Every post, summarised

Oct 2, 2026

• Hugging Face

  Open-sourcing AstaBrief, the fast report-generation model in Asta

  AstaBrief is an open-weights 8B-parameter model developed by Ai2 for generating cited scientific reports from a research question and literature excerpts, designed for evidence-grounded outputs. It was trained from Qwen3-8B using supervised fine-tuning on 47K filtered real user queries and direct preference optimization, focusing on data quality. Unlike Asta’s Thinking mode, which uses a multi-step pipeline, AstaBrief writes the full report in a single pass to reduce generation time. In Asta’s Fast mode, it averages 51.1 seconds per report versus 178.5 seconds for Thinking mode, roughly 3.5× faster, while competitive on answer and citation quality. The model and training data are open-sourced on Hugging Face, enabling institutions to deploy behind their own firewall and supporting future open scientific models.

• Cloudflare

  Introducing Web Search API via AI Gateway

  Cloudflare launched a Web Search API via AI Gateway, partnering with Ceramic.ai, Exa, and Linkup, to provide grounded intelligence by letting AI agents search the web instead of guessing URLs that return 404 errors. The API injects live, structured snippets into inference pipelines, giving models access to information beyond their training cutoff, such as new Birthday Week releases, and grounding agent responses with real-time data. Developers can integrate via AI Gateway credits, a direct REST endpoint with curl, or Workers bindings with one line of code. Partners commit to Cloudflare’s verified bot standards, including identifying crawlers, respecting robots.txt, and providing source links for transparency. Web search calls are logged in AI Gateway observability, billed at list pricing without markup, support Bring-Your-Own-Key and Zero Data Retention, with native server tools coming soon.

• Red Hat

  Benchmarking AI decision models against traditional guardrails

  Enterprise generative AI applications require guardrails that balance flexibility with reliability. Decision models such as TypeSafe AI’s Jev produce fixed decisions with guaranteed schema and type safety, operating faster and cheaper than LLM-as-a-judge approaches. The Red Hat AI Safety team benchmarked nine guardrails across four methodologies for prompt injection and content safety tasks: pre-trained CPU-scale classifiers like Red Hat’s DeBERTa-v3 and Granite Guardian HAP-125m, older zero-shot models like BART-large-mnli, modern LLM-as-a-judge safety models including Shieldstral and Nemotron-3.5, and Jev-style decision models including Laya and DiffusionGemma. Each guardrail was evaluated using stock and custom risk policies, with Jev and DiffusionGemma using zero-shot questions. The results highlight trade-offs: Jev provides zero-shot flexibility and low latency, but purpose-built classifiers often match its speed and cost while delivering superior task-specific performance, and LLM-as-a-judge models can be tuned for higher accuracy.

• Red Hat

  Kube AuthKit: Unified Kubernetes and OpenShift auth in Python

  Kube AuthKit is a lightweight Python library that unifies Kubernetes and OpenShift authentication behind a single API, eliminating conditional code paths across local, pod, notebook, and CI/CD environments. It supports four strategies—kubeconfig, in-cluster, OIDC, and OpenShift OAuth—auto-detected by an AuthFactory that probes environment variables and in-cluster markers in a defined order. The library handles token lifecycle transparently, with in-memory storage by default and optional OS keyring persistence for local development to avoid repeated logins. It provides two OIDC flows: device code for headless environments and authorization code with PKCE for interactive applications, both with automatic token refresh. Kube AuthKit returns a standard Kubernetes Python client ApiClient, ensuring full compatibility with the official library, and is actively maintained by the Open Data Hub community for OpenShift AI environments.

• Red Hat

  Smarter GPU sharing: How Red Hat build of Kueue works with dynamic resource allocation

  The Kubernetes device plugin model treats GPUs as anonymous integers, making fair sharing impossible because a full 80 GB GPU and a 5 GB partition both consume ‘1’ from the same quota. Dynamic resource allocation (DRA), generally available in Kubernetes 1.34, replaces this by having drivers advertise real device attributes like memory and compute capability, but DRA alone does not address quota management or preemption. Red Hat build of Kueue 1.4 on Red Hat OpenShift integrates with DRA to enforce quota, borrowing, and preemption for both whole GPUs and partitionable devices using device-count or counter-based memory accounting. For partitionable GPUs, Kueue reads counter data from DRA drivers and charges GPU memory against ClusterQueue quota instead of device count, enabling accurate fair sharing between training and inference workloads. Future developments include extended resources for simpler adoption without ResourceClaimTemplates, consumable capacity for dynamic time-slicing, and scheduler-library integration to verify scheduling feasibility.

• Cloudflare

  8 major updates to Cloudflare Observability

  Cloudflare announced eight major updates unifying logs, traces, analytics, alerts, dashboards, and data export into one observability platform with simplified pricing. The new Logs home combines Workers Observability and Log Explorer, letting users query datasets like HTTP events, firewall events, Workers, and R2 using SQL or filters. Cloudflare Traces, now in open beta, provides request-level visibility across security rules, transformations, caching, routing, Workers, and origin, with OpenTelemetry export and W3C trace context propagation. A unified SQL API lets humans and agents query telemetry across Cloudflare products, and custom alerts can be set on any dataset using threshold, anomaly, or SLO conditions. Pricing shifts to a volume-based model for ingested and stored logs and traces, effective December 1, 2026, with free tier at 0.5 GB ingestion per day and paid plans starting at 50 GB ingestion per billing cycle.

• Cloudflare

  Introducing Cloudflare Traces: follow requests through our entire platform

  Cloudflare Traces, in open beta, extends tracing beyond Workers to the full request path, capturing spans for security, transformations, cache, routing, Workers, and origin handling in one timeline. Users set a baseline sampling rate and use Trace Rules to override it for specific traffic, enabling targeted debugging without increasing volume across the domain. The feature accepts and forwards W3C traceparent headers for distributed tracing and exports spans via OTLP to any compatible backend, with no instrumentation required. It reveals why a request was blocked, which rule acted, whether the URL was rewritten, and where time was spent between cache, origin, and the application. Pricing, effective December 1, 2026, is based on ingestion and retention: free tier 0.5 GB daily with 7-day retention, paid plans 50 GB ingestion and up to 365-day retention.

• Cloudflare

  Updates on our pledge to make Cloudflare features accessible to everyone

  Cloudflare CTO Dane Knecht pledged a year ago to make every Cloudflare feature available to all customers, not just Enterprise. The company has since expanded Logpush and Logpush Transformers, which use SQL to filter, redact, and reformat logs, to Free, Pro, and Business plans. Custom Dashboards for personalized metrics are now available to all customers. Role-Based Access Control (RBAC) has been extended to nearly all products, including resource-level roles for Workers, and a New Account button lets users create additional accounts directly. Organizations, which group accounts for unified analytics and shared configurations, are in beta for Enterprise and will reach free accounts in early 2027, and platform limits have also been raised, including Workers subrequests from 50 to 100 and Durable Objects idle time from 70–140 seconds to 15 minutes with active outbound connections.

• Cloudflare

  Announcing Cloudflare OHTTP Gateway – expanding access to Cloudflare’s privacy-preserving infrastructure

  Cloudflare announced the closed beta of its OHTTP Gateway, a managed service that decapsulates encrypted OHTTP requests for application servers while preserving client privacy and expanding access to privacy-preserving infrastructure. OHTTP is an IETF standard that uses two independent hops—a relay and a gateway—to hide client IP addresses and TLS fingerprints from app servers, ensuring no single party sees both client identifiers and request contents. The new Gateway is designed for customers whose app servers are already behind Cloudflare, allowing them to use a third-party relay while Cloudflare handles the cryptographic work, for example with Apple’s LiveCallerID. Cloudflare also renamed its existing Privacy Gateway product to Cloudflare OHTTP Relay to better distinguish the two product options. The Gateway runs on Cloudflare’s global edge network to minimize latency, and developers can implement OHTTP clients using sample libraries while joining a waitlist for the paid add-on.

• Cloudflare

  Follow the thread: a new dashboard to investigate account abuse

  Cloudflare’s new Account Abuse Protection dashboard helps fraud teams investigate account abuse by moving beyond stateless identity checks to a stateful trust model. The dashboard uses cryptographically hashed identifiers, called Hashed User IDs, created from customer-provided identifiers like email or username, to anchor account activity across login and signup events. It provides an account population overview with metrics like total events, unique IPs, and devices to spot anomalies such as leaked credential matches or unusual login failure rates, then allows analysts to filter and drill into individual accounts. Each account view shows historical behavioral, network, and device signals, enabling teams to reconstruct events and decide on responses like WAF rules. The dashboard also introduces two new roles—Account Abuse Protection and Account Abuse Protection PII—to enforce least privilege for dashboard access and PII exposure.

• Cloudflare

  Protected Quick Tunnels: simple accountless authentication for your next dev project

  Cloudflare’s Quick Tunnels now support email-based access control via the –allowed-mail flag, requiring no account on either side. The feature addresses the risk of exposing sensitive work, especially as AI coding agents increasingly use tunnels to share previews. Cloudflare Access verifies the visitor’s email with a one-time PIN, while cloudflared on the developer’s machine authorizes the request against a local rule list. The guest list never leaves the developer’s machine, and the tunnel remains accountless and free. The feature was built and shipped by two interns, Hugo Vicente and Alessandro Frigerio.

• Cloudflare

  Building for good: How civil society organizations are automating on Cloudflare

  Cloudflare awarded $7.5 million in credits to 30 civil society organizations to build automation tools using Workers AI and AI Gateway on its global network. LebTown replaced manual editorial workflows with a custom management system, and Kaya Guides built a WhatsApp mental health app processing 500,000 messages monthly with real-time counselor feedback. Larger groups like Freedom House and Article One received volunteer engineering support to build tools for tracking transnational repression and assessing human rights risks from factory audits. Cloudflare’s developer services include automatic DDoS protection and data minimization, addressing privacy and cost barriers that have limited AI adoption in the sector. The program is now open for a second cohort of non-profit organizations to apply for up to $250,000 in credits.

• Cloudflare

  2026 Birthday week: network performance update

  Cloudflare is now the fastest provider in 74% of the top 1,000 global networks, up from 60% in April 2026, representing an additional 150 networks and 38 countries. Performance is measured using connection time (TCP handshake) and the trimean of connection times, which combines the 25th, 50th, and 75th percentiles to reduce outlier influence. To expand data collection, Cloudflare introduced a new methodology using Challenge Pages, which run non-interactive background measurements fetching lightweight files from providers including Cloudflare, Amazon CloudFront, Google, Fastly, and Akamai. Challenge Pages are delivered by Turnstile and preserve privacy while providing broader reach than error-page measurements alone. This increased measurement volume narrows confidence intervals around trimean values, making rankings more stable in networks where top providers are separated by only a millisecond or two.

• Databricks

  Real-Time Retail Intelligence: Building E-Commerce Recommendations with Lakebase and AI Search on Databricks

  The post presents a reference architecture for building a production-grade e-commerce recommendation system on Databricks, based on a real-world implementation for a leading fashion e-commerce platform in Asia serving over 1 million monthly active users across 100,000+ SKUs. The system ingests approximately 1,000 events per second via Lakeflow Connect’s Zerobus into Unity Catalog Delta tables within a medallion architecture. Serving uses two paths: Path A for pre-computed batch recommendations via key-value lookup from Lakebase online tables, and Path B for real-time session-aware scoring using AI Search and a LightGBM model in a 3-stage funnel. The architecture unifies ingestion, feature management, model training, vector retrieval, and serving on a single governed platform, with cold-start handling for new users and products. Expected outcomes include low 2-digit millisecond responses, daily-fresh recommendations, and unified governance via Unity Catalog.

• Clickhouse

  What is direct I/O, and why does ClickHouse Managed Postgres use it for backups?

  A base backup reads every byte of a live database off the same NVMe drives that serve queries. Buffered reads go through the kernel page cache, evicting warm database pages and adding a kernel copy per byte. Direct I/O skips the cache, leaving Postgres’s warm data in place, but also disables kernel readahead. On a RAID0 array, small direct reads hit only one drive, so ClickHouse Managed Postgres sizes each direct read to span the whole stripe and scales the reader count to the hardware. On a 48 vCPU box with four NVMe drives and a 467 GB database, the direct I/O backup evicted nothing, cut query latency impact by about two thirds, used about 14% less CPU, and finished in 71 seconds.

• Hugging Face

  AutoSynthData: Generating Training Data for Enterprise Agents

  AutoSynthData, built by ServiceNow CoreAI, generates training data for enterprise agents by targeting capability gaps from evaluation, using a stronger teacher such as Qwen3.8-27B to demonstrate successes. It uses a target model’s failures and a stronger teacher’s successes to decide what to learn next. The system produces tasks composing a system specification, user prompt, and verifier, ensuring feasibility, realism, and difficulty against the target environment. After sample-level checks and batch-level review, the dataset grows via target and multiply phases, generating 2,000 samples in 18 hours for the Hybrid domain. In EnterpriseOps Gym, synthetic SFT on Gemma-4-26B-A4B-it improved mean Pass@1 by 7.2 points (35% relative) in Hybrid and from 18.77% to 27.18% in ITSM, showing the approach works across domains.

• Twilio

  How to Create and Send vCards with Go

  Sharing contact details by copying text between apps is ineffective compared to sending a vCard, a structured data format supported by major operating systems and email clients. This tutorial demonstrates creating vCards in Go using the go-vcard package, which handles fields such as formatted name, structured name, street address, telephone number, email address, and URL. The code writes the vCard to a .vcf file with version 4.0 using the go-vcard encoder and constants from the package, exiting on failure. The vCard file is uploaded to Twilio Assets, a static file hosting service bundled with every Twilio account, to make it publicly accessible for the SMS. The Twilio Go SDK sends an SMS with a message body and the vCard URL as a media attachment via the Programmable Messaging API, allowing recipients to open it in their contacts app.

• Twilio

  How to Track Opt-Outs in PHP

  This tutorial demonstrates building a PHP application that records customer opt-out preferences from SMS replies using Twilio’s Incoming Message Webhook and Event Streams, which require PHP 8.5, Composer, and SQLite. When the SMS body is an opt-out keyword such as STOP, START, or HELP, Twilio includes an OptOutType parameter in the webhook request, which the application checks using strcasecmp and array_first. The application, based on the Twilio Slim Base project, stores the opt-out status and account SID in an SQLite database via PHP-DB and laminas-servicemanager, using a TableGateway for the user_optouts table. The handleWebhook() function validates the OptOutType against class constants (OPT_OUT_TYPE_START, OPT_OUT_TYPE_STOP, OPT_OUT_TYPE_HELP) and inserts a record before returning a TwiML response. Twilio already blocks further messages for standard opt-outs, but local recording enables advanced actions like syncing a CRM; the tutorial covers bootstrapping, configuring Twilio messaging services with Advanced Opt-Out, using ngrok, and verifying with an SQL query.

• Twilio

  How to Get Started With WebRTC: Intro to Browser APIs

  WebRTC provides browser APIs for real-time voice, video, and data sharing without plugins, with mandatory encryption via DTLS-SRTP and DTLS; the standard became a W3C Recommendation in January 2021. The core APIs are getUserMedia for capturing audio/video from user devices, RTCPeerConnection for peer-to-peer media exchange via offer/answer and ICE candidates, and RTCDataChannel for arbitrary data transfer. WebRTC is supported by all major browsers and used by services like Google Meet, Discord (which uses media servers for group calls to avoid expensive peer-to-peer), and AI voice agents. Twilio offers Video and Voice JavaScript SDKs that handle signaling and media relay, enabling calls to phone numbers and SIP endpoints. The post includes a camera preview example using getUserMedia that requires a secure origin and can be served with Python, then directs readers to Twilio’s quickstart tutorials for building video and voice applications.

• Apple

  Limits of Confidence in Diffusion

  The post analyzes limitations of confidence-based ranking in discrete diffusion, where sequences are generated by writing multiple token positions per step from per-position distributions. It shows that a step matches the training distribution only when the written positions are conditionally independent given fixed tokens, and no product of per-position distributions can match a dependent group. Additionally, per-position distributions do not determine group dependence: two joint distributions can have identical per-position marginals but differ in value combinations. On the synthetic ScanAndAdd task, every group of two or more undetermined positions written by a confidence ranking is dependent, and the generated distribution is 29 times the sampling-noise floor in total variation, with per-sample metrics at 1.0. The post also includes updates on two related readings: on-policy distillation for reasoning models and self-supervised learning with Transformers.