Loading…
Latest reads
Every post, summarised
Grounded summaries of engineering blogs, newest first. Each links to the original.
- 4,671 posts
- 20 companies
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Latest posts
Have it both ways: stay discoverable in search while disallowing AI training
Cloudflare announces a Disallow AI Training setting intended to let website owners refuse AI training while keeping content available to search crawlers. The problem is mixed-use crawlers such as Applebot, Bingbot, and Googlebot, which can serve both search indexing and model training, making a simple block affect discoverability. Cloudflare says its network can publish preferences, identify and classify crawlers, block those that ignore controls, and report operator behavior on Radar; the setting publishes a no-training preference through robots.txt while allowing Accountable mixed-use crawlers for search. Apple, Google, and Microsoft meet or have committed to meet the Accountable requirements, which include training and summary opt-outs, URL-level visibility, metrics, and assurance that training opt-outs will not affect traditional search.
Give every teammate and agent the right level of access to your Workers
Cloudflare has introduced resource-level access controls for Workers, allowing a teammate or agent to access one specific Worker rather than other resources in an account. Four roles define progressively broader capabilities: Metadata Read-Only exposes settings and observability data, Content Read-Only permits code or product-content reads, Editor allows content and settings changes without resource deletion, and Admin provides full control. These roles can be assigned to dashboard users or attached to scoped API tokens, supporting debugging without source exposure, code review without deployment, and CI/CD deployments limited to one Worker. Worker-level access also governs Durable Objects, while routes and Custom Domains require both Worker Editor access and Workers Routes permission; existing legacy permissions continue to work, but the new roles are recommended for granular access and are planned for D1, R2, and KV.
Let’s talk wait times and delays
The update explains how drivers can be compensated when pickups, additional stops, route changes, or road delays make a trip take longer than expected. At the first pickup, wait-time and no-show fees may apply, with the pickup screen showing elapsed wait time and potentially applicable amounts; at an additional stop, stop-time fees now begin after one minute rather than two, and the app displays both waiting time and earnings. If a rider adds a stop or changes the destination, the app shows the new drop-off address and fare change. For eligible trips running at least five minutes longer than estimated from pickup to drop-off, Delayed Ride Guarantee can automatically increase the fare, with higher potential earnings for trips exceeding 15 extra minutes; receipts explain the adjustment, reason, and amount, while eligibility varies by location and trip type.
How Databricks’ marketers use data 3x more with Genie, an AI analytics assistant
Databricks marketers struggled to get trusted answers from fragmented marketing data quickly, prompting the creation of Marge, a marketing implementation of Genie Agents. The team first unified campaign, sales, web, event and advertising information in a governed Marketing Lakehouse, then grounded the assistant in business definitions, verified logic and example queries. Marge translates natural-language questions into analytical queries, uses Unity Catalog for lineage and role-based access, and can ask clarifying questions or perform multi-step analysis. The reported results include threefold greater data use in decisions, more than 85% adoption, 50% quarter-over-quarter growth, over 5,000 answered questions and a 25% reduction in flagged incorrect responses. Databricks attributes the rollout to continuous feedback, benchmark evaluation, focused use cases and embedding Genie in existing workflows rather than treating conversational analytics as a one-time deployment.
From Curiosity to Impact: Inside the MongoDB Intern Experience
MongoDB’s internship program provides a multi-layered support network including team mentors, inclusion guides, and early talent program advisors. Interns work on real, impactful projects: Aashcharya built and tested AI agents to automate platform support, Cristina created an open-source Python binding for Atlas Local to simplify AI development, Maria built an end-to-end energy industry solution, and Tyler tackled a storage challenge to make the storage layer more flexible. Mentors teach that revision is part of the job, not a failure, and that taking ownership and earning buy-in are critical skills. Community events such as welcome lunches, bowling outings, and bagel-making classes help interns connect with peers and leadership, including an impromptu AMA with the CMO. Interns leave with improved communication, openness to feedback, and an understanding of sustainable work practices.
KubeVirt, VSOCK, and eBPF: who does what?
KubeVirt, VSOCK, and eBPF address different layers, so none replaces the others. KubeVirt adds virtual-machine lifecycle management to Kubernetes, running QEMU in a launcher Pod while KVM uses hardware virtualization features to execute guest code; it does not replace either component. VSOCK provides host–guest communication through a CID-and-port socket address, independently of guest IP networking, but attaching virtio-vsock does not define permitted applications or provide authentication and authorization. For host-enforced control, BPF LSM can use the socket_listen hook to deny unapproved host-side VSOCK listeners before creation, whereas ordinary XDP and TC filters on VM network interfaces do not see VSOCK traffic; this still leaves existing listeners, per-guest permissions, kernel attack surface, policy lifetime, and other virtual devices to address.
Why we chose KubeVirt for our VM sandboxes
BoxCompute chose KubeVirt for its VM sandboxes because workloads need a real Linux machine with a guest kernel, systemd, and machine-level workflows that process-oriented environments do not fully provide. KubeVirt adds VM resource types and controllers to Kubernetes, while launcher Pods run QEMU/KVM and the guest on a worker. The arrangement keeps placement, lifecycle, permissions, storage, and cleanup within the Kubernetes model, avoiding a separate VM management platform, although resource accounting and readiness still require sandbox-specific work. The post stresses that full virtualization does not automatically provide security: the platform still needs deliberate controls for host access, guest traffic, credentials, persistence, and cleanup after failures.
How to Orchestrate Multi-Call Conversations with an LLM and Twilio Conversation Memory
The tutorial builds a C# .NET 9 ASP.NET Core voice service that preserves caller context, preferences, and action history across separate inbound calls. It combines Twilio Conversation Relay and a Twilio Conversation Memory Store with an OpenAI gpt-4o-mini service, using WebSockets to connect the call flow and stream generated text. The setup covers creating the project, installing Twilio, DotNetEnv, and OpenAI packages, configuring credentials and IDs in .env, exposing local webhooks with ngrok, and routing /voice to /ws. The sample assistant is framed as Owlbert's Auto Repair and is instructed to speak naturally, avoid lists and emojis, refer to caller details, and acknowledge uncertainty rather than guess. Testing uses two calls from the same number; the expected result is that the second call recalls first-call details and that Twilio shows a stored conversation summary.
What is CIAM in 2026 and why does it matter?
CIAM has expanded beyond password storage and login-time credential checks as digital experiences include autonomous AI agents and attacks make point-in-time verification less reliable. Modern customer identity is presented as a continuous trust and control layer across web, mobile, messaging, voice, email, and AI interactions, balancing low friction with adaptive risk detection. The architecture separates an identity authority, which owns identity, federation, and authorization, from a trust orchestration layer that evaluates live signals, triggers step-up verification, adapts to mid-session risk, and records decisions. It also must define delegated authority for agents, human approval boundaries, multi-signal decisioning, explainability, consent, and identity resolution. Twilio is described as an adjacent execution layer providing Verify, Lookup, carrier intelligence, device fingerprinting, and passwordless or one-time passcode flows for high-risk moments.
How to Connect Your Twilio Agent to External APIs
This tutorial shows how to connect a Twilio voice agent to an external REST API so it can retrieve live information during a conversation. It uses C# .NET 9, Twilio Conversation Relay, WebSockets, OpenAI tool calling, and the authentication-free Cat Facts API as a demonstration. An ASP.NET Core application exposes a /voice webhook, connects calls to a /ws endpoint, maintains conversation messages, streams model responses, and executes get_cat_fact by requesting and parsing JSON from the Cat Facts service. The guide also covers environment variables, NuGet dependencies, ngrok tunneling, Twilio number configuration, and troubleshooting for webhook URLs and API keys. After setup, callers can ask for a cat fact and receive one from the external service, illustrating how function tools can give voice agents real-time data and perform API-backed work.
Build zero-trust AI agents that judge intent, not just syntax
Part 2 of the Zero-trust Agents series addresses attacks that deterministic, build-time checks cannot recognize when syntax remains valid. It keeps the Customer Support and Returns Agent, which reads orders, calculates restocking fees in Agent Sandbox, and commits payouts through an issue_refund tool signed with a hardware-backed Cloud KMS key, then moves enforcement to Gemini Enterprise Agent Platform. Agent Gateway applies three runtime controls: Model Armor screens prompts and responses, Semantic Governance Policies evaluates proposed tool calls against intent, history, and business rules, and Agent Anomaly Detection analyzes behavior across a session. The examples cover prompt injection, a non-refundable digital-license refund, and a multi-turn refund drain; detected anomalies can trigger a new policy that blocks subsequent calls without redeploying the agent.
Managed Postgres: What Lakebase Actually Takes Off Your Plate
Managed Postgres varies from OS patching alone to operating scaling, failover, backups, recovery, and related database tooling. Lakebase Postgres applies this model to serverless infrastructure, offering automatic scaling, scale-to-zero, PostgreSQL compatibility, automatic snapshots, point-in-time recovery, branching, built-in PgBouncer, and support for extensions including pgvector and PostGIS. Within a region, patching, scaling, failover, and backups run automatically, while encryption, access control, audit visibility, connection pooling, and lakehouse integrations are also addressed. The discussion also stresses checking PostgreSQL versions, configuration, extensions, and migration methods before moving an existing database. Cross-region disaster recovery remains the main exception: it is in Private Preview for AWS, with periodic replication, manual failover, and customer-managed recovery procedures.
Announcing On-Demand State Repartitioning for Apache Spark™ Structured Streaming on Databricks
Stateful Apache Spark Structured Streaming queries historically locked their state-store partition count into the checkpoint, so changing spark.sql.shuffle.partitions after a workload grew had no effect without rebuilding and losing accumulated state. Databricks Runtime 18 and later introduces on-demand state repartitioning, a Public Preview feature that preserves the checkpoint while moving state to a new partition layout. Operators set spark.sql.streaming.stateStore.partitions, stop the query, and restart it; the query finishes any pending microbatch, physically rehashes and redistributes state, then resumes with the requested count. The feature applies to aggregations, stream-stream joins, deduplication, sessionization, and transformWithState, provided the RocksDB state store is used. Repartitioning pauses processing and its duration is reported in controlBatch.REPARTITION; Coveo reports a 40% reduction in related Amazon S3 API costs.
How AI Agents Get Trusted Customer Context with Data 360 Data Graphs
Salesforce’s AI Engineering team uses Data 360 data graphs to close the context gap that prevents agents from reliably personalizing customer interactions. The graphs join, aggregate, and apply business logic across fragmented identities, accounts, products, contracts, orders, cases, services, and entitlements, while partitioned data spaces provide a filtered customer-success view. The team designs smaller graphs or multi-graphs around agent access patterns, adds indices, supports semantic or keyword search, and curates context so agents can traverse extensible many-to-many relationships without receiving unnecessary data. Reusable deployment automation and validation practices helped deliver five major releases in six months, with integrations spanning Postman, Apex, Agentforce, and low-code or no-code workflows. Live monitoring later showed P50 performance below 200 milliseconds, compared with an earlier benchmark of about 400 milliseconds.
Accelerating Dropless MoE Training in JAX with NVIDIA Transformer Engine
Production-scale mixture-of-experts (MoE) training must handle uneven, data-dependent expert loads, creating ragged tensors and expensive dispatch, combine, and all-to-all communication. Dropless MoE processes every selected token, preserving model quality but requiring kernels that support variable token counts without padding or dropping. The post presents JAX and NVIDIA Transformer Engine optimizations centered on group-aware MXFP8 quantization, grouped GEMM, and fused expert-parallel (EP) dispatch and combine using NCCL EP. Grouped GEMM computes each expert’s actual workload in one kernel path, while EP reduces movement overhead and can deduplicate tokens crossing networks. For DeepSeek-V3 training on NVIDIA GB200, the reported throughput increased from 103 to 1,068 TFLOPS/GPU, a 10.4x improvement; the post also reports roughly 10x throughput improvement and 97% scaling efficiency at 1,024 GPUs.
Toolbox App 3.8: Improves IDE Update Handling on macOS and Fixes Keyboard Navigation
Toolbox App 3.8 addresses IDE update handling on macOS and restores keyboard navigation in project and tool lists. On macOS, manual IDE updates remain available when the system incorrectly reports an installation directory as non-writable, with instructions shown if macOS blocks the update. On Windows, Ctrl+1 and Ctrl+2 switch between the Tools and Projects tabs, while the Up Arrow, Down Arrow, Page Up, Page Down, Home, and End keys navigate lists, including filtered results. Cleanup of leftover IDE directories now displays progress for each tool and the full operation, and disables delete controls until cleanup and rescanning finish, preventing duplicate cleanup starts.
Understanding W8A8 INT8 LLM quantization: Accuracy and performance results
The post evaluates whether W8A8 INT8 quantization can reduce the size of a Llama 3.1 8B Instruct model without sacrificing accuracy or inference performance. Using SmoothQuant to address activation outliers and GPTQ with error compensation for BF16 weights, the model was compressed from 14.9 GB to 8.0 GB after calibration on WikiText-2. Identical zero-shot lm-eval-harness tests across MMLU, ARC Easy, HellaSwag, and IFEval found MMLU, ARC Easy, and HellaSwag deltas smaller than their standard errors, while the IFEval change was described as likely within a similar noise range; the post concludes no measurable degradation. vLLM and GuideLLM tests on one NVIDIA L40S reported 29% more concurrent requests, 24% lower synchronous TTFT, and 44% faster token generation at maximum load, while ITL degraded more quickly under high concurrency because of dynamic activation quantization overhead.
Python 3.14 free-threaded build is now available in RHEL
Red Hat Enterprise Linux 9.8 and 10.2 now provide a free-threaded Python 3.14 build alongside the regular interpreter, enabling developers to test parallel CPU execution with threads. The build disables the GIL, allowing Python threads to execute on multiple CPU cores in one process, while built-in dict, list, and set operations retain internal locking for individual operations. Developers install the python3.14-freethreading package from the CodeReady Linux Builder repository; it provides the separate python3.14t executable and commands to verify free-threading support and GIL status. Existing code may expose race conditions, and unsupported C-extension dependencies can re-enable the GIL, so the source recommends testing, dependency checks, explicit synchronization, and workload measurement. The build carries a stated 5%-10% single-threaded performance overhead and mainly targets CPU-bound threaded workloads.
Stop Rubber-stamping AI: A Contestable AI Framework for Regulated Industries
AI deployed in regulated industries such as healthcare and manufacturing often lacks explainability and contestability, creating a barrier to adoption because responsible humans cannot meaningfully challenge AI outputs. The post presents contestable AI as an architectural pattern where multiple specialist agents debate recommendations, a qualified human reviews and overrides arguments, and the system re-scores in real time. In a clinical scenario, a patient analyzer agent retrieves similar cases, specialists argue for and against care options, and a general practitioner overrides as needed before a care plan is finalized. In manufacturing, a site reader agent ingests equipment sensor labels, two specialist agents debate classifications against a standard ontology, and an engineer overrides with context the model lacked, like a fixture offset. MongoDB’s document model stores the AI arguments, human overrides, confidence scores, and final decision in one retrievable document, supporting single-query decision lineage without joining data across systems.
Product updates: Sandbox Sidecars, new models, a refreshed dashboard, and more
Modal added day-zero support for Kimi K3, Qwen 3.8, GLM 5.3, and GLM 5.3 Flash on Auto Endpoints, with custom DFlash speculators boosting throughput to 460 tokens per second. New environment-level budgets give Team and Enterprise workspaces per-environment compute limits, while the pricing multiplier for broad region selection dropped from 1.5x to 1.15x. The dashboard got a refreshed navigation, color system, and beta light mode, and Private Environments now support a default No Access role. Sandbox Sidecars are in public alpha, running additional containers via low-latency internal networking, and VM Sandboxes are in public beta with a real Linux kernel for Docker and eBPF. Sandbox directory snapshots and a new filesystem API are now GA, and regional Proxies allow selecting a region for static outbound IPs, while SDK updates improved log APIs and autoscaler reporting.
Top topics
- Architecture834
- Performance816
- LLMs660
- Machine Learning622
- Open Source563
- AI Agents553
- AI470
- Developer Experience448
Weekly digest
The best engineering reads, once a week.