---
title: "Latest reads"
description: "The engineering internet, summarised so you can actually read it."
---

# Latest reads
> The engineering internet, summarised so you can actually read it.

## Articles

### [Reflecting on the Five Years of Bug Bounty at Grab](https://yomu.fyi/post/reflecting-on-the-five-years-of-bug-bounty-at-grab.md)
- Company: [Grab](https://yomu.fyi/company/grab.md)
- Author: Ajay Srivastava
- Published: Dec 16, 2020
- Type: Explainer

Grab launched a private bug bounty programme on HackerOne before opening it publicly in 2017 to complement internal product security efforts. Prior to going public, the team conducted security sweeps, established policies, and expanded the testing scope to prepare for an influx of reports. Operationally, the team opted to pay full bounties immediately upon report triage rather than waiting for vulnerability resolution to incentivize security researchers. Noise reduction was handled using HackerOne Triage, Human-Augmented Signal, and by blocking automated scanning networks targeting Grab's infrastructure. In addition, rotating security engineers weekly and integrating HackerOne APIs with PagerDuty ensured fast initial response times.


### [Making the Supabase Dashboard Supa-fast](https://yomu.fyi/post/making-the-supabase-dashboard-supa-fast.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: Inian Parameshwaran
- Published: Dec 13, 2020
- Type: Problem & solution

Adding features to the Supabase single-page application dashboard risked performance regressions due to increasing JavaScript bundle sizes. To establish a baseline, the engineering team introduced next-bundle-analyzer and tracked Real User Monitoring alongside Core Web Vitals using Sentry. Optimization efforts focused on pruning dependencies, which included swapping Moment.js for day-js, replacing Joi with ajv, reverting crypto-js to version 3.3.0, and moving the 388 KB zxcvbn password module to a backend API. The team also implemented Next.js dynamic imports for heavy components like spreadsheet parsing, removed legacy server-side props to unlock Automatic Static Optimization, and configured long cache headers on assets. These architectural adjustments brought Core Web Vitals within recommended thresholds and lowered client-side page transition payloads below 200 KB of JavaScript.


### [Extend Flows with Heroku Compute: An Event-Driven Pattern](https://yomu.fyi/post/extend-flows-with-heroku-compute-an-event-driven-pattern.md)
- Company: [Heroku](https://yomu.fyi/company/heroku.md)
- Author: Chris Marino
- Published: Dec 11, 2020
- Type: Tutorial

The post presents an event-driven pattern for extending Salesforce Flow with custom business logic deployed as a Heroku app and exposed as an external service. It uses an OpenAPI specification to define the interface, generates a Node.js application stub, adapts it for Heroku with a Procfile and port configuration, and registers the API in Salesforce. Flow accesses the service through a Named Credential using basic HTTP authentication, while the Heroku app authorizes Salesforce access with a JWT account token and API token. The example begins with product retrieval and then adds a Get Inventory method that can read inventory and update the Salesforce Product object. A Platform Event can trigger a flow that calls this method, while programmers and low-code builders iterate against the shared API contract before completing their work independently.


### [New VMs: more RAM, extra CPU, and a dollar menu](https://yomu.fyi/post/new-vms-more-ram-extra-cpu-and-a-dollar-menu.md)
- Company: [Fly.io](https://yomu.fyi/company/fly-io.md)
- Published: Dec 10, 2020
- Type: Announcement

Fly.io introduces new virtual-machine configurations after developers shifted attention from CPU-intensive workloads such as image processing, machine learning predictions, and video transcoding toward databases, which need higher RAM-to-CPU ratios. Shared-cpu VMs offer up to 2GB of RAM, while dedicated-cpu VMs reach 64GB across configurations with one, two, four, or eight dedicated CPUs. Shared-cpu-1x pricing starts at $1.94 per month for 256MB and reaches $10.70 for 2GB; dedicated-cpu-1x with 2GB costs $31 per month. The pricing model combines dedicated hardware with shared CPU capacity, averaging 12 shared VMs per CPU and using cgroups priorities and relocation to manage contention. Persistent storage remains unavailable, so the post says ephemeral VMs are unsuitable for database applications and that Fly.io should offer storage.


### [Resiliency Planning for High-Traffic Events](https://yomu.fyi/post/resiliency-planning-for-high-traffic-events.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: 2023-10-18
- Published: Dec 10, 2020
- Type: Explainer

Shopify’s preparation for Black Friday Cyber Monday (BFCM) centers on building and maintaining resiliency practices for a high-traffic platform and large development teams. Regular load and stress tests verify required capacity, probe limits, detect regressions, and compare behavior across differently configured shops. Teams document expected user experiences and dependency failure modes in a resiliency matrix, then use game days to test that model against reality, including alerts, paging, operator readiness, and response procedures. Incident analysis treats disruptions as learning opportunities rather than stopping at a single “root cause”; nearer to BFCM, Shopify slows feature and service changes while increasing work on performance, reliability, scale, runbooks, tools, and bottlenecks. The source says these practices support a platform that powered over $5.1 billion in sales.


### [Simplify, Batch, and Cache: How We Optimized Server-side Storefront Rendering](https://yomu.fyi/post/simplify-batch-and-cache-how-we-optimized-server-side-storefront-rende.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: 2023-10-18
- Published: Dec 10, 2020
- Type: Explainer

The post explains how a new Ruby-based server-side Storefront Renderer reduced the time required to serve Shopify storefront requests. It combines MySQL multi-statement queries, handcrafted SQL, a thin data-mapping layer built from plain old Ruby objects, query book-keeping with eager- and lazy-loading, multiple LRU caching layers, and techniques for reducing memory allocations. For a product page, one database round trip can load the product, variants, images, shop, theme, and related resources; later requests can replay previously observed queries early, while less frequently used data remains lazy-loaded. The resulting renderer serves 75% of requests in under ~45ms, 90% in under ~230ms, and 99% in under ~900ms, with average response time nearly five times faster than the previous implementation.


### [Incoming! 6PN Private Networks](https://yomu.fyi/post/incoming-6pn-private-networks.md)
- Company: [Fly.io](https://yomu.fyi/company/fly-io.md)
- Published: Dec 8, 2020
- Type: Announcement

Fly.io introduces 6PN, an IPv6 private network intended to let applications in the same organization communicate without public IP addresses, mTLS, or certificates. Each application instance receives an organization-scoped IPv6 address, while per-application internal DNS zones resolve instances, regions, and sibling apps; enabling it requires private\_network = true in fly.toml, though the post says it will soon be on by default. Examples show nginx discovering cache shards, Redis binding to fly-local-6pn, and NATS forming a cross-application cluster through internal names. Behind the feature, addresses encode organization, host, and instance identifiers, while BPF programs enforce network isolation and support WireGuard cryptokey routing; a Rust DNS server serves internal records. The stated goal is simple private connectivity with optional user-managed clustering, service discovery, and certificate infrastructure.


### [How to Reliably Scale Your Data Platform for High Volumes](https://yomu.fyi/post/how-to-reliably-scale-your-data-platform-for-high-volumes.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: 2023-10-18
- Published: Dec 8, 2020
- Type: Problem & solution

Shopify’s data platform prepared for BFCM 2020, when merchant sales exceeded $5.1 billion and platform throughput rose by an average of 150 percent. The Data Platform Engineering team focused on throughput risk, which grows with volume and is greatest near ingestion and processing, while prioritizing work through four service tiers. For Tier 1 and Tier 2 systems, engineers defined each service’s primary objective, identified adjustable controls such as job frequency, overlap intervals, CPU and memory requests, BigTable node pools, and ProxySQL connection queues, then used controlled load tests to expose capacity and recovery risks. The resulting work included cluster scaling, load-balancing adjustments, query and job tuning, and improved indices, schemas, dashboards, playbooks, SLOs, incident handling, and alerts. The post reports that BFCM 2020 completed without merchant-impacting incidents; only a handful of minor, self-healing incidents occurred, while monitoring and occasional tuning preserved spare capacity.


### [Organizing 2000 Developers for BFCM in a Remote World](https://yomu.fyi/post/organizing-2000-developers-for-bfcm-in-a-remote-world.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: 2023-10-18
- Published: Dec 7, 2020
- Type: Problem & solution

Shopify organized a cross-company program to prepare its platform for Black Friday and Cyber Monday (BFCM), coordinating more than 2,500 people responsible for over 1,000 deploys across services. Engineering Program Managers absorbed administrative, communication, and reporting work so BFCM leads could focus on technical challenges, while departmental champions assigned preparation tasks. Preparation covered maintenance, game days, load tests, capacity increases, weekly tracking, and a Caution Tape bot requiring risk-to-value assessments for pull requests in critical areas. Deploys were slowed through smaller batches, longer canaries, and a planned weeklong lock while communication used Slack, GitHub, documentation, presentations, emails, and office hours. The effort coincided with $5.1+ billion in BFCM sales and load testing plus resource scaling paid off, but developer productivity declined amid inconsistent messaging; future plans called for a more balanced approach, automation, and reusable communication templates.


### [The State of Ruby Static Typing at Shopify](https://yomu.fyi/post/the-state-of-ruby-static-typing-at-shopify.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: 2023-10-18
- Published: Dec 7, 2020
- Type: Explainer

Shopify’s Ruby monolith receives about 400 commits and 40 deployments daily, spanning 37,000 files, 622,000 methods, and over 2,000,000 calls, making correctness difficult despite rigorous review and 150,000 automated tests. Since 2018, Shopify’s Ruby Infrastructure team has pursued static typing and adopted Sorbet, discussed in a 2020 Shipit! event. The post describes Sorbet’s handling of simple collections such as T::Array\[Integer\], nested types using T.untyped, and dedicated classes for complex structures, while noting obstacles involving ActiveSupport::Concern, implicit inclusion requirements, metaprogramming, and dynamic GraphQL resolvers. For Rails projects, guidance is to begin with typed: false, generate RBI files using Tapioca or sorbet-rails, then move suitable files toward typed: true based on reuse, errors, collaboration, or churn, checking generated files into the repository.


### [A World Rendered Beautifully: The Making of the BFCM 3D Data Visualization](https://yomu.fyi/post/a-world-rendered-beautifully-the-making-of-the-bfcm-3d-data-visualizat.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: 2023-10-18
- Published: Dec 4, 2020
- Type: Explainer

The 2020 Black Friday Cyber Monday Globe and a related Live View visualization had to represent orders from one million merchants within two months while remaining realistic and performant. The team used a reusable layer architecture with three.js, physically based rendering, 32-bit EXR environment maps, and custom materials and shaders for the Earth and carbon-offset bubble effects. To display thousands of orders, it replaced arc-heavy rendering with particle-based visuals built from Points, BufferGeometry attributes, and ShaderMaterial. An automatic optimizer monitors frame rate and, when it stays below 55 fps for more than two seconds, lowers canvas pixel ratio to 1x and reduces environment-map resolution, helping low-power devices return to 60 fps. The resulting implementation became an internal library for future globes.


### [How Grab is Blazing Through the Superapp Bazel Migration](https://yomu.fyi/post/how-grab-is-blazing-through-the-superapp-bazel-migration.md)
- Company: [Grab](https://yomu.fyi/company/grab.md)
- Author: Sergii Grechukha
- Published: Dec 3, 2020
- Type: Problem & solution

Grab's mobile superapp scaled past 2.5 million lines of code across both Android and iOS, leading to unsustainable local and CI build times under Gradle and Xcode. To address these bottlenecks, the engineering team analyzed their dependency trees and introduced an internal tool to calculate and optimize the build critical path. They also deployed a Kubernetes-autoscaled remote build system using Mainframer for Android and implemented Test Impact Analysis to run only affected tests in pre-merge validation. While dependency decoupling yielded modest 7% to 10% gains and iOS remote builds proved unscalable on Apple hardware, Android remote builds reduced local compile times by up to 50%, and targeted test execution reduced pre-merge pipeline durations by more than 30%.


### [We cut bandwidth prices. Go nuts.](https://yomu.fyi/post/we-cut-bandwidth-prices-go-nuts.md)
- Company: [Fly.io](https://yomu.fyi/company/fly-io.md)
- Published: Dec 3, 2020
- Type: Announcement

Fly.io announces lower outbound data-transfer pricing for apps running in its Firecracker VMs: $0.02 per GB from North America and Europe, and $0.04 per GB almost everywhere else. The December 1, 2020 change follows dramatically increased volume, reducing bandwidth costs by 75% from the March launch prices of $0.085 per GB in North America and Europe and $0.14 in Asia Pacific. Rather than use graduated tiers or regional rates, Fly.io uses one blended price for all customers, accepting that some traffic is more expensive and some use cases may pay too much. A 70% target margin underpins the model, while a 160GB monthly free allowance covers low-volume projects; India is an exception at $0.12 per GB, and large-transfer customers can request lower prices if they commit to substantial monthly usage.


### [Capacity Planning at Scale](https://yomu.fyi/post/capacity-planning-at-scale.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: 2023-10-18
- Published: Dec 3, 2020
- Type: Explainer

Shopify’s BFCM preparation combines traffic forecasting, resource planning, and platform-wide scalability testing to reduce the risk of outages during its busiest sales period. The engineering team worked with data scientists to model expected traffic, reviewed historical numbers, added safety margins, and created a master Google Cloud resource plan covering CPUs, storage, machine types, locations, and project-level quotas. Because 2020 brought unusual uncertainty from COVID-19-driven changes in online commerce, Shopify modeled multiple demand scenarios and chose the more aggressive growth cases, while retaining buffers for changes and regional failover. It also ran the Oktoberfest scale-up on Google Kubernetes Engine, using internal load-testing tooling powered by go-lua and embedded Lua to simulate storefront browsing, cart additions, checkout, and mock payment processing. The exercise exposed bottlenecks, which teams fixed before repeating the test; the successful rerun increased confidence for BFCM and reinforced a longer-term aim of more automated, dynamic, and resilient systems.


### [Monitoro Built a Web Crawler Handling Millions of API Requests](https://yomu.fyi/post/monitoro-built-a-web-crawler-handling-millions-of-api-requests.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Published: Dec 2, 2020
- Type: Announcement

Supabase showcases numerous customer case studies illustrating how companies across various industries utilize its platform to build products, migrate infrastructure, and improve operational metrics. Several organizations report substantial cost and efficiency improvements, such as Shotgun achieving an 83% data infrastructure cost reduction and Good Tape saving 60% after moving to managed Postgres and authentication. In terms of developer velocity, Kayhan Space experienced an 8x boost in speed, while Quilia reduced development time by 75% through Data API and Row Level Security features. Other highlighted migrations include Mobbin moving 200,000 users from Firebase, Bree transitioning from Fauna, and Firecrawl switching from Pinecone to Supabase Vector for PostgreSQL vector embeddings.


### [TAYFA Built a No-Code Website Builder in Seven Days](https://yomu.fyi/post/tayfa-built-a-no-code-website-builder-in-seven-days.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Published: Dec 2, 2020
- Type: Explainer

Supabase compiles case studies detailing how organizations across industries build applications, scale infrastructure, and migrate databases. Organizations adopt the platform for capabilities including managed Postgres, Authentication, Row Level Security, Data APIs, and Supabase Vector for PostgreSQL vector embeddings. Reported operational outcomes include Shotgun reducing data infrastructure costs by 83 percent, Quilia cutting development time by 75 percent, and Good Tape achieving a 60 percent cost reduction. Several teams completed platform migrations to Supabase, including Mobbin migrating 200,000 users from Firebase, Bree moving from Fauna, and Firecrawl transitioning from Pinecone. Furthermore, organizations like Replenysh implemented one-time passwords within 24 hours, while Xendit shipped a production solution in under one week.


### [Xendit Built a Counter-Fraud Watchlist for the Fintech Industry](https://yomu.fyi/post/xendit-built-a-counter-fraud-watchlist-for-the-fintech-industry.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Published: Dec 2, 2020
- Type: Problem & solution

Payment processor Xendit needed a fast, cost-effective counter-fraud watchlist system to screen transactions against international sanctions lists in real time without relying on expensive providers like Worldcheck or Refinitiv. Leveraging their existing familiarity with Postgres, the team loaded parsed sanctions lists from the United Nations and the Indonesian government into Supabase. They implemented full-text search using the Postgres Trigram extension, enabling relevance scoring across queried records. A dedicated database function handles the search queries directly via Xendit's Python clients, allowing the entire solution to reach production in under one week. The deployment has operated reliably in production for nine months without issues, with potential future iterations planned around machine learning techniques.


### [Supabase Partners With Strive School To Help Teach Open Source](https://yomu.fyi/post/supabase-partners-with-strive-school-to-help-teach-open-source.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: Rory Wilding
- Published: Dec 2, 2020
- Type: Announcement

Supabase has partnered with fellow Y Combinator Summer 20 alumni Strive School to teach upcoming software engineers open-source development practices. Strive School operates an eight-month training program in Europe covering full-stack web and artificial intelligence engineering, with students paying tuition only after securing employment. Through this collaboration, Supabase aims to improve relational database instruction using Postgres while producing exclusive educational content for the program. In addition to creating learning materials, Supabase is hiring a Strive School graduate as an intern to integrate new engineering talent into its team. Supabase is also introducing a Student Developer Pack offering two years of free platform credits, Slack community access, founder office hours, and merchandise.


### [Pummelling the Platform–Performance Testing Shopify](https://yomu.fyi/post/pummelling-the-platform-performance-testing-shopify.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: 2023-10-18
- Published: Dec 2, 2020
- Type: Explainer

Shopify prepares for high-traffic sales events such as BFCM by repeatedly simulating customer traffic on representative test shops, aiming to expose bottlenecks before merchants experience them. Its Platform Conditioning team supports service-owning teams with approachable performance-testing tools and processes, distinguishing load tests for known traffic levels from stress tests that push services toward failure. A Go load generator runs Lua flows through lightweight VMs, models realistic traffic shapes and costly endpoints, and can issue tens of millions of requests per minute or more. Tests are initiated through Slack using the internal ChatOps tool Spy, which returns links to dashboards, logs, and results. Cronograma provides formal experiments with hypotheses, observations, conclusions, alert detection, Slack timelines, and comparable metrics such as response times, 5xx errors, and requests per minute; the tools have led to performance improvements and give Shopify confidence in future sales events.


### [Supabase Alpha November 2020](https://yomu.fyi/post/supabase-alpha-november-2020.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: Paul Copplestone
- Published: Dec 1, 2020
- Type: Announcement

After nine months of development, Supabase introduced several platform updates as it progressed closer to its beta release. The dashboard now supports manual user creation alongside administrative actions such as deleting users and sending password reset emails or magic links. Database management gained direct browser support through a full Monaco SQL editor and new foreign key controls within the table editor. Platform reliability and security were addressed through a DigitalXRAID audit, default email confirmations on signups, and a dedicated status page tracking uptime and latency. Additional progress included community integration work with Vercel, Stripe, and Redwood, as well as an updated benchmarking suite for realistic server workloads.


[Newer posts](https://yomu.fyi/posts/page/226.md) · [Older posts](https://yomu.fyi/posts/page/228.md)