Loading…
Browse by type
Announcement reads
Announcement posts on Yomu, summarised newest first.
- 1,548 posts
- 20 companies
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Announcement posts
Simpler Fly deployments for NodeJS, Rails, Go, and Java
flyctl now supports building and deploying NodeJS, Rails, Go, and Java applications to Fly with two commands. The feature uses Cloud Native Buildpacks from buildpacks.io, turning an application into a Docker image during deployment without requiring users to understand Buildpacks. Cloud Native Buildpacks are described as an evolution of Heroku and Cloud Foundry systems, but are not compatible with their older buildpacks. After installing the latest flyctl, users can initialize an app with flyctl init --builder cloudfoundry/cnb:bionic and run flyctl deploy, then open it with flyctl open. Buildpack support complements Dockerfile-based image builds, while listed builders provide different language coverage and image sizes; the post recommends heroku/buildpacks:18 for its wider coverage.
Bug Bounty Year in Review 2019
Shopify’s 2019 bug bounty review describes experiments and process improvements intended to increase program speed, while reporting changes in response, resolution, disclosure, and bounty metrics. Shopify-Experiments, a private program launched in mid-2019 for high-signal, high-impact hackers, tested expanded scope, full payment after triage, disclosure requirements, self-closing false positives, and collaboration with third-party developers. Using registration data, HackerOne API exports, and a Slack chatbot, the team improved program analytics and automated report-state changes, assignments, comments, bounty suggestions, and common invalid-report closures. Average first response fell to 16 hours, triage to 2 days and 13 hours, bounty payment to 7 days and 1 hour, and post-triage resolution to 20 days and 3 hours; disclosures rose to 74 bugs. For 2020, Shopify announced full bounty payment within seven days of triage, a $50,000 maximum bounty, higher payouts for several vulnerability classes, and added visibility for duplicate reports.
Command Lines, Flyctl and Fly
Fly presents the Fly Global Application Platform as a command-line-first service and introduces flyctl as the way to sign up for free and manage an application's entire lifecycle. The post argues that command-line interfaces integrate directly with modern workflows, are simple and expressive, and keep developers in their terminal and current directory. To replace its Node-based command-line technology, Fly built flyctl in Go as self-contained binaries for macOS, Linux, and Windows, and adopted Cobra for familiar command/subcommand behavior and contextual help. Web interfaces remain intended for rich dashboards and metric displays, alongside interactive terminal use. The command-line approach also makes instructions self-contained, scriptable, and repeatable, which the post identifies as valuable for support and operations, while the open GitHub repository invites feedback.
React Native is the Future of Mobile at Shopify
Shopify is moving forward with React Native for new mobile apps after years of native development, driven by mobile purchasing volumes and a desire to consolidate iOS and Android work. It describes React Native as a framework that uses JavaScript and React’s declarative model to translate virtual DOM structures into native platform views through native bindings. Experiments with Arrive, Point of Sale, and Compass reported twice the productivity on Arrive, an estimated 80% code sharing target, and observed sharing of 95% for Arrive and 99% for Compass, while testing lowered the considered Android CPU threshold from 2GHz to 1.5GHz. The policy does not require rewriting existing native apps, leaves low-level libraries native and native hiring in place, and calls for dedicated React Native tooling, foundations, and open-source partnerships.
No More Forgetting to Input ERP Charges - Hello Automated ERP!
Grab launched an automated Electronic Road Pricing (ERP) fare calculation feature in Singapore to eliminate the need for driver-partners to manually track gantries and enter toll charges. Because Singapore gantries frequently adjust fares based on time and road conditions, manual entry often caused driver errors and revenue loss. Grab solved this by mapping precise geographical coordinates for every toll gate using satellite imagery and open data, matching frequent driver GPS pings against road layers and gantry locations. The engineering and operations teams also built an internal ERP Workflow tool to map ride trajectories and resolve driver dispute feedback within an average of one day. Following its rollout in Singapore, Grab began testing and planning regional expansion to Indonesia, Thailand, Malaysia, and the Philippines.
A New Kubectl Plugin for Kubernetes Ingress Controller ingress-nginx
Shopify contributed a kubectl plugin to ingress-nginx, an open-source Kubernetes Ingress controller built on NGINX, because debugging and upgrading the heavily used controller often required long, frustrating sequences of kubectl commands. The plugin’s lint subcommand identifies ingress configuration that may need changes for a new release, while richer ingress listings expose individual paths, target services, and TLS configuration. It also wraps common kubectl operations, automatically selects an ingress pod, and helps inspect generated nginx.conf and dynamic configuration managed with openresty lua-nginx-module. The author reports substantially faster upgrades and debugging, comparing a rollout to version 0.24.1 with an earlier upgrade to 0.22.0 that took days, while acknowledging that growing Kubernetes expertise also contributed. Released with ingress-nginx 0.24.0, the plugin should also be compatible with 0.23.0.
Guiding You Door-to-Door via Our Superapp!
Grab addressed passenger navigation challenges at large Southeast Asian venues such as airports and shopping centers. Satellite signals weaken through concrete and steel, creating GPS inaccuracies that caused the rendezvous distance between passengers and drivers at large venues to exceed twice the average. While introducing Entrances previously mapped over 120,000 green dots to lower rendezvous distances, passengers still struggled to locate specific pickup spots indoors. The company launched Venues, an in-app feature delivering turn-by-turn text and photo directions to designated pickup points. To support this system, operations teams surveyed sites with cameras and scanners to capture landmarks, after which in-house teams masked faces and vehicle license plates.
One Million Dollars in Bug Bounties
Shopify announces that it has awarded more than $1M USD through its bug bounty programs, which complement its security strategy by bringing in researchers with varied perspectives to assess the platform. The company says it is the fifth public program among 176 on HackerOne to reach that milestone, after four years of working with researchers. It describes three resolved vulnerabilities: an SSRF in Shopify Exchange that could provide root access within one infrastructure subset, an admin authentication bypass involving duplicate partner accounts, and stored cross-site scripting from improperly sanitized sales-channel SVG files. Shopify disabled or audited affected services, deployed a metadata-concealment proxy, corrected account verification, removed unnecessary admin functionality, and checked for exploitation. It plans to experiment with ways to increase hacker engagement and make the program more attractive.
Supporting Open Source: Our Donations for 2018
Kickstarter describes its 2018 effort to support the open-source ecosystem through financial contributions aligned with its PBC charter and stated values. After surveying engineers for nominations, the company split its yearly donation budget among two open-source projects, Babel and Webpack, and four organizations supporting learning or coding skills: Advent of Code, Rails Girls Summer of Code, Code Nation, and Code Cooperative. Babel converts ECMAScript 2015+ into backwards-compatible JavaScript, while Webpack bundles JavaScript used at Kickstarter. The other recipients support collaborative problem-solving, participation by women and non-binary individuals, technology pathways for students in under-resourced high schools, and technology education for formerly incarcerated people. The post also notes an engineer’s weekly Code Nation mentoring and invites engineers to join the team and help choose future recipients.
Ruby 2.6 Released: Just-In-Time Compilation Is Here
Ruby 2.6 introduces an initial Just-In-Time (JIT) compiler, making the feature available through the --jit option and on Heroku. The implementation follows Takashi Kokubun’s YARV-MJIT approach, retaining Ruby’s existing YARV instructions instead of replacing them with the proposed RTL intermediate representation; it starts a compiler process at startup and supports GCC, Clang, and Microsoft Visual C++. On Heroku, applications can select Ruby 2.6 in the Gemfile and enable JIT through a Procfile flag or RUBYOPT, although setting RUBYOPT with heroku config is not yet supported. The optcarrot benchmark showed a reported 1.8x speed increase over Ruby 2.5, while Rails and Sidekiq were slower because compilation costs and roughly 2MB per compiled method create overhead. JIT compaction reduces memory use near the 1,000-method cache limit, but the source says further work is needed before JIT becomes the default.
Developer Talks: How the Command Line Can Empower You (Webinar)
On 27 November 2018, Eric Fung, a Senior Data Scientist, presented “How the Command Line Can Empower You,” a 45-minute talk followed by 15 minutes of questions and answers. The presentation addresses work that often happens outside an IDE, including interacting with APIs, creating screenshots, and massaging data, and shows how command-line tools can simplify, improve, or automate those tasks. Using real-world examples, Fung covers typing less in the terminal, searching files, manipulating images and JSON files, and generating code automatically without point-and-click interaction. The presentation focuses on software for macOS, while noting that Linux and Windows users can benefit because many mentioned tools are cross-platform; the presentation can be watched online and speaker notes can be downloaded.
Introducing the Deprecation Toolkit
Shopify’s Deprecation Toolkit is an open-source Ruby gem for tracking deprecated code in an application and preventing new deprecations from entering a codebase. It addresses the limits of warning messages and the impracticality of immediately raising on every existing deprecation, especially in a large monolith with complex dependency upgrades. The toolkit records deprecations triggered by test suites in YAML whitelist files, then compares later test runs with the accepted set; mismatches trigger configurable behavior, raising an error by default. Existing deprecations can therefore remain acceptable while teams fix them gradually, whereas introduced or removed deprecations are surfaced in CI. Shopify reports that using the toolkit reduced deprecations, supported dependency upgrades, blocked pull requests introducing new ones, and enabled team-based tracking of remediation progress.
Grab Senior Data Scientist Liuqin Yang Wins Beale-Orchard-Hays Prize
Grab Senior Data Scientist Dr. Liuqin Yang, Professor Defeng Sun, and Professor Kim-Chuan Toh received the 2018 Beale-Orchard-Hays Prize for their research paper introducing SDPNAL+. The software employs a majorised semismooth Newton-CG augmented Lagrangian method to solve large-scale semidefinite programming problems with nonnegative constraints. While traditional methods struggled beyond matrix dimensions of 2,000 and 5,000 constraints, SDPNAL+ successfully scales to matrix dimensions of 9,261 and over 12 million constraints. In benchmark testing, the software solved a problem on a desktop PC in 1.5 hours that required 122 hours on a 56-core CPU and 128-GPU cluster using a traditional solver. Grab implements these optimisation techniques to accelerate its passenger-driver allocation algorithms by hundreds of times.
Introducing the Merge Queue
Shopify describes a merge queue added to Shipit to reduce failures in its large monolithic Rails application, where growing pull request volume made manually checking whether master was safe unsustainable. The queue adds pull requests from GitHub, merges them when master is healthy, waits for required CI statuses, and can reject stale branches using configurable divergence thresholds. It is encouraged rather than enforced, while changing the browser extension’s visual emphasis helped make queued merging the default workflow; over 90% of core application pull requests use it. Shipit also handles unsafe deployment commits by allowing explicit marking and automatically detecting reverts of undeployed commits, marking the original and intermediate commits unsafe. These changes let deployment continue safely around reverted work without requiring developers to manually unlock the pipeline.
Shopify’s Infrastructure Collaboration with Google
Shopify announces that it is building its Cloud with Google after more than a decade of operating the foundation of its commerce cloud through its own data centers and incremental public-cloud adoption. Its infrastructure evolved from database and application sharding, performance testing, automated failovers, and Docker-based immutable infrastructure toward Kubernetes orchestration, after the company initially built minimal container-management features itself. During the migration, Shopify created Shop Mover, a selective database migration tool that rebalances shops between shards with an average of 2.5s downtime per shop, and moved more than 50% of data-center workloads to Google Cloud. It also grew to more than 400 production services, consolidated them on Kubernetes through a platform-as-a-service, and contributed to and used Grafeas for software supply-chain auditing and governance.
2017 Bug Bounty Year in Review
Shopify’s 2017 bug bounty review reports higher payouts, four-hour average first responses, four-day triage, and changes intended to improve researcher participation. The program paid $67,550 outside the H1-415 event, with an average bounty of almost $1,100, while 121 reports were resolved and 63.1% of submissions were closed as not applicable. At H1-415, five hackers helped resolve 15 bugs for $42,000, and the program’s largest individual payout, $20,000, addressed unauthorized collaborator access caused by account-conversion logic. Shopify also acknowledges fewer resolved reports and delayed low-severity cases, then announces a $500 minimum payment at triage, clearer scope and payout guidance, a $25,000 typical maximum, and earlier access to beta functionality for eligible whitehat partner accounts.
GrabShare at the Intelligent Transportation Engineering Conference
Grab presented a technical paper on the construction of its real-time ridesharing service, GrabShare, at the Intelligent Transportation Engineering Conference in Singapore. The platform pairs passengers heading along similar routes with drivers immediately while handling network drops, volatile supply and demand, and heavy traffic conditions in Southeast Asian cities. To deliver accurate pairings, the scheduling system generates and filters through hundreds of travel time estimates for each candidate match before finalizing an itinerary. Operational teams on the ground evaluate complaints about poor matches, enabling engineers to refine the online matching systems. Over the course of one month, the service cut more than 4.5 million kilometers of driving distance and brought in over 100,000 new users within two weeks.
In the Cloud, No One Can Hear Your OutOfMemoryError
Heroku introduces Heroku Exec and Language Runtime Metrics to improve production monitoring, inspection, and debugging for applications running on dynos. Heroku Exec creates secure TCP and SSH tunnels for SSH sessions, port forwarding, remote debugging, and diagnostic tools, while the Heroku Java CLI integrates jmap and VisualVM. A synthetic Java memory-leak example shows VisualVM tracking heap growth and jmap producing a downloadable HPROF heap dump that Eclipse Memory Analyzer identifies as Servlet-held FakeLeak objects. The metrics feature, enabled through the Heroku Metrics buildpack on paid Standard-or-above dynos, displays heap, non-heap, and garbage-collection activity in the dashboard through a Java agent using Prometheus; JVM-language support is generally available, while Go support is in beta.
Come and #hackallthethings at Grab
Grab has officially launched a public bug bounty program in partnership with HackerOne to strengthen the security of its platform. This rollout follows a private bounty initiative operated over the previous year, during which the organization worked with over 350 security researchers and resolved nearly 200 awarded bug reports. The new public program invites external researchers to scrutinize Grab's code for critical flaws, including remote code execution, SQL injections, and exportable cross-site scripting vulnerabilities. To support ethical and responsible disclosure, Grab offers payouts reaching up to $10,000 per valid vulnerability report based on severity and impact.
Functional Swift Conference 2017 — Brooklyn
Kickstarter hosted the fourth Functional Swift Conference on April 15th, marking the third time the event had been held at its office. The all-day gathering brought together 10 speakers, including four Kickstarter engineers, and 90 attendees to discuss what functional programming can contribute to better Swift code. Sessions covered recursive enums and KD-trees, testing side-effects, domain-specific languages with GraphQL, algebraic laws, monoids, predicates, sorting functions, applicative functors, parsing, and type inference. Examples included using value types and recursive data structures to describe complicated objects and live-coding an applicative parsing API that generates its own documentation. The closing type-system talk examined why inference is hard and described the Swift compiler team’s use of graph theory to address inference problems practically.
Top topics
- Architecture834
- Performance817
- LLMs673
- Machine Learning622
- Open Source568
- AI Agents564
- AI483
- Developer Experience448
Weekly digest
The best engineering reads, once a week.