Explore the latest engineering posts and summaries

Search by topic, company, or concept and scan results quickly.

Posts indexed1,141

Last indexedOct 27, 2026

GitHub EngineeringSep 25, 2026

GitHub Copilot app for Beginners: How to build custom workflows with canvases

Why it matters: Canvases shift AI interaction from text-only chat to a shared, stateful UI. This allows engineers to build custom, bidirectional tools like triage boards or release checklists instantly using natural language, significantly improving collaborative efficiency between humans and AI agents.

GitHub Copilot canvases are customizable, bidirectional interfaces that allow users and AI agents to share a workspace like a kanban board or dashboard.
Users can generate these interfaces using the /create-canvas skill by describing the desired workflow and controls in natural language.
The canvas maintains a shared state, meaning updates made by the user via UI controls are instantly visible to the agent and vice versa.
Canvases are persistent and can be saved as extensions to be reused across different projects or shared with entire engineering teams.
The tool eliminates the need for manual UI coding for internal workflows, allowing the agent to refine the interface based on iterative feedback.

#mlp #culture

Read original

Netflix Tech BlogSep 25, 2026

Trading a Cloud Identity for Your Own: Workload Attestation on Managed Compute

Why it matters: This approach allows managed cloud workloads to securely acquire internal identities without manual secret injection. It ensures consistent access control and auditability across heterogeneous environments by bridging cloud-native IAM with private PKI systems.

Netflix bridges AWS IAM roles with their internal Metatron PKI using a 1:1 mapping between Data Project identities and dedicated IAM roles.
The system uses a control plane to sign workload metadata payloads, ensuring only authorized services can assert a workload's legitimacy.
Workloads prove identity by generating a pre-signed AWS STS URL, which serves as a verifiable proof of possession for the assigned IAM role.
The internal Identity service corroborates the signed metadata against the STS response to issue short-lived X.509 certificates for mutual TLS.
To scale beyond IAM role limits, Netflix shards Data Project roles across multiple dedicated AWS accounts.
A Spark plugin handles the attestation logic during driver and executor bootstrap, making the process transparent to the end-user.

#security #data #sre

Read original

Pinterest EngineeringSep 25, 2026

Partition Finalization in Pinterest’s Next-Generation DB Ingestion Framework

Why it matters: Determining when a streaming dataset is ready for batch processing is difficult. This metadata-driven approach signals data completeness based on event-time watermarks, reducing processing latency while ensuring data integrity against late-arriving records.

Pinterest developed a partition finalization mechanism for its stream-based DB ingestion framework to signal when data is complete for downstream batch processing.
The system extracts event-time statistics from CDC records and stores them as metadata within Apache Iceberg snapshot summaries during Flink checkpoints.
A centralized Watermark Generator aggregates these statistics to calculate a global watermark, accounting for late-arriving data via configurable safety buffers.
Finalization markers are emitted to a dedicated Iceberg table or as Hive _SUCCESS files once the watermark passes a partition's end time.
This approach decouples producers from consumers, allowing Airflow sensors to trigger downstream jobs based on data completeness rather than fixed schedules.
The framework uses t-digest sketches to maintain accurate event-time distributions without the overhead of storing every individual timestamp.

#data #dist

Read original

GitHub EngineeringSep 25, 2026

Improving site performance by shipping more CSS

Why it matters: This migration demonstrates how large-scale design systems can overcome performance bottlenecks by moving from runtime CSS-in-JS to static CSS Modules. It provides a blueprint for incremental refactoring of core UI infrastructure while maintaining stability in a massive production codebase.

GitHub migrated its Primer Design System from CSS-in-JS to CSS Modules to eliminate runtime performance overhead on both client and server.
The transition addressed critical bottlenecks including slow server-side rendering and high component initialization costs in high-density pages.
An incremental migration strategy utilized feature flags and visual regression testing to ensure UI consistency without breaking production environments.
To maintain backward compatibility for the legacy sx prop, GitHub created a temporary wrapper library called @primer/styled-react.
The migration achieved a 55% reduction in server-side rendering time and a 25% improvement in component initialization speed.
The team is currently executing 'Styled Box Zero,' a project to systematically remove all remaining CSS-in-JS usage across the GitHub codebase.

#frontend

Read original

Cloudflare BlogSep 25, 2026

Agents can now set up your website’s security with Turnstile Spin

Why it matters: Turnstile Spin simplifies bot protection by automating the complex two-step frontend/backend integration via AI agents. This reduces implementation errors, ensures server-side validation is correctly configured, and accelerates security deployments for both manual and AI-driven development.

Cloudflare Turnstile Spin automates the integration of privacy-first, puzzle-free CAPTCHA alternatives using AI coding agents.
The tool handles both frontend widget embedding and backend Siteverify API integration, ensuring end-to-end security validation.
It supports three primary workflows: fresh installations, fixing existing widgets missing server-side validation, and migrating from legacy CAPTCHA providers.
Spin integrates with popular AI development tools like Claude Code, Cursor, and Codex via a public skill URL or Cloudflare Wrangler.
Security is maintained by keeping application code local; the AI agent performs modifications within the user's codebase rather than on Cloudflare's servers.

#security #frontend #mlp

Read original

PlanetScale Tech BlogSep 25, 2026

When to choose x86-64 vs aarch64

Why it matters: Choosing the right CPU architecture impacts database performance and cost. ARM offers dedicated physical cores per vCPU, potentially providing better price-performance and more predictable scaling compared to hyperthreaded x86-64 instances.

Cloud providers define vCPUs differently; x86-64 usually employs hyperthreading while ARM (aarch64) utilizes dedicated physical cores.
In x86-64 environments, two vCPUs share a single core's resources, which can cause performance bottlenecks during high-load database operations.
ARM-based chips like AWS Graviton and Google Axion assign one full core per vCPU, offering more predictable performance.
ARM's architecture prioritizes power efficiency, leading to lower operational costs for cloud providers and better price-performance for users.
Architecture selection is a high-stakes decision for databases like Postgres, as migrating between x86 and ARM later is complex.

#data #finops #sre

Read original

GitHub EngineeringSep 24, 2026

When chat is the wrong UI

Why it matters: This article highlights a shift from chat-centric AI to task-oriented interfaces. For engineers, this means better productivity through custom tools that reduce token costs and provide precise control over local environments and data without leaving the AI workspace.

Chat interfaces are often inefficient for task-oriented AI interactions, acting as a 'universal' but suboptimal solution.
GitHub Copilot's 'Canvas' feature enables the creation of ephemeral, full-stack applications within the AI environment.
Canvases support bi-directional communication, allowing the AI agent to control the UI and the UI to send data back to the agent.
These custom interfaces can execute local code and call third-party APIs, enabling direct management of system resources like SQLite databases.
Building specialized tools via Canvas reduces token waste by shifting the AI's role from a direct executor to a tool-builder.
The approach allows for rich UI components like Intellisense and interactive games to exist natively within the AI workflow.

#mlp #frontend #culture

Read original

GitHub EngineeringSep 24, 2026

AI-powered fuzzing with the GitHub Security Lab Taskflow Agent

Why it matters: Traditional fuzzing requires significant manual effort to maintain coverage and triage crashes. This autonomous agent lowers the barrier to entry for high-quality security testing, allowing developers to find critical vulnerabilities in C/C++ projects with minimal human intervention.

Introduces Fuzzing Taskflow, an autonomous pipeline for C/C++ projects that reduces human effort in continuous fuzzing.
Automates the entire fuzzing lifecycle, including entrypoint discovery, build system analysis, and harness generation.
Leverages LLM agents to iteratively improve harnesses based on coverage reports and triage resulting crashes.
Built on the GitHub Security Lab Taskflow Agent framework for structured, LLM-driven security automation.
Integrates with industry-standard tools like AFL++ and clang to perform deep security testing.
Provides a streamlined CLI interface requiring only a GitHub repository slug to initiate a fuzzing campaign.

#security #mlp

Read original

Salesforce EngineeringSep 24, 2026

How Intelligent Load Shedding Prevents Cascading Failures in Tier-0 Systems

Why it matters: Protecting Tier-0 identity services is critical because failures amplify through retries. This approach ensures five-nines availability by using latency-based load shedding and decentralized quota management to stop cascading failures before they impact the entire distributed system.

Salesforce transitioned from static per-instance rate limiting to a coordinator-free global quota management system to handle dynamic autoscaling and unpredictable traffic.
The system utilizes intelligent load shedding to detect system pressure early by monitoring queue times rather than waiting for error rates to spike.
To avoid becoming a single point of failure, the protection layer operates without a central coordinator, ensuring the resilience of the identity platform.
The architecture prioritizes multi-tenant isolation, preventing 'noisy neighbor' traffic spikes from consuming shared resources and impacting unrelated customers.
By proactively shedding load during latency increases, the platform prevents retry storms and cascading failures from spreading across the distributed ecosystem.

#sre #dist #security

Read original

Cloudflare BlogSep 24, 2026

How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers

Why it matters: This highlights the risks of performance optimizations like skipping block zeroing in multi-tenant environments. It demonstrates how low-level storage configurations can bypass tenant isolation, emphasizing the need for secure defaults and thorough sanitization in container orchestration.

A vulnerability in Cloudflare Containers allowed cross-tenant data exposure due to the 'skip_block_zeroing' configuration in Linux dm-thin pools.
The flaw enabled attackers to recover residual disk blocks from previous tenants by triggering new 64 KiB block allocations with smaller 4 KiB writes.
Security researchers used ext4 directory block checksums to validate the presence of foreign data without accessing specific customer content.
Cloudflare mitigated the issue by enabling block zeroing and purging cached OCI image layers across its global fleet.
Long-term remediation included implementing the 'discard' (TRIM) command to ensure physical blocks are unmapped and zeroed upon container deletion.
Telemetry analysis confirmed no evidence of malicious exploitation prior to the researcher's report.

#security #sre

Read original

Page 16 of 115

Prev 1...14 15 16 17 18...115 Next