Read what ships.

01Cloudflare · architecture

Origin Range Requests: Serving large files without range-request tuning

Cloudflare replaced a legacy, fixed-size range caching design that suffered from bandwidth waste and memory pressure with a Pingora-based chunk coordinator. The new implementation dynamically combines cached chunks and aligned origin fetches to serve range requests accurately without manual tuning. This approach cut p99 time to first byte in half for R2 storage and reduced tiered cache traffic by six percent.

DEPTH ■■■■■8 min read2 days ago

DatabasesPerformanceRedis

Sign in to save and rate

02Shopify · architecture

We gave AI agents a mobile dev environment

Engineering teams outgrew their local machines while running parallel AI mobile development agents, constrained by heavy builds and lack of iOS tools on Linux. To solve this, they built Remote Dev using warm pools of remote Macs connected via SSH alongside separate Linux VMs for Android virtualization, paired with agent skills and live browser streaming. This setup shifted workflow bottlenecks, increasing AI-merged pull requests from 6 percent to 61 percent.

DEPTH ■■■■■9 min read3 days ago

ArchitectureMobile

Sign in to save and rate

03GitLab · tutorial

PHP2Shell: GitLab helps find and remediate critical PHP flaws

Critical remote code execution vulnerabilities known as PHP2Shell affect the PHP engine across multiple versions, requiring immediate runtime updates to fixed versions or patched distribution packages. The team utilized platform features like container scanning, code search, and automated agent workflows to locate PHP projects and remediate vulnerabilities. Operators must also check logs and environments for signs of compromise as framework updates and input validations cannot prevent these engine-level flaws.

DEPTH ■■■■■10 min read3 days ago

ArchitectureSecurity

Sign in to save and rate

04Cloudflare · architecture

Bringing post-quantum cryptography to geographically fenced key management

Cloudflare introduced a post-quantum geographically restricted key manager in closed beta to enforce data sovereignty and protect customers against harvest-now-decrypt-later attacks. The team implemented a hybrid ML-KEM-768 and X25519 cryptographic design that separates globally distributed wrapped private keys from regionally restricted root keys. This ensures that decryption keys are only accessible within authorized geographical boundaries and fails closed if validation fails.

DEPTH ■■■■■12 min read2 days ago

Security

Sign in to save and rate

05Martin Fowler · architecture

When Software Meets Hardware

A software engineering team modernizing a large-scale retail IoT system of 800,000 battery-powered sensors faced challenges integrating software practices with embedded hardware. By building physical sensor farms, virtual emulators, and self-diagnosing firmware, the team learned to design for intermittent connectivity, power efficiency, and fleet-level observability. The project succeeded by treating the physical world, hardware constraints, and engineering environments as core parts of the system lifecycle.

DEPTH ■■■■■12 min read10 days ago

Sign in to save and rate

06Shopify · architecture

How Shopify turns open models into task experts

Shopify uses a continual learning flywheel to post-train open models, such as NVIDIA Nemotron, to serve as dedicated subagents for specific tasks like GraphQL generation. By optimizing inference and utilizing automated self-healing to generate training data from production failures, the team successfully created task experts that outperform frontier models while reducing serving costs by 90-98% and improving response times.

DEPTH ■■■■■5 min read4 days ago

Architecture

Sign in to save and rate

07Shopify · architecture

Cross-store product clustering across millions of stores

Shopify needed to group identical product listings from millions of different merchants under a single global identifier. To solve this at scale without comparing every possible pair, the team implemented a multi-stage pipeline using vector retrieval, a tiered scoring system of ML models, and a bounded graph clustering approach. This architecture successfully standardizes product data across the entire platform while controlling computational costs.

DEPTH ■■■■■13 min read5 days ago

Architecture

Sign in to save and rate

08Martin Fowler · performance

Are Harnesses Worth the Cost?

An experiment was conducted to evaluate whether behavioral harnesses improve coding agent reliability when building a complex backend-for-frontend service. While frontier models succeeded consistently with or without a harness, the harness significantly increased token usage, time, and cost without improving final output. However, for a cost-optimized model, the harness improved success rates from 30 percent to 100 percent.

DEPTH ■■■■■17 min read12 days ago

Sign in to save and rate

09Cloudflare · performance

Cutting our inference bill by 68% by being obsessive about optimization

An engineering team investigated a steady rise in AI code review costs and found that cache misses and redundant model calls were driving up expenses. By restructuring system prompts to enable cross-repository prompt caching, eliminating wasted tool calls, and switching to more efficient models, the team cut inference costs by 68% while also significantly improving review latency.

DEPTH ■■■■■15 min read6 days ago

Machine Learning

Sign in to save and rate

10GitLab · scaling

Make every AI credit count: See, cap, and reduce agent spend

Uncontrolled AI agent spending can be mitigated by combining open-weight models, centralized context graphs to reduce retries, and usage analytics with credit caps. GitLab introduced these capabilities in its Duo Agent Platform to help platform teams trace, limit, and optimize AI credit consumption. The resulting architecture matches specific tasks to lower-cost models while maintaining task completion quality.

DEPTH ■■■■■6 min read12 days ago

Sign in to save and rate

11Shopify · tooling

Building Overexposed: understanding application exposure

The team built an automated scanner called Overexposed to track internet-facing services and verify access controls across Kubernetes and Cloud Run. By querying live cloud inventories and probing endpoints like an outsider, the scanner classifies exposure while avoiding false assumptions from static config files. As a result, the engineering organization improved accuracy and significantly reduced inconclusive findings over time.

DEPTH ■■■■■8 min read6 days ago

Sign in to save and rate

12Cloudflare · performance

Yandex outage: Data shows that instead of going dark, malicious bots went on the move

Following physical strikes on Yandex data centers, overall HTTP traffic from the network dropped significantly, leading to speculation that malicious bot farms had been disabled. However, traffic analysis revealed that search crawling simply decreased while malicious automation quickly migrated to other hosting providers with identical fingerprints. Consequently, overall malicious bot traffic remained flat, demonstrating that network disruptions do not stop portable automated workloads.

DEPTH ■■■■■8 min read11 days ago

Incidents & Postmortems

Sign in to save and rate

13Cloudflare · postmortem

Inside Hyperdrive: How we solved a rare Hyperdrive MySQL caching bug

During the beta of MySQL support for Hyperdrive, engineers investigated rare empty query responses and connection hangs occurring in 0.001% of requests. They discovered that sharing the data center cache between client and endpoint nodes caused protocol capability mismatches when translating MySQL wire messages. The team resolved the issue by standardizing the cache to always store responses encoded with canonical Hyperdrive capabilities.

DEPTH ■■■■■9 min read11 days ago

MySQL

Sign in to save and rate

14Cloudflare · architecture

Under the hood, off the hot path: How D1 scales to millions of databases

Cloudflare scaled its serverless SQLite database, D1, to support millions of databases by decoupling the control plane from the data plane. The team used distributed metadata caching via Workers KV, optimized database connections through Hyperdrive, and implemented a self-correcting heartbeat mechanism. This architecture prevents centralized bottlenecks and allows D1 to handle rapid on-demand database creation efficiently.

DEPTH ■■■■■22 min read12 days ago

Databases

Sign in to save and rate

15Martin Fowler · practice

Fragments: October 21

This post discusses commentary on AI usage in writing, the cancellation of the Grace Hopper Celebration, and reviews a detailed article by Cindy Sridharan on debugging with AI agents. The reviewed article highlights that AI agents excel at processing raw data rather than reading code first, and outlines a three-step debugging process involving controls, signals, and hypothesis validation. The lesson is that engineers must guide AI agents by setting up verification loops and providing raw data rather than human-centric abstractions.

DEPTH ■■■■■5 min read4 days ago

Sign in to save and rate

16Shopify · architecture

ShopGym: Realistic, reproducible sandboxes for shopping agents

Training and evaluating shopping agents is difficult due to changing live store environments, bot detection, and limited hand-built test stores. The team developed ShopGym, a framework that converts live storefronts into self-contained, anonymized sandbox shops and generates benchmark tasks. Evaluation showed that synthetic shops preserve key structural properties and behavioral alignment with live stores, giving agents a reliable environment to practice and improve.

DEPTH ■■■■■6 min read3 weeks ago

Sign in to save and rate

17Cloudflare · scaling

Rewinding the exponential: How we keep hardware usage down

Cloudflare tackled exponential traffic growth against linear hardware growth by continuously evolving their data pipeline architecture over five years. Key optimizations included breaking up monolithic schemas, switching to zstd compression, decoupling pipeline transit from database replication, decentralizing sampling, and moving aggregations earlier in the pipeline. These strategies significantly reduced backbone bandwidth usage, network congestion, and storage requirements while preserving data quality.

DEPTH ■■■■■12 min read12 days ago

Infrastructure

Sign in to save and rate

18Cloudflare · architecture

Filter, reshape, and redact logs before export with Transformers

Cloudflare integrated SQL-based log transformation directly into its Logpush export pipeline, allowing customers to filter, redact, and reshape logs before delivery. The team chose to embed the Apache DataFusion engine in-process using Rust and Go across an Arrow IPC boundary to ensure high throughput and avoid network latency. As a result, the system processes high-volume log streams efficiently while maintaining predictable resource usage and strict delivery reliability.

DEPTH ■■■■■8 min read13 days ago

Sign in to save and rate

19Martin Fowler · practice

Practitioner Voice: The Writing Category Nobody has Named Yet

The author explores a missing category of writing called Practitioner Voice, which is grounded in earned experience and visible personal judgment rather than academic rigor, corporate polish, or AI generation. They examine how AI can be used as an extended cognitive tool for practitioners without losing human accountability. Ultimately, the piece argues that maintaining personal judgment and consequence-bearing experience is essential for authentic professional writing.

DEPTH ■■■■■39 min read12 days ago

Sign in to save and rate

20Shopify · tooling

Helix: The internal tool powering our Shopify app's native migration

Shopify is migrating its mobile apps from React Native to native Swift and Kotlin using an internal LLM-powered tool called Helix. Helix breaks migrations down into small checkpoints and enforces strict quality gates covering behavior, UI equivalence, architectural compliance, and human review. This iterative loop allows the team to reliably generate and migrate hundreds of screens to native code.

DEPTH ■■■■■8 min read4 weeks ago

Sign in to save and rate