Explore the latest engineering posts and summaries

Search by topic, company, or concept and scan results quickly.

Posts indexed584

Last indexedApr 30, 2026

GitHub EngineeringOct 30, 2025

Measuring what matters: How offline evaluation of GitHub MCP Server works

Why it matters: This article details GitHub's robust offline evaluation pipeline for its MCP Server, crucial for ensuring LLMs like Copilot accurately select and use tools. It highlights how systematic testing and metrics prevent regressions and improve AI agent reliability in complex API interactions.

GitHub's MCP (Model Context Protocol) Server enables LLMs to interact with APIs and data, forming the basis for Copilot workflows.
Minor changes to MCP tool descriptions or configurations significantly impact an LLM's ability to select correct tools and pass arguments.
An automated offline evaluation pipeline is crucial for validating changes, preventing regressions, and improving LLM tool-use performance.
The pipeline utilizes curated benchmarks containing natural language inputs, expected tools, and arguments to test model-MCP pairings.
The evaluation process comprises three stages: fulfillment (recording model invocations), evaluation (computing metrics), and summarization (reporting).
Key evaluation metrics focus on both correct tool selection (using accuracy, precision, recall, and F1-score) and accurate argument provision.

#mlp #sre

Read original

Airbnb EngineeringOct 30, 2025

GraphQL Data Mocking at Scale with LLMs and @generateMock

Why it matters: This innovation significantly streamlines frontend and mobile development by automating the creation of realistic, type-safe mock data. It frees engineers from tedious manual work, accelerates feature delivery, and improves the reliability of tests and demos.

Airbnb introduces @generateMock, a new GraphQL client directive, to automate the creation and maintenance of realistic, type-safe mock data.
The solution combines GraphQL schema validation, rich product context, and Large Language Models (LLMs) to generate convincing mock data.
Engineers can use @generateMock on any GraphQL operation, fragment, or field, providing optional hints and design URLs to guide the LLM's data generation.
Integrated with Airbnb's Niobe CLI tool, it generates JSON mock files and helper functions (TypeScript/Kotlin/Swift) for seamless consumption in tests and demo apps.
This approach eliminates the tedious manual process of writing and updating mocks, enabling faster parallel client/server development and ensuring data consistency.

#frontend #mobile #mlp

Read original

Microsoft Azure BlogOct 30, 2025

GitHub Universe 2025: Where developer innovation took center stage

Why it matters: This article highlights the transformative impact of AI agents on software development, enabling developers to focus on higher-value tasks and accelerating innovation. It showcases GitHub's platform and Microsoft's infrastructure as key enablers for this "new era of collaboration."

GitHub Universe 2025 emphasized a "new era of collaboration" where AI agents automate repetitive coding, freeing developers for complex problem-solving.
GitHub launched Agent HQ, an open ecosystem providing a single mission control for assigning, governing, and tracking multiple AI agents.
Microsoft Azure is crucial, offering infrastructure to accelerate agentic AI adoption, transforming it into a strategic advantage.
The Octoverse 2025 report reveals significant growth: 180M+ developers, 80% of new users adopt Copilot in week one, and 4.3M+ AI-related repositories.
AI's influence is evident as TypeScript and Python are now the top two most used languages, reflecting AI development preferences.
AI and agentic workflows are reinventing software development, boosting efficiency for enterprises and enabling startups to ship faster.

#mlp #culture

Read original

Cloudflare BlogOct 30, 2025

Anonymous credentials: rate-limiting bots and agents without compromising privacy

Why it matters: As AI agents reshape web interactions, engineers need privacy-preserving security solutions. Anonymous credentials offer a critical mechanism to manage agent traffic, prevent abuse, and ensure fair access without compromising user data, crucial for the evolving AI-driven internet.

The rise of AI agents is rapidly changing web traffic patterns, necessitating new security approaches beyond traditional bot defenses.
Existing coarse-grained bot detection methods risk inadvertently blocking legitimate users when applied to shared AI agent platforms.
Anonymous credentials (AC) are proposed as a privacy-preserving solution for rate-limiting and blocking malicious agents without user identification or tracking.
AC allows website operators to enforce fine-grained security policies while maintaining user privacy, crucial for the evolving web.
The IETF is developing anonymous credentials as a standard, with Cloudflare actively contributing to its real-world deployment.
A practical example demonstrates building an AI agent using Cloudflare Workers, Workers AI, and Browser Rendering with Stagehand to illustrate agent interactions.

#security #dist #mlp

Read original

Cloudflare BlogOct 30, 2025

Policy, privacy and post-quantum: anonymous credentials for everyone

Why it matters: This article is crucial for engineers working on security, privacy, and identity systems. It highlights the urgent need to integrate post-quantum cryptography into Anonymous Credentials to protect against future quantum attacks and ensure privacy in digital identity solutions.

The internet is migrating to post-quantum (PQ) cryptography, a complex transition requiring new, higher-cost algorithms like ML-KEM and ML-DSA, not simple drop-in replacements.
Anonymous Credentials (ACs) are vital for privacy, enabling attribute proof without over-sharing, but current AC schemes are vulnerable to quantum attacks.
Digital identity systems, like the EU wallet, need robust unlinkability for privacy; PQ-safe ACs offer a cryptographic solution superior to organizational policies.
The "store-now/harvest-later" threat necessitates urgent development of PQ-safe ACs to ensure their long-term viability and prevent obsolescence upon mass adoption.
While PQ TLS migration progresses, ACs present a greater challenge, demanding efficient PQ replacements or significant re-engineering for scale and privacy.

#security #dist #data

Read original

PlanetScale Tech BlogOct 30, 2025

$5 PlanetScale

Why it matters: Lowering the barrier to entry for PlanetScale allows developers to use high-quality database tooling from day one. It eliminates the need for stressful migrations later by providing a clear path from a $5 single node to a highly available, hyper-scale cluster.

PlanetScale has launched a $5/month entry-level tier for Postgres databases to support early-stage builders.
The new PS-5 node class utilizes a single-node, non-HA configuration to reduce costs compared to the previous $30/month HA minimum.
Users can vertically scale single nodes to meet performance demands without the immediate need for replicas or complex migrations.
The tier includes PlanetScale's core features, such as Insights, making it suitable for development, testing, and non-critical workloads.
This pricing strategy aims to prevent future emergency migrations by allowing startups to start small on a platform capable of hyper-scale.

#data #finops

Read original

Cloudflare BlogOct 29, 2025

Defending QUIC from acknowledgement-based DDoS attacks

Why it matters: This article highlights critical DDoS vulnerabilities in QUIC's ACK handling, emphasizing the importance of robust validation in transport protocols for network fairness and security. Engineers gain insight into preventing sophisticated amplification attacks.

Cloudflare's open-source QUIC implementation, quiche, was found to have two DDoS vulnerabilities (CVE-2025-4820, CVE-2025-4821) related to ACK handling.
These vulnerabilities included a lack of ACK range validation and susceptibility to 'Optimistic ACK' attacks, allowing an attacker to artificially expand an endpoint's send rate.
Exploiting these flaws could lead to DDoS attacks by increasing server CPU utilization and amplifying network traffic.
Cloudflare promptly patched the affected infrastructure; quiche versions prior to 0.24.4 were vulnerable, though no evidence of exploitation was found.
The mitigation for Optimistic ACK attacks involves a dynamic, CWND-aware skip frequency that scales with a connection’s send rate.
Robust ACK validation is crucial for Internet protocols like QUIC to ensure fair network usage, prevent subversion of congestion control signals, and maintain performance.

#security #dist

Read original

Cloudflare BlogOct 29, 2025

How to build your own VPN, or: the history of WARP

Why it matters: This article details how Cloudflare built a high-performance VPN using Linux networking, offering practical insights into NAT, Netfilter, and conntrack for engineers developing secure, scalable network solutions.

Cloudflare's WARP app required building a high-performance, mobile-first VPN solution for secure packet egress from edge machines.
The initial WARP implementation functioned as a Layer 3 VPN, encapsulating private IP packets within public ones for secure tunneling.
Linux's Netfilter subsystem, configured via nftables, was used to implement Network Address Translation (NAT) for routing VPN client traffic.
A key aspect involved setting up source NAT rules to rewrite client IP addresses to the server's public IP for outgoing packets.
The conntrack module in Linux Netfilter is crucial for stateful NAT, managing TCP/UDP connections and port reuse efficiently.

#dist #security #mobile

Read original

Cloudflare BlogOct 29, 2025

One IP address, many users: detecting CGNAT to reduce collateral effects

Why it matters: Engineers must understand that IP addresses no longer reliably identify single users due to CGNAT. Failing to detect large-scale IP sharing can lead to unintended collateral damage, disproportionately affecting users in developing regions and causing significant operational and security issues.

Traditional IP-based security mechanisms (blocklists, rate-limiting) assume a single IP represents a single user, an assumption no longer valid due to widespread CGNAT, VPNs, and proxies.
Carrier-Grade NAT (CGNAT) allows ISPs to share a single IPv4 address among hundreds or thousands of users, primarily driven by IPv4 address exhaustion, especially in developing regions.
This large-scale IP sharing creates significant collateral damage, leading to socioeconomic bias where security actions disproportionately affect users in regions with high user-to-IP ratios.
Cloudflare is developing methods to detect large-scale IP sharing to mitigate unintended negative impacts and improve digital equity, a problem recognized by IETF RFCs.

#security #dist #data

Read original

Cloudflare BlogOct 29, 2025

So long, and thanks for all the fish: how to escape the Linux networking stack

Why it matters: This article details advanced Linux networking challenges when pushing performance boundaries. It highlights how low-level kernel interactions can cause subtle but critical issues, requiring custom solutions to ensure reliable, high-performance network services.

Cloudflare developed "soft-unicast" to share IP subnets across data centers, requiring machines to manage numerous IP/source-port combinations for outgoing connections.
Traditional Linux networking stack tools like iptables and Netfilter's conntrack module presented significant challenges for soft-unicast due to complexity and unexpected interactions.
A custom service, "SLATFATF" (fish), was created to manage soft-unicast IP packet proxying and address leasing, aiming to reduce firewall workload.
A critical issue arose from the collision between Netfilter's conntrack table and kernel socket binding, where conntrack could silently rewrite source ports of TCP sockets, breaking connections.
This collision meant that a socket's source address might not match the actual IP packet's source, leading to connection failures and timeouts.
The final solution for WARP involved terminating TCP connections within the server and proxying them to local sockets with correct soft-unicast addresses, bypassing problematic packet rewriting.

#dist #sre

Read original

Page 48 of 59

Prev 1...46 47 48 49 50...59 Next