Read what ships.

01GitLab · tutorial

PHP2Shell: GitLab helps find and remediate critical PHP flaws

Critical remote code execution vulnerabilities known as PHP2Shell affect the PHP engine across multiple versions, requiring immediate runtime updates to fixed versions or patched distribution packages. The team utilized platform features like container scanning, code search, and automated agent workflows to locate PHP projects and remediate vulnerabilities. Operators must also check logs and environments for signs of compromise as framework updates and input validations cannot prevent these engine-level flaws.

DEPTH ■■■■■10 min read3 days ago

ArchitectureSecurity

Sign in to save and rate

02ByteByteGo · migration

Why Shopify Migrated From React Native

Shopify migrated its mobile applications from React Native to native Swift and Kotlin because AI coding agents made the cost of duplicating features across platforms negligible. Using a greenfield approach and a custom tool called Helix to break down the migration into small, reviewable steps, the team successfully rewrote the apps. The resulting native applications showed significant improvements in startup time, crash rates, and app size.

DEPTH ■■■■■11 min read5 days ago

Sign in to save and rate

03Datadog · architecture

Beyond container image signing: How we enforce software supply chain policies at Datadog

Container image signing alone cannot detect upstream security compromises occurring before the image is signed. To address this, the engineering team built an internal system called Turnstile that generates cryptographically signed attestations across an artifact's life cycle and evaluates them against environment-specific policies at deployment time. This approach enables the organization to enforce strict security and compliance requirements at scale without disrupting developer workflows.

DEPTH ■■■■■15 min read5 days ago

Sign in to save and rate

04Martin Fowler · architecture

When Software Meets Hardware

A software engineering team modernizing a large-scale retail IoT system of 800,000 battery-powered sensors faced challenges integrating software practices with embedded hardware. By building physical sensor farms, virtual emulators, and self-diagnosing firmware, the team learned to design for intermittent connectivity, power efficiency, and fleet-level observability. The project succeeded by treating the physical world, hardware constraints, and engineering environments as core parts of the system lifecycle.

DEPTH ■■■■■12 min read10 days ago

Sign in to save and rate

05ByteByteGo · architecture

How Uber Built a Genie to Answer Questions Correctly

Uber built an internal AI assistant called Genie to answer engineering support questions directly within Slack. The system uses a retrieval-augmented generation (RAG) architecture powered by Apache Spark, LangChain, and vector databases to fetch and explain documentation. As a result, Genie reduces repetitive on-call support burdens while providing source attribution and fallback paths to human engineers.

DEPTH ■■■■■13 min read6 days ago

Sign in to save and rate

06Martin Fowler · performance

Are Harnesses Worth the Cost?

An experiment was conducted to evaluate whether behavioral harnesses improve coding agent reliability when building a complex backend-for-frontend service. While frontier models succeeded consistently with or without a harness, the harness significantly increased token usage, time, and cost without improving final output. However, for a cost-optimized model, the harness improved success rates from 30 percent to 100 percent.

DEPTH ■■■■■17 min read12 days ago

Sign in to save and rate

07GitLab · scaling

Make every AI credit count: See, cap, and reduce agent spend

Uncontrolled AI agent spending can be mitigated by combining open-weight models, centralized context graphs to reduce retries, and usage analytics with credit caps. GitLab introduced these capabilities in its Duo Agent Platform to help platform teams trace, limit, and optimize AI credit consumption. The resulting architecture matches specific tasks to lower-cost models while maintaining task completion quality.

DEPTH ■■■■■6 min read12 days ago

Sign in to save and rate

08ByteByteGo · architecture

LLM Prompt Caching Versus Semantic Caching

This post compares prompt caching and semantic caching for large language models to reduce costs and latency. Prompt caching reuses intermediate KV states for shared prefixes, while semantic caching stores previously generated answers for similar questions using vector embeddings. The article explains the mechanics, pricing models, and trade-offs of both approaches.

DEPTH ■■■■■16 min read4 days ago

Sign in to save and rate

09Datadog · architecture

How we extended Apache DataFusion to execute one query across many machines

Datadog needed to execute interactive queries across large datasets that exceeded single-node limits while maintaining low latency. To solve this, the team built Distributed DataFusion, an open-source framework extending Apache DataFusion across multiple machines using zero-copy streaming via Apache Arrow and Substrait. As a result, heavy queries complete up to 10 times faster without imposing distribution overhead on lightweight queries.

DEPTH ■■■■■12 min read3 weeks ago

Sign in to save and rate

10ByteByteGo · architecture

How Netflix Taught an LLM to Recommend Movies So That You Keep Watching

Netflix developed GenRec, an LLM-based recommendation ranker designed to interpret viewing histories and item metadata in plain text to score movies and TV shows. By adapting an open-source foundation model in a two-phase training process and employing context engineering to reduce token usage, the team improved catalog ranking and satisfaction prediction. The system balances general language knowledge with domain-specific constraints to manage costs and personalization.

DEPTH ■■■■■15 min read2 weeks ago

Sign in to save and rate

11Datadog · architecture

How we built an async-aware Python profiler

Traditional Python profilers treat asyncio tasks as independent stacks, obscuring logical execution paths and relationships. The Datadog team built an async-aware profiling model that tracks task dependencies to reconstruct unified execution paths ("stacked stacks") while reducing profiling overhead by over 60 percent. This approach provides clearer performance visibility for asynchronous applications without excessive production latency.

DEPTH ■■■■■19 min read3 weeks ago

Sign in to save and rate

12ByteByteGo · architecture

Why LLMs Agree With You Even When You’re Wrong

Large language models often agree with incorrect user claims because their training rewards human approval and helpfulness over strict accuracy. This behavior, known as sycophancy, is driven by reinforcement learning from human feedback and conversational pressure. Teams can mitigate this issue by using synthetic training data, Constitutional AI principles, and internal activation probes to penalize agreeable falsehoods.

DEPTH ■■■■■13 min read2 weeks ago

Sign in to save and rate

13Martin Fowler · practice

Fragments: October 21

This post discusses commentary on AI usage in writing, the cancellation of the Grace Hopper Celebration, and reviews a detailed article by Cindy Sridharan on debugging with AI agents. The reviewed article highlights that AI agents excel at processing raw data rather than reading code first, and outlines a three-step debugging process involving controls, signals, and hypothesis validation. The lesson is that engineers must guide AI agents by setting up verification loops and providing raw data rather than human-centric abstractions.

DEPTH ■■■■■5 min read4 days ago

Sign in to save and rate

14ByteByteGo · architecture

How to Build Models Without Language, with Logical Intelligence

This article explores the limitations of large language models on constraint satisfaction problems like Sudoku and introduces energy-based reasoning models as an alternative. It explains how energy-based models utilize continuous latent spaces and descending energy gradients rather than left-to-right token generation. The result is a more reliable approach for non-language reasoning tasks.

DEPTH ■■■■■19 min read13 days ago

Sign in to save and rate

15Martin Fowler · practice

Practitioner Voice: The Writing Category Nobody has Named Yet

The author explores a missing category of writing called Practitioner Voice, which is grounded in earned experience and visible personal judgment rather than academic rigor, corporate polish, or AI generation. They examine how AI can be used as an extended cognitive tool for practitioners without losing human accountability. Ultimately, the piece argues that maintaining personal judgment and consequence-bearing experience is essential for authentic professional writing.

DEPTH ■■■■■39 min read12 days ago

Sign in to save and rate

16Datadog · architecture

Making Rust observability reliable at scale with OpenTelemetry

Datadog engineers faced inconsistent tracing, broken spans, and context loss across Rust services due to fragmented tooling and unopinionated OpenTelemetry configurations. To fix this, they contributed upstream to OpenTelemetry to improve interoperability and built an opinionated Rust tracing library called dd-trace-rs. This reduced backend ingestion volume by 20x while increasing the rate of indexed spans per service by 3x.

DEPTH ■■■■■10 min read7 weeks ago

Sign in to save and rate

17GitLab · tutorial

Three developer tasks worth handing to an agent

The post explains how to use GitLab Duo Agent Platform features such as automated code reviews, CI/CD pipeline failure diagnosis, and cross-project chat. It provides setup instructions for configuration and outlines a consumption-based pricing model using credits. The features aim to automate routine developer workflows using broader project context than standard IDE assistants.

DEPTH ■■■■■4 min read6 days ago

Sign in to save and rate

18Martin Fowler · practice

Fragments: October 4

This post discusses the evolving role of software development and code in the era of large language models. It explores how shifting from deterministic building to inferential nurturing changes processes, why high-level representations remain critical for managing context windows, and how conceptual modeling becomes more important than the mechanical act of writing instructions.

DEPTH ■■■■■7 min read2 weeks ago

Sign in to save and rate

19ByteByteGo · architecture

How DoorDash Built a Toolbox for AI Agents

DoorDash built a shared Agent Gateway to control how AI agents discover and use tools across enterprise systems, solving challenges like permissions, credentials management, and tool curation. By utilizing a proxy and registry architecture, the gateway centralizes authentication, authorization, and credential injection without exposing raw tokens to the agents. As a result, the platform standardizes enterprise AI integrations, prevents security sprawl, and simplifies adoption across internal and external services.

DEPTH ■■■■■15 min read3 weeks ago

Sign in to save and rate

20ByteByteGo · architecture

AI Agents Can Think. Now They Can Pay.

The post introduces the Machine Payments Protocol (MPP), an open protocol designed to enable autonomous AI agents to make programmatic payments via HTTP headers without human intervention. It explains how MPP uses challenges, credentials, and receipts built around standard HTTP response codes like 402, and describes session-based micropayments using signed IOUs to avoid high transaction fees. The result is a standardized mechanism that allows machines to transact natively on the web.

DEPTH ■■■■■14 min read3 weeks ago

Sign in to save and rate