Loading…
Browse by type
Tutorial reads
Tutorial posts on Yomu, summarised newest first.
- 630 posts
- 20 companies
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Tutorial posts
Modern Web Stack: Rails 5 API, ActiveAdmin, and Create React App on Heroku
Modern Rails applications can combine a Rails 5 API-only backend, ActiveAdmin for CMS capabilities, and a Create React App frontend in one Heroku-hosted project. The tutorial addresses the tension between Rails API mode, which omits views and middleware, and ActiveAdmin’s need to serve HTML and use cookies, flash, sessions, and assets. It restores those pieces by switching ApplicationController to ActionController::Base, adding forgery protection and middleware, reintroducing sprockets, and defining a separate ApiController that retains ActionController::API. The frontend uses Create React App, API proxying during development, React Router for client-side routes, and a build process that serves the compiled app from Rails on Heroku, including a React 404 for unmatched paths. A smoothie-recipes example demonstrates the resulting setup.
Rails 5.2 Active Storage: Previews, Poppler, and Solving Licensing Pitfalls
Rails 5.2’s Active Storage adds file uploads and attachments for Active Record models, with backing services such as AWS S3 and previews for PDFs and videos, but its beta PDF support depended on MuPDF. Security and legal review found MuPDF’s AGPL licensing could require commercial licensing, so Terence Lee updated Active Storage to support Poppler, an open-source PDF backend merged before release. Deployment guidance uses S3 through aws-sdk-s3, configures :amazon rather than the non-scalable local disk, and installs a custom buildpack containing FFmpeg and Poppler. The example Rails app attaches files to a Bulletin model, accepts uploads, and chooses PDF or video previews, image variants, or downloads according to available binaries and MiniMagick.
Using HTTP Headers to Secure Your Site
A straightforward Static Buildpack app received an F, scoring 20/100 in Mozilla Observatory because several security response headers were missing, despite redirecting visitors to HTTPS with an Automated Certificate Management certificate. The walkthrough examines failures for Content Security Policy, HTTP Strict Transport Security, X-Content-Type-Options, X-Frame-Options and X-XSS-Protection, then configures them through the static.json headers collection. The CSP restricts resource origins, blocks inline scripts by default, and uses a SHA-256 hash to permit the Google Analytics inline script without adding unsafe-inline. HSTS uses max-age=63072000, includeSubDomains and optionally preload, while other headers supply MIME sniffing, iframe and legacy XSS protections. After the changes, the reported checks pass, the configuration reaches an A and is later described as A+; the final recommendation adds Referrer-Policy and omits opt-in HSTS preload.
Kafka Streams on Heroku
Kafka Streams on Heroku shows how to organize, deploy, and scale Java stream-processing services using Kafka Streams, Apache Kafka, and the Heroku Runtime. The example contains a Text Processor that splits input from a textlines topic into words, an Aggregator that counts words in 10-second windows before writing to Postgres, and an independent Anomaly Detector that routes 10-second login-failure counts to urgent alerts or non-urgent email based on thresholds. A Gradle multi-project setup packages each service as an executable and uses a Procfile to run them as separate Heroku workers, while managed Kafka supplies the event-streaming infrastructure. Scaling is explained through Kafka partitions and Kafka Streams Stream Tasks: Stream Threads provide vertical scaling, dyno counts provide independent horizontal scaling, and Kafka Streams redistributes tasks when workers change or fail.
Jekyll on Heroku
Jekyll can be deployed on Heroku to use its plugin system, but relying on jekyll serve would use Ruby’s single-threaded WEBrick rather than a production-oriented web server. The setup installs Ruby with ruby-install and chruby, then installs Bundler and Jekyll, creates a site, and tracks it in Git. Heroku’s official Ruby buildpack handles dependencies and runs a Rake assets:precompile task that executes jekyll build, while the Static buildpack serves the generated _site/ directory according to static.json. The example pins Ruby 2.4.2, adds Rake, enables clean URLs and HTTPS, and completes with a successful deployment of the generated site to a Heroku URL.
FRP at Kickstarter and Kotlin
Kickstarter’s open-source iOS and Android apps use Functional Reactive Programming (FRP) patterns to keep views simple and move mutation and complex logic into thoroughly tested ViewModels. The post describes how this discipline helped a developer ramp up quickly on the Android codebase after working on Kickstarter’s backend and payments teams. It also introduces the Android team’s interest in Kotlin, a JetBrains language that runs on the JVM, while noting that dependency concerns had prevented conversion of core functionality. For a 2017 Functional Swift Conference talk in Berlin, the author used Kotlin to add a simple Android screen following the team’s established FRP patterns, presenting the implementation as live coding and an introduction to FRP and Kotlin.
Always Be Learning
Kickstarter’s Data team describes how pair learning fits into its broader “always be learning” culture, alongside monthly reading groups open to all employees. Two team members worked through Hadley Wickham’s Advanced R by reading one chapter every two weeks, then meeting for an hour and a half to discuss the material and complete exercises. They found that a steady pace, applying concepts to Kickstarter data, explaining ideas aloud, and documenting lessons in an internal R guide supported sustained learning; the guide includes a demonstration of R’s lazy evaluation. The pair considered the format easier to schedule and harder to neglect than larger groups, while acknowledging fewer perspectives and inclusion challenges, and concluded that it strengthened job-related skills and intellectual curiosity.
Handling Very Large Tables in Postgres Using Partitioning
Very large Postgres tables containing application events or log-like data can degrade query performance, slow index updates, and make vacuum disproportionately long. The article explains table partitioning through inheritance, using a master table, child partitions, CHECK constraints, and a trigger that routes inserts according to created_at; for an events workload with 10 million daily inserts and short-lived data, it uses daily partitions. It then introduces pg_partman, whose create_parent command configures time-based partitioning and whose run_maintenance function creates new partitions and removes old ones according to retention settings. Partitioning can improve performance and simplify deletion of expired data, but it should follow indexing and usage analysis, especially when queries cover a small time range and older data has little value.
Incident Preparation: Simulating Third-Party Downtime
Heroku’s help application depends on the Platform API for authentication, authorization, and user data, so it must remain available to agents and customers during platform incidents. The open-sourced api-maintenance-sim app tests this requirement by imitating an outage in which every request receives an HTTP 503 Service Unavailable response. After deploying the simulator, teams point the application under test to its hostname through PLATFORM_API_URL, passed to platform-api’s connect_oauth method; when unset, the gem uses the production URI. A heroku config:set command enables the alternate endpoint, making regular simulations possible and helping reveal what failure means for the application or service when the Platform API is unavailable, supporting preparation for incidents and communication during outages.
Getting started with the Force.com APIs for the Hackathon
With a Salesforce hackathon approaching, the guide introduces the Force.com APIs as a way to build applications using Salesforce1’s authentication, data storage, and business rule services. It compares native Salesforce1 applications, connected web applications using SOAP or REST, and three mobile patterns, including hybrid extensions, native iOS or Android clients, and a “force.com proxy” model. For hands-on setup, it recommends a free Developer Edition account and Salesforce Workbench, then explains OAuth2 web flow and password-plus-token login before showing Ruby with Restforce and Node.js with Nforce. The examples configure a Connected App, keep credentials in environment variables, query records with SOQL, and create Account records, providing a practical starting path for API integration.
Top topics
- Architecture834
- Performance817
- LLMs673
- Machine Learning622
- Open Source568
- AI Agents564
- AI483
- Developer Experience448
Weekly digest
The best engineering reads, once a week.