Loading…
Latest reads
Every post, summarised
Grounded summaries of engineering blogs, newest first. Each links to the original.
- 4,671 posts
- 20 companies
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Latest posts
Complete guide to sending email to Google: Rules, signals & setup
Sending email to Google requires understanding differences between consumer Gmail and Google Workspace, plus the authentication and reputation signals used by Google’s filtering systems. The guide says SPF and DKIM are required for all senders, while DMARC is required for senders exceeding 5,000 messages per day to Google inboxes; it also gives a bounce example for missing alignment. It recommends keeping user-reported spam below 0.1%, never reaching 0.3%, and providing one-click unsubscribe handling. Google Postmaster Tools reports compliance, spam rate, authentication success, and delivery errors, while the Feedback-ID header enables aggregate complaint analysis by campaign or sender ID. Workspace administrators can apply additional filters, so successful delivery to Gmail does not guarantee placement in a corporate Workspace inbox.
Introducing @huggingface/kernels: 200+ WebGPU Kernels for Local AI
Hugging Face’s WebAI team is releasing @huggingface/kernels, a JavaScript loader for optimized WebGPU kernels hosted on the Hub, alongside an initial collection of 207 Apache-2.0 kernels. Each kernel repository packages a versioned contract, metadata, correctness cases, benchmark cases, and parameterized WGSL shader templates, while the loader derives outputs and selects variants for a request and device. Fleet adds browser-based correctness and performance testing, with consent-based private evidence used to identify failures, compare variants, and guide optimization. In comparisons against ORT WebGPU on an Apple M4, matching cases showed a 2.57x geometric-mean speedup and a 1.90x median speedup, though the measurements cover individual GPU operations and exclude setup costs. The project is also intended as a shared foundation for browser inference and future integration with higher-level tooling.
How to Make Your AI Agent Enterprise-Ready: Enabling Enterprise-Managed Authorization for Client Apps in Auth0
Auth0 is launching Early Access for Client App, or Requesting App, capabilities that support Cross App Access (XAA) for AI assistants, developer tools, and autonomous agents. In the Enterprise-Managed Authorization (EMA) model, an employee’s corporate SSO login can authorize access to external APIs or Model Context Protocol (MCP) servers through the IETF Identity Assertion Authorization Grant (ID-JAG) draft specification. Auth0’s Token Vault brokers the multi-hop exchange: it stores an upstream enterprise refresh token, retrieves a short-lived ID-JAG, exchanges it with the downstream Resource App, and returns a standard access token to the backend. Setup uses dashboard toggles and connection settings, followed by a standard /oauth/token federated exchange, while the API requires no XAA-specific changes. The release also describes audit logging, enterprise IdP policy control, OIN distribution, and caching downstream tokens because ID-JAG exchanges are rate-limited to 50% of the tier’s standard Auth API limit.
Running a Software Factory Efficiently at Uber Scale
Uber describes a Software Factory in which AI tools and managed agents support software development, with more than 70% of pull requests attributed to local or cloud agents and over 3,600 agent skills. From February to August 2026, weekly active users grew sevenfold and weekly agentic requests 9.4-fold, while holding a model constant showed cost per 1,000 requests down almost 34% and cost per session down 52% from its June peak. The framework organizes usage into four layers and decomposes session spend into adoption, engagement, input and output workload, token pricing, and related execution factors measured through portfolio, model, driver, and managed-agent outcome metrics. Its optimization program uses real-work benchmarks, Pareto model selection, cheaper subagents, prompt caching, graph-grounded context, batched tool calls, and session-level waste analysis to reduce zero-value token use while improving or maintaining quality.
Rerouting the Stream: How Lyft Moved to the Apache Flink Operator
Lyft migrated its fleet of hundreds of critical streaming jobs from an internally developed Flink Kubernetes operator to the open-source Apache Flink Kubernetes operator. The legacy system imposed maintenance burden, feature gaps, outdated dependencies, fragile savepoint handling, and a rigid memory model that complicated varied workloads, including Apache Beam applications. Lyft used an incremental migration designed to preserve deployment patterns and team workflows while addressing CRD translation, state-machine behavior, and operational compatibility. The new platform added explicit last-state upgrades, autoscaling, automatic memory tuning, and safer upgrade mechanisms, though autotuning required trade-offs with in-place autoscaling and node capacity planning. After the multi-quarter transition, maintenance burden was minimized, the autoscaler right-sized a fleet previously overprovisioned by a few million dollars annually, and Lyft could contribute fixes upstream instead of maintaining its own operator.
Why AI Agents Get the Right Facts but the Wrong Answer—and How GraphRAG Helps
The post examines why an agent can cite accurate return-policy evidence yet reject an eligible customer when decisive facts are distributed across systems. Its washing-machine scenario combines a product classification, an extended-policy rule, membership tier, purchase amount, and purchase date to show that retrieving enough evidence differs from retrieving relevant evidence. GraphRAG addresses the gap by extracting entities and relationships into a knowledge graph, then using multi-hop retrieval to follow connections from WM-500 to the applicable policy and supporting records. The implementation also uses explicit pointers from graph entities to structured data, while separating the TBox blueprint from ABox instances and requiring business validation of the schema. The diagnostic framework distinguishes missing retrieved context, omitted business rules, and broken record mappings, while noting that these examples are not benchmark results and that correct evidence can still be used incorrectly.
Securing Agentic Commerce
Agentic commerce is moving from AI-assisted product discovery toward purchases completed by agents, but retail systems often cannot reliably establish the shopper’s identity or spending authority. The post describes four phases—product discovery, checkout functions, delegate-to-buy, and agent-to-agent commerce—and notes standards including UCP, ACP, and AP2. Auth0’s approach combines user authentication, asynchronous authorization, and authentication for MCP, using CIMD-based agent registration, OAuth, and on-behalf-of token exchange to issue temporary, scoped transaction access. It presents third-party shopping agents and retailer-owned agents as two deployment models, with actions tied to an authenticated shopper and recorded for auditability. The proposed identity layer can sit alongside an existing identity provider while supporting emerging protocols and future autonomous purchasing.
Autoscaling Lakebase Postgres
Lakebase Postgres addresses the waste and uncertainty of choosing a fixed database instance size before workload demand is known. Its decoupled architecture separates stateless compute from durable storage, allowing compute to start, stop, move, or resize without moving the database. The autoscaling algorithm combines CPU load, memory pressure, and a time-aware estimate of the Postgres working set, using modified HyperLogLog registers that store timestamps and estimate windows from one to 60 minutes. Scaling occurs live through autoscaler-agent, vm-monitor, Kubernetes scheduling, and NeonVM, with checks preventing unsafe downscales and scheduler approval for upscales. The system scales in both directions without dropping connections and operates across 100-millisecond, five-second, and 20-second timescales, including more than 32,000 resizes per month.
Testing cookie behavior across hundreds of web surfaces with our in-house auditor
Maintaining cookie consent behavior across more than 200 web surfaces is difficult because URLs, integrations, experiments, languages, and page settings change over time. Dropbox built an in-house cookie auditor that uses Playwright and fresh isolated browser sessions to test three experiences—a standard US visitor, an EU visitor, and a visitor sending a Global Privacy Control signal. Each test records cookies before interaction, finds consent controls without relying on visible button text, declines non-essential cookies, reloads the page, and verifies that the resulting cookies and saved preference match expected behavior. A companion URL detector narrows the audit set from traffic records, while configurable classifications, exceptions, weekly reports, and historical results support review, trend detection, and follow-up by Privacy and Engineering teams.
Run NVIDIA BioNeMo NIM Microservices for Protein Structure Prediction in Claude Science
Claude Science is used with the NVIDIA BioNeMo Agent Toolkit and NVIDIA NIM microservices to investigate how the predicted Seh1 structure changes alone versus with proposed partner C1HCX1. The workflow retrieves UniProt sequences, generates unpaired and species-paired multiple-sequence alignments with MSA Search, and sends those inputs to OpenFold3 and Boltz-2 for independent monomer and heteromer predictions. Using MSA input, heteromer iPTM reached 0.85 for OpenFold3 and 0.82 for Boltz-2, versus 0.14 and 0.19 without it; five-sample runs had standard deviations no greater than 0.006. Both models placed partner β-strands at Seh1’s WD40 propeller closure, while core Cα-RMSD remained 0.68 Å and 0.65 Å, respectively, but the predicted interaction remains experimentally unverified.
Scale AV Perception Across Vehicle Platforms with NVIDIA Omniverse NuRec
Autonomous-driving perception changes when the same software moves across carlines because sensor placement, calibration, fields of view, occlusions, geometry, timing, and coverage change. The post presents NVIDIA Omniverse NuRec as a way to adapt a stack before a complete target-carline dataset exists, while retaining real-world data for grounding and validation. NuRec reconstructs recorded drives with 3D Gaussian splatting, renders novel views through a target rig with configurable camera models and calibration, and preserves trajectories, annotations, and map data for label adaptation. The workflow pairs a reconstructed scene with a rig, renders target views, refines frames with NVIDIA Harmonizer, and trains a perception model on the output. It also documents containerized rendering and auxiliary-data generation, including semantic masks, metric depth, and ego-vehicle masks, while noting that views outside observed coverage may be lower quality.
Developing provably correct Rust code with Verus
Rust’s type system prevents many memory-safety bugs, but it does not prove that programs compute intended results, avoid leaks, or correctly handle every unsafe and concurrent operation. Verus is an open-source automated program verifier that checks Rust implementations against formal specifications for all possible inputs, using solvers to discharge proof obligations while developers provide guidance such as loop invariants. Specifications and proofs use Rust-like requires and ensures annotations written alongside the code, while ordinary Rust compilers ignore them and Verus typically returns feedback in under a second. The tool can prove properties of unsafe code, lock invariants, and concurrent systems, and Amazon has used it for key Nitro Isolation Engine primitives and other critical infrastructure.
Fine-Tuning SOTA Object Detection Models on Real-World Datasets
This practical comparison examines how YOLO12, YOLO26, and RF-DETR behave when moved from COCO to specialized real-world object-detection datasets, and how fine-tuning changes the outcome. The authors first evaluate six pretrained checkpoints on COCO val2017, then use cable-damage, bone-fracture, and soda-bottles datasets from RF100-VL for zero-shot testing, fine-tuning, and accuracy/latency comparison. Because the model implementations require incompatible dependencies, the workflow uses one PyCharm project with three isolated uv environments and remote GPU execution; the reported latency stays in native frameworks rather than TensorRT. All models perform well on COCO, but direct performance on specialized data falls close to zero, while 10 fine-tuning epochs adapt the detectors well to cable damage and soda bottles. Bone-fracture remains difficult despite fine-tuning, with RF-DETR performing best, indicating that domain shift may require more data, longer training, or domain-specific pretraining.
Introducing Adaptive Intelligence: undermining the economics of every bot attack
Cloudflare introduces Adaptive Intelligence, a bot detection engine designed for attackers who distribute requests across proxies, vary fingerprints, and continually test defenses. It argues that deterministic, rule-based systems create stationary targets: attackers receive repeated yes-or-no feedback while defenders update on slower release cycles, making adaptation economically cheaper for attackers. The engine changes this dynamic through continuously retrained machine learning, statistical rather than fixed judgments, and planned disposable rules that appear and retire at random intervals; it also learns from corrections and misses across millions of sites. Its first component, continuous retraining of the machine-learning system behind bot score, is launching now, while disposable rule generation and broader traffic learning are described as forthcoming, with Enterprise customers enabling “Auto Update Machine Learning” to receive it.
From Leaderboards to Model Profiles: A Deep Dive Evaluation of LLMs for Agentic Coding
Resolve rate alone can hide how coding agents reach the same outcome. This evaluation compares Claude Opus 4.7, Gemini 3.5 Flash, GPT-5.5, and Qwen 3.6 27B FP8 through a Junie pipeline across four benchmark datasets, combining test results with trajectory, cost, efficiency, patch quality, and process measures. In one private benchmark, Opus and Gemini solved the same number of tasks, but Opus averaged 184 steps at USD 2.79 per run versus Gemini's 271 steps at USD 1.24. Across 523 tasks, Opus resolved 267 (51.1%) and Gemini 254 (48.6%); shared outcomes masked differences in navigation, validation, redundancy, hallucination, and patch scope. The wider comparison found GPT-5.5 had the highest resolve rate and always ran an executable check, Opus led patch-quality metrics, and Qwen delivered lower cost with lower resolution, while the authors caution that profiles depend on the Junie scaffold and LLM judges are diagnostic rather than ground truth.
Sunsetting of the JetBrains Teacher Pack for Bootcamps
JetBrains is sunsetting the Teacher Pack for Bootcamps, citing the expansion of separate education programs for teachers, students, classrooms, and independent learners. Bootcamps can submit one final application by September 30, 2026, at 11:59 pm CET; applications will no longer be accepted from October 1. Approved applications submitted by the deadline receive one final set of student coupons valid for up to six months, while previously issued coupons and instructor IDE access remain active until their expiration dates, with no additional coupons or free instructor access after October 1. The program will be fully retired on April 1, 2027, when all bootcamp-provided coupons will have expired and the graduation discount will end; alternatives include Teacher Packs for accredited institutions, the Course Creators Program, the Student Pack, and free or non-commercial IDE options.
AI-powered multicluster management: Querying fleet health with OpenShift Lightspeed and Red Hat Advanced Cluster Management
Managing modern large-scale Kubernetes fleets across distributed clusters can make troubleshooting slow because administrators must build manual search queries and sift scattered outputs. The post presents a Technology Preview MCP server for Red Hat Advanced Cluster Management that translates natural-language prompts into structured searches across managed clusters, deployed with Helm in the hub cluster. OpenShift Lightspeed is configured through its OLSConfig custom resource to call the MCP endpoint, use a Kubernetes service-account token for internal authorization, and optionally skip approval for read-only searches. The examples cover finding clusters below OpenShift 4.21, locating pods in a specified cluster and namespace, and identifying an unhealthy VM across the fleet; one result finds dev-vm in an ErrorUnschedulable condition and provides diagnostic guidance.
Stop wasting GPU allocation in Kubernetes with GPU-pruner
GPU-pruner addresses idle GPU allocation in Kubernetes by identifying workloads whose hardware activity remains below a configured threshold, rather than relying on browser sessions, network traffic, or pod lifetime. It queries Prometheus for NVIDIA Data Center GPU Manager metrics, including engine activity and GPU utilization, and treats peak performance below 1% throughout a default 35-minute observation window as idle. After tracing an idle pod through ownerReferences or KServe labels, it scales the parent resource to zero, preserving workload metadata for later restoration. Slack notifications, grace periods, lookback checks, and dry-run mode provide safeguards, while Prometheus label handling must preserve the workload namespace and pod identity in DCGM telemetry.
How to Approve Real Users and Block Fake Accounts at Sign Up with Lookup and Verify in PHP
The tutorial shows how to combine Twilio Lookup and Verify in a PHP sign-up flow that screens phone numbers before sending an OTP. It starts with Line Type Intelligence to accept mobile numbers, optionally checks reachability with Line Status, and uses Identity Match to compare submitted first and last names against authoritative sources without revealing underlying data. If those checks pass, the application sends a six-digit verification code and validates it through a Verify service. The provided implementation uses PHP 8.5, Slim, Twig, Monolog, and the Twilio REST client, with environment flags controlling optional checks and logs recorded in data/app.log. Testing covers mobile, toll-free, VoIP, and name-mismatch cases, while the pricing discussion recommends ordering cheaper checks before more expensive Identity Match and Verify calls.
Your customers don't hate AI — they hate you lying about it
Twilio research reports a major gap between brands’ and consumers’ accounts of AI-agent disclosure: 81% of brands say agents identify themselves immediately, while only 22% of consumers report that experience. Teams may treat a system-prompt line, widget label, or one-time channel message as disclosure, even though customers can miss it or encounter a different experience on SMS or voice. Recommended practice includes naming “AI agent” at the first turn, repeating disclosure across channels, explaining accessible data and decision logic, and offering an immediate route to a person. It also recommends checking transcripts rather than trusting configuration, using conversation analysis to verify whether disclosure fired. Research cited says 76% expect identification at the start, 49% want data-access transparency, and 54% trust AI more when its logic is explained.
Top topics
- Architecture834
- Performance816
- LLMs660
- Machine Learning622
- Open Source563
- AI Agents553
- AI470
- Developer Experience448
Weekly digest
The best engineering reads, once a week.