Loading…
Latest reads
Every post, summarised
Grounded summaries of engineering blogs, newest first. Each links to the original.
- 4,668 posts
- 20 companies
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Latest posts
Stopping business email compromise with AI-driven email security: How VIPRE protects modern enterprises on AWS
Business email compromise (BEC) uses social engineering and impersonation rather than malicious links, bypassing traditional secure email gateways that are blind to internal traffic and lateral movement. VIPRE developed Integrated Email Security (IES), a cloud-native solution on AWS that integrates directly with Microsoft 365 via APIs, eliminating the need for MX record changes. The solution uses multiple machine learning layers, including semantic similarity models, contextual language models, and dynamic behavioral analysis of links and attachments, running on AWS services such as Amazon ECS with NVIDIA GPUs. In production, VIPRE IES processes over half a million messages daily with P95 latency between 1.4 and 78 seconds depending on sandbox analysis, detecting approximately 1% of messages as BEC attempts. Deployment can be completed in minutes rather than days, providing immediate visibility into internal risks that traditional gateways miss.
Bulk Executor for Amazon DynamoDB, Part 2: Lessons we learned the hard way
The post describes design tradeoffs and workarounds encountered while building the open-source Bulk Executor tool for Amazon DynamoDB on AWS Glue. Core requirements included real-time local-script feel, scaling to hundreds of parallel workers without user infrastructure management, and easy command extensibility. AWS Glue was chosen for serverless parallelism and a built-in DynamoDB connector, but the connector simplified data types, losing distinctions like string set versus list of strings. Challenges included estimating costs for provisioned tables, handling job termination with ^C, and streaming output via CloudWatch Live Tail which samples events and delivers out-of-order. Solutions included a two-phase cost estimate for deletes, programmatic interrupt handling, writing large output to S3 with a preview, mandating point-in-time recovery for mutating commands, and using AI for testing and linting; the team also migrated from AWS Glue 4 to 5 and 6 for faster startup and 30 percent lower DPU costs.
NVIDIA Run:ai Is Now Open Source as Part of NVIDIA DSX AI Factory Platform
NVIDIA has released the complete Run:ai platform as open source software, expanding the NVIDIA DSX AI Factory Platform and giving customers, developers, and ecosystem partners production-grade AI workload and GPU orchestration capabilities. Run:ai has dynamically allocated GPU resources and managed workloads on Kubernetes across data processing, training, and inference. The release includes the full platform plus four independently adoptable components: KAI Scheduler, GPU Fractioning Operator, KAI Resource Management, and Workload Map. Teams can deploy the stack from the NVIDIA Run:ai repository in the DSX AI Factory GitHub organization or via an NGC Community Product Helm chart, without a paid subscription or enterprise support entitlement. Ecosystem partners including Crusoe, Mirantis, Nebius, OpenNebula Systems, Rafay, Saturn Cloud, Spectro Cloud, and vCluster are integrating the platform or its components into their offerings.
Test and deploy bootable containers with bootc virtualization kit (bcvk)
Managing a traditional operating system across multiple hosts often leads to configuration drift, slow updates, and painful rollbacks. Bootable containers solve this by packaging the entire OS as an OCI container image, including the kernel, initrd, bootloader, and applications. Red Hat Enterprise Linux 10 introduced image mode deployment, and the bootc container virtualization kit (bcvk) enables end-to-end testing of these images on a laptop using familiar Podman and libvirt packages. The tool offers three deployment modes: ephemeral for rapid testing, persistent for long-term development, and disk image for creating bootable artifacts. Users build a custom bootc image via a Containerfile with the containers.bootc=1 label, then deploy it identically across virtual and physical infrastructure, reducing environmental drift.
Red Hat AI Inference 3.5 MaaS governance on AKS
Red Hat AI Inference 3.5 extends its Model-as-a-Service (MaaS) governance layer to non-OpenShift Kubernetes distributions, including Azure Kubernetes Service (AKS). MaaS adds multi-tenant API governance on top of the inference platform, controlling authentication, rate limiting, and model access via Authorino and Limitador from Red Hat Connectivity Link (Kuadrant). A model is first deployed with a single LLMInferenceService YAML, creating a vLLM server and router-scheduler, but the endpoint is open. Applying a MaaSSubscription and MaaSAuthPolicy activates governance: Authorino validates API keys or JWTs, and Limitador enforces token rate limits. The post demonstrates three enforcement scenarios on an AKS cluster with a T4 GPU running Qwen3-0.6B: 401 for missing or invalid keys, 200 for authenticated requests, and 429 when rate limits are exceeded, blocking requests before they reach vLLM.
Sharding etcd on hosted control planes and what the numbers actually say
Sharding etcd on hosted control planes splits the key-value store into multiple instances by resource kind, a tech preview feature tested with a main shard for cluster state and a dedicated events shard on Red Hat OpenShift 4.21 with HyperShift. Under event pressure from synthetic storms and realistic crashlooping pods, the sharded configuration showed up to 96% fewer slow applies, faster compaction and raft snapshot durations, and 60% more WAL fsyncs and 90% more backend commits combined. The sharded arm never failed the event storm workload, while the standard arm occasionally did. Pod-ready latencies and workload finish times remained comparable across both configurations. The trade-offs are roughly 1.8 to 2.3 times the etcd container memory and a compaction regression under large custom resource quota pressure that is still under investigation.
CI/CD Pipeline Observability Tools: How to Choose the Right Setup
CI/CD pipeline observability tools help teams understand why builds fail or slow down by connecting data from version control, build agents, tests, and deployment tools. The JetBrains Developer Ecosystem Survey 2026 found that 44% of 20,416 respondents cited debugging cloud infrastructure as a top challenge, while 16% named observability. Pipeline observability covers queue time, duration, success rates, flaky tests, cache performance, and platform-level metrics like agent utilization and server health. Built-in CI/CD dashboards are used by 76% of respondents, but many teams also use Prometheus, Grafana, Elastic, or OpenTelemetry for metrics, logs, and traces. The post compares built-in dashboards, Prometheus and Grafana, Elastic and OpenSearch, OpenTelemetry, commercial platforms like Datadog, and custom in-house solutions, recommending teams start with the questions their current setup cannot answer.
Python vs Go: A Practical Comparison for Developers
The post compares Python and Go across language design, performance, tooling, and developer profiles, drawing on quantitative data from the JetBrains Developer Ecosystem 2026 survey of 28,945 respondents and qualitative interviews with developers who migrated production workloads from Python to Go. Python favors expressive code and rapid iteration, while Go emphasizes explicit, standardized code that is easy to maintain across teams. Go excels in raw performance and concurrency and is widely used in cloud infrastructure, whereas Python remains stronger for machine learning, data science, and scientific computing. Survey data shows that Go developers are typically more infrastructure-focused and senior, and that Go is rarely a first language, while Python is beginner-friendly with 10% of its developers coding for less than a year. Most teams use both languages, with Go for services and infrastructure and Python for AI and data workloads, and moving to Go rarely means abandoning Python.
Chasing that 32 ms tail latency in ClickHouse
A customer observed an extra ~32 ms tail latency on simple SELECT queries after idle periods in ClickHouse’s Native TCP protocol. The root cause was that after a TCP idle period (RTO), the congestion window resets to initcwnd (8 MSS), and with TCP_NODELAY enabled, each metadata packet (ProfileEvents, Logs, Progress) becomes a separate TCP segment, exceeding the small window and forcing an additional round trip. The ClickHouse Native protocol sends these metadata packets between Data and EndOfStream, and the unbatched writes caused the problem. The team reproduced the issue deterministically using Linux network namespaces and tc to simulate 32 ms RTT and initcwnd 8. They fixed it by batching those metadata packets into a single buffer write at the application layer, reducing tail latency from ~32 ms to ~1 ms, as confirmed by a Go client program that measured the time between the last Data packet and EndOfStream.
Coding, Math, and AI: What’s Ahead for School Students in 2026–2027
JetBrains Academy is offering free Youth Clubs in mathematics, AI, and coding for school students in 2026-2027, with registration open until October 31 for the Math and AI clubs and the Coding Club starting October 22. In-person JetBrains Coding Cups will be held in Cyprus, Poland, and Serbia for students aged 13-19, and the Cyprus Programming Challenge returns for its fourth edition on November 8. The Youth Coding Challenge on November 29 features Junior and Senior leagues, with winners potentially invited to advanced programs like the Youth Coding Club or the ACTS camp. The ACTS 2027.1 camp in Cyprus from March 15-25 offers tracks in Competitive Programming, Software Engineering, and Artificial Intelligence, with the AI track by invitation only for national teams from five countries and 20 students from Cyprus. Participants develop skills through practical assignments and challenging problems alongside like-minded peers.
GrabMart data for faster disease outbreak detection
GrabMart transaction data could supplement clinical surveillance because over-the-counter demand sometimes shifts before confirmed case reports. The concept aggregates eligible purchases, maps SKUs to broad symptom classes, and compares demand series against seasonal and historical baselines to produce an Early Outbreak Detection Index. Public health experts would review that aggregate signal alongside independent evidence, and the method excludes identity linkage and individual-level health inference. Statistical evaluation would need sensitivity, false-alert rate, calibration, geographic stability, and retrospective testing against approved public health data, with ongoing monitoring for catalogue changes, promotions, and shifting purchasing behaviour. Privacy relies on data minimisation, coarse geography, aggregate time windows, minimum-count thresholds, and possibly differential privacy under an approved budget; the authors state this is early-stage planning only, with no deployment, measured performance, or integration claimed.
Closing the AI context gap: what it takes to make enterprise AI trustworthy
The post argues that model intelligence is no longer the bottleneck for enterprise AI; the real gap is business context — the unique knowledge about an organization’s processes, customers, and products. Without proper grounding, agents resort to brute force, iterating through guesses and burning tokens while producing unreliable answers. While building a well-grounded agent for a single domain is now easier, scaling context across hundreds of agents in an enterprise remains unsolved due to fragmentation, fast-changing definitions, and differing team-specific interpretations of the same concepts. Genie Ontology addresses this by providing a unified, governed context layer that combines intentionally curated knowledge with automatically learned observations from system usage. This enables every agent connected to Databricks to work from the same consistent business understanding, supporting accurate answers without each agent rediscovering the business from scratch.
Cyber Week Readiness: A Developer's Guide to Scalable Comms
Cyber Week compresses a year’s worth of system failures into 72 hours, making it the ultimate stress test for communication infrastructure. Developers must optimize APIs with rate limiting, caching, and traffic shaping to absorb sudden spikes without dropping connections. Email delivery requires early IP warmup, SPF/DKIM/DMARC configuration, and limiting promotional sends to recently engaged customers to maintain inbox placement. Voice pipelines need proactive capacity planning for Calls Per Second quotas, fallback URLs, and STIR/SHAKEN attestation to prevent fraud and dropped calls. Monitoring should use a unified dashboard with per-channel metrics, correlation IDs, and pre-written runbooks rehearsed in game days to turn inevitable failures into routine events.
Origin App Marketplace
Origin’s App Marketplace now integrates with over 20 apps from partners including Cloudflare, Linear, Sentry, and Socket Security, covering deployments, CI, code review, security, monitoring, and project management. The marketplace is open to public submissions, allowing any team building developer tools to publish an app. To submit, developers create an app in their namespace, where it stays private while they build against the Origin API, and authenticate using an app JWT and installation access tokens. Apps receive webhook events and can write back check runs, pull request comments, and reviews. After making the app public, developers submit it with a slug, suggested tags, and a demo video showing install, uninstall, and core product flows; Origin reviews and lists approved apps.
Optimizing a 200,000-line Python codebase overnight with Gemini 4 Argon
Google tested Gemini 4 Argon on google/adk-python, a 205,000-line Python framework with 800 source files and 17,000 unit tests. The model ran unattended for 11 hours, guided by a /goal prompt and .agents/skills rulefiles that encoded maintainer conventions. Argon first wrote a benchmark script, spent 70 minutes measuring before editing code, and proposed six optimizations across 32 files; two shipped after human code review. The shipped changes cut in-memory session prep time by about 40% in long sessions and sped up cold package imports by 21% by filtering events before copying and using lazy module accessors. The other four proposals were rejected for relying on fragile state, private library internals, or synthetic-only gains, illustrating a division of labor where the agent explores and the maintainer subtracts.
Gemini 4 Argon for Robotics
Gemini 4 Argon is a new model that achieves a step change in physical understanding, code generation, and visual-semantic reasoning for robotics. It scores 87% on the Embodied Reasoning (ERQA) benchmark using pure reasoning, outperforming other frontier models. The model can be applied across the entire robotics lifecycle, including robot control, Real2Sim reconstruction, physical understanding, and research self-improvement. Examples include controlling a Spot quadruped to practice foot-pedal trash bin disposal in MuJoCo before executing, zero-shot control of a robotic arm, steering a video world model to rearrange Scrabble tiles, reconstructing simulation twins from robot camera feeds or hand-drawn sketches, and reproducing robotics papers as self-contained MuJoCo WebAssembly browser labs with a single prompt. Argon also performs agentic multimodal hindsight labeling for dexterity understanding and dense value functions, and can self-improve by diagnosing failures and optimizing speed, bridging coding, visual perception, physics simulation, and embodied control toward physical AGI.
Run recurring jobs on Stripe without a cron server
Stripe Workflows now supports recurring schedule triggers, enabling automated tasks like notifying teams about past-due subscriptions without external cron servers. Users set schedules in the Dashboard, and Stripe runs the workflow at each scheduled time, following the local clock and handling daylight saving time. A walkthrough lists past-due subscriptions, uses a metadata key condition to skip already-notified ones, and sends Slack notifications via the installed Slack app. The workflow handles pagination; if an action fails, the loop stops and remaining items are picked up on the next run, with details showing which step failed. This eliminates the need for a separate server, secret key storage, and daylight saving time logic, putting calendar-based operations under the finance team’s control.
Introducing the Auth0 SDK for TanStack Start
Auth0 released a dedicated SDK for TanStack Start, a full-stack React framework, to replace hand-rolled OIDC flows or adapted SDKs. The SDK provides hooks, components, route guards, server middleware, and server helpers that integrate with TanStack Start’s server functions, middleware, and file-based router. Setup involves installing the package, configuring environment variables for the Auth0 application, creating a server-side Auth0 instance, registering the auth0Middleware in the start file, and wiring the router context and Auth0Provider in the root route. The SDK automatically mounts auth routes for login, callback, logout, profile, and backchannel logout, and supports features like login, logout, protected routes via requireAuth, session reading on the server with getSession, and additional capabilities such as passkeys, organizations, MFA, and API scope checks. The fastest way to try it is the official quickstart, which scaffolds a fresh app and adds the SDK step by step.
Mix, Don't Tune: Bilingual Pre-Training Outperforms Hyperparameter Search in Data-Constrained Settings
In data-constrained language model pre-training, two remedies exist: aggressive hyperparameter tuning such as high weight decay, and mixing in data from a high-resource auxiliary language to expand the training distribution. This study systematically compares these levers across four model scales from 150M to 1.43B parameters, using Arabic as the low-resource target and English as the auxiliary, over approximately 1000 pre-training runs. Mixing yields larger improvements than hyperparameter tuning on both validation loss and downstream task accuracy, and the gap grows with model size. Mixing boosts performance by an amount equivalent to 2–3× the unique target data on validation loss and 2–13× on downstream task accuracy, with the gain scaling steeply with model size. The authors recommend mixing in a high-resource language, prioritizing the mixing ratio over hyperparameter tuning, and transferring hyperparameters from a small proxy model via μP, noting that target-language validation loss systematically underestimates mixing’s value.
OCP Summit 2026: Powering AI with Open Innovations in Scale-Up, Scale-Out, and Scale-Across Networks
At OCP Summit 2026, Meta unveiled next-generation open networking infrastructure for AI, including IcePack, its first liquid-cooled network rack, and IceCube, a 102.4T switch blade delivering 128×800G non-blocking capacity. The Flattened Planar Fabric (FPF) introduces a multiplane scale-out design where each GPU connects via eight independent 100G links to different switches, reducing latency and enabling larger clusters. Meta also shared its BAG super-spine for multi-site aggregation and Tahan, an Ethernet-based 51.2T scale-up switch for MTIA 300 systems. The company launched the Open Switch Platform Architecture (OSPA) initiative with Microsoft and Alibaba to standardize switch platform hardware and software interfaces. Additionally, Meta announced open-source implementations of MetaRoCE, its RDMA transport protocol optimized for AI cluster networks over Ethernet.
Top topics
- Architecture834
- Performance815
- LLMs659
- Machine Learning621
- Open Source563
- AI Agents553
- AI469
- Developer Experience448
Weekly digest
The best engineering reads, once a week.