Loading…
Latest reads
Every post, summarised
Grounded summaries of engineering blogs, newest first. Each links to the original.
- 4,720 posts
- 20 companies
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Latest posts
Announcing Cloudflare OHTTP Gateway – expanding access to Cloudflare’s privacy-preserving infrastructure
Cloudflare announced the closed beta of its OHTTP Gateway, a managed service that decapsulates encrypted OHTTP requests for application servers while preserving client privacy and expanding access to privacy-preserving infrastructure. OHTTP is an IETF standard that uses two independent hops—a relay and a gateway—to hide client IP addresses and TLS fingerprints from app servers, ensuring no single party sees both client identifiers and request contents. The new Gateway is designed for customers whose app servers are already behind Cloudflare, allowing them to use a third-party relay while Cloudflare handles the cryptographic work, for example with Apple’s LiveCallerID. Cloudflare also renamed its existing Privacy Gateway product to Cloudflare OHTTP Relay to better distinguish the two product options. The Gateway runs on Cloudflare’s global edge network to minimize latency, and developers can implement OHTTP clients using sample libraries while joining a waitlist for the paid add-on.
Follow the thread: a new dashboard to investigate account abuse
Cloudflare’s new Account Abuse Protection dashboard helps fraud teams investigate account abuse by moving beyond stateless identity checks to a stateful trust model. The dashboard uses cryptographically hashed identifiers, called Hashed User IDs, created from customer-provided identifiers like email or username, to anchor account activity across login and signup events. It provides an account population overview with metrics like total events, unique IPs, and devices to spot anomalies such as leaked credential matches or unusual login failure rates, then allows analysts to filter and drill into individual accounts. Each account view shows historical behavioral, network, and device signals, enabling teams to reconstruct events and decide on responses like WAF rules. The dashboard also introduces two new roles—Account Abuse Protection and Account Abuse Protection PII—to enforce least privilege for dashboard access and PII exposure.
Protected Quick Tunnels: simple accountless authentication for your next dev project
Cloudflare’s Quick Tunnels now support email-based access control via the –allowed-mail flag, requiring no account on either side. The feature addresses the risk of exposing sensitive work, especially as AI coding agents increasingly use tunnels to share previews. Cloudflare Access verifies the visitor’s email with a one-time PIN, while cloudflared on the developer’s machine authorizes the request against a local rule list. The guest list never leaves the developer’s machine, and the tunnel remains accountless and free. The feature was built and shipped by two interns, Hugo Vicente and Alessandro Frigerio.
Building for good: How civil society organizations are automating on Cloudflare
Cloudflare awarded $7.5 million in credits to 30 civil society organizations to build automation tools using Workers AI and AI Gateway on its global network. LebTown replaced manual editorial workflows with a custom management system, and Kaya Guides built a WhatsApp mental health app processing 500,000 messages monthly with real-time counselor feedback. Larger groups like Freedom House and Article One received volunteer engineering support to build tools for tracking transnational repression and assessing human rights risks from factory audits. Cloudflare’s developer services include automatic DDoS protection and data minimization, addressing privacy and cost barriers that have limited AI adoption in the sector. The program is now open for a second cohort of non-profit organizations to apply for up to $250,000 in credits.
2026 Birthday week: network performance update
Cloudflare is now the fastest provider in 74% of the top 1,000 global networks, up from 60% in April 2026, representing an additional 150 networks and 38 countries. Performance is measured using connection time (TCP handshake) and the trimean of connection times, which combines the 25th, 50th, and 75th percentiles to reduce outlier influence. To expand data collection, Cloudflare introduced a new methodology using Challenge Pages, which run non-interactive background measurements fetching lightweight files from providers including Cloudflare, Amazon CloudFront, Google, Fastly, and Akamai. Challenge Pages are delivered by Turnstile and preserve privacy while providing broader reach than error-page measurements alone. This increased measurement volume narrows confidence intervals around trimean values, making rankings more stable in networks where top providers are separated by only a millisecond or two.
Real-Time Retail Intelligence: Building E-Commerce Recommendations with Lakebase and AI Search on Databricks
The post presents a reference architecture for building a production-grade e-commerce recommendation system on Databricks, based on a real-world implementation for a leading fashion e-commerce platform in Asia serving over 1 million monthly active users across 100,000+ SKUs. The system ingests approximately 1,000 events per second via Lakeflow Connect’s Zerobus into Unity Catalog Delta tables within a medallion architecture. Serving uses two paths: Path A for pre-computed batch recommendations via key-value lookup from Lakebase online tables, and Path B for real-time session-aware scoring using AI Search and a LightGBM model in a 3-stage funnel. The architecture unifies ingestion, feature management, model training, vector retrieval, and serving on a single governed platform, with cold-start handling for new users and products. Expected outcomes include low 2-digit millisecond responses, daily-fresh recommendations, and unified governance via Unity Catalog.
What is direct I/O, and why does ClickHouse Managed Postgres use it for backups?
A base backup reads every byte of a live database off the same NVMe drives that serve queries. Buffered reads go through the kernel page cache, evicting warm database pages and adding a kernel copy per byte. Direct I/O skips the cache, leaving Postgres’s warm data in place, but also disables kernel readahead. On a RAID0 array, small direct reads hit only one drive, so ClickHouse Managed Postgres sizes each direct read to span the whole stripe and scales the reader count to the hardware. On a 48 vCPU box with four NVMe drives and a 467 GB database, the direct I/O backup evicted nothing, cut query latency impact by about two thirds, used about 14% less CPU, and finished in 71 seconds.
AutoSynthData: Generating Training Data for Enterprise Agents
AutoSynthData, built by ServiceNow CoreAI, generates training data for enterprise agents by targeting capability gaps from evaluation, using a stronger teacher such as Qwen3.8-27B to demonstrate successes. It uses a target model’s failures and a stronger teacher’s successes to decide what to learn next. The system produces tasks composing a system specification, user prompt, and verifier, ensuring feasibility, realism, and difficulty against the target environment. After sample-level checks and batch-level review, the dataset grows via target and multiply phases, generating 2,000 samples in 18 hours for the Hybrid domain. In EnterpriseOps Gym, synthetic SFT on Gemma-4-26B-A4B-it improved mean Pass@1 by 7.2 points (35% relative) in Hybrid and from 18.77% to 27.18% in ITSM, showing the approach works across domains.
How to Create and Send vCards with Go
Sharing contact details by copying text between apps is ineffective compared to sending a vCard, a structured data format supported by major operating systems and email clients. This tutorial demonstrates creating vCards in Go using the go-vcard package, which handles fields such as formatted name, structured name, street address, telephone number, email address, and URL. The code writes the vCard to a .vcf file with version 4.0 using the go-vcard encoder and constants from the package, exiting on failure. The vCard file is uploaded to Twilio Assets, a static file hosting service bundled with every Twilio account, to make it publicly accessible for the SMS. The Twilio Go SDK sends an SMS with a message body and the vCard URL as a media attachment via the Programmable Messaging API, allowing recipients to open it in their contacts app.
How to Track Opt-Outs in PHP
This tutorial demonstrates building a PHP application that records customer opt-out preferences from SMS replies using Twilio’s Incoming Message Webhook and Event Streams, which require PHP 8.5, Composer, and SQLite. When the SMS body is an opt-out keyword such as STOP, START, or HELP, Twilio includes an OptOutType parameter in the webhook request, which the application checks using strcasecmp and array_first. The application, based on the Twilio Slim Base project, stores the opt-out status and account SID in an SQLite database via PHP-DB and laminas-servicemanager, using a TableGateway for the user_optouts table. The handleWebhook() function validates the OptOutType against class constants (OPT_OUT_TYPE_START, OPT_OUT_TYPE_STOP, OPT_OUT_TYPE_HELP) and inserts a record before returning a TwiML response. Twilio already blocks further messages for standard opt-outs, but local recording enables advanced actions like syncing a CRM; the tutorial covers bootstrapping, configuring Twilio messaging services with Advanced Opt-Out, using ngrok, and verifying with an SQL query.
How to Get Started With WebRTC: Intro to Browser APIs
WebRTC provides browser APIs for real-time voice, video, and data sharing without plugins, with mandatory encryption via DTLS-SRTP and DTLS; the standard became a W3C Recommendation in January 2021. The core APIs are getUserMedia for capturing audio/video from user devices, RTCPeerConnection for peer-to-peer media exchange via offer/answer and ICE candidates, and RTCDataChannel for arbitrary data transfer. WebRTC is supported by all major browsers and used by services like Google Meet, Discord (which uses media servers for group calls to avoid expensive peer-to-peer), and AI voice agents. Twilio offers Video and Voice JavaScript SDKs that handle signaling and media relay, enabling calls to phone numbers and SIP endpoints. The post includes a camera preview example using getUserMedia that requires a secure origin and can be served with Python, then directs readers to Twilio’s quickstart tutorials for building video and voice applications.
Limits of Confidence in Diffusion
The post analyzes limitations of confidence-based ranking in discrete diffusion, where sequences are generated by writing multiple token positions per step from per-position distributions. It shows that a step matches the training distribution only when the written positions are conditionally independent given fixed tokens, and no product of per-position distributions can match a dependent group. Additionally, per-position distributions do not determine group dependence: two joint distributions can have identical per-position marginals but differ in value combinations. On the synthetic ScanAndAdd task, every group of two or more undetermined positions written by a confidence ranking is dependent, and the generated distribution is 29 times the sampling-noise floor in total variation, with per-sample metrics at 1.0. The post also includes updates on two related readings: on-policy distillation for reasoning models and self-supervised learning with Transformers.
Architecting Secure Identity: Extending Auth0 PrivateLink with Intelligent Gateways
Enterprises centralize authentication into a single Auth0 environment but must comply with frameworks like PCI-DSS, HIPAA, and SOC 2 that restrict data to private channels. Auth0 Outbound PrivateLink provides a secure unidirectional connection between Auth0 and AWS infrastructure, avoiding the public internet. However, a single PrivateLink connection per environment cannot directly reach multiple isolated VPCs for staging and production. The Intelligent Gateway Pattern solves this by deploying an API gateway or reverse proxy at the PrivateLink termination point to fan out traffic. Auth0 Actions append context such as custom headers like X-Target-Env or specific paths, and the gateway inspects these to route requests to the appropriate isolated VPC, decoupling secure transport from internal routing. This pattern unblocks identity consolidation by allowing a single Auth0 tenant to serve both staging and production workloads while maintaining strict VPC isolation.
Language Discrimination Improves Linguistic Learning in Multilingual Speech Models
Multilingual self-supervised speech models underperform monolingual models under a matched total pretraining data budget, but strengthening language discrimination during pretraining reduces this gap while preserving cross-language sharing. In a controlled English/French HuBERT setting, two interventions—an auxiliary language classifier and per-language k-means targets—improve language discrimination. Continuous-feature phone discrimination error (phone-ABX) decreased from 11.6% in the bilingual baseline to 10.4%, approaching the monolingual 10.8%. Lexical performance (sWUGGY) rose from 52.1% to 56.7% (monolingual: 58.5%), and prosodic performance (ProsAudit lexical subtask) from 68.9% to 72.9% (monolingual: 72.6%). The strongest gains occur when language discrimination is introduced in the first HuBERT iteration; later or repeated interventions yield smaller improvements and increase language-wise segregation, supporting a causal role for language discrimination in reducing the cost of multilingual learning.
Seer, the Sentry MCP and CLI, or your own coding agent: where each one fits
Seer is Sentry’s agent debugger that reasons across errors, traces, logs, profiles, and linked repositories to identify root causes, not just surface-level stack traces. The Sentry MCP, set up via the agent plugin with a single command, bridges Sentry’s data into coding agents like Claude Code and Cursor, enabling them to invoke Seer’s full analysis. The new Sentry CLI provides natural-language access to Seer’s diagnosis and issue management directly from the terminal, using selectors like @latest and @most_frequent. These tools are complementary: Seer provides deep diagnosis, while the MCP and CLI deliver that context into the environments developers already use. Teams can automate the entire workflow so Seer diagnoses, an agent fixes, and a draft PR awaits review without human involvement until approval, with Seer triggering on issues meeting event count and fixability thresholds.
Creating a whitelabeled connected account dashboard with embedded components
This tutorial explains how to build a whitelabeled connected account dashboard using Stripe Connect embedded components, eliminating the need to manually implement pagination, permissions, and state management. The example uses FurEver, a pet grooming SaaS platform, and integrates the ConnectPayments, ConnectPayouts, and ConnectNotificationBanner components for payments, refunds, dispute management, balance and payout views, and account enablement alerts. The server-side requires creating an account session with enabled components, while the frontend initializes ConnectComponentsProvider with the fetched client secret and publishable key. Platform user roles can be enforced by setting features such as refund_management based on admin status in the account session, automatically adjusting component behavior. The dashboard’s appearance matches the platform using the appearance API with variables for colors, fonts, and locale, and it receives automatic updates for new payment methods and compliance.
Lakebase Postgres branch-based restores for fast recovery at scale
Traditional Postgres point-in-time recovery is slow because compute and storage are coupled, requiring provisioning a new instance, restoring a snapshot from object storage to disk, and replaying WAL, leading to hours of downtime for large databases. In a survey of developers running 1TB+ production Postgres, 59% had a critical production failure and 30% were down for over three hours. Lakebase Postgres decouples compute and storage using safekeepers, a pageserver, and object storage, storing database history as an immutable timeline. A restore becomes a branch at a point in history, a metadata operation that does not copy data, making it near-instant regardless of database size. This eliminates data copies and WAL replay, so restoring a 100 TB database is as fast as restoring 10 GB, and agents can use restores as ordinary tool calls for versioning and undo.
Build Applications on NVIDIA BlueField Faster with NVIDIA DOCA Agent Skills
General-purpose AI agents lack domain-specific knowledge for NVIDIA DOCA development, often inventing APIs or skipping hardware checks, leading to correction cycles. DOCA AI agent skills provide a structured, machine-readable specification in a SKILL.md file containing verified API signatures, hardware capability requirements, and build constraints for components like Flow, GPUNetIO, and PCC. In a 65-prompt evaluation, agents without skills satisfied only 19% of graded checklist items, while agents with skills satisfied 100% across all prompts. The skills reduce correction cycles; in a side-by-side demo, the with-skills agent used 73% less handwritten code and 46% fewer hardware commands. The skills are available on GitHub and enable developers to build faster, ship more stable code, and deploy with fewer unknowns on BlueField infrastructure.
Build Local AI Apps with C++ and NVIDIA TensorRT RTX Samples
DIN Deploy is an open-source collection of C++ samples combining ONNX Runtime with NVIDIA TensorRT RTX for local AI inference on Windows and Linux. It separates model conversion from deployment: Python exports models to ONNX, then native C++ runs inference via ONNX Runtime session and tensor APIs. Supported workloads include automatic speech recognition (Whisper offline, Parakeet TDT streaming), interactive segmentation (SAM 2.1), and prompt-driven image generation (FLUX.2-klein-4B). The FLUX.2 sample includes Vulkan and DirectX graphics interop and demonstrates post-training quantization with NVIDIA Model Optimizer, producing quantized ONNX models as drop-in replacements without code changes. On DGX Spark, GPU acceleration provides speedups: Whisper large-v3-turbo achieves 58.5x real-time factor, Parakeet TDT 206.41x, and SAM 2.1 runs at 38.3 FPS on GPU versus 0.5 FPS on CPU.
Accelerating airline retailing innovation: how Datalex modernized with AWS Experience-Based Acceleration and agentic AI
Datalex, a leader in airline ecommerce, needed to modernize its mature EJB2/Java 8 system for Modern Airline Retailing while maintaining continuous airline operations. Over three days, 16 Datalex engineers and 6 AWS specialists proved migration feasibility by extracting a Reservation service into a Spring Boot microservice on Java 21. The team used agentic AI tools—Kiro and AWS Transform Custom—to automate code changes, and established repeatable patterns for DevSecOps, observability, and a multi-agent AI prototype via Amazon Bedrock AgentCore. A business service proxy using the Strangler Fig pattern enabled incremental migration with backward compatibility. The board approved significant investment, the prototype team expanded into a full Agile team, and the EBA shortened discovery from an estimated 8–12 weeks to three days.
Top topics
- Architecture834
- Performance816
- LLMs670
- Machine Learning622
- Open Source567
- AI Agents561
- AI480
- Developer Experience448
Weekly digest
The best engineering reads, once a week.