Brand: Artifact vs Operating System
Compare two mental models for brand: a static artifact (logos, guidelines, centralized control) and a living operating system (values, APIs, support, trust). See which choices fit your engineering team.
Loading…
Topic
Developer Experience
447 posts about Developer Experience. Every summary links to the original.
- 447 posts
- 42 companies
- 10 explainers
See the idea
Developer Experience explainers
What an App Store Actually Is: A Contract, a Surface, and a Health Loop
An app store is a distribution surface, a versioned contract, and a health loop between a platform and its developers. Here is how those parts fit together and why each one fails loudly if ignored.
One IDE vs. the Right Tool: Android Studio's Boundary Trade-off
Android Studio keeps cross-platform Kotlin run and debug in one workspace but hands Swift editing to Xcode. This explainer maps the benefit, cost, and condition behind that boundary.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Posts
The Future of Agentic AI Depends on Openness and Trust. That’s Why Docker Is Joining Nvidia’s Open Secure AI Alliance.
Modern discussions surrounding agentic AI increasingly center on whether autonomous systems can be trusted and securely placed at the core of enterprise workflows. While intelligence is generated by underlying models, operational trust depends on the surrounding execution runtime, identity frameworks, governance models, and security boundaries. To address these challenges across an open ecosystem, Docker has joined NVIDIA's Open Secure AI Alliance. This initiative aims to ensure developers can seamlessly route tasks between open-weight and frontier models without rewriting their application architectures or sacrificing control. By extending security and governance into the agent execution environment, the alliance seeks to deliver predictable control as AI agents become fundamental components of software stacks.
Your trusted knowledge layer: Introducing Stack Internal's new platform experience
Organizations face growing challenges managing fragmented institutional data as AI agents and human workers operate across disparate tools. When agents consume stale or conflicting information, they produce confident errors that require costly human verification. Stack Internal has introduced an AI-native knowledge platform that ingests raw data across sources—including Google Docs, Slack, and Stack Internal communities—and evaluates it for trust, freshness, and authority. The updated platform adds a chat interface featuring response-level confidence labels and provenance cards, along with API and MCP server integrations that enforce identity-aware permission boundaries for AI agents. Engineering leaders can also track internal knowledge usage and high-traffic dependencies across versions via new Swagger API v3 endpoints.
How we set up our cloud agent environment
Setting up a cloud-agent environment for the Cursor monorepo required treating development infrastructure as a product for agent users. The team aligned cloud VMs with local development by adapting utilities and setup scripts for Ubuntu, adding dependencies to a Cursor-defined Dockerfile, and introducing security controls for secrets and network access. To make the repository easier to operate, it built anydev to start services, route utility scripts, explain subcommands, and supervise long-running builds. Cursor Cloud MCP and Cloud Doctor then inspect environments, distinguish transient from salient failures, perform root-cause analysis, open high-confidence fixes, and improve workflows using traces. The resulting end-to-end testing and recorded demos helped cloud agents grow from about one in ten merged PRs in December to more than half, with the post identifying tool parity, documented skills, and core-workflow verification as readiness checks.
Welcoming Phil Nash, our new Developer Experience Engineer
Phil Nash is joining Resend as a Developer Experience (DX) Engineer after eight years at Twilio and subsequent work at IBM. He has taught developers through talks, articles, and live coding, and will focus on helping developers become more productive. His path into software began with building an HTML page at 13, continued through maths and computer science studies, and led to front-end development after creating a WordPress blog and writing about what he learned. Nash says he joined because he had used Resend for a personal-site contact form, built a simple TypeScript API client, and wanted to help make email a better experience for developers. He recommends sharing new learning through writing, presentations, videos, or other community contributions.
Meet Stripe's Knowledge AI Platform
Stripe built Kai, a knowledge AI platform for non-engineering work that existing no-code and coding agents could not support with Stripe’s required data security and workflow specificity. It serves tasks including account research, incident triage, revenue modeling, compliance reviews, and data-warehouse queries, while adapting to different tools, data sources, outputs, and definitions of completion. Kai is organized into surface-agnostic APIs, AgentStudio for domain teams to build and govern agents, and shared execution environments with per-session Kubernetes sandboxes, multi-tenant virtual filesystems, access controls, and long-session state management. The platform connects to more than 1,000 skills and tools and supports web, Slack, embedded, and custom application experiences. Within two weeks of its April launch, most of Stripe was using Kai; it now has 83% weekly active users, and reported effects include 25,000 annual hours shifted from administrative work and higher sales activity and deal creation among Account Executives.
Tame Dependabot: Group your updates, slow the cadence, keep security fast
Dependabot often floods repository maintainers with individual daily pull requests for single patch bumps, wasting review and continuous integration resources. Microsoft's GCToolkit project mitigated this issue by updating its dependabot.yml configuration to group dependency updates using wildcard patterns and slowing the schedule interval to monthly. The project also expanded coverage to include Maven alongside GitHub Actions so all relevant package ecosystems receive managed updates. Because Dependabot processes security alerts independently of regular version schedules and enforces a default three-day package cooldown, critical vulnerability fixes remain fast while routine maintenance noise drops significantly.
Developers are attached to tools because tools encode trust
Traditional developer tools like Vim, Emacs, and IDEs earn trust through predictability, bounded roles, and muscle memory developed over time. In contrast, agentic coding tools operate across the entire software development lifecycle using ambiguous natural language, rapidly generating vast amounts of code that developers do not inherently trust. This influx shifts development bottlenecks from code authoring to code review, validation, and infrastructure cost management. Tooling additions such as automated code reviewers, context managers, and memory systems cannot repair broken software development lifecycles unless organizations actively adapt their culture and workflows. Teams can establish trust in agentic environments by providing explicit contextual specifications, reusing verified components to avoid duplicate implementations, and restricting non-deterministic artificial intelligence to appropriate problem domains.
Sign in with ChatGPT is in beta on Supabase
Supabase is rolling out Sign in with ChatGPT in beta on its login page and through the Supabase plugin in ChatGPT on desktop, web, and mobile. The flow lets new users create a Supabase account with their ChatGPT identity, while existing Supabase accounts with the same email are linked automatically; SSO accounts remain separate. Users can add Supabase from ChatGPT’s plugins directory, authenticate with ChatGPT, review a consent screen, and return to the conversation with the connection enabled. Authentication and plugin authorization remain separate, with access revocable from the Supabase Dashboard, and users must create an organization in the Dashboard before creating projects from ChatGPT. The beta is described as a partnership with OpenAI intended to reduce account setup between ChatGPT or Codex and a Supabase backend.
Coding Agent Horror Stories: The 29 Million Secret Problem
Compromised versions of the Nx npm package, dubbed the s1ngularity campaign, used a post-install hook to repurpose installed AI coding agents as credential scanners. Because AI command-line interfaces often run with the developer's full user permissions, the malware invoked tools such as Claude Code, Gemini CLI, and Amazon Q with permission-bypass flags to map sensitive files. GitGuardian findings indicate that AI-assisted code leaks secrets at roughly twice the baseline rate, largely because models ingest live credentials into working contexts. Docker Sandboxes addresses this risk by restricting the execution environment to the project workspace and keeping actual credentials on the host. When sandboxed with sbx, agents receive sentinel placeholders, while an egress proxy injects real secrets into outgoing network requests.
Six Agent Harness Capabilities for Higher Model Performance
NVIDIA Labs released NVIDIA Labs Object-Oriented Agents (NOOA), an open-source research preview treating AI agents as single Python classes. The harness implements six model-facing capabilities: typed inputs and outputs, passing live objects by reference, code-based actions, programmable loops, explicit object state, and model-callable harness APIs. Instead of context compaction, passing live references keeps transcripts append-only, preserving prompt cache validity across long sessions. NOOA also includes a curated SQLite-backed long-term memory system forming a typed knowledge graph. Across evaluations, NOOA achieved 82.2 percent on SWE-bench Verified with GPT-5.5 using roughly 1.1M tokens per task, 86.8 percent on CyberGym L1 without network access, and 85.1 percent mean RHAE on ARC-AGI-3 using GPT-5.6-sol at under twenty dollars per game.
No Dumb Questions: What is the AI bottleneck? How does context engineering fix it?
An adoption bottleneck slows artificial intelligence integration because standalone tools lack connectivity with everyday enterprise workflows. While models can draft responses or process text, they fail to access siloed background information from emails, chat channels, and shared documents. Consequently, human users must expend disproportionate effort gathering context, granting tool permissions, and editing preliminary outputs. Michael Foree explains that overcoming this hurdle requires context engineering, where practitioners deliberately observe their own thought processes to identify relevant information sources and filter out distracting data. Testing mock prompts and iteratively refining context architectures allows practitioners to bridge the gap between standalone model capabilities and autonomous task execution.
From 57 bugs to 1, thanks to Seer
Software teams frequently defer low-priority bugs to the backlog because manual triage, investigation, and code fixes consume valuable engineering time. To resolve 56 out of 57 backlog bugs, Dan Mindru utilized Sentry telemetry combined with Seer and the hosted Sentry Model Context Protocol server. Sentry captures context including traces, logs, and session replays, allowing Seer to assess fixability scores and generate pull requests with unit tests for isolated issues. For more intricate problems, developers query production breadcrumbs and telemetry directly in their agentic editors while supplying missing historical business logic. Consequently, automated tool calling and agent workflows drastically lowered the economic cost of addressing routine production bugs.
How to structure a log
Logging arbitrary JSON objects often produces unstable messages and deeply nested data that complicate searching, aggregating, and debugging production incidents. Structured logging treats log output as real application data by establishing predictable, consistent schemas across services. Engineers should define stable event names using a domain.action pattern and capture dynamic dimensions with flattened, snake_case attributes formatted in dot notation. Attribute payloads must contain only primitive values or primitive arrays rather than arbitrary objects, utilizing low-cardinality result identifiers and explicit units for numeric measurements. Teams can enforce these structural conventions automatically with linting tools such as ESLint, while routing execution durations and timing measurements to tracing spans.
The cost of saying yes has changed
Generating initial code patches has become significantly cheaper with AI agents, shifting the primary expense of small feature requests from writing code to debating scope in meetings. Teams can use agent-generated patches as diagnostic probes rather than final deliverables, turning abstract scope debates into concrete artifacts that reveal true system touchpoints and risks. However, low generation costs do not translate to low ownership costs, as changes touching areas like authorization, compliance, or public contracts still demand significant human review. Constrained attempts allow engineers to price uncertainty quickly and shift scope discipline from pre-implementation speculation to evidence-based code review.
Build a Secure C# MCP App with Cross App Access (XAA)
Cross App Access (XAA) addresses the gap between a user’s authenticated identity and a downstream MCP server, API, or agent tool that must trust that identity without another login. The described flow uses OIDC and PKCE for sign-in, then RFC 8693 token exchange to turn the ID token into a JWT Authorization Grant (JAG), followed by RFC 7523 exchange at the MCP authorization server for a scoped bearer token. A C# MCP SDK IdentityAssertionGrantProvider encapsulates both exchanges, while ASP.NET Core OIDC middleware persists the ID token and an HTTP transport presents the resulting token to the MCP server. The sample connects to a Todo resource through the xaa.dev playground, completes MCP initialization, lists resources, and reads todo0://todos; the article states that the end-to-end implementation fits in under 50 lines of C#.
Migrating from Apollo Tooling to GraphQL Codegen at Yelp
Yelp migrated its frontend React monorepo from the deprecated apollo-tooling to GraphQL Codegen to ensure ongoing maintenance and build reliability. Because the monorepo spans over 500 packages with thousands of generated type files and custom nested type imports, the Client Data team prioritized a transparent migration that avoided codebase-wide changes. The team rejected approaches requiring syntax updates or altered import paths, choosing instead to configure GraphQL Codegen and contribute upstream plugin changes so output structures and naming conventions matched the legacy output. Migrating packages incrementally through small pull requests enabled continuous feedback while allowing developers across dozens of teams to maintain their workflows without editing existing code. Completing the migration to GraphQL Codegen v6 simplified Yelp's build tooling, eliminated deprecated dependencies, and left upstream compatibility enhancements available for the wider open-source community.
Training Orchestrator: Unifying Model Training at Yelp
Yelp developed Training Orchestrator to standardize machine learning pipeline execution and eliminate divergent training scripts across its applied engineering teams. Previously, monolithic Spark scripts coupled training logic directly to cluster runtimes, preventing local testing, slowing debug cycles, and causing inconsistent configuration drift across projects. The new framework introduces a declarative configuration layer backed by Pydantic models, enabling static type checking and step schema validation before runtime execution starts. Training workflows are defined as modular step hierarchies that the orchestration engine compiles into directed acyclic graphs for execution in topological order. By injecting Spark and MLflow contexts into steps, the architecture ensures reproducible tracking, automated Slack alerts, and parity across local development and production environments.
Better tools made Copilot code review worse. Here’s how we actually improved it.
When migrating GitHub Copilot code review from custom navigation tools to shared Unix-style CLI utilities—grep, glob, and view—benchmarks revealed higher review costs and fewer caught issues. Rather than an issue with the underlying tools, trace analysis showed the agent used general-purpose coding assistant instructions that triggered expansive repository browsing loops. In response, the team rewrote the tool guidance to enforce a review-specific workflow anchored to pull request diffs. The updated instructions direct the agent to narrow candidate call sites and files using batched discovery before reading minimal line ranges with view. This workflow tuning reduced average review costs by approximately 20% in production while maintaining review quality.
When and what should I be logging?
Targeted structured logging provides a fast way to capture operational behavior in production without requiring new deployments for debugging. Developers benefit most from logging key runtime decisions, multi-step algorithm outcomes, mutating audit operations, and context around non-critical or retried errors. Rather than outputting plain text, applications should record structured key-value pairs that capture who performed an action, what occurred, and associated trace identifiers. Sensitive information such as secrets and personally identifiable data must be excluded or scrubbed, and large unparsed payloads should be avoided to prevent excessive costs. Managing log levels appropriately and treating logs as potentially temporary instrumentation helps maintain actionable telemetry without generating unnecessary noise.
Automating cross-repo documentation with GitHub Agentic Workflows
Maintaining documentation across separate repositories often leads to severe lag because technical writers must reverse-engineer shipped features weeks after release. To address this in the Aspire project, the team implemented an automated pipeline using GitHub Agentic Workflows to bridge the product and documentation repositories. When product pull requests merge, a bash step maps milestones to docs release branches before an LLM agent evaluates the diff, drafts documentation updates, and emits structured pull request intents. A dedicated safe-outputs handler materializes these drafts via a scoped GitHub App and assigns the original code reviewers to verify accuracy. Across 396 product pull requests, the system generated 82 documentation pull requests that all merged with a median turnaround time of 44.8 hours.
Related topics
All topics →Weekly digest
The best engineering reads, once a week.