Loading…
Latest reads
Every post, summarised
Grounded summaries of engineering blogs, newest first. Each links to the original.
- 4,671 posts
- 20 companies
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Latest posts
Running AI agents in GitHub Actions with Docker Sandboxes
GitHub Agentic Workflows added support for Docker Sandboxes as an agent runtime, allowing CI coding agents to operate within microVM isolation. Useful AI agents require broad capabilities like executing arbitrary shell commands and launching containers, which elevates risk on shared CI runners. With the docker-sbx runtime, agents receive root privileges and a private Docker daemon inside a dedicated microVM while external repository access and network traffic remain restricted. In a demonstration, an agent ran on an Ubuntu runner, executed Java 21 integration tests with PostgreSQL via Testcontainers, identified an email case-sensitivity defect, applied a code fix, and opened a draft pull request. The complete workflow executed in eleven minutes and sixteen seconds while confining modifications strictly to source files.
10 Best Websites to Book a Rental Car in 2026
The guide compares 10 websites and apps for booking rental cars in 2026, grouping them into aggregators, direct rental companies, peer-to-peer marketplaces, and hybrid platforms. It matches services to needs such as price comparison, member discounts, unusual vehicles, loyalty rewards, bundling, coupon savings, and international coverage. The entries describe concrete differences: Kayak searches hundreds of providers, Costco Travel uses negotiated member rates, Turo lists vehicles from private owners, and Uber Rent combines traditional agencies with Turo listings in one search. Other examples include Priceline’s Express Deals, Expedia’s trip bundling, AutoSlash’s coupon and price-tracking tools, and direct programs from Enterprise and Hertz. It advises comparing total cost, cancellation terms, mileage limits, fuel policy, protection options, deposits, pickup and drop-off locations, and additional-driver fees because advertised daily rates do not capture every booking condition.
How AgentFlo built AI sales agents with Amazon Bedrock AgentCore – Part 2
AgentFlo designed an architecture using Amazon Bedrock AgentCore and AWS serverless infrastructure to address traffic spikes and build trust in autonomous commerce agents. Security operates across three stages: AWS Fargate filters prompt injections and opt-outs, AgentCore Gateway enforces deterministic Cedar authorization policies during tool execution, and post-turn privacy filters screen outputs. Session isolation is maintained across merchants through AgentCore runtime microVMs, while AgentCore Observability and Amazon CloudWatch provide end-to-end tracing. Data reliability and long conversation journeys rely on Amazon DynamoDB context storage, Amazon Bedrock Knowledge Bases, and Amazon S3 Vector embeddings. Early deployment data showed a 12 percent net revenue uplift.
August 2026 newsletter
The August 2026 newsletter rounds up ClickHouse product releases, research, managed services, observability, community work, and upcoming events. It introduces Andy Pavlo’s arrival to establish ClickHouse Labs, describes the 26.7 release’s join optimizations, token-position text indexes, and EXPLAIN ANALYZE, and reports a 40× phrase-search improvement on a Hacker News dataset. It also covers an interactive ClickBench playground for more than 100 database systems, running isolated workloads in Firecracker microVMs on AWS EC2, plus guidance on combining Postgres for mutable data with ClickHouse for immutable analytical workloads. Additional items address Managed Postgres notifications and backups, TTL-related disk growth, vector-search trade-offs, and hdx-evals, which found a purpose-built ClickStack MCP server scored 7–20 percentage points higher than direct SQL access in five reproducible scenarios.
Spring Boot Configuration Management Best Practices
Spring Boot externalizes application configuration across files, environment variables, system properties, and command-line arguments to allow a single artifact to run across multiple environments. A resilient setup classifies values into application defaults, deployment configurations, and externalized secrets stored in dedicated vaults. Binding properties to type-safe Java records via @ConfigurationProperties ensures immutability, supports relaxed property mapping, and eliminates the discovery issues common to scattered @Value annotations. Enforcing validation with @Validated and Jakarta Bean Validation constraints triggers fail-fast startup behavior when required settings are absent or malformed. Property precedence determines the effective runtime values, which must be adapted appropriately whether deploying a monolith, containerized workloads in Kubernetes, or a microservices cluster.
Red Hat Ansible development workspaces for governed automation content creation
Ansible development workspaces in Red Hat Ansible Automation Platform leverage Red Hat OpenShift Dev Spaces to solve environment drift and lengthy developer onboarding. Instead of configuring local environments, developers access cloud-hosted VS Code instances via a web browser using declarative devfile.yaml configurations. The platform enforces immutability with a read-only /var directory at runtime, preventing arbitrary package installations that cause configuration drift. To address differing domain requirements across teams without creating bloated monolithic images, the solution implements a four-tiered image strategy based on OpenShift BuildConfigs and ImageStreams. When base container images receive security patches, the dependent image layers automatically rebuild throughout the entire chain.
Add Cross App Access to Your OIDC Requesting Application
OpenID Connect federated applications connecting to third-party services can implement Cross App Access using the Identity Assertion Authorization Grant specification. When a user authenticates via the standard authorization code flow, the requesting application retains the issued refresh token. The application exchanges this refresh token at Okta's token endpoint via RFC 8693 token exchange to receive a short-lived Identity Assertion Authorization Grant JSON Web Token. Next, the application presents this assertion to the third-party resource authorization server using the RFC 7523 JWT bearer grant to obtain a final access token. Developers can configure an AI Agent and application integrations in Okta to validate the entire end-to-end request flow against test endpoints on xaa.dev.
GLM-5.3 vs. GPT-5.6 Sol on DeepSWE: Cost, Coding, and Routing
GLM-5.3 and GPT-5.6 Sol were evaluated on 113 DeepSWE tasks with 904 rollouts, comparing accuracy, cost, and failure patterns. Sol edges ahead at pass@1 (72.7% vs 69.0%), but GLM-5.3 leads at pass@4 (87.6% vs 85.8%) at $3.99 per rollout, half Sol’s $8.37 cost and yielding 17 solves per $100 versus Sol’s 9. Their low per-task correlation of 0.43 makes a cascade effective: GLM-5.3 first, then Sol on test failure, achieving 85.9% solved at $6.61 per task. Sol runs faster (19 minutes, 61 steps vs 35 minutes, 124 steps) and achieves higher reliability (61 tasks solved all four tries vs 48), but it breaks passing tests in 20% of failures versus GLM-5.3’s 11%.
GLM-5.3 vs. Claude Fable 5 on DeepSWE: Cost, Coding, and Routing
GLM-5.3 and Claude Fable 5 were compared on the DeepSWE benchmark across 113 tasks with four trials each, totaling 904 rollouts. On first-attempt accuracy, Fable 5 scored 69.7% and GLM-5.3 scored 69.0%, a statistical tie inside error bars. GLM-5.3 led on pass@2 (81.1% vs. 77.1%) and pass@4 (87.6% vs. 84.1%), and cost $3.99 per rollout versus Fable’s $21.63, a 5.4x price gap. Per $100, GLM-5.3 solved 17 tasks while Fable solved 3. Both models regress test suites in only 11% of failures, and GLM-5.3 averages 35 minutes per rollout with 80k output tokens versus Fable’s 34 minutes and 114k tokens. The models are near-substitutes with 0.65 per-task correlation; GLM-5.3 won five of eight domains including JavaScript and concurrency, while Fable excelled only in Rust and serialization, making GLM-5.3 the practical default.
Top user authentication trends for 2026
The article outlines authentication trends expected to shape identity verification, fraud prevention, payments, and access in 2026, against a backdrop of deepfakes, synthetic identities, regulatory change, and increasingly online services. It describes identity orchestration that combines document checks, biometrics, device intelligence, and behavioral signals, while fraud systems assess behavior and may allow, challenge, delay, or block access. For AI agents, Know Your Agent links a bot to its enterprise and official communication channel, with document verification and Twilio Lookup presented as a combined onboarding approach. The recommended strategies add continuous anomaly monitoring, risk-based MFA, human-in-the-loop approvals, multichannel authorization, passkeys, digital IDs, and layered controls, while concluding that businesses and regulators should remain agile and use services such as Twilio Verify, Lookup API, and Verify Fraud Guard.
The fraud-friction paradox: Why stronger security should feel invisible
The post argues that the long-standing trade-off between security and seamless user experience is a false choice, especially as autonomous AI agents act across systems. High-friction measures such as passwords, CAPTCHAs, and one-time login checks can create insecure credential reuse and fail to govern over-permissioned agents or risks that emerge during a session. It proposes invisible, continuous risk evaluation using device, network, phone, email, communication, and behavioral signals, with event-triggered verification when an agent requests a consequential action. The approach also separates human authentication from agent identity and Know Your Agent (KYA), which define delegated authority, contextual rules, and time-bounded permissions while linking an agent to its deploying entity. Twilio is presented as a unified trust layer combining customer data, security intelligence, AI governance, and communication channels; the conclusion is that adaptive controls can protect users while making security largely invisible.
How Hugging Face Inference Endpoints, Jobs, and Buckets Power Search on Papers with Code
Papers with Code needs a search engine that supports exact titles and arXiv identifiers, semantic requests, navigational queries, typos, and fast responses when model services are cold or unavailable. The system uses hybrid retrieval: PostgreSQL full-text search provides a lexical baseline, pgvector stores dense embeddings, and reciprocal rank fusion combines them. Full-corpus embeddings for more than 110,000 papers run in burstable GPU Jobs from repeatable-read database snapshots, with checksummed JSONL inputs and resumable Parquet outputs stored in Buckets. An Inference Endpoint serves low-latency query embeddings and bounded hourly updates for changed papers, while lexical retrieval remains a fallback. The embedding contract pins the model revision, dimension, prompts, normalization, and source hash; production uses Qwen/Qwen3-Embedding-0.6B with 256-dimensional L2-normalized vectors, and stored vectors also support related-paper retrieval without a request-time model call.
Measuring benchmark optimization in speech recognition
Public voice AI benchmark scores can overstate speech-recognition ability when models learn benchmark-specific patterns rather than improve underlying transcription. Traditional evaluations may miss reliability, naturalness, contextual appropriateness, and other real-world conditions, motivating held-out sets in Real World VoiceEQ, the Open-ASR Leaderboard, and the Far-field ASR Leaderboard. The study introduces three tests and evaluates 11 widely used open-source ASR models, finding that several reproduce VoxPopuli and LibriSpeech reference transcripts when audio contradicts them, words are silenced, or two written forms sound identical. Models also sometimes use acoustic cues to identify dataset membership and select its expected transcription policy, while fresh post-cutoff data and other interventions often restore more audio-faithful output; the findings support fully held-out evaluation and broader metrics than a single public WER score.
Building Jarvis Pro: Route first, answer later
Grab designed Jarvis Pro as an AI assistant for account managers turning complex account data into actionable merchant conversations. Early prototypes generated polished but operationally unsound advice, such as pushing promotions when order drops were caused by outlet pauses and fulfillment issues. To address this, the team implemented a "route first, answer later" design that uses a prompted LLM classification step constrained by a routing guide to dictate context, tool paths, answer structure, and guardrails before generation. The pipeline also isolates narrow memory decisions, reconciles metric freshness across data sources, and caps tool calls to maintain usability. In offline evaluations across 351 realistic prompts, routing matched safe routes 99.4% of the time while answer quality scores in a portfolio subset improved from 78.5 to 91.0.
Inbound Private Link now supports account-level Genie One, the account console, and custom URLs
Databricks has expanded Inbound Private Link in Beta on AWS and Azure to cover account-level resources, including account-level Genie One, the account console, Governance Hub, and account-level APIs. The update also supports custom URLs and Managed Disaster Recovery stable URLs, while one shared General Access endpoint in any region can serve workspace and account-level UI and API resources, removing the need for one endpoint per region or workspace. These capabilities use context-based ingress, where account admins define allow and deny rules by caller identity, network source, and destination through account and workspace policies. Enabling private access to account-level resources requires registering and allowlisting a General Access endpoint with the account-policy and resolving the custom URL to that endpoint. Existing workspace-specific URLs, private access settings, and IP access lists continue to work in parallel, while service-direct and SCC relay endpoints retain per-region requirements.
Why AI-Generated Code Is Easy but Engineering Trust Is Hard
At Salesforce, engineering teams discovered that AI coding agents could produce internally consistent code and passing test suites that still failed to meet actual requirements. To ensure correctness before writing code, the team developed an agentic Spec-Driven Development workflow centered on explicit specifications and gated verification. The system separates evidence-based repository lookups handled by agents from subjective judgment calls escalated to human engineers. Implementation plans must cite repository evidence reviewed by a Skeptic Agent, while a Compliance Matrix traces each success criterion directly to executable test proof. Finally, a multi-agent review system evaluates the implementation under an asymmetric rule allowing an independent judge to downgrade passing checks but never override failed gates.
AI Won't Replace Project Managers, But It is Reshaping How Work Gets Done
Technical project managers historically spend 60 to 70 percent of their working time managing routine coordination tasks, including manual spreadsheet updates and obsolete status reporting. Engineering organizations are addressing this overhead by integrating generative artificial intelligence, large language models, and agentic workflows into delivery pipelines. Automated agents ingest telemetry directly from Git commits, pull request comments, and CI/CD logs to assess system state while machine learning models execute Monte Carlo simulations to forecast delivery risks. Although this automation reduces administrative overhead below 30 percent, implementations face practical obstacles like inconsistent ticket definitions across teams and algorithmic over-reliance on uncontextualized historical patterns. Consequently, technical project managers are transitioning into strategic roles that coordinate hybrid human-agent workforces while providing critical judgment and organizational context.
Busting SQL Migration Myths: How New SQL Features Make Lift-and-Shift to Lakehouse Easier
The post addresses the procedural core of warehouse-to-lakehouse migrations: legacy stored procedures that use temporary tables, cursors, control flow, multi-table updates, and transaction handling while remaining maintained by SQL teams. Using a composite daily-orders procedure based on an Oracle migration, it translates rather than rewrites the logic on Databricks, covering procedure registration in Unity Catalog, session-scoped temporary tables, cursor syntax, handlers, conditional scripting, and atomic transactions. Databricks SQL scripting supports cursors from Runtime 18.1, and BEGIN ATOMIC provides automatic commit or rollback plus row-level conflict detection; catalogManaged tables are required inside atomic blocks. The post says this mechanical translation can cut migration timelines by 50–75% for complex procedures, while preserving business logic and allowing the SQL team to maintain it, though the procedure still needs validation in a migration project.
Securing Software at the Speed of AI
Palantir describes how its Product Security Team built an agentic software security strategy around multi-agent review, vulnerability hunting, triage, and runtime validation. The approach treats models as replaceable components within a governed harness that controls tools and data access, preserves evidence, coordinates specialized stages, independently challenges findings, and deduplicates reports using source-to-sink paths. Foundry supplies organizational context and lineage across code, services, findings, decisions, and remediation, while Apollo provides a controlled path for delivering verified fixes across heterogeneous software environments. The strategy positions remediation, rather than vulnerability identification, as the central bottleneck and extends these capabilities through Security Forge, a model-agnostic platform for customer cyber defense.
Quantum-Augmented Applications: Integrating Quantum Subroutines into Classical Software Stacks
Quantum-augmented applications treat Quantum Processing Units (QPUs) as targeted coprocessors for NP-hard subroutines rather than standalone computing replacements. Near-term noisy intermediate-scale quantum systems handle tasks like combinatorial optimization, high-dimensional state sampling, and kernel mapping while classical stacks retain business logic and pipeline control. A hybrid runtime architecture routes parameterized ansatz circuits through middleware to the QPU, returning raw measurements for error mitigation and classical optimization. A Python implementation using Qiskit demonstrates this interaction by running a parameterized variational ansatz inside a classical COBYLA minimization loop. Operating this hybrid model requires navigating physical constraints including coherence limits, circuit transpilation latencies, and network bandwidth bottlenecks across the classical-QPU boundary.
Top topics
- Architecture834
- Performance816
- LLMs660
- Machine Learning622
- Open Source563
- AI Agents553
- AI470
- Developer Experience448
Weekly digest
The best engineering reads, once a week.