Loading…
Latest reads
Every post, summarised
Grounded summaries of engineering blogs, newest first. Each links to the original.
- 4,738 posts
- 20 companies
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Latest posts
Authenticating TeamCity Builds to External Services With OIDC
Static CI/CD credentials can leak through logs or artifacts, expose uncertainty over who copies them, and require rotation, so the article presents OIDC as an alternative for authenticating TeamCity builds. It explains the workload flow: an identity provider issues a signed JWT whose claims include validity, audience, and issuer, while the consuming service retrieves metadata and JWKS, verifies the signature, and checks those claims. The TeamCity OIDC JWT plugin makes the server an identity provider, supports RSA- or ECDSA-based signing, key rotation, configurable public issuer hosting, and extensions for HSMs or key-management services. After installation from JetBrains Marketplace, build configurations can issue tokens at startup or on demand, with default or fixed five-minute lifetimes, for direct presentation or token exchange with AWS, Google Cloud, and other OIDC services.
Developing LLM guardrail configs locally with NeMo Guardrails
The article presents a local workflow for developing and testing NeMo Guardrails configurations in a Jupyter notebook, avoiding repeated Kubernetes deployments and requiring no LLM, GPU, or cloud resources. It defines rails, configurations, and servers, then starts with a case-insensitive regex rail that blocks the exact phrase “ignore all previous instructions”; the test catches a direct attack but allows an accented “Ignóre” variant. A broader regex configuration is followed by a DeBERTa-based prompt-injection classifier and a manually assembled set of 13 prompts, producing 12 correct decisions out of 13, with one subtle attack allowed. The article recommends iterating locally, potentially layering targeted regexes before classifiers for fail-fast, defense-in-depth filtering, while noting that 13 prompts cannot meaningfully measure performance and pointing to standardized EvalHub evaluations as a next step.
Red Hat OpenShift autoscaling using MachineSet autoscaler with KEDA
The demonstration compares OpenShift MachineSet Autoscaler with KEDA against the previously used Cluster Autoscaler, using metrics to scale a MachineSet before pods remain pending. After installing Red Hat’s Custom Metrics Autoscaler operator (KEDA 2.19), granting permissions for MachineSet scaling and Thanos/Prometheus access, it creates a ScaledObject with a Prometheus trigger targeting demo-p4p95-worker-eastus3. Because a MachineSet has no pods, the HPA path cannot use metricType: Value, so AverageValue is paired with a PromQL query that multiplies CPU request utilization by the current node count. With nine one-CPU test pods, the MachineSet scaled from one to two to three nodes as the metric crossed 75%, and all pods reached Running; two additional Standard_D4s_v3 VMs were provisioned in zone 3.
Europe Data Residency for Atlas Embedding and Reranking
MongoDB announced the public preview of data residency in Europe and the United States for the Embedding and Reranking API Service (ERAS) on Atlas. This introduces a Geography, a named group of cloud regions, as a processing boundary for inference, distinct from the region-level cluster provisioning. Requests to a Designated Service are processed and logged only within the chosen Geography, with a 10% price premium for scoped processing. The Europe Geography initially covers EEA regions, and the US Geography covers US regions, with plans to expand. This approach supports data sovereignty goals for European organizations while maintaining a global endpoint for workloads without residency requirements.
The Shared View That Makes Insurance AI Fast and Safe
Agentic AI transforms insurance claims processing, underwriting, and customer service by autonomously executing tasks, reducing a routine claims review from eight hours to eight minutes. However, adding AI agents to fragmented data silos of policy details, claims history, and buried email threads multiplies problems because agents work with incomplete views that degrade. Pairing AI with a unified data architecture that creates a single shared context layer is key; MongoDB Atlas powers this by storing all data in a flexible document model. This shared view delivers accelerated resolution through single-motion retrievals, seamless human oversight by basing decisions on the same record, and built-in compliance through an automatic action trail. Insurers who build on this foundation can safely scale AI agents across claims, underwriting, and customer service while maintaining the oversight regulators and customers expect.
How to disclose AI to customers without killing the conversation
Customer service teams may avoid disclosing AI because they fear customers will leave, but the post argues that unclear or delayed disclosure creates more frustration than honesty. It recommends a short first-turn greeting that says “AI,” explains what the agent can do, and offers an immediate route to a human, with renewed disclosure when a conversation moves to SMS or voice. Web chat, SMS, and voice examples show how to pair disclosure with an exit, while voice should disclose before the caller explains the issue and leave a pause. The post identifies burying the disclosure, using ambiguous labels, apologizing, over-explaining, and omitting escalation as failure modes. It proposes checking Twilio Conversation Intelligence transcripts alongside containment and escalation rates to assess wording changes, citing research on customer expectations and bypass behavior.
When AI takes the wheel: The rise of invisible identity intelligence in 2026
Point-in-time authentication treats an initial password, MFA, or passkey check as sufficient trust for the rest of a session, leaving post-login account takeovers, session hijacking, and risky API actions insufficiently evaluated. The proposed model replaces this front-door assumption with continuous context evaluation using passive telemetry such as network, telecommunications, device, behavioral, and transaction signals, then intervenes when risk scores or policy thresholds rise. For AI agents, delegated authority sets temporal, monetary, and API limits through short-lived credentials, while Know Your Agent lineage links execution to the authorizing human and deploying enterprise. High-impact actions can trigger human checkpoints through SMS, push, or voice channels, while immutable logs, transparent scoring, tenant isolation, and session lineage support auditability and compliance. The resulting architecture aims to keep low-risk autonomous work unobtrusive while making sensitive operations controllable and provable.
Complete guide to sending email to Google: Rules, signals & setup
Sending email to Google requires understanding differences between consumer Gmail and Google Workspace, plus the authentication and reputation signals used by Google’s filtering systems. The guide says SPF and DKIM are required for all senders, while DMARC is required for senders exceeding 5,000 messages per day to Google inboxes; it also gives a bounce example for missing alignment. It recommends keeping user-reported spam below 0.1%, never reaching 0.3%, and providing one-click unsubscribe handling. Google Postmaster Tools reports compliance, spam rate, authentication success, and delivery errors, while the Feedback-ID header enables aggregate complaint analysis by campaign or sender ID. Workspace administrators can apply additional filters, so successful delivery to Gmail does not guarantee placement in a corporate Workspace inbox.
Introducing @huggingface/kernels: 200+ WebGPU Kernels for Local AI
Hugging Face’s WebAI team is releasing @huggingface/kernels, a JavaScript loader for optimized WebGPU kernels hosted on the Hub, alongside an initial collection of 207 Apache-2.0 kernels. Each kernel repository packages a versioned contract, metadata, correctness cases, benchmark cases, and parameterized WGSL shader templates, while the loader derives outputs and selects variants for a request and device. Fleet adds browser-based correctness and performance testing, with consent-based private evidence used to identify failures, compare variants, and guide optimization. In comparisons against ORT WebGPU on an Apple M4, matching cases showed a 2.57x geometric-mean speedup and a 1.90x median speedup, though the measurements cover individual GPU operations and exclude setup costs. The project is also intended as a shared foundation for browser inference and future integration with higher-level tooling.
How to Make Your AI Agent Enterprise-Ready: Enabling Enterprise-Managed Authorization for Client Apps in Auth0
Auth0 is launching Early Access for Client App, or Requesting App, capabilities that support Cross App Access (XAA) for AI assistants, developer tools, and autonomous agents. In the Enterprise-Managed Authorization (EMA) model, an employee’s corporate SSO login can authorize access to external APIs or Model Context Protocol (MCP) servers through the IETF Identity Assertion Authorization Grant (ID-JAG) draft specification. Auth0’s Token Vault brokers the multi-hop exchange: it stores an upstream enterprise refresh token, retrieves a short-lived ID-JAG, exchanges it with the downstream Resource App, and returns a standard access token to the backend. Setup uses dashboard toggles and connection settings, followed by a standard /oauth/token federated exchange, while the API requires no XAA-specific changes. The release also describes audit logging, enterprise IdP policy control, OIN distribution, and caching downstream tokens because ID-JAG exchanges are rate-limited to 50% of the tier’s standard Auth API limit.
Running a Software Factory Efficiently at Uber Scale
Uber describes a Software Factory in which AI tools and managed agents support software development, with more than 70% of pull requests attributed to local or cloud agents and over 3,600 agent skills. From February to August 2026, weekly active users grew sevenfold and weekly agentic requests 9.4-fold, while holding a model constant showed cost per 1,000 requests down almost 34% and cost per session down 52% from its June peak. The framework organizes usage into four layers and decomposes session spend into adoption, engagement, input and output workload, token pricing, and related execution factors measured through portfolio, model, driver, and managed-agent outcome metrics. Its optimization program uses real-work benchmarks, Pareto model selection, cheaper subagents, prompt caching, graph-grounded context, batched tool calls, and session-level waste analysis to reduce zero-value token use while improving or maintaining quality.
Rerouting the Stream: How Lyft Moved to the Apache Flink Operator
Lyft migrated its fleet of hundreds of critical streaming jobs from an internally developed Flink Kubernetes operator to the open-source Apache Flink Kubernetes operator. The legacy system imposed maintenance burden, feature gaps, outdated dependencies, fragile savepoint handling, and a rigid memory model that complicated varied workloads, including Apache Beam applications. Lyft used an incremental migration designed to preserve deployment patterns and team workflows while addressing CRD translation, state-machine behavior, and operational compatibility. The new platform added explicit last-state upgrades, autoscaling, automatic memory tuning, and safer upgrade mechanisms, though autotuning required trade-offs with in-place autoscaling and node capacity planning. After the multi-quarter transition, maintenance burden was minimized, the autoscaler right-sized a fleet previously overprovisioned by a few million dollars annually, and Lyft could contribute fixes upstream instead of maintaining its own operator.
Why AI Agents Get the Right Facts but the Wrong Answer—and How GraphRAG Helps
The post examines why an agent can cite accurate return-policy evidence yet reject an eligible customer when decisive facts are distributed across systems. Its washing-machine scenario combines a product classification, an extended-policy rule, membership tier, purchase amount, and purchase date to show that retrieving enough evidence differs from retrieving relevant evidence. GraphRAG addresses the gap by extracting entities and relationships into a knowledge graph, then using multi-hop retrieval to follow connections from WM-500 to the applicable policy and supporting records. The implementation also uses explicit pointers from graph entities to structured data, while separating the TBox blueprint from ABox instances and requiring business validation of the schema. The diagnostic framework distinguishes missing retrieved context, omitted business rules, and broken record mappings, while noting that these examples are not benchmark results and that correct evidence can still be used incorrectly.
Securing Agentic Commerce
Agentic commerce is moving from AI-assisted product discovery toward purchases completed by agents, but retail systems often cannot reliably establish the shopper’s identity or spending authority. The post describes four phases—product discovery, checkout functions, delegate-to-buy, and agent-to-agent commerce—and notes standards including UCP, ACP, and AP2. Auth0’s approach combines user authentication, asynchronous authorization, and authentication for MCP, using CIMD-based agent registration, OAuth, and on-behalf-of token exchange to issue temporary, scoped transaction access. It presents third-party shopping agents and retailer-owned agents as two deployment models, with actions tied to an authenticated shopper and recorded for auditability. The proposed identity layer can sit alongside an existing identity provider while supporting emerging protocols and future autonomous purchasing.
Autoscaling Lakebase Postgres
Lakebase Postgres addresses the waste and uncertainty of choosing a fixed database instance size before workload demand is known. Its decoupled architecture separates stateless compute from durable storage, allowing compute to start, stop, move, or resize without moving the database. The autoscaling algorithm combines CPU load, memory pressure, and a time-aware estimate of the Postgres working set, using modified HyperLogLog registers that store timestamps and estimate windows from one to 60 minutes. Scaling occurs live through autoscaler-agent, vm-monitor, Kubernetes scheduling, and NeonVM, with checks preventing unsafe downscales and scheduler approval for upscales. The system scales in both directions without dropping connections and operates across 100-millisecond, five-second, and 20-second timescales, including more than 32,000 resizes per month.
Testing cookie behavior across hundreds of web surfaces with our in-house auditor
Maintaining cookie consent behavior across more than 200 web surfaces is difficult because URLs, integrations, experiments, languages, and page settings change over time. Dropbox built an in-house cookie auditor that uses Playwright and fresh isolated browser sessions to test three experiences—a standard US visitor, an EU visitor, and a visitor sending a Global Privacy Control signal. Each test records cookies before interaction, finds consent controls without relying on visible button text, declines non-essential cookies, reloads the page, and verifies that the resulting cookies and saved preference match expected behavior. A companion URL detector narrows the audit set from traffic records, while configurable classifications, exceptions, weekly reports, and historical results support review, trend detection, and follow-up by Privacy and Engineering teams.
Run NVIDIA BioNeMo NIM Microservices for Protein Structure Prediction in Claude Science
Claude Science is used with the NVIDIA BioNeMo Agent Toolkit and NVIDIA NIM microservices to investigate how the predicted Seh1 structure changes alone versus with proposed partner C1HCX1. The workflow retrieves UniProt sequences, generates unpaired and species-paired multiple-sequence alignments with MSA Search, and sends those inputs to OpenFold3 and Boltz-2 for independent monomer and heteromer predictions. Using MSA input, heteromer iPTM reached 0.85 for OpenFold3 and 0.82 for Boltz-2, versus 0.14 and 0.19 without it; five-sample runs had standard deviations no greater than 0.006. Both models placed partner β-strands at Seh1’s WD40 propeller closure, while core Cα-RMSD remained 0.68 Å and 0.65 Å, respectively, but the predicted interaction remains experimentally unverified.
Scale AV Perception Across Vehicle Platforms with NVIDIA Omniverse NuRec
Autonomous-driving perception changes when the same software moves across carlines because sensor placement, calibration, fields of view, occlusions, geometry, timing, and coverage change. The post presents NVIDIA Omniverse NuRec as a way to adapt a stack before a complete target-carline dataset exists, while retaining real-world data for grounding and validation. NuRec reconstructs recorded drives with 3D Gaussian splatting, renders novel views through a target rig with configurable camera models and calibration, and preserves trajectories, annotations, and map data for label adaptation. The workflow pairs a reconstructed scene with a rig, renders target views, refines frames with NVIDIA Harmonizer, and trains a perception model on the output. It also documents containerized rendering and auxiliary-data generation, including semantic masks, metric depth, and ego-vehicle masks, while noting that views outside observed coverage may be lower quality.
Developing provably correct Rust code with Verus
Rust’s type system prevents many memory-safety bugs, but it does not prove that programs compute intended results, avoid leaks, or correctly handle every unsafe and concurrent operation. Verus is an open-source automated program verifier that checks Rust implementations against formal specifications for all possible inputs, using solvers to discharge proof obligations while developers provide guidance such as loop invariants. Specifications and proofs use Rust-like requires and ensures annotations written alongside the code, while ordinary Rust compilers ignore them and Verus typically returns feedback in under a second. The tool can prove properties of unsafe code, lock invariants, and concurrent systems, and Amazon has used it for key Nitro Isolation Engine primitives and other critical infrastructure.
Fine-Tuning SOTA Object Detection Models on Real-World Datasets
This practical comparison examines how YOLO12, YOLO26, and RF-DETR behave when moved from COCO to specialized real-world object-detection datasets, and how fine-tuning changes the outcome. The authors first evaluate six pretrained checkpoints on COCO val2017, then use cable-damage, bone-fracture, and soda-bottles datasets from RF100-VL for zero-shot testing, fine-tuning, and accuracy/latency comparison. Because the model implementations require incompatible dependencies, the workflow uses one PyCharm project with three isolated uv environments and remote GPU execution; the reported latency stays in native frameworks rather than TensorRT. All models perform well on COCO, but direct performance on specialized data falls close to zero, while 10 fine-tuning epochs adapt the detectors well to cable damage and soda bottles. Bone-fracture remains difficult despite fine-tuning, with RF-DETR performing best, indicating that domain shift may require more data, longer training, or domain-specific pretraining.
Top topics
- Architecture834
- Performance817
- LLMs673
- Machine Learning622
- Open Source568
- AI Agents564
- AI483
- Developer Experience448
Weekly digest
The best engineering reads, once a week.