Loading…
Browse by type
Explainer reads
Explainer posts on Yomu, summarised newest first.
- 1,318 posts
- 20 companies
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Explainer posts
Resilient Edge AI: Keeping Connected Vehicles Smart Offline
Connected vehicles face intermittent connectivity in tunnels, rural roads, and underground garages, yet drivers expect reliable AI assistance during those moments. The post argues that offline capability is a requirement, not a fallback, for trustworthy in-vehicle AI. It proposes three principles: design for the moment of need, treat vehicle knowledge as an evolving product asset, and separate availability from connectivity. A reference architecture uses ObjectBox for local persistence and synchronization with MongoDB Atlas, which provides the cloud foundation for shared knowledge and updates. The enduring pattern is to keep critical interactions available at the edge while using the cloud for scale, coordination, and continuity when connectivity returns.
From 2D Drawings to 3D Models: Designing an AI Reconstruction Pipeline on MongoDB
BIRD is a research framework that converts five 2D perspective drawings into a proportionate, dimensioned 3D building envelope. It uses a dual-branch CNN to separate architectural line segments from noise, a text recognition model to scale them to real-world inches, and a wrapping algorithm to fold the elevation views around the floor plan. The framework achieved a median accuracy of roughly 93% across complete building plan sets from small residences to a multi-story apartment complex. The proposed deployment on MongoDB Atlas stores each project as a single JSON document containing all drawings’ segments, corrections, and final geometry, with S3 for image storage and Atlas Stream Processing for event-driven workflow coordination. MongoDB Search and Vector Search with Voyage AI embeddings enable full-text and semantic search over past projects, allowing drafters to start from corrected models of similar builds.
Confused Deputy: The Old Bug That AI Agents Keep Reintroducing
The Confused Deputy problem, first documented in 1988, describes a program with legitimate authority being tricked into misusing that authority on behalf of a less-privileged actor. AI agents are particularly vulnerable because they process instructions and untrusted content through the same natural-language channel, making prompt injection straightforward. The post traces this pattern through CSRF, SSRF, and recent attacks like Clinejection, where an issue-triage bot executed an attacker-supplied command from a crafted issue title. That attack led to a poisoned GitHub Actions cache and a compromised npm package downloaded 4,000 times. The fix involves task-scoped short-lived credentials, capability-scoped permissions, credential isolation from the model, and human-in-the-loop approval for high-risk actions.
Data Sovereignty by Design: Five Practical Evaluation Lenses for IT Leaders
Data sovereignty is a market expression, not a universal legal standard, and IT leaders should evaluate it through architecture and governance questions rather than a single label. The assessment covers where data resides, who can access it, how it moves, and whether control is retained, with considerations varying by jurisdiction, industry, and risk posture. Physical location is only one part of a broader control boundary that includes operations, key custody, and access paths. The article proposes five technical lenses for evaluation: jurisdiction-native data placement, in-use encryption, customer-held keys, network isolation and identity-based access, and forensic-grade audit evidence. These lenses are practical reference points for architecture decisions, not a legal test or certification checklist, and organizations should assess their own requirements with qualified counsel.
How to Evaluate AI Agents From Tool Calls to Task Completion
Standard LLM benchmarks are insufficient for evaluating AI agents because they score static outputs rather than multi-step tool-call sequences against a live environment. The post explains that agent evaluation requires two scoring layers: step-level (process scoring) checks each call’s validity and usefulness, while end-to-end (E2E) scoring checks only the final environment state. A trace logs every step and environment state, and metrics roll up through a hierarchy of benchmark, trial, task, turn, and step. Key metrics include task success rate, consistency, tool-call precision, argument accuracy, steps per success, and cost per success. The post argues that benchmarks are converging on tool use because deployed agents always use tools, and enterprise benchmarks should measure task completion against real APIs and policies.
Comparison of Cluster Autoscaler and KEDA MachineSet Autoscaling on Red Hat OpenShift
This article compares two autoscaling approaches for Red Hat OpenShift compute infrastructure: the built-in Cluster Autoscaler and the KEDA-driven MachineSet Autoscaler. The key difference is the trigger mechanism: Cluster Autoscaler reacts to Pending pods, while KEDA scales based on external metrics like PromQL queries. KEDA triggers faster, scaling within about 15 minutes versus 24 minutes for Cluster Autoscaler, because it acts on metric thresholds before pods become unschedulable. Cluster Autoscaler offers built-in scale-down safety and zero configuration, while KEDA provides fine-grained, metric-driven control but requires the Custom Metrics Autoscaler operator. The choice depends on workload predictability, with Cluster Autoscaler suited for general-purpose workloads and KEDA for dedicated pools with predictable metric patterns. The two autoscalers cannot coexist on the same MachineSet, as they would fight over replica counts.
Supporting a DPDPA-Compliant Ecosystem in India with MongoDB
India’s Digital Personal Data Protection Act (DPDPA), made law in 2023 and enforced in 2025, requires organizations to implement technical controls for consent, access, security, retention, and deletion of personal data. Traditional relational architectures often fragment customer information across multiple tables and services, making it difficult to track consent or respond to correction and deletion requests. MongoDB’s capabilities, including its flexible document model, change streams, queryable encryption, and search, can help consolidate privacy-relevant data and context. The document model allows storing consent state, personal data, and security controls together, reducing fragmentation and simplifying auditability. MongoDB Atlas and Enterprise Advanced offer deployment options for fully managed or self-hosted environments to support privacy-by-design architectures.
Financial Crime Mitigation with MongoDB / Part III: Behavioral Risk Modeling for Event-Driven Fraud Detection
MongoDB’s document model and event-driven architecture support behavioral risk modeling for fraud detection in financial institutions. The platform combines rule-based policies with probabilistic reasoning, using change streams for real-time event processing and vector search for similarity assessment. MongoDB captures behavioral events like typing patterns and device IP addresses, aggregating them into dynamic customer profiles. Vector search compares incoming transactions against historical patterns, but it does not evaluate numerical data such as transaction amount, which requires traditional risk scoring. This approach reduces false positives and lowers total cost of ownership by minimizing manual intervention, while MongoDB’s flexible schema allows adding risk factors without downtime.
ReadyOn’s Four Walls of tenant isolation on Amazon EKS
ReadyOn describes a four-layer tenant-isolation architecture for Harmony, its multi-tenant workforce-intelligence platform on Amazon EKS, which handles payroll data, organizational hierarchies, and operational analytics. The design combines dedicated Kubernetes namespaces, Karpenter-managed tenant node pools, per-tenant Amazon VPC security groups, and dedicated Amazon Aurora databases, with RBAC, admission control, default-deny network policies, IAM Roles for Service Accounts, and tenant-scoped secrets. GitOps through Argo CD ApplicationSets provisions identical controls and continuously reverts drift, while dual taints and admission validation prevent cross-tenant scheduling. ReadyOn says adversarial exercises have blocked all six tested cross-tenant paths to date, and reports defenses across 10 threat-model stages, though shared control-plane dependencies make the layers defense in depth rather than fully independent probabilities.
Enabling secure, productive work on personal devices
Personal devices let employees use Slack, approve requests, and access internal apps, but they combine corporate data with private content that Databricks cannot inspect or control. The proposed mobile security model layers Mobile Device Management (MDM), identity and context-aware authentication, Zero Trust Network Access (ZTNA), and application management. On iOS, Account-Driven User Enrollment creates an encrypted workspace without full device management, while Android Work Profile provides comparable separation; per-app VPN keeps work traffic apart from personal traffic. Access requires strong authentication, a managed device, and a trusted tunnel, with continuous posture checks able to block unhealthy devices. Managed apps, configurations, tenant controls, and sensitivity tiers contain data where supported, while transparency about privacy encourages enrollment and supports mobile apps such as Genie.
Saving another 100TB of RAM with math (and Rust)
Cloudflare describes how excessive memory use in pingora-ketama, the consistent-hashing component of its Pingora Backend Router, was investigated as a resource-efficiency problem at global scale. Consistent hashing maps servers and cache keys onto a circular hash space, but a single hash per server creates uneven ranges, while multiple hashes improve balance; with 160 points per server, the coefficient of variation falls to about 8% in the 100-server example. The work produced a v2 ring with compacted storage, faster sorting, and a configurable base number of hashes per node, while retaining the existing v1 ring and supporting simultaneous use during migration. After the old ring was decommissioned, measured memory usage for PBR fell by 100TB globally, and the changes are available in pingora-ketama behind an unadvertised Cargo feature.
How Notion handles concurrent editing with CRDTs
Notion replaced its text-editing system because its former last-write-wins storage could overwrite concurrent edits to the same block, with Offline Mode increasing the risk of lost changes. The new system uses a Conflict-free Replicated Data Type based on Replicated Growable Array, representing inserted text as uniquely identified items, retaining deletions as tombstones, and deterministically ordering concurrent inserts. Peritext-based annotation operations merge rich-text formatting such as bold, italics, and hyperlinks while preserving extendability rules. To keep edits correctly positioned when Enter splits a block, Notion introduced text slices, text slice trees, text instances, and compact search labels for locating slices across blocks. Deployed in July 2025, the system processes millions of CRDT operations per minute and supports Offline Mode and agent collaboration.
How CSIRO built scalable, cost-optimized genomic variant querying on AWS
CSIRO built Serverless Beacon (sBeacon), a production-ready implementation of the Global Alliance for Genomics and Health (GA4GH) Beacon protocol for secure genomic variant querying. Its serverless architecture combines Amazon S3, AWS Lambda, Amazon DynamoDB, and Amazon Athena: genomic data remains in its original S3 location, while metadata is indexed in ORC tables and ontology indexes for query processing. Standard VCF files can be queried through API Gateway, with modular Lambda functions resolving ontology terms, querying Athena, and, when needed, issuing HTTP byte-range requests to source buckets so raw VCF bytes do not leave their owning organization. The post reports support for hundreds of millions of individuals and billions of genomic locations, approximately USD 0.40 monthly operation for a 1000 Genomes-scale dataset, roughly five-second real-world queries, and about 18-second generation-to-use onboarding, while noting that whole-genome range queries can time out.
The AIDEs Framework: How We Built a “Theory of Everything” for AI Development Tools
JetBrains presents the AIDEs Framework as a model for understanding how AI development tools evolve, rather than trying to track every market change. The post describes a progression from single-line completion through multiline completion, IDE chat, AI code editors, agentic development environments, and cloud-based agents. It defines an Artificial Intelligent System as a system that demonstrates intelligence in helping users achieve goals, and an Artificial Intelligent Development Environment (AIDE) as an AIS for creating software; intelligence may come from deterministic heuristics as well as LLMs. The framework treats principals and agents as potentially human or AI actors and views software creation as a broader delegation process than coding alone. It proposes examining assumptions, building a model, and validating it against ongoing change, while suggesting a possible future of vertically integrated Agentic Software Production Platforms that use AI as an “intelligence” resource.
Red Hat OpenShift networking: Default OVN-Kubernetes vs. Cilium operator
The article compares Red Hat OpenShift’s default OVN-Kubernetes CNI with the Cilium operator for teams managing microservices, AI workloads, and declarative multi-cluster infrastructure with Cluster API (CAPI). It describes OVN-Kubernetes as natively managed by the OpenShift Cluster Network Operator, with Open vSwitch foundations, hardware offloading, Multus and OpenShift Virtualization compatibility, and OVN Interconnect for large-scale deployments. Cilium uses kernel-level eBPF programs and offers identity-based policies, sidecarless service mesh capabilities, and Hubble Layer 7 observability, while CAPI manifests and MachineSets support declarative worker-node provisioning. The source recommends Cilium for new clusters when eBPF capabilities and CAPI integration justify added operational complexity, while positioning OVN-Kubernetes as the simpler choice for integrated lifecycle management and hardware acceleration.
Matching OpenShift edge topologies to your physical footprint
Red Hat OpenShift topologies are mapped to edge-site constraints such as hardware footprint, availability, rack space, power, and workload needs. It is presented as a micro cloud that brings full Kubernetes functionality to server-class edge hardware, with optional virtualization and software-defined storage. Cluster capabilities can be minimized with baselineCapabilitySet: none and selectively enabled later, although added capabilities cannot be removed without reinstalling. Options span single-node OpenShift, which requires 4 vCPUs, 16 GB RAM, and 120 GB storage, two-node designs using fencing or an arbiter, and three-node compact clusters for resilient high availability. Each topology retains shared management and security practices, so selection depends on the physical footprint, failure tolerance, and scale required at the site.
Modernizing the Trade Lifecycle With Governed Data and AI
Capital-markets firms are revisiting the trade lifecycle as data volumes grow, AI moves toward production, settlement cycles shorten, and scrutiny increases. Fragmented data across research, trading, risk, operations, and surveillance can slow decision-making, complicate execution analysis, limit risk visibility, and hinder reconstruction of events. The proposed response starts with decisions such as execution-cost divergence, shock impacts, and exception or settlement-fail rates, then identifies the data domains needed for a few high-value workflows rather than migrating everything at once. It emphasizes a governed, reusable foundation connecting real-time and historical data, analytics, and AI, with access controls, lineage, traceability, and evaluation. Databricks components named include Unity Catalog for governance, discovery, and lineage, Agent Bricks for domain-specific agents, and AI/BI for governed exploration; the stated conclusion is that this operating-model approach can support faster decisions, resilience, and scalable use cases.
Database for AI Agents: 5 Evaluation Criteria
The post defines a database for AI agents as infrastructure for short-term, episodic, procedural, and operational memory, rather than merely a place to retrieve documents. It proposes five evaluation criteria for moving agent workloads from prototypes to production: per-agent branch isolation, serverless scale-to-zero, hybrid search, ACID guarantees, and unified platform access. The technical rationale is that agents perform repeated reads and writes, resume tasks, share state concurrently, and need current data across vector, keyword, and metadata retrieval; zero-copy branches, sub-second wakeups, and single-query hybrid search address specific operational constraints. It concludes that a database missing more than one minimum bar becomes a production risk, while standard Postgres alone supplies ACID but not branching, scale-to-zero, or unified operational and analytical access.
Google Cloud Use Cases: How Enterprises Run Data & AI on GCP with Databricks
The guide presents Google Cloud as a unified platform for enterprise data engineering, analytics, machine learning, and generative AI, with managed services intended to reduce infrastructure and integration work. It focuses on practical architectures, including medallion ETL pipelines that store Bronze, Silver, and Gold Delta Lake tables in Google Cloud Storage and expose Gold data to BigQuery through an optimized connector. For streaming workloads, Cloud Pub/Sub supplies ingestion while Apache Spark Structured Streaming processes continuous micro-batches; together with Delta Lake ACID transactions, this supports exactly-once results despite duplicates or out-of-order messages. The text also describes Cloud Run and Cloud Functions for containerized or event-driven workloads, and identifies retrieval-augmented generation applications on Vertex AI as a common starting point for generative AI. It concludes that integrated service combinations, rather than isolated tools, are the central strategic advantage for organizations building evolving data and AI platforms on Google Cloud.
How Databricks Helps Baseball Teams Gain an Edge with Data & AI
Baseball teams can use Databricks to turn Statcast and team-derived pitch-level data into game-day plans for hitters, bullpen changes, pinch-hit choices, advance scouting, and roster decisions. Genie, on Unity Catalog, queries governed Delta tables and reusable Unity Catalog SQL functions for tendencies by count, handedness, pitch type, location, and base-runner state. A Multi-Agent Supervisor built with Agent Bricks and deployed on Model Serving simulates matchup pockets, compares reliever arsenals with hitter profiles, and produces explanations that staff distill into printed decision cards. For advance work, AI Search indexes pitcher and hitter embeddings to find similar arms, while Lakebase Postgres keeps reports, tags, and decisions close to the source data for shared operational memory.
Top topics
- Architecture830
- Performance812
- LLMs648
- Machine Learning617
- Open Source561
- AI Agents542
- AI454
- Developer Experience446
Weekly digest
The best engineering reads, once a week.