, and the feature reached over 470,000 monthly active users in production.


### [It's Time to Evolve Authentication Security](https://yomu.fyi/post/it-s-time-to-evolve-authentication-security.md)
- Company: [Okta](https://yomu.fyi/company/okta.md)
- Author: Alisa Duncan
- Published: Aug 6, 2025
- Type: Explainer

Identity-based attacks and compromised credentials are driving a need for stronger authentication, while security requirements must be balanced against user friction and application sensitivity. The guidance recommends phishing-resistant factors, including smart cards, biometric-capable hardware, FIDO2 with WebAuthn, and Passkeys, while warning against security questions, SMS codes, email TOTP, and password antipatterns. It also advises using strong MFA as a backup, dynamic authentication policies and threat detection, and OAuth 2.1/OIDC through an identity provider, with step-up authentication to maintain assurances during a session. For application integration, the recommended approach is to redirect users to an Okta-hosted Sign-In Widget through vetted OIDC client libraries or Okta SDKs, reducing implementation errors in PKCE and token verification while supporting evolving standards.


### [Building financial operations agents with Hypermode and Stripe](https://yomu.fyi/post/building-financial-operations-agents-with-hypermode-and-stripe.md)
- Company: [Stripe](https://yomu.fyi/company/stripe.md)
- Author: William Lyon
- Published: Aug 6, 2025
- Type: Tutorial

Hypermode Agents and Stripe can be combined to create domain-specific financial operations agents from natural-language descriptions rather than conventional code. The workflow uses Hypermode’s Concierge to generate a system prompt, then connects the agent to Stripe through the Stripe Model Context Protocol (MCP) server and optionally to services such as Notion, Slack, and Google Calendar. With a restricted Stripe API key and sandbox data, the agent can retrieve policies, inspect customer and transaction history, apply refund rules, process payments, create invoices, and analyze subscriptions for metrics such as MRR. The examples describe partial refund decisions, onboarding workflows, campaign suggestions, and populated test environments, while the guidance recommends prompt iteration, human approval for high-value transactions, and monitoring and logging for compliance and improvement.


### [How Aaron Chasan is making the office less lonely](https://yomu.fyi/post/how-aaron-chasan-is-making-the-office-less-lonely.md)
- Company: [Notion](https://yomu.fyi/company/notion.md)
- Author: Drew Evans
- Published: Aug 5, 2025
- Type: Problem & solution

While working at Ernst & Young in 2020, Aaron Chasan heard HR leaders worry about maintaining social connection in a hybrid workplace, prompting him to build Thred. The tool asks employees who opt in to complete an interest assessment, then matches them with coworkers for one-on-one conversations around shared interests, applying a summer-camp insight about connecting isolated newcomers with socially connected peers. Platform data says employees who made a friend on Thred are 50 percent less likely to leave, and the service has expanded beyond workplaces to neighborhoods and school districts. Chasan runs Thred’s product roadmap, wikis, schedules, and other projects in Notion, which he describes as central to his professional and personal organization. He advises builders to surface common ground, start building rather than over-research, and maintain a personal connection to the problem.


### [Forward Deployed Engineering](https://yomu.fyi/post/forward-deployed-engineering.md)
- Company: [Ramp](https://yomu.fyi/company/ramp.md)
- Author: Leo Mehr
- Published: Aug 5, 2025
- Type: Explainer

Forward Deployed Engineering (FDE) is presented as a customer-facing engineering function for B2B companies that need to integrate software deeply, customize implementations, and deliver outcomes for enterprise customers. Palantir is described as creating the role after its founding in 2003, with engineers deployed at military sites and customer offices; the model later spread to companies including Scale AI, C3.ai, Databricks, and Snowflake. At Ramp, the team grew from two to 16 FDEs after emerging in fall 2023, moving from firefighting toward generalized features, platforms, and AI that support enterprise product-market fit and new verticals. Its operating model spans prospects, implementation, rollout, and long-tail support, while “always be scoping” encourages direct requirement questioning, workarounds, and generalized solutions. The hiring guidance prioritizes drive, ownership, customer empathy, and communication alongside sufficient technical fundamentals, arguing that judgment about quick fixes versus scalable solutions is central to the role.


### [MCP UI: Breaking the text wall with interactive components](https://yomu.fyi/post/mcp-ui-breaking-the-text-wall-with-interactive-components.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: 2023-10-18
- Published: Aug 5, 2025
- Type: Explainer

Model Context Protocol (MCP) can let AI agents search catalogs, interpret reviews, build carts, and support purchases, but a text-only flow does not provide the visual and interactive details central to commerce. Shopify presents MCP UI as an extension that returns embedded UI resources for components such as product cards, with delivery through inline HTML, remote resources in sandboxed iframes, or Remote DOM. Its intent-based message system keeps components from directly modifying state: actions such as view\_details, checkout, notify, and ui-size-change are surfaced for the agent to interpret, while render data lets hosts provide CSS for adaptive styling. The open-source, deliberately extensible protocol is demonstrated in a Shopify Storefront MCP UI Server prototype and is intended for commerce as well as data visualization, form builders, and media players.


### [AppLink Fundamentals III: Building with AppLink – Development Flow and Language Choices](https://yomu.fyi/post/applink-fundamentals-iii-building-with-applink-development-flow-and-la.md)
- Company: [Heroku](https://yomu.fyi/company/heroku.md)
- Author: Ken W. Alger
- Published: Jul 31, 2025
- Type: Tutorial

AppLink Fundamentals III describes how to build Salesforce extensions on Heroku, covering local testing, OpenAPI contract management, deployment workflows, and programming-language selection. For applications that receive Salesforce requests, the supplied invoke.sh script simulates production headers using Salesforce CLI data, can activate session-based permission sets, and accepts JSON payloads for testing; Pattern 1 applications that call Salesforce APIs do not require this special setup. The OpenAPI specification serves as the shared contract for endpoints and Salesforce consumers, with publish-time validation intended to catch misalignment. AppLink also supports Agentforce actions through x-sfdc agent extensions, enabling topics, publishing, input and display settings, privacy controls, and outputs such as generated PDFs in the automotive finance example. The comparison positions Apex for transaction-critical record updates and AppLink languages such as Node.js, Python, and Java for external integrations, intensive computation, elastic scaling, and reuse of existing code.


### [Introducing CIBA for Secure Transaction Verification](https://yomu.fyi/post/introducing-ciba-for-secure-transaction-verification.md)
- Company: [Okta](https://yomu.fyi/company/okta.md)
- Author: Indranil Jha
- Published: Jul 31, 2025
- Type: Explainer

CIBA addresses identity verification when an application cannot use an interactive login on the consumption device, including bank customer-service changes, retail POS payments, browser-constrained devices, and shared kiosks. Client-Initiated Backchannel Authentication decouples authentication from the application: a client sends a back-channel request to an OAuth 2.0 authorization provider, while the user approves it on a separately enrolled phone or smartwatch. CIBA extends OpenID Connect with a grant type, discovery metadata, and poll, ping, and push token-delivery modes; in the described banking flow, the application receives a user-scoped token to update the email address. The approach improves least-privilege access and avoids exposing credentials on shared devices, but can enable MFA-fatigue-style attacks, should not be used same-device, and may warrant device code flow in some cases.


### [FlashList v2: A ground-up rewrite for React Native's New Architecture](https://yomu.fyi/post/flashlist-v2-a-ground-up-rewrite-for-react-native-s-new-architecture.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: 2023-10-18
- Published: Jul 31, 2025
- Type: Announcement

FlashList v2 is a ground-up rewrite of the React Native list component, aimed at removing v1’s dependence on item-size estimates, native layout corrections, and imprecise scrolling. Built for React Native’s New Architecture, it uses synchronous layout measurements to correct positions before paint and eliminates the need for native code. Its algorithm combines progressive rendering, predictions updated by item type, and rapid corrections, while adaptive rendering responds to scroll velocity, direction, and device performance. The new scrolling system progressively refines target positions for precise scrollToIndex operations, and horizontal lists can contain resizable items and coordinate with parent lists. The release also adds scroll-position maintenance, improved masonry support, recycle-pool controls, helper hooks, and better web support; benchmarks report up to 50% less blank area while scrolling than v1 on the new architecture.


### [AppLink Fundamentals II: Advanced AppLink Integrations – Automation & AI](https://yomu.fyi/post/applink-fundamentals-ii-advanced-applink-integrations-automation-ai.md)
- Company: [Heroku](https://yomu.fyi/company/heroku.md)
- Author: Ken W. Alger
- Published: Jul 30, 2025
- Type: Explainer

Heroku AppLink lets connected Heroku applications extend Salesforce through Data Cloud, Flow, Apex, and Agentforce, bringing external logic, real-time data processing, and automation into Salesforce orgs. It uses an OpenAPI YAML or JSON specification, including x-sfdc metadata for authentication and permissions, to generate strongly typed Apex classes, Flow External Service definitions, Agent Actions, and related Connected App and Permission Set configurations. Developers can invoke services synchronously or asynchronously from Apex, use operations as no-code Flow actions, and configure Agentforce to call endpoints for specialized processing; callbacks support longer-running work. AppLink uses User Mode authentication by default, while administrator-controlled Permission Sets can temporarily elevate access during execution without changing a user’s permanent permissions.


### [AppLink Fundamentals I: AppLink Integration Patterns – Connecting Salesforce to Heroku Applications](https://yomu.fyi/post/applink-fundamentals-i-applink-integration-patterns-connecting-salesfo.md)
- Company: [Heroku](https://yomu.fyi/company/heroku.md)
- Author: Ken W. Alger
- Published: Jul 29, 2025
- Type: Tutorial

AppLink Fundamentals I describes four integration patterns for connecting Salesforce orgs with Heroku applications, focusing on API access and Salesforce extension. Pattern 1 uses run-as-user authentication for automated or customer-facing applications, with the AppLink add-on, CLI plugin, optional SDK, named authorizations, and SOQL queries through the Data API; the SDK manages authentication, session management, and connection pooling for single- or multi-org access. Pattern 2 lets Salesforce users invoke published Heroku services through Flow, Apex, or Agentforce, using User Mode or elevated “user mode plus” permissions controlled by Permission Sets, an OpenAPI description, and a service-mesh buildpack that blocks external access. The post also positions batch processing and real-time eventing as extensions of these patterns, and describes Data Cloud querying and Data Action Targets for applications to receive Data Cloud events.


### [Secure Your Express App with OAuth 2.0, OIDC, and PKCE](https://yomu.fyi/post/secure-your-express-app-with-oauth-2-0-oidc-and-pkce.md)
- Company: [Okta](https://yomu.fyi/company/okta.md)
- Author: Akanksha Bhasin
- Published: Jul 28, 2025
- Type: Tutorial

Building authentication from scratch is risky and time-consuming, so the tutorial integrates Okta with an Express application using Passport, openid-client, OAuth 2.0, and OpenID Connect (OIDC). It creates a role-based expense dashboard in which users view spending data for their assigned teams, with team membership mapped from the email claim in the ID token. The setup uses Authorization Code Flow with PKCE, defined in RFC 7636, alongside express-session, EJS views, environment variables, and Okta redirect URI configuration. The sample project includes routes for login, logout, dashboard, profile, and team-specific expenses, while the running app displays these authenticated views. It concludes that OIDC supplies the identity layer over OAuth 2.0 and presents PKCE as a security baseline for server-side and browser-based web applications.


### [How Sarah Jutras is teaching the world how to work for themselves](https://yomu.fyi/post/how-sarah-jutras-is-teaching-the-world-how-to-work-for-themselves.md)
- Company: [Notion](https://yomu.fyi/company/notion.md)
- Author: Drew Evans
- Published: Jul 24, 2025
- Type: Explainer

Sarah Jutras moved from junior UX designer to director of interaction design before age thirty, but repeated conflicts with startup hustle culture, demanding bosses, and corporate work led her to leave her tech job in 2016. She now runs Huzzah Studio, a product design practice serving clients including Instacart and Imperfect Produce, while also leading Freelance for Life, a community launched in 2022 that has helped more than one thousand professionals design freelance practices. She uses Notion as a hub for client relationships, with a customer relationship manager, onboarding guides, and project boards, and created a Business Kit covering finance, business development, client experience, and work-life balance. Her guidance emphasizes identifying the audience and its problem, treating business building as an experiment, and designing a supportive team through community, collaboration, and public learning.


### [Bugbot is out of beta](https://yomu.fyi/post/bugbot-is-out-of-beta.md)
- Company: [Cursor](https://yomu.fyi/company/cursor.md)
- Author: Jon Kaplan, Lee Danilek & Rohan Varma
- Published: Jul 24, 2025
- Type: Announcement

Cursor has released Bugbot, a code review agent that automatically analyzes pull-request changes for logic bugs, edge cases, and security issues before production. It runs automatically on pull requests, gathers context from changes to understand code intent, and comments detected issues directly where they occur. Teams can steer reviews with custom BUGBOT.md rules, then send flagged issues to Cursor or launch a background agent on the web with one click. During its beta, Bugbot reviewed over 1 million PRs and found over 1.5 million issues; more than 50% of identified bugs were resolved before merge. Cursor also reports adoption by several companies, with testimonials citing review-time savings, strong bug detection, and confidence reviewing AI-generated code.


### [The evolution of Grab's machine learning feature store](https://yomu.fyi/post/the-evolution-of-grab-s-machine-learning-feature-store.md)
- Company: [Grab](https://yomu.fyi/company/grab.md)
- Author: Daniel Tai
- Published: Jul 24, 2025
- Type: Explainer

Grab describes how it evolved its machine learning feature store as increasingly complex models began requiring high-cardinality keys and high-dimensional data. It replaced its initial Amphawa approach with feature tables: data-lake tables whose contents are atomically ingested into serving storage, with emphasis on consistency and reproducibility. The workflow stores feature tables and version-control metadata as Parquet objects in Amazon S3, validates schemas, loads data through reverse ETL into Aurora Postgres, and warms new tables through shadow reads before switching. The redesign supports contextual retrieval, atomic collection-wide updates, and isolation between reading and writing capacity; its SDK remains a thin database-driver wrapper that translates queries to SQL. Grab also chose decentralised deployments for version flexibility, rollout strategies, noisy-neighbor mitigation, and improved caching, concluding that Amazon Aurora for Postgres provides a robust, scalable, cost-effective foundation.


### [Unleashing new AI capabilities for popular frameworks in Firebase Studio](https://yomu.fyi/post/unleashing-new-ai-capabilities-for-popular-frameworks-in-firebase-stud.md)
- Company: [Google](https://yomu.fyi/company/google.md)
- Author: Jeanine Banks, Vikas Anand
- Published: Jul 23, 2025
- Type: Announcement

Firebase Studio announced updates to its cloud-based AI workspace that combine Gemini with Agent modes, Model Context Protocol support, and Gemini CLI across Flutter, Angular, React, Next.js, and Web projects. AI-optimized templates default to autonomous Agent mode and include airules.md files that give Gemini framework-specific guidance on coding standards, error handling, dependencies, and development practices. Developers can prompt Gemini to recommend Firebase backend services, import libraries or packages, update code, and explain additional setup steps. Workspace forking preserves an identical copy and the original’s entire agent chat history, supporting backups, experimentation, debugging, and collaboration, while enhanced prompts and a 100MB project upload limit broaden the workflow. The editor’s note says Firebase Studio will sunset on March 22, 2027, with lessons from its preview moving to Google AI Studio and Google Antigravity.


### [First Block with Varun Anand, cofounder of Clay](https://yomu.fyi/post/first-block-with-varun-anand-cofounder-of-clay.md)
- Company: [Notion](https://yomu.fyi/company/notion.md)
- Author: Anastasia Crew
- Published: Jul 22, 2025
- Type: Explainer

First Block features Varun Anand, cofounder of Clay, discussing the company’s path from a horizontal spreadsheet tool to a specialized go-to-market platform at the intersection of GTM and AI. He argues that product-market fit can emerge from curiosity, authenticity, and unique insights rather than rigid goal-setting or conventional market sizing. Clay changed its sales motion from seven demos for a $200/month product to self-serve after running eight daily “reverse demos,” in which customers brought real problems for 20–25 minute sessions that informed rapid iteration. Anand also describes hiring people without prior experience in the role, including more than half of Clay’s non-engineering team, and connecting flexible compensation with varied perspectives and competitive advantages.


### [Create a React PWA with Social Login Authentication](https://yomu.fyi/post/create-a-react-pwa-with-social-login-authentication.md)
- Company: [Okta](https://yomu.fyi/company/okta.md)
- Author: Emmanuel Jesulayomi Folaranmi
- Published: Jul 22, 2025
- Type: Tutorial

The tutorial builds a React Progressive Web App (PWA) called Lister, combining offline support with authentication through Okta and Google Social Login. It creates an Okta OIDC single-page application, configures Authorization Code and Refresh Token grants, sets localhost redirect URIs, and wires Okta React and AuthJS into React Router routes. The implementation uses environment variables for the Okta domain and client ID, OAuth 2.0 and OpenID Connect scopes including openid, profile, email, and offline\_access, and a Vite PWA plugin to provide a manifest, service worker, and installable behavior. Authenticated users receive a todo-list interface with CRUD operations, while the article notes that production deployments would need more advanced service-worker configuration and a proper database.


[Newer posts](https://yomu.fyi/posts/page/174.md) · [Older posts](https://yomu.fyi/posts/page/176.md)