Read what ships.

01GitLab · tutorial

PHP2Shell: GitLab helps find and remediate critical PHP flaws

Critical remote code execution vulnerabilities known as PHP2Shell affect the PHP engine across multiple versions, requiring immediate runtime updates to fixed versions or patched distribution packages. The team utilized platform features like container scanning, code search, and automated agent workflows to locate PHP projects and remediate vulnerabilities. Operators must also check logs and environments for signs of compromise as framework updates and input validations cannot prevent these engine-level flaws.

DEPTH ■■■■■10 min read3 days ago

ArchitectureSecurity

Sign in to save and rate

02GitHub · architecture

The bridge to agent-scale Git infrastructure

GitHub faced infrastructure capacity limits and a 25ms cross-region network round trip when migrating repositories to Azure. The team changed the storage quorum from repository-wide locks to per-reference serialization and introduced ephemeral virtual replicas backed by object storage. This raised write throughput, prevented slow replicas from blocking traffic, and decoupled read scaling from the write quorum.

DEPTH ■■■■■8 min read4 days ago

Infrastructure

Sign in to save and rate

03Martin Fowler · architecture

When Software Meets Hardware

A software engineering team modernizing a large-scale retail IoT system of 800,000 battery-powered sensors faced challenges integrating software practices with embedded hardware. By building physical sensor farms, virtual emulators, and self-diagnosing firmware, the team learned to design for intermittent connectivity, power efficiency, and fleet-level observability. The project succeeded by treating the physical world, hardware constraints, and engineering environments as core parts of the system lifecycle.

DEPTH ■■■■■12 min read10 days ago

Sign in to save and rate

04GitHub · architecture

From 2,500 requests to 24: Rebuilding star history without the stargazers

GitHub faced abuse and performance issues because tools were scraping user identities to reconstruct repository star history. The engineering team collaborated with maintainers to build a purpose-built aggregate endpoint that returns daily star counts without identities and filters by time before aggregation. This reduced request volume from thousands to a few dozen and eliminated heavy database scans.

DEPTH ■■■■■8 min read11 days ago

Microservices

Sign in to save and rate

05Martin Fowler · performance

Are Harnesses Worth the Cost?

An experiment was conducted to evaluate whether behavioral harnesses improve coding agent reliability when building a complex backend-for-frontend service. While frontier models succeeded consistently with or without a harness, the harness significantly increased token usage, time, and cost without improving final output. However, for a cost-optimized model, the harness improved success rates from 30 percent to 100 percent.

DEPTH ■■■■■17 min read12 days ago

Sign in to save and rate

06GitLab · scaling

Make every AI credit count: See, cap, and reduce agent spend

Uncontrolled AI agent spending can be mitigated by combining open-weight models, centralized context graphs to reduce retries, and usage analytics with credit caps. GitLab introduced these capabilities in its Duo Agent Platform to help platform teams trace, limit, and optimize AI credit consumption. The resulting architecture matches specific tasks to lower-cost models while maintaining task completion quality.

DEPTH ■■■■■6 min read12 days ago

Sign in to save and rate

07GitHub · architecture

Building Git infrastructure for agent-scale development

GitHub is redesigning its Git infrastructure to handle the massive surge in concurrent read and write operations driven by agentic software development and high-volume workloads. The team is decoupling storage from compute by leveraging Azure Blob Storage for durability and lightweight compute workers for requests, which separates scaling dimensions. In internal benchmarks, this approach achieves up to 35 times higher write throughput and independent read scalability.

DEPTH ■■■■■9 min read2 weeks ago

Infrastructure

Sign in to save and rate

08GitHub · architecture

Staying Evergreen: How we automated secure access and repo hygiene in a shared org

Manual repository housekeeping and access reviews for outside collaborators become difficult to maintain as organizations scale. The team built Evergreen, a GitHub App that automates quarterly access reviews and stale repository archiving using native platform features and IssueOps. This automation successfully enforces secure defaults by revoking unanswered access while maintaining a full audit trail in git history.

DEPTH ■■■■■8 min read10 days ago

Sign in to save and rate

09Martin Fowler · practice

Fragments: October 21

This post discusses commentary on AI usage in writing, the cancellation of the Grace Hopper Celebration, and reviews a detailed article by Cindy Sridharan on debugging with AI agents. The reviewed article highlights that AI agents excel at processing raw data rather than reading code first, and outlines a three-step debugging process involving controls, signals, and hypothesis validation. The lesson is that engineers must guide AI agents by setting up verification loops and providing raw data rather than human-centric abstractions.

DEPTH ■■■■■5 min read4 days ago

Sign in to save and rate

10GitHub · migration

Improving site performance by shipping more CSS

GitHub faced performance degradation on server-side rendering and initial page loads due to scaling issues with its CSS-in-JS solution. The engineering team executed a multi-year migration to CSS Modules and eliminated dynamic styling props using incremental rollouts, wrapper components, and automation tools. This resulted in significant performance gains, including 55% faster server-side rendering and the complete removal of styled-components.

DEPTH ■■■■■8 min read4 weeks ago

FrontendPerformance

Sign in to save and rate

11Martin Fowler · practice

Practitioner Voice: The Writing Category Nobody has Named Yet

The author explores a missing category of writing called Practitioner Voice, which is grounded in earned experience and visible personal judgment rather than academic rigor, corporate polish, or AI generation. They examine how AI can be used as an extended cognitive tool for practitioners without losing human accountability. Ultimately, the piece argues that maintaining personal judgment and consequence-bearing experience is essential for authentic professional writing.

DEPTH ■■■■■39 min read12 days ago

Sign in to save and rate

12GitHub · architecture

Rendering huge pull requests in the GitHub Copilot app

Rendering extremely large pull requests with millions of lines and hundreds of comments requires separating deterministic code row geometry from unpredictable dynamic comment blocks. The team implemented an idle-gated measurement scheduler, separate height indices, and identity-based scroll anchoring to maintain smooth scrolling. As a result, the pull request view remains performant and responsive even under extreme loads.

DEPTH ■■■■■14 min read4 weeks ago

Sign in to save and rate

13GitLab · tutorial

Three developer tasks worth handing to an agent

The post explains how to use GitLab Duo Agent Platform features such as automated code reviews, CI/CD pipeline failure diagnosis, and cross-project chat. It provides setup instructions for configuration and outlines a consumption-based pricing model using credits. The features aim to automate routine developer workflows using broader project context than standard IDE assistants.

DEPTH ■■■■■4 min read6 days ago

Sign in to save and rate

14Martin Fowler · practice

Fragments: October 4

This post discusses the evolving role of software development and code in the era of large language models. It explores how shifting from deterministic building to inferential nurturing changes processes, why high-level representations remain critical for managing context windows, and how conceptual modeling becomes more important than the mechanical act of writing instructions.

DEPTH ■■■■■7 min read2 weeks ago

Sign in to save and rate

15Julia Evans · practice

Replacing the old battery on rechargeable bike lights

An individual attempted to repair old rechargeable bike lights with degraded batteries by cutting open the casing, desoldering the dead cells, and soldering in replacements. Despite lacking electronics experience and losing some screws, the repair was successful and restored the functionality of the lights.

DEPTH ■■■■■5 min read4 weeks ago

Sign in to save and rate

16Martin Fowler · practice

Principles for effective slides

Presenters often rely on text-heavy slide decks that distract audiences and undermine storytelling. To fix this, speakers can use minimalist slides as a complementary visual channel to control the rate of information and manage cognitive load. This approach leads to more engaging presentations where visuals reinforce the spoken narrative rather than replace it.

DEPTH ■■■■■12 min read3 weeks ago

Sign in to save and rate

17GitHub · performance

How we make AI coding more cost efficient without sacrificing task quality

GitHub optimized GitHub Copilot to improve cost efficiency without sacrificing task quality by evaluating changes across the entire agentic workflow. The team implemented four targeted adjustments including selective output compression, removing unused line-number formatting, shortening prompts via meta-prompting with behavioral tests, and delivering background work completions directly. These modifications reduced token usage and model inference costs globally without causing task-success regressions.

DEPTH ■■■■■9 min read7 weeks ago

Machine Learning

Sign in to save and rate

18Martin Fowler · practice

Build your slide template

Presenters often struggle with the visual design of slides and default to cluttered or uniform corporate templates. To build a better presentation foundation, the author recommends sticking to a restricted color palette, limiting the number of fonts, and using minimal layouts without unnecessary floodmarks like page numbers or logos. This approach results in a cohesive visual identity that provides greater flexibility during slide construction.

DEPTH ■■■■■11 min read11 days ago

Sign in to save and rate

19Martin Fowler · practice

Bliki: Sensible Default

The engineering post introduces the concept of a sensible default as an alternative to best practices in software development. Sensible defaults serve as reliable starting points for tasks in the absence of hard constraints, while still allowing teams to adapt and override them when context requires. Organizations like Thoughtworks utilize playbooks of these defaults to guide initial work while encouraging regular reflection and adjustment.

DEPTH ■■■■■2 min read3 weeks ago

Sign in to save and rate

20Martin Fowler · practice

Fragments: September 29

This post discusses observations on coding agents, focusing on their persistence, the role of training material in hacking behavior, and the need for greater safety measures and liability. It examines experiments with unlimited tokens and explores regulatory and educational perspectives on agentic AI.

DEPTH ■■■■■4 min read3 weeks ago

Sign in to save and rate