Loading…
Browse by type
Explainer reads
Explainer posts on Yomu, summarised newest first.
- 1,318 posts
- 20 companies
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Explainer posts
Championing CyberSecurity: Grab's bug bounty programme in 2023
Grab reviewed the performance and milestones of its security bug bounty programme for 2023, marking eight years of running the initiative. Operating quarterly campaigns through HackerOne alongside dedicated internal teams, the company processed approximately 1,000 vulnerability submissions over the year, including 400 reports during Q1 alone. Cumulative payouts to external security researchers surpassed $700,000 since the programme's 2015 launch. To adapt to an expanding service portfolio, Grab broadened its scope to encompass joint ventures and acquisitions while introducing diversified financial and recognition-based rewards.
What are these "GPUs" really?
The post explains how graphics hardware evolved from CPU-offloaded video rendering into modern GPUs and why those devices now matter for AI/ML. It traces the path from the Commodore 64’s VIC-II and 3D accelerator cards through Quake, Tomb Raider, integrated graphics, and increasingly parallel hardware, while describing components such as framebuffers, command processors, shader hardware, memory, and display outputs. It then connects shader and CUDA cores to workloads including GPT-2, Stable Diffusion, and speech or text processing, and presents model chaining as more useful than treating models as isolated tools. A conference-video workflow combines ffmpeg, Whisper, subtitle segmentation, a large language model, Markdown, and human review to produce accessible written material. The conclusion distinguishes graphics-capable cards from A100 accelerators, which the post says cannot process graphics or encode video but are highly effective for AI/ML workloads.
The risks of building apps on ChatGPT
The post argues that applications with critical AI features should avoid relying on proprietary, externally hosted models such as OpenAI’s ChatGPT and consider self-hosted open source alternatives. It identifies single-provider, regulation or policy, financial, and governance risks, illustrating the first with a Personal AI Fitness Trainer that failed during an OpenAI outage on November 8, 2023. When the AI is the app’s primary value proposition, an outage, changed behavior, denied usage, price increase, or provider leadership crisis can make the service unusable or threaten the business; less-central integrations may instead cause only degraded experience. Self-hosting a model can insulate an application from provider interruptions, licensing or usage-fee changes, regulator- or company-driven behavior changes, and leadership turmoil, while introducing GPU capital and operating costs with rented cloud GPU access available as an alternative to owning GPUs.
Learnings from Building and Scaling Ramp’s Growth Engine
Ramp’s growth team explains the principles and systems it used to scale customer acquisition since launching its first product in February 2020. By February 2021, annualized run-rate revenue reached $12 million, crossed $100 million a year later, and was far beyond that figure at the end of 2023. The approach combines first-principles thinking and prioritization with fast, data-driven MVP experiments, then productionizes ideas that show significant impact; it also relies on full-stack capabilities across business operations, engineering, and sales. An AI email overlay that classified and prioritized sales messages helped representatives handle more prospects and increase conversion rates. The team attributes tens to hundreds of millions of dollars in sales pipeline and real revenue to these practices, while noting that sustainable growth requires a solid product and real addressable market.
How I Fly
This article describes how Xe Iaso uses Fly.io to host a blog, CDN, and experimental personal projects while deploying services near users. The blog backend runs in Toronto, while XeDN runs in 35 datacenters, fetches missing files from Backblaze B2, and uses caching and traffic shifting to tolerate individual node failures. Arsène runs every 12 hours, asking the ChatGPT API for posts, using Stable Diffusion for illustrations through an Automatic1111 API on a private network, then sending images to XeDN for global delivery. The setup emphasizes reusable, interoperable building blocks rather than isolated projects, with Fly.io handling deployment, networking, and scaling concerns. Xe reports that three 256 MB Machines ran XeDN for a year, while Arsène still runs on one, and says applications can scale to zero when idle.
Engineering Management
The post presents an engineering-leadership perspective on how the author incepted and grew Ramp’s Core Engineering team from zero to 50+ engineers, while noting that the guidance is shaped by a company under Dunbar’s number. It defines an engineering manager’s role as unblocking reports, appreciating their contributions with technical depth, and helping them advance through the leveling deck. The central leadership practice is “pay attention”: build a coherent organizational model, maintain consistent direction, understand motivations, and avoid feedback that misses important tradeoffs. Core Engineering favored hiring individual-contributor engineers and moving some gradually into management after testing their aptitude. The post also presents one-on-ones as a way to build organizational context, and describes slow growth, intern mentorship, and prompt dispute resolution as forms of compounding management quality.
Abstraction Engineering
Ramp’s early product encoded opinionated limits, but by fall 2022 customers needed configuration based on departments, accounting fields, subsidiaries, budgets, and HRIS fields, making incremental feature work increasingly complex. The team reframed these requests as a generic workflows platform in which Python functions served as actions, boolean logic as conditions, and workflows as graphs persisted in Postgres. After rejecting a dependency-based design, they built a graph-traversal engine, a Postgres-backed queue that retries asynchronous tasks, and an SDK for expressing constructs such as elif and else. The infrastructure now supports customer-facing policies and internal tasks; more than 45 million workflows have run, at over a million per day, while the core engine has not changed since launch. The project took weeks upfront but saved the engineering organization months by turning complex features into applications of broader abstractions.
Router 2.0 Common Runtime Router: The Road to Beta
Heroku’s Router 2.0 is a beta replacement for the Common Runtime’s Erlang-based “Hermes” router, which is planned to be replaced in 2024. The project addresses the difficulty of safely delivering upgrades from a legacy custom HTTP server and aims to share routing code with the Go-based Private Spaces router; common functionality has been extracted into an internal HTTP library. Architecturally, Router 2.0 is an L7 router running in memory behind the existing L4 proxy, alongside Hermes, allowing app-level traffic to move from the old path without a big-bang cutover. The team added continuous load testing that exercises scaling policies and blocks deployments missing internal service-level objectives, and introduced Network Error Logging to measure browser-observed failures. Feature parity is still incomplete, with HTTP/2 planned next; apps can opt into the beta using a Heroku Labs command.
Step
Step-up authentication lets an application permit access to non-critical resources with basic authentication while requiring additional authentication for sensitive resources. The post describes how Okta Workforce Identity Cloud supports this pattern across modern OIDC applications and legacy integrations. For OIDC, applications use the /authorize endpoint’s acr_values and max_age parameters to request a mapped higher assurance level for a limited period, or prompt=login to force re-authentication each time. For non-OIDC applications, privileged Factor API operations can issue and verify challenges through a protected middleware layer using an Okta API token, while Okta Access Gateway can enforce step-up through advanced policies. Transactional MFA is presented as an alternative using OIDC CIBA, but the source defers its detailed treatment.
Our problems
The post lays out problems Cursor is working on in AI-assisted coding, from selecting relevant context in large codebases to making edits and finding bugs. It proposes collecting 500k tokens from editor sources and using a custom, fast reranker to reduce that context to 8k tokens, while reporting 1.4 billion vectors and 150,000 codebases indexed as of October 12, 2023. Other planned capabilities include a constrained few-step agent that searches, writes, and runs code with feedback, passive and active bug finding, and larger edits presented in real time. Future ideas include time-warp predictions, code understanding in model weights, reader and pseudo-code modes, and automatic stack-trace fixes. The list is explicitly not a final roadmap because new ideas and priorities change, and the post also invites interested people to join the company.
Picking Low Hanging Fruit
The page identifies the item with the title “Picking Low Hanging Fruit,” but provides no accompanying article narrative or technical subject matter. Instead, it consists of HTML metadata, favicon and RSS references, JavaScript and stylesheet asset links, a notice that JavaScript must be enabled, and analytics snippets. The metadata names the site “Ramp Builders” and labels its RSS feed “Ramp Builders Blog”; the scripts reference Segment analytics and a Google Analytics configuration. No problem, implementation, experiment, outcome, or conclusion is described, so the title’s meaning and the post’s intended subject cannot be established from this text. There is no basis in the available material for a more specific technical classification.
Why You Should Migrate to OAuth 2.0 From Static API Tokens
Static API tokens provide a simple way to authorize calls to protected third-party APIs, but their long lifetimes, broad permissions, and lack of user context create security and auditing risks. OAuth 2.0 addresses these limitations through a centralized authorization server that issues short-lived access tokens, which clients send in the Authorization header with the Bearer scheme. The post describes Client Credentials for service-to-service interactions and explains that scopes can distinguish permissions such as okta.users.read and okta.users.write; other configurations support task-based automation and user access through web applications. Migration guidance recommends implementing new calls with OAuth 2.0, applying least privilege, testing expiration and error handling, and securing private keys and JWKS generation before production deployment.
The 10 teamwork skills everyone needs
Workplace collaboration depends on interpersonal skills that help groups interact productively while preserving individuals’ independence. The post identifies ten core capabilities: communication, active listening, respect, conflict resolution, accountability, delegation, problem-solving, open-mindedness, self-awareness, and trust. It explains how these skills address practical team problems, from siloed information and excessive workloads to miscommunication, unresolved disagreements, and emotional reactions, while noting that effective communication requires balance rather than constant messages or meetings. Improvement relies on setting one goal at a time, requesting honest feedback, and observing effective teammates; the post also recommends tailoring a CV’s examples to an employer’s values and keeping entries brief. Notion is presented as a platform for roadmaps, one-on-ones, team pages, and wikis.
The AR Measuring Box: Etsy's answer to Big Tape Measure
Etsy extended its iOS Wall View experience into an AR measuring tool that represents listings as scaled 3D boxes, allowing shoppers to judge an item's size and fit in their space. The work addressed the difficulty of creating models for millions of customizable, often handmade items by improving dimension extraction instead. A server-side regex parser reads titles, descriptions, customization information, overviews, and variations, handling unit variants, localization, special characters, fractions, conversions, complex imperial measurements, and duplicate values while prioritizing structured fields and caching results. In iOS, the measuring box uses SceneKit’s SCNBox and SCNNode labels, supports movement and rotation, and uses LiDAR-derived meshes for environment occlusion. The resulting feature adds real-size AR functionality to nearly a million Etsy items, viewed by tens of thousands of users weekly.
Skip the API, Ship Your Database
The post describes an unexpected use for LiteFS, a distributed SQLite database: replacing service-to-service APIs with read-only database replicas. Typical APIs require anticipating access patterns; shipping the full database lets clients use SQL joins, aggregation, and windowing locally, while one-way LiteFS replication avoids chatty gossip and is simple to configure with an upstream primary hostname. Moving queries to client hardware removes shared service compute contention and the need for tenant rate limiting and timeouts, but replicas cannot handle mutations and raw schema changes create looser contracts, mitigated by backward-compatible changes and views. Data access is harder to restrict in multi-tenant databases, so per-tenant SQLite files are a suggested workaround. The approach is positioned for specific read-heavy use cases, potentially including local copies of Stripe or GitHub data, with event buses such as Kafka generating per-tenant databases.
Women’s World Cup 2023: How The Tournament Fared Online
The analysis examines online conversation around the 2023 FIFA Women’s World Cup using English-language mentions from social media, blogs, forums, and news sources collected between 20 July and 20 August 2023. It reports over 2.2 million social-media mentions, with major peaks during the Round of 16, the semi-finals, and the final, which generated more than 150,000 mentions and ended with Spain winning the title. Among gender-categorized authors on X, 75% were male, while England was the most discussed country, followed by Australia, the United States, New Zealand, and Spain. Mary Earps’s penalty save produced an initial final-minute spike, and Spain’s coronation prompted a peak of 2,100 mentions at 10:03 PM AEST. The analysis concludes that mention volume, sentiment, emotion, and team comparisons can help brands identify which aspects of the sport generate the most interest and where to participate.
What I learned taking Ramp Bill Pay from 0 to N
An engineer recounts lessons from taking Ramp’s Bill Pay from its first code in April 2021 to a publicly launched product that eventually became a product with multibillion annual total payment volume. For 0-to-1 work, the account emphasizes protecting core abstractions, including canonicalized payment statuses that reduce varied payment states to five, using mocked functions to coordinate parallel engineering, and reaching beta customers quickly. Customer feedback, session replay, and persistent iteration are presented as necessary because the first customer will usually expose substantial flaws. For 1-to-N growth, manual processes and duct tape must be prioritized for replacement according to user impact, error risk, and workload. Growing stakes also require testing, monitoring, contingency plans, gradual rollouts, QA, and documentation that helps engineers self-service onboarding.
Sidekick’s Improved Streaming Experience
Sidekick addresses two streaming problems in LLM chatbots: Markdown fragments can render awkwardly before syntax is complete, and tool-driven responses can delay visible output across multiple LLM roundtrips. Its solution combines a buffering Markdown parser with an event emitter that multiplexes the main response and asynchronously resolved content into one stream. A Node.js Transform stream processes Unicode characters through a finite-state machine, buffering ambiguous sequences such as emphasis, list markers, and links until they resolve or are flushed as raw text. The parser also recognizes card links, triggering asynchronous card-resolution tasks while Server-Sent Events carry named streams to the UI, which demultiplexes them into the main response and placeholders. The design uses Markdown as a human-readable transport between the LLM, backend, and frontend, allowing content to appear as it is produced.
How Ramp builds customer-first AI
Ramp describes principles for building customer-focused AI, contrasting embedded outcomes with superficial chatbot experiences it calls “AI washing.” The approach emphasizes integrating models into workflows, separating general models trained on aggregated and masked data from sensitive models that use private customer data temporarily through in-context learning, and requiring explicit opt-in for sharing contract data. It prioritizes user control and feedback over lengthy explanations, while using guardrails that constrain outputs through predefined interactive data blocks rather than relying only on censorship filters. Ramp cites contract term extraction, spend intelligence, pricing benchmarks, Copilot, and Jsonformer as examples of these practices. The stated goal is AI that saves customers time and money while protecting privacy and producing safer, more useful results.
Go From 0 To 1 To Enterprise-Ready With MongoDB Atlas And LLMs
Generative AI applications require grounding in up-to-date operational data to avoid incorrect or uninformed answers, yet moving from prototype to enterprise-ready production is a significant challenge. MongoDB Atlas unifies operational, analytical, and vector search data services, enabling developers to provide long-term memory to large language models without costly fine-tuning. The post presents five resources for integrating MongoDB Atlas with LLMs, including tutorials for Atlas Vector Search with OpenAI, LlamaIndex, LangChain, MindsDB, and HuggingFace. These integrations support semantic search, chat applications with proprietary data, prediction generation, and automated reactions to data changes via serverless triggers. MongoDB Atlas offers a flexible document model, high performance, and scalability, validated by enterprises, to accelerate building production-ready generative AI applications.
Top topics
- Architecture830
- Performance812
- LLMs648
- Machine Learning617
- Open Source561
- AI Agents542
- AI454
- Developer Experience446
Weekly digest
The best engineering reads, once a week.