Assorted links for Wednesday, October 2:
links
Assorted links for Tuesday, October 1:
- Hacker plants false memories in ChatGPT to steal user data in perpetuity
- Getting started with testing and .NET Aspire
- The 10 best tools to green your software
- Introducing NotebookLM
An AI-first notebook, grounded in your own documents, designed to help you gain insights faster.
- NotebookLM now lets you listen to a conversation about your sources
Our new Audio Overview feature can turn documents, slides, charts and more into engaging discussions with one click.
Assorted links for Monday, September 30:
- Changes coming in PostgreSQL 17
- Eliminating Memory Safety Vulnerabilities at the Source
- Unauthenticated RCE Flaw With CVSS 9.9 Rating For Linux Systems Affects CUPS
A remote unauthenticated attacker can silently replace existing printers' (or install new ones) IPP urls with a malicious one, resulting in arbitrary command execution (on the computer) when a print job is started (from that computer)."
- NIST Recommends Some Common-Sense Password Rules
- Microsoft details security/privacy overhaul for Windows Recall ahead of relaunch
Assorted links for Tuesday, September 24:
- Let’s Build an Incremental Source Generator With Roslyn, by Stefan Pölz
- Vaporizing plastics recycles them into nothing but gas
- OpenHCL: Evolving Azure’s virtualization model
Azure Boost is a revolutionary accelerator system designed by Microsoft that offloads server virtualization processes traditionally performed by the hypervisor and host OS onto purpose-built software and hardware. This offloading frees up CPU resources for virtual machines, resulting in improved performance and a secure foundation for your cloud workloads.
- Going Super Sonic with Asio: Gotta go fast! Lessons learned for squeezing the most out of Asio for your application’s networking.
- Grid-scale batteries: They’re not just lithium
When size and weight don’t matter, lots of other battery chemistries can work.
Today is C++ instrumentation day!
Assorted links for Monday, September 23:
Assorted links for Friday, September 20:
- Minesweeper automates root cause analysis as a first-line defense against bugs
- FOQS: Scaling a distributed priority queue
- Faster, more efficient systems for finding and fixing regressions
- Writing fuzz tests with ease using Bazel
- MezzFS — Mounting object storage in Netflix’s media processing platform
Assorted links for Thursday, September 19:
- Legacy Modernization meets GenAI
So far, most attention to Generative Artificial Intelligence (GenAI) in software development is on generating code. But we believe there is as much, if not more, value in understanding existing code - particularly long-lived, large, and complex legacy systems.
- User-space interrupts
The term “interrupt” brings to mind a signal that originates in the hardware and which is handled in the kernel; even software interrupts are a kernel concept. But there is, it seems, a use case for enabling user-space processes to send interrupts directly to each other.
At its core, Mehta began, the user-space interrupts (or simply “user interrupts”) feature is a fast way to do event signaling. It delivers signals directly to user space, bypassing the kernel to achieve lower latency.
- Dissecting the GZIP format
- Storing and retrieving millions of ad impressions per second
- Sacrificial architecture: Learning from abandoned systems
Assorted links for Wednesday, September 18:
- As quantum computing threats loom, Microsoft updates its core crypto library
Microsoft has updated a key cryptographic library with two new encryption algorithms designed to withstand attacks from quantum computers.
- OpenAI’s new “reasoning” AI models are here: o1-preview and o1-mini
OpenAI finally unveiled its rumored “Strawberry” AI language model on Thursday, claiming significant improvements in what it calls “reasoning” and problem-solving capabilities over previous large language models (LLMs). Formally named “OpenAI o1,” the model family will initially launch in two forms, o1-preview and o1-mini, available today for ChatGPT Plus and certain API users.
- The Good and Bad of C++ As a Rust Dev
- Secure by Design for AI: Building Resilient Systems from the Ground Up
- Mice made transparent with a dye used in Doritos
But now, a team of Stanford University scientists has finally found an agent that can reversibly make skin transparent without damaging it. This agent was tartrazine, a popular yellow-orange food dye called FD&C Yellow 5 that is notably used for coloring Doritos.
Today is a .NET focused day.
Assorted links for Tuesday, September 17:
- Performance Improvements in .NET 9
- How Async/Await Really Works in C#
- Dynamically Adapting To Application Sizes: A blog post about advanced garbage collection techniques.
- Preventing breaking changes in public APIs with PublicApiGenerator. See also Preventing breaking changes in .NET class libraries.
- A Complete .NET Developer’s Guide to Span with Stephen Toub
Assorted links for Monday, September 16:
- A good day to trie-hard: saving compute 1% at a time: Related repository: GitHub cloudflare/trie-hard
- Noisy Neighbor Detection with eBPF
- Pushy to the Limit: Evolving Netflix’s WebSocket proxy for the future
- Announcing Linting for Bazel
- Fix C++ warnings and errors with Copilot: Introducing AI-Assisted Code Fixes in Visual Studio
Assorted links for Friday, September 13:
Assorted links for Thursday, September 12:
noexceptaffects libstdc++’sunordered_set: It may be worthwhile to investigate alternative data structure implementations like Boost.UnorderedGNU libstdc++’s hash-based associative containers change the struct layout of their nodes depending on the noexceptness of your hash function
- RETINAS: Real-Time Infrastructure Accounting for Sustainability
We are introducing a new metric – real-time server fleet utilization effectiveness —- as part of the RETINAS initiative to help reduce emissions and achieve net zero emissions across our value chain in 2030. This new metric allows us to measure server resource usage (e.g., compute, storage) and efficiency in our large-scale data center server fleet in near real-time.
- How Meta enforces purpose limitation via Privacy Aware Infrastructure at scale
Privacy Aware Infrastructure (PAI) offers efficient and reliable first-class privacy constructs embedded in Meta infrastructure to address complex privacy issues. For example, we built Policy Zones that apply across our infrastructure to address restrictions on data, such as using it only for allowed purposes, providing strong guarantees for limiting the purposes of its processing.
- Landlock: unprivileged access control: Landlock is a userspace API provided by the Linux kernel.
The goal of Landlock is to enable to restrict ambient rights (e.g. global filesystem or network access) for a set of processes.
- Intel Further Speeds Up strnlen() In The GNU C Library For Recent Intel/AMD CPUs: It’s
incredible that we’re still finding performance improvements in venerable functions like
strlen().
Assorted links for Wednesday, September 11:
- Building a Rule-Based Platform to Manage Netflix Membership SKUs at Scale
- Growth Engineering at Netflix – Creating a Scalable Offers Platform
- Edge Authentication and Token-Agnostic Identity Propagation
- The Netflix Cosmos Platform: Orchestrated Functions as a Microservice
- Beyond REST: Rapid Development with GraphQL Microservices
Assorted links for Tuesday, September 10:
- Visualizing
boost::unordered_mapin GDB, with pretty-printer customization points - Is Telegram really an encrypted messaging app?
From your perspective as a user, an “encrypted messenger” ensures that each time you start a conversation, your messages will only be readable by the folks you intend to speak with… Telegram clearly fails to meet this stronger definition for a simple reason: it does not end-to-end encrypt conversations by default. If you want to use end-to-end encryption in Telegram, you must manually activate an optional end-to-end encryption feature called “Secret Chats” for every single private conversation you want to have.
- Threat Monitoring: Best Practices for Security
- FUSE Adding IDMAPPED Mounts Support In Linux 6.12
- Australia Threatens to Force Companies to Break Encryption
Assorted links for Monday, September 9:
- A Guide to Managed Backup and Disaster Recovery
- Continuous reinvention: A brief history of block storage at AWS
While the much celebrated ideal of a “full stack engineer” is valuable, in deep and complex systems it’s often even more valuable to create cohorts of experts who can collaborate and get really creative across the entire stack and all their individual areas of depth.
- Untangling Lifetimes: The Arena Allocator
- Governing data products using fitness functions
Fitness functions are a powerful automated governance technique we’ve applied to data products within the context of a Data Mesh. Since data products serve as the foundational building blocks (architectural quanta) of a data mesh, ensuring robust governance around them significantly increases the chances of a successful data mesh transformation.
- Honey, I shrunk {fmt}: bringing binary size to 14k and ditching the C++ runtime
Assorted links for Friday, August 30:
- Reimplementing A Linux Rust Scheduler In eBPF Shows Very Promising Results
In conclusion, prototyping new schedulers in user-space using Rust and then re-implementing them in BPF can be an effective workflow for designing new specialized schedulers.
- Introducing Docker Build Checks: Optimize Dockerfiles with Best Practices
- Docker Scout Health Scores: Security Grading for Container Images in Your Docker Hub Repo
- 50 Years of Queries
A discussion of the evolution of the database industry over the last half century, and why the relational database concepts introduced by E. F. Codd have proven so resilient over several decades.
- Operational and Analytic Data Cycles
The relationship between operational and analytic data systems, and the challenges facing their implementation and management.
Assorted links for Thursday, August 29:
- Zero-click Windows TCP/IP RCE impacts all systems with IPv6 enabled, patch now
- Automating open source: How Ersilia distributes AI models to advance global health equity
- Java 21 Virtual Threads - Dude, Where’s My Lock?
- Linux VFS Fix For 5 Year Old Bug That Could Cause Corruption, Security Issues Or Crash
- OpenZFS 2.2.5 Released With Linux 6.9 Support, Some Linux 6.10 Bits
Assorted links for Wednesday, August 28:
- How Meta animates AI-generated images at scale
- New AI algorithm flags deepfakes with 98% accuracy — better than any other tool out there right now
- More than 100K sites impacted by Polyfill supply chain attack – An important way to protect your supply chain is to lock your dependency to a specific version + hash (e.g. SHA256). This way the dependency can’t be backdoored without you detecting it.
- Providing Security Updates to Automobile Software
- NIST Releases First Post-Quantum Encryption Algorithms
Assorted links for Tuesday, August 27:
- Semantic Router using Azure AI Search
- The ultimate guide to developer happiness: Five actionable tips and strategies to supercharge developer happiness—and a more innovative workplace.
- Introducing the Azure AI Inference SDK: Access More AI Models with the Azure AI Model Catalog
- What are AI agents and why do they matter?
- Found means fixed: Secure code more than three times faster with Copilot Autofix
Assorted links for Monday, August 26:
Assorted links for Friday, August 16:
Assorted links for Thursday, August 15:
Assorted links for Wednesday, August 14:
Assorted links for Tuesday, August 13:
Assorted links for Monday, August 12:
- Adding .NET Aspire to your existing .NET apps
But .NET Aspire is not just about cutting-edge technology and green-field apps; it’s also about making your current applications more straightforward. With .NET Aspire, you can streamline the startup process, improve monitoring, and increase the reliability of your applications.
- Announcing Rust 1.80.1
- .NET Cancellation by Stephen Cleary:
- Networking improvements in Windows Server 2025
- Machine Learning in Content Moderation at Etsy
Assorted links for Wednesday, August 7:
- US solar production soars by 25 percent in just one year
- Securely design your applications and protect your sensitive data with VBS enclaves
Virtualization Based Security (VBS) is the core feature of Windows used to the high value secrets stored within Windows (e.g., Credential Guard). VBS utilizes the Hyper-V hypervisor to create an environment that is higher privileged than the rest of the system kernel. Like VM isolation, the hypervisor sets memory protections in the second level address tables and IOMMU tables to isolate this environment from the rest of the system kernel.
- Apple signs on to Biden’s responsible AI guidelines
Apple now joins 15 other major tech companies, including Amazon, Anthropic, Google, Inflection, Meta, Microsoft and OpenAI, in committing to responsible AI development and rollout.
- N3199: Improved
__attribute__((cleanup))Throughdefer: A proposal for adeferkeyword in C. See alsodeferreference implementation for C. - The C++ Object Lifecycle
Assorted links for Tuesday, August 6:
- A GitHub token leak could have put the entire Python language at risk
- This developer tool is 40 years old: can it be improved? – can we design a better
diff? - DCPerf: An open source benchmark suite for hyperscale compute applications
- Investigation of a Cross-regional Network Performance Issue
- Why the CrowdStrike bug hit banks hard
Assorted links for Thursday, August 1:
Assorted links for Wednesday, July 31:
- Meta’s approach to machine learning prediction robustness
- Advancing responsible practices for open source AI
- AI Lab: The secrets to keeping machine learning engineers moving fast
- systemd Talks Up Automatic Boot Assessment In Light Of The Crowdstrike-Microsoft Outage
- GNU C Library 2.40 Released With New C23 Features & New Performance Tunables
Assorted links for Tuesday, July 30:
- Add AI to Your .NET Apps Easily with Prompty
- Google halts its 4-plus-year plan to turn off tracking cookies by default in Chrome
- AT&T failed to test disastrous update that kicked all devices off network
- No More Blue Fridays: It used to be that reliability was achieved by moving code out of kernel mode and into user mode. eBPF suggests an alternative: allow code to run in kernel mode, but in a sandbox.
Assorted links for Monday, July 29:
- rr
rr aspires to be your primary C/C++ debugging tool for Linux, replacing — well, enhancing — gdb. You record a failure once, then debug the recording, deterministically, as many times as you want. The same execution is replayed every time.
- How we improved availability through iterative simplification
- Introducing Bazel 7.2’s Output Service protocol
One of the exciting new features in Bazel 7.2 is support for the Bazel Output Service which allows Bazel to lazily materialize outputs when you access them with normal filesystem operations. This allows you to maintain visibility to the entire output tree while still saving network bandwidth.
- How to review code effectively: A GitHub staff engineer’s philosophy
- What’s new in .NET Aspire 8.1 for cloud native developers!
Assorted links for Friday, July 26:
- Metric Display Standards: Best practices for presenting numbers that change with time
- 9 Best Cloud Logging Services for Log Management, Analysis, Monitoring & More (2023 Comparison)
- AsyncAPI: Building the future of Event-Driven Architectures (EDA)
- Embrace your inner incident commander
- How to Successfully Hand Over Systems
Assorted links for Thursday, July 25:
- Profiling in production to detect server bottlenecks
- OpenSLO
OpenSLO is a service level objective (SLO) language that declaratively defines reliability and performance targets using a simple YAML specification.
- Understanding Java Garbage Collection Logging: What Are GC Logs and How to Analyze Them
- Using Kubernetes to rethink your system architecture and ease technical debt
- DevOps Practices for Continuous Deployment
Assorted links for Wednesday, July 24:
Assorted links for Tuesday, July 23:
- Automerge is a library of data structures for building collaborative applications
- Maestro: Netflix’s Workflow Orchestrator
Maestro is a general-purpose, horizontally scalable workflow orchestrator designed to manage large-scale workflows such as data pipelines and machine learning model training pipelines. It oversees the entire lifecycle of a workflow, from start to finish, including retries, queuing, task distribution to compute engines, etc.
- Key JVM Metrics to Monitor for Peak Java Application Performance
- “THANOS” — Monitoring with Prometheus and Grafana
- Reducing data transfer costs with a Docker registry cache
Assorted links for Monday, July 22:
Today is (Un)Happy Crowdstrike Day! Assorted links for Friday, July 19:
- What Is CrowdStrike, the Company Behind Today’s Global Tech Outage?
- Major outages at CrowdStrike, Microsoft leave the world with BSODs and confusion
- Your IT Department Might Need Your Help Fixing the CrowdStrike Outage
- Reddit CrowdStrike Thread
- Technical Details on Today’s Outage (Crowdstrike Blog)
My immediate thoughts are as follows:
- Monocultures are inherently fragile and an high-value attack target. This applies whether you’re talking about Windows running 95%+ of desktops, CrowdStrike running 50%+ of Fortune 500 computers, or all Cavendish bananas being genetic clones of each other – an attack on one can easily become an attack on all. Sometimes it pays to not make the same choice as everyone else. Think security through diversity.
- All automatic software deployment processes must always use progressive deployment with metric-based success gates and a straightforward, regularly-tested rollback process. If you can’t meet these requirements, you don’t deserve the ability to deploy your software automatically.
Assorted links for Wednesday, July 17:
- Genetic cloaking of healthy cells opens door to universal blood cancer therapy
- Report: Alphabet close to $23 billion deal for cybersecurity startup Wiz
- Docker Best Practices: Choosing Between RUN, CMD, and ENTRYPOINT
- fs-verity: read-only file-based authenticity protection
- Memory-allocation profiling for the kernel
Assorted links for Tuesday, July 16:
- Linux 6.11 To Introduce Block Atomic Writes - Including NVMe & SCSI Support
- Device Memory TCP Nears The Finish Line For More Efficient Networked Accelerators
- Why every quantum computer will need a powerful classical computer
- turbopuffer: fast search on object storage
- Performance Improvements in .NET 6
Assorted links for Monday, July 15:
- “We’re Living in a Nightmare:” Inside the Health Crisis of a Texas Bitcoin Town
- Ubuntu 24.10 To Enable Frame Pointers For More Packages: tl;dr: don’t use
-fomit-frame-pointeranymore. - State of Text Rendering 2024
- Scalpers Work With Hackers to Liberate Ticketmaster’s ‘Non-Transferable’ Tickets
- Exploring the challenges in creating an accessible sortable list (drag-and-drop)
Assorted links for Friday, July 12:
Assorted links for Thursday, July 11:
Assorted links for Wednesday, July 10:
Assorted links for Tuesday, July 9:
- A Behind-the-Scenes Look at How Postman’s Data Team Works
- How We Saved Millions in SSD Costs by Upgrading Our Filesystem
- Forecasting SQL query resource usage with machine learning
- Linux x86 Program Start Up or - How the heck do we get to main()? by Patrick Horgan
- Deploy without credentials with GitHub Actions and OIDC
Assorted links for Monday, July 8:
Assorted links for Friday, July 5:
Assorted links for Thursday, July 4:
Assorted links for Wednesday, July 3:
- Error and Transaction Handling in SQL Server: Part One – Jumpstart Error Handling
- Error and Transaction Handling in SQL Server: Part Two – Commands and Mechanisms
- Error and Transaction Handling in SQL Server: Part Three – Implementation
- SLICK: Adopting SLOs for improved reliability
SLICK can help us locate metric and performance data regarding the reliability of a specific service just by knowing its name. It does this by building an index of onboarded services that link to dashboards with standard visualizations to analyze and assess the service reliability. So, with a single click, it becomes possible to know whether a service currently meets or doesn’t meet user expectations. We can then start asking why.
- Using Admission Controllers to Detect Container Drift at Runtime
Assorted links for Tuesday, July 2:
- How to Measure DevSecOps Success: Key Metrics Explained
Key DevSecOps metrics:
- Number of security vulnerabilities over time
- Compliance with security policies
- “Energy-smart” bricks need less power to make, are better insulation
According to the RMIT researchers, “Brick kilns worldwide consume 375 million tonnes (~340 million metric tons) of coal in combustion annually, which is equivalent to 675 million tonnes of CO2 emission (~612 million metric tons).” This exceeds the combined annual carbon dioxide emissions of 130 million passenger vehicles in the US.
- Researchers upend AI status quo by eliminating matrix multiplication in LLMs
In the new paper, titled “Scalable MatMul-free Language Modeling,” the researchers describe creating a custom 2.7 billion parameter model without using MatMul ([matrix multiplication]) that features similar performance to conventional large language models (LLMs). They also demonstrate running a 1.3 billion parameter model at 23.8 tokens per second on a GPU that was accelerated by a custom-programmed FPGA chip that uses about 13 watts of power (not counting the GPU’s power draw). The implication is that a more efficient FPGA “paves the way for the development of more efficient and hardware-friendly architectures,” they write.
- Enhancing Netflix Reliability with Service-Level Prioritized Load Shedding
We implemented a concurrency limiter within PlayAPI that prioritizes user-initiated requests over prefetch requests without physically sharding the two request handlers. This mechanism uses the partitioning functionality of the open source Netflix/concurrency-limits Java library.
- Explaining generative language models to (almost) anyone
Assorted links for Monday, July 1:
- The Danger of Atomic Operations
Most engineers reach for atomic operations in an attempt to produce some lock-free mechanism. Furthermore, programmers enjoy the intellectual puzzle of using atomic operations. Both of these lead to clever implementations which are almost always ill-advised and often incorrect.
- What an SBOM can do for you
- sched_ext: a BPF-extensible scheduler class (Part 1)
sched_extallows you to write and run your custom process scheduler optimized for your target workloads and hardware architectures using BPF programs. - sched_ext: scheduler architecture and interfaces (Part 2)
- Leveraging AI for efficient incident response
We’ve streamlined our investigations through a combination of heuristic-based retrieval and large language model (LLM)-based ranking to provide AI-assisted root cause analysis. During backtesting, this system has achieved promising results: 42% accuracy in identifying root causes for investigations at their creation time related to our web monorepo.
Assorted links for Friday, June 28:
- IncludeOS
IncludeOS is a minimal unikernel operating system for C++ services running in the cloud and on real hardware. Starting a program with
#include <os>will include a tiny operating system into your service during link-time. - Designing Uber
- Designing Tinder
- Fixing Performance Regressions Before they Happen
- How we used C++20 to eliminate an entire class of runtime bugs
Assorted links for Thursday, June 27:
- Rapid Event Notification System at Netflix
- The Internals of PostgreSQL
- Testing Microservices: You’re Thinking About (Environment) Isolation All Wrong
- Testing Microservices: Isolating Requests (Not Environments) with Telepresence
- Testing Microservices: How to Share Staging Environments without Tripping Over Each Other
Assorted links for Wednesday, June 26:
- Speed Up Your CI/CD Pipeline with Change-Based Testing in a Yarn-Based Monorepo: I note that only building and testing what changed is one of the core value propositions of Bazel, but adopting Bazel often requires large investment in engineering and training.
- What makes a good REST API?
- How to use DORA metrics to improve software delivery
- Don’t Get Lost in the Metrics Maze: A Practical Guide to SLOs, SLIs, Error Budgets, and Toil
- Static B-Trees
In this section, we generalize the techniques we developed for binary search to static B-trees and accelerate them further using SIMD instructions. In particular, we develop two new implicit data structures:
- The first is based on the memory layout of a B-tree, and, depending on the array size, it is up to 8x faster than
std::lower_boundwhile using the same space as the array and only requiring a permutation of its elements. - The second is based on the memory layout of a B+ tree, and it is up to 15x faster than
std::lower_boundwhile using just 6-7% more memory — or 6-7% of the memory if we can keep the original sorted array.
- The first is based on the memory layout of a B-tree, and, depending on the array size, it is up to 8x faster than
Assorted links for Tuesday, June 25:
- Radioactive drugs strike cancer with precision
Pluvicto and Lutathera are both built around small protein sequences, known as peptides. These peptides specifically bind to target receptors on cancer cells—PSMA in the case of prostate cancer and somatostatin receptors in the case of Lutathera—and deliver radiation through the decay of unstable lutetium.
Administered via infusion into the bloodstream, these drugs circulate throughout the body until they firmly attach to the surfaces of tumor cells they encounter. Anchored at these target sites, the lutetium isotope then releases two types of radiation that aid in cancer treatment. The primary emission consists of beta particles, high-energy electrons capable of penetrating tumors and surrounding cells, tearing into DNA and causing damage that ultimately triggers cell death.
- Amazon Exploring MM-Local Memory Allocations To Help With Current/Future Speculation Attacks
Back in 2019 after various speculation-based CPU vulnerabilities began coming to light, Amazon engineers proposed process-local memory allocations for hiding KVM secrets. They were striving for an alternative mitigation for vulnerabilities like L1TF by essentially providing some memory regions for kernel allocations out of view/access from other kernel code. Amazon engineers this week laid out a new proposal after five years of ongoing Linux kernel improvements for MM-local memory allocations for dealing with current and future speculation-based cross-process attacks.
- TypeSpec: An API design language that either competes with, or augments, OpenAPI.
- Optimize Kubernetes Pods’ Startup Time Using VolumeSnapshots: If your K8S application uses enormous, static data sources, using VolumeSnapshots may speed up its launch time significantly.
- Building a GitOps CI/CD Pipeline with GitHub Actions (SOC 2)
Assorted links for Monday, June 24:
- The time smart quotes prevented the entire Office division from committing code
- Video annotator: a framework for efficiently building video classifiers using vision-language models and active learning
We introduce a novel framework, Video Annotator (VA), which leverages active learning techniques and zero-shot capabilities of large vision-language models to guide users to focus their efforts on progressively harder examples, enhancing the model’s sample efficiency and keeping costs low.
VA seamlessly integrates model building into the data annotation process, facilitating user validation of the model before deployment, therefore helping with building trust and fostering a sense of ownership. VA also supports a continuous annotation process, allowing users to rapidly deploy models, monitor their quality in production, and swiftly fix any edge cases by annotating a few more examples and deploying a new model version.
- PVF: A novel metric for understanding AI systems’ vulnerability against SDCs in model parameters
Parameter vulnerability factor (PVF) is a novel metric we’ve introduced with the aim to standardize the quantification of AI model vulnerability against parameter corruptions.
- Keeping main green in a monorepo
- Researchers describe how to tell if ChatGPT is confabulating
…[T]he researchers focus on what they call semantic entropy. This evaluates all the statistically likely answers evaluated by the LLM and determines how many of them are semantically equivalent. If a large number all have the same meaning, then the LLM is likely uncertain about phrasing but has the right answer. If not, then it is presumably in a situation where it would be prone to confabulation and should be prevented from doing so.
Assorted links for Friday, June 21:
- MLow: Meta’s low bitrate audio codec
After nearly two years of active development and testing, we are proud to announce Meta Low Bitrate audio codec, aka MLow, which achieves two-times-better quality than Opus (POLQA MOS 1.89 vs 3.9 @ 6kbps WB). Even more importantly, we are able to achieve this great quality while keeping MLow’s computational complexity 10 percent lower than that of Opus.
- Unlocking the power of unstructured data with RAG
To make the most of their unstructured data, development teams are turning to retrieval-augmented generation, or RAG, a method for customizing large language models (LLMs). They can use RAG to keep LLMs up to date with organizational knowledge and the latest information available on the web. They can also use RAG and LLMs to surface and extract insights from unstructured data.
- LXC vs. Docker: Which One Should You Use?
LXC is not typically used for application development but for scenarios requiring full OS functionality or direct hardware integration. Its ability to provide isolated and secure environments with minimal overhead makes it suitable for infrastructure virtualization where traditional VMs might be too resource-intensive.
Docker’s utility in supporting rapid development cycles and complex architectures makes it a valuable tool for developers aiming to improve efficiency and operational consistency in their projects.
- AES-GCM and breaking it on nonce reuse
- Next-Level Boilerplate: An Inside Look Into Our .Net Clean Architecture Repo
Clean architecture is a widely adopted opinionated way to structure your code and to separate the concerns of the application into layers. The main idea is to separate the business logic from the infrastructure and presentation layers.
Assorted links for Thursday, June 20:
- How we improved push processing on GitHub
A push triggers a Kafka event, which is fanned out via independent consumers to many isolated jobs that can process the event without worrying about any other consumers.
- Leveraging Rust in High-Performance Web Services
Rust’s ownership model is a fundamental feature that enhances both speed and safety. Every value in Rust has a unique owner, responsible for its cleanup when it’s no longer needed. This eliminates the need for a garbage collector and ensures efficient memory management. The ownership rules are enforced at compile time, which means there’s no runtime overhead.
- systemd 256 Released With run0, systemd-vpick, importctl & Other New Features
- Maintaining large-scale AI capacity at Meta
Outside of special cases, Meta maintains its fleet of clusters using a technique called maintenance trains. This is used for all capacity, including compute and storage capacity. A small number of servers are taken out of production and maintained with all applicable upgrades. Trains provide the guarantee that all capacity minus one maintenance domain is up and running 24/7, thus providing capacity predictability. This is mandatory for all capacity that is used for online and recurring training.
- How Meta trains large language models at scale
Assorted links for Wednesday, June 19:
- Arm64 on GitHub Actions: Powering faster, more efficient build systems
Developers can now take advantage of Arm-based hardware hosted by GitHub to build and deploy their release assets anywhere Arm architecture is used. Best of all, these runners are priced at 37% less than our x64 Linux and Windows runners.
- Develop Kubernetes Operators in Java without Breaking a Sweat
- The Energy Footprint of Humans and Large Language Models
Assuming an 8-hour workday and considering 260 workdays per year brings the annual energy cost of one person’s hour of daily work to around 6 kWh[a].
Now for the energy cost of running an LLM. We have set a target of 250 words in an hour. LLMs generate tokens, parts of words, so if we use the standard ratio (for English) of 0.75 words per token, our target for one hour of work is around 333 tokens. Measurements with Llama 65B reported around 4 Joules per output token [4]. This leads to 1,332 Joules for 333 tokens, about 0.00037 kWh.
- Microsoft is reworking Recall after researchers point out its security problems
Microsoft’s upcoming Recall feature in Windows 11 has generated a wave of controversy this week following early testing that revealed huge security holes. The initial version of Recall saves screenshots and a large plaintext database tracking everything that users do on their PCs, and in the current version of the feature, it’s trivially easy to steal and view that database and all of those screenshots for any user on a given PC, even if you don’t have administrator access. Recall also does little to nothing to redact sensitive information from its screenshots or that database.
First and most significantly, the company says that Recall will be opt-in by default, so users will need to decide to turn it on. It may seem like a small change, but many users never touch the defaults on their PCs, and for Recall to be grabbing all of that data by default definitely puts more users at risk of having their data stolen unawares.
The company also says it’s adding additional protections to Recall to make the data harder to access. You’ll need to enable Windows Hello to use Recall, and you’ll need to authenticate via Windows Hello (whether it’s a face-scanning camera, fingerprint sensor, or PIN) each time you want to open the Recall app to view your data.
- Building Generative AI apps with .NET 8
Assorted links for Tuesday, June 18:
- Composable data management at Meta
By providing a reusable, state-of-the-art execution engine that is engine- and dialect-agnostic (i.e, it can be integrated with any data system and extended to follow any SQL-dialect semantic), Velox quickly received attention from the open-source community. Beyond our initial collaborators from IBM/Ahana, Intel, and Voltron Data, today more than 200 individual collaborators from more than 20 companies around the world participate in Velox’s continued development.
- New warp drive concept does twist space, doesn’t move us very fast
A team of physicists has discovered that it’s possible to build a real, actual, physical warp drive and not break any known rules of physics. One caveat: the vessel doing the warping can’t exceed the speed of light, so you’re not going to get anywhere interesting any time soon. But this research still represents an important advance in our understanding of gravity.
- Biggest Windows 11 update in 2 years nearly finalized, enters Release Preview
Windows 11 24H2 includes an updated compiler, kernel, and scheduler, all lower-level system changes made at least in part to better support Arm-based PCs. Existing Windows-on-Arm systems should also see a 10 or 20 percent performance boost when using x86 applications, thanks to improvements in the translation layer (which Microsoft is now calling Prism).
There are more user-visible changes, too. 24H2 includes Sudo for Windows, the ability to create TAR and 7-zip archives from the File Explorer, Wi-Fi 7 support, a new “energy saver” mode, and better support for Bluetooth Low Energy Audio. It also allows users to run the Copilot AI chatbot in a regular resizable window that can be pinned to the taskbar instead of always giving it a dedicated strip of screen space.
- BitKeeper, Linux, and licensing disputes: How Linus wrote Git in 14 days
- Another US state repeals law that protected ISPs from municipal competition
Minnesota this week eliminated two laws that made it harder for cities and towns to build their own broadband networks. The state-imposed restrictions were repealed in an omnibus commerce policy bill signed on Tuesday by Gov. Tim Walz, a Democrat.
Minnesota was previously one of about 20 states that imposed significant restrictions on municipal broadband. The number can differ depending on who’s counting because of disagreements over what counts as a significant restriction. But the list has gotten smaller in recent years because states including Arkansas, Colorado, and Washington repealed laws that hindered municipal broadband.
The Minnesota bill enacted this week struck down a requirement that municipal telecommunications networks be approved in an election with 65 percent of the vote. The law is over a century old, the Institute for Local Self-Reliance’s Community Broadband Network Initiative wrote yesterday.
Assorted links for Monday, June 17:
- General Availability of .NET Aspire: Simplifying .NET Cloud-Native Development
.NET Aspire brings together tools, templates, and NuGet packages that help you build distributed applications in .NET more easily.
- .NET Announcements and Updates from Microsoft Build 2024
Here’s a look at our updates & announcements:
- Artificial Intelligence: End-to-end scenarios for building AI-enabled applications, embracing the AI ecosystem, and deep integration with cloud services.
- .NET Aspire: for building cloud-native distributed applications, releasing today.
- C# 13: Improvements to much loved C# features to make them even better for you.
- Performance: Reducing memory and execution time with critical benchmarks.
- Enhancements to .NET libraries and frameworks including ASP.NET Core, Blazor, .NET MAUI, and more.
- We get more useful energy out of renewables than fossil fuels
A new study by researchers at the UK’s University of Leeds, however, suggests that … renewables already produce more net energy than the fossil fuels they’re displacing. The key to understanding why is that it’s much easier to do useful things with electricity than it is with a hunk of coal or a glob of crude oil.
- Docker Documentation Gets an AI-Powered Assistant
We recently launched a new tool to enhance Docker documentation: an AI-powered documentation assistant incorporating kapa.ai. Docker Docs AI is designed to get you the information you need by providing instant, accurate answers to your Docker-related questions directly within our documentation pages.
- FUSE Adds VirtIO-FS Multi-Queue For ~5x Performance Win With Linux 6.10
With making use of multiple queues, the VirtIO-FS file-system code can be up to 5~5.5x faster for read and write performance.
Assorted links for Friday, June 14:
- Updated Intel Meteor Lake Tuning For Linux Shows Huge Performance/Power Improvements. It is a minor tweak to the default Energy Performance Preference (EPP) value within the Intel P-State CPU frequency scaling driver.
It’s like magic with one line of code changed in the Linux kernel that Intel is reporting up to 19% performance improvement for Intel Core Ultra “Meteor Lake” and up to an 11% improvement in performance per Watt. Or in another EPP mode, the power consumption during video playback can be reduced by 52%!
- These light paintings let us visualize invisible clouds of air pollution
Light painting is a technique used in both art and science that involves taking long-exposure photographs while moving some kind of light source—a small flashlight, perhaps, or candles or glowsticks—to essentially trace an image with light. A UK collaboration of scientists and artists has combined light painting with low-cost air pollution sensors to visualize concentrations of particulate matter (PM) in select locations in India, Ethiopia, and Wales. The objective is to creatively highlight the health risks posed by air pollution, according to a new paper published in the journal Nature Communications.
- GPT-4 beats psychologists on a new test of social intelligence
There were significant differences in SI between psychologists and AI’s ChatGPT-4 and Bing. ChatGPT-4 exceeded 100% of all the psychologists, and Bing outperformed 50% of PhD holders and 90% of bachelor’s holders. The differences in SI between Google Bard and bachelor students were not significant, whereas the differences with PhDs were significant; Where 90% of PhD holders excel on Google Bird.
- Wasm vs. Docker: Performant, Secure, and Versatile Containers
- Battery Arbitrage
NYTimes: Since 2020, California has installed more giant batteries than anywhere in the world apart from China. They can soak up excess solar power during the day and store it for use when it gets dark.
Those batteries play a pivotal role in California’s electric grid, partially replacing fossil fuels in the evening. Between 7 p.m. and 10 p.m. on April 30, for example, batteries supplied more than one-fifth of California’s electricity and, for a few minutes, pumped out 7,046 megawatts of electricity, akin to the output from seven large nuclear reactors.
Assorted links for Thursday, June 13:
- Microsoft Rolling Out New Windows Subsystem For Linux “WSL” Features For 2024
Windows Subsystem for Linux is now automatically releasing stored memory in WSL back for use by Windows. This automatic memory reclaim support is a great addition and makes Windows behave better especially for systems with limited amounts of RAM. Without this support in memory hungry situations like with Docker it was possible for WSL2 to exhaust all of the system’s physical memory.
Windows Subsystem for Linux has also enabled DNS tunneling by default for improved network support.
Meanwhile in experimental form is support for automatic disk reclaim and a new mirrored networking mode that provides for features like IPv6 support.
- New York Stock Exchange says bizarre glitch that showed Berkshire Hathaway down 99.97% has been resolved. Reversibility is an important feature of financial systems which naive blockchain systems deliberately forego.
For nearly two hours, Berkshire Hathaway’s Class A shares were listed as trading at just $185.10 — a price that would represent a loss of 99.97%. Berkshire closed at $627,400 on Friday.
NYSE announced it has decided to “bust,” or cancel, all “erroneous” trades for Berkshire between 9:50 am ET and 9:51 am ET at or below $603,718.30. The exchange said that ruling is not eligible for appeal and indicated it could cancel other trades.
- Microsoft Releases Azure Linux 3.0 Preview
Azure Linux 3.0 shifts from the aging Linux 5.15 kernel to the newer Linux 6.6 LTS kernel as well as significant updates to OpenSSL, systemd, Runc, and other components. Azure Linux 3.0 is also now defaulting to SELinux’s enforcing mode by default.
- Announcing the official OpenAI library for .NET
Today, the OpenAI team released their first beta, version 2.0.0-beta.1, of the official OpenAI library for .NET. Features include:
- Support for the entire OpenAI API, including Assistants v2 and Chat Completions
- Support for GPT-4o, OpenAI’s latest flagship model
- Extensibility to enable the community to build libraries on top
- Sync and async APIs for ease of use and efficiency
- Access to streaming completions via
IAsyncEnumerable<T>
- We’ve just had a year in which every month was a record-setter
Yesterday, the European Union’s Copernicus Earth-monitoring service announced that we’ve now gone a full year where every single month has been the warmest version of that month since we’ve had enough instruments in place to track global temperatures.
Assorted links for Wednesday, June 12:
- Fracking wastewater has “shocking” amount of clean-energy mineral lithium
A study from researchers at the National Energy Technology Laboratory shows the wastewater produced by Pennsylvania’s unconventional wells could contain enough lithium to meet 38 to 40 percent of current domestic consumption.
- Catch Up on Microsoft Build 2024: Essential Sessions for .NET Developers
- Highlights from Microsoft Build: Docker’s Innovations with AI and Windows on Arm
- Google Cloud explains how it accidentally deleted a customer account. The Google blog post is entitled
Sharing details on a recent incident impacting one of our customers which is a ridiculous understatement.
During the initial deployment of a Google Cloud VMware Engine (GCVE) Private Cloud for the customer using an internal tool, there was an inadvertent misconfiguration of the GCVE service by Google operators due to leaving a parameter blank. This had the unintended and then unknown consequence of defaulting the customer’s GCVE Private Cloud to a fixed term, with automatic deletion at the end of that period. The incident trigger and the downstream system behavior have both been corrected to ensure that this cannot happen again.
- AI passes the restaurant review Turing test. We are rapidly entering an era where we won’t be able to believe anything – articles, photos, videos, voice recordings – is genuine and original. Are you prepared?
In a series of experiments for a new study, Kovács found that a panel of human testers was unable to distinguish between reviews written by humans and those written by GPT-4, the LLM powering the latest iteration of ChatGPT. In fact, they were more confident about the authenticity of AI-written reviews than they were about human-written reviews.
Assorted links for Tuesday, June 11:
- Experimental Windows Containers Support for BuildKit Released in v0.13.0
BuildKit is a toolkit for converting source code to build artifacts (like container images) in an efficient, expressive, and repeatable manner.
- OpenAI training its next major AI model, forms new safety committee
On Monday, OpenAI announced the formation of a new “Safety and Security Committee” to oversee risk management for its projects and operations. The announcement comes as the company says it has “recently begun” training its next frontier model, which it expects to bring the company closer to its goal of achieving artificial general intelligence (AGI), though some critics say AGI is farther off than we might think. It also comes as a reaction to two weeks of public setbacks for the company.
- Canonical Developing “Flamenco” For Enhancing .NET Developer Experience On Ubuntu
“Flamenco is a CLI tool that helps toolchain developers manage many different package versions and releases from a single debian folder source tree.”
- GitHub and JFrog partner to unify code and binaries for DevSecOps
Together, we’ve built an integration that includes intuitive navigation and traceability between source code and binaries, CI/CD with GitHub Actions and JFrog Artifactory, and a unified view of security findings across the software supply chain. By providing full control and visibility across the entire software supply chain, we are accelerating our joint vision of making developers’ lives easier and happier.
- Amazon Cloud Traffic Is Suffocating Fedora’s Mirrors
A massive uptick in traffic to Fedora’s package mirrors is causing problems for the Linux distribution. Some five million additional systems have started putting additional strain on Fedora’s mirror resources since March and appear to be coming from Amazon’s cloud.
Assorted links for Monday, June 10:
- Federal agency warns critical Linux vulnerability being actively exploited
The vulnerability, tracked as CVE-2024-1086 and carrying a severity rating of 7.8 out of a possible 10, allows people who have already gained a foothold inside an affected system to escalate their system privileges. It’s the result of a use-after-free error, a class of vulnerability that occurs in software written in the C and C++ languages when a process continues to access a memory location after it has been freed or deallocated. Use-after-free vulnerabilities can result in remote code or privilege escalation.
The vulnerability, which affects Linux kernel versions 5.14 through 6.6, resides in the NF_tables, a kernel component enabling the Netfilter, which in turn facilitates a variety of network operations, including packet filtering, network address [and port] translation (NA[P]T), packet logging, userspace packet queueing, and other packet mangling. It was patched in January, but as the CISA advisory indicates, some production systems have yet to install it. At the time this Ars post went live, there were no known details about the active exploitation.
- Google’s AI Overview is flawed by design, and a new company blog post hints at why
Here we see the fundamental flaw of the system: “AI Overviews are built to only show information that is backed up by top web results.” The design is based on the false assumption that Google’s page-ranking algorithm favors accurate results and not SEO-gamed garbage. Google Search has been broken for some time, and now the company is relying on those gamed and spam-filled results to feed its new AI model.
- Online Privacy and Overfishing
Internet surveillance, and the resultant loss of privacy, is following the same trajectory. Just as certain fish populations in the world’s oceans have fallen 80 percent, from previously having fallen 80 percent, from previously having fallen 80 percent (ad infinitum), our expectations of privacy have similarly fallen precipitously. The pervasive nature of modern technology makes surveillance easier than ever before, while each successive generation of the public is accustomed to the privacy status quo of their youth. What seems normal to us in the security community is whatever was commonplace at the beginning of our careers.
- The Danish Mortgage System Avoids Lock-In
Recall that in the Danish system each mortgage is backed by a matching bond. As a consequence, mortgage holders have two ways to pay a mortgage: 1) hold the mortgage and pay the monthly payments or 2) buy the matching bond and, in effect, extinguish the mortgage. The latter option is valuable because when interest rates rise, the price of mortgages fall.
…Danish sellers are able to earn a profit when they trade in their low mortgage rates for more-expensive ones, making it easier to move even when rates rise.
- Vaccines don’t cause autism, but the lie won’t die. In fact, it’s getting worse.
In all, it’s a bleak finding that bodes poorly for the collective health of Americans, who are now seeing rises in cases of measles and other vaccine-preventable illnesses. Additional surveys by the APPC in 2021, 2022, and 2023 identified a slight increase in the number of survey takers who specifically believe, falsely, that the MMR (measles, mumps, and rubella) vaccine causes autism. In 2021, 9 percent of respondents falsely indicated that MMR vaccine causes autism, responding that the statement was “definitely true” (2 percent) or “probably true” (7 percent). In 2023, 12 percent of respondents fell into those categories, 2 percent for “definitely true” and 10 percent for “probably true.”
Since the start of 2024, the US has seen a steady march of measles infections nationwide. As of May 31, the CDC has recorded 146 cases across 21 states. Of those cases, 64 were part of a large outbreak in Chicago, which was declared over on May 30.
Assorted links for Wednesday, May 22:
- Investment Returns Are NOT Random
- Why Running Slower Isn’t Always the Answer
- How to Set Up a Home Security Camera System Without Using the Cloud
- The Best Custom GPTs to Make ChatGPT Even More Useful
- How AI enhances static application security testing (SAST)
- Why do only a small percentage of GenAI projects actually make it into production?
- Data Fetching Patterns in Single-Page Applications
- What’s new with io-uring in 6.10
Assorted links for Tuesday, May 21:
- Linux maintainers were infected for 2 years by SSH-dwelling backdoor with huge reach
- Building your C++ Code with CMake in VS Code
- Pure Virtual C++ 2024 Recordings Now Available
- Microsoft launches AI chatbot for spies
- Critical vulnerabilities in BIG-IP appliances leave big networks open to intrusion
- Major ChatGPT-4o update allows audio-video talks with an “emotional” AI chatbot
- Before launching, GPT-4o broke records on chatbot leaderboard under a secret name
- AI in Gmail will sift through emails, provide search summaries, send emails
- MIT students stole $25M in seconds by exploiting ETH blockchain bug, DOJ says
- The Rise of Large-Language-Model Optimization
Assorted links for Monday, May 20:
- Microsoft plans to lock down Windows DNS like never before. Here’s how.: The framework is called Zero Trust DNS (ZTDNS)
- An informal comparison of the three major implementations of
std::string - “Unprecedented” Google Cloud event wipes out customer account and its backups
- Slack Is Using Your Private Conversations to Train Its AI
- Cloudflare Praises Golang PGO For Significant CPU Savings
- Torvalds Voices Thoughts On Linux Mitigating Unexpected Arithmetic Overflows/Underflows
- IO-uring Bringing Better Send Zero-Copy Performance With Linux 6.10
- Microsoft Engineer Ports EXT2 File-System Driver To Rust
- Secure Randomness in Go 1.22
- FUSE passthrough for file I/O
Assorted links for Friday, May 10:
- How an empty S3 bucket can make your AWS bill explode
- MemoryDB: Speed, Durability, and Composition.
- Best practices for monitoring ML models in production
- New Microsoft AI model may challenge GPT-4 and Google Gemini
- Novel attack against virtually all VPN apps neuters their entire purpose
- Hackers discover how to reprogram NES Tetris from within the game
- Storage Churn: Some thoughts on alternative cloud storage services
- Was There A Trojan Horse Hidden In Section 230 All Along That Could Enable Adversarial Interoperability?
- Why choose sum types over exceptions?
- Fixing retries with token buckets and circuit breakers
Assorted links for Thursday, May 9:
- Dependabot on GitHub Actions and self-hosted runners is now generally available
- Speeding up C++ build times
- Why OpenAI Replaced ChatGPT Plugins With GPTs
- Making an Application More Robust With Data Mapping
- The business of wallets
Regulators strongly prefer that deposits stay within the regulated banking sector. The single largest reason is that they’re worried that households’ immediately accessible stored funds stay safe and accessible. A major follow-up reason, less understood by non-specialists, is that regulated banks are bound to a long list of consumer protection items on the transaction level, not the institution level. A lot of the abuse in the economy happens in $50 and $5,000 increments, rather than multi-billion dollar increments. Regulators sleep happier knowing that this abuse happens at companies with teams of operators standing. Those operators will groan and chalk a disputed transaction, instance of fraud, or glitch in the matrix up to the operational losses budget rather than sticking a user with it.
- How we built Text-to-SQL at Pinterest
- Minimizing on-call burnout through alerts observability
- What Is Amazon Resource Name (ARN)?
- OpenTelemetry Best Practices #1: Naming
- OpenTelemetry Best Practices #2 Agents, Sidecars, Collectors, Coded Instrumentation
Assorted links for Wednesday, May 8:
- Development Containers Simplified
- Highlights from Git 2.45
- If you are interested in how Git stores data behind the scenes, here is the reftable storage specification for the new reftable storage backend
- systemd Rolling Out
run0As sudo Alternative: From what I can tell from the summary,run0should be more secure thansudo- Detailed commentary from Lennart Poterring is here
- What we need to take away from the XZ Backdoor
- Get started with the latest updates for Dockerfile syntax (v1.7.0)
- MSVC Address Sanitizer adoption in .NET’s CoreCLR: I want to use significantly more static and dynamic analysis in my occasional C++ use
- Visual Studio features for C++ Header Files and Modules
- How to audit data modifications with surgical precision
- Storing energy with compressed air is about to have its moment of truth
- Introducing Artifact Attestations–now in public beta
Assorted links for Tuesday, May 7:
- Streamline your container build and publish with .NET 8
- Building a scalable gateway with .NET for Microsoft AI
- Profiling Docker Compose services through Visual Studio
- Refactor your C# code with primary constructors
- What’s new for .NET in Ubuntu 24.04
- Secure your container build and publish with .NET 8
- Silent, brokered authentication on Windows with the Azure Identity libraries
- Vendor-Locked DevOps Strategies: Personally I think vendor lock-in is mostly overblown.
- 4 ways GitHub engineers use GitHub Copilot
- The Performance Impact of C++’s
finalKeyword: tl;dr,finalisn’t always faster, and modern CPU performance defies intuition so always test & measure.
Assorted links for Monday, May 6:
- It’s About Time!: Some discussions about the use of time in system designs.
- BPFAgent: eBPF for Monitoring at DoorDash
- Best practices to prevent alert fatigue
- Streamlining and Implementing Incident Management at Dyninno
- What is Platform Engineering? by Gartner
- Inside the gamedays: how we tested Signals for reliability
- The Making of VES: the Cosmos Microservice for Netflix Video Encoding
- Researchers make a plastic that includes bacteria that can digest it
- Review of the Summer 2023 Microsoft Exchange Online Intrusion by the Cyber Safety Review Board
- How G.M. Tricked Millions of Drivers Into Being Spied On (Including Me)
Assorted links for Friday, April 26:
- Apache DataSketches: A software library of stochastic streaming algorithms
- Sysdig 2022 Cloud-Native Security and Usage Report: Stay on Top of Risks as You Scale
- validkube: Validkube combines the best open-source tools to help ensure Kubernetes YAML best practices, hygiene & security
- Best Practices for Running Stateful Applications on Kubernetes
- The Twelve-Factor App
- Multi-Runtime Microservices Architecture
- What Comes after Microservices? Multi-Runtime Microservices with Bilgin Ibryam at QCon London
- Microservices guru warns devs that trendy architecture shouldn’t be the default for every app, but ‘a last resort’
- Istio as an Example of When Not to Do Microservices
- Zhamak Dehghani on Data Mesh, Domain-Oriented Data, and Building Data Platforms
Assorted links for Thursday, April 25:
- Onboarding SLOs for Salesforce services
- Curiefense: An application security platform
- It’s always DNS… except when it’s not: A deep dive through gRPC, Kubernetes, and AWS networking
- Set up a Terraform Pipeline with GitHub Actions and GitHub OIDC for AWS
- Improving software supply chain security with tamper-proof builds
- How Netflix Content Engineering makes a federated graph searchable
- The complete guide to protecting your APIs with OAuth2 (part 1)
- How to Use Docker to Containerize Java Web Applications: Tutorial for Beginners
- Detecting silent errors in the wild: Combining two novel approaches to quickly detect silent data corruptions at scale
- Awesome C: A curated list of C good stuff
Assorted links for Wednesday, April 24:
- Pharos: The Observability Platform at Workday
- How We Halved Go Monorepo CI Build Time
- DevOps and Cloud InfoQ Trends Report – June 2022
- SLSA: Securing the Software Supply Chain
- AWS Security Maturity Model
- Uncurled – everything I know and learned about running and maintaining Open Source projects for three decades.
- .bazelrc flags you should enable
- OpenFeature: Standardizing Feature Flagging for Everyone
- Building a Platform for Serving Recommendations at Etsy
- Observability 4 JVM Frameworks with Grafana in Java and Kotlin
Assorted links for Tuesday, April 23:
- Cost Optimisation In The Cloud – Practical Design Steps For Architects and Developers – Part 1
- Cost Optimisation In The Cloud – Practical Design Steps For Architects and Developers – Part 2
- Optimizing TCP for high WAN throughput while preserving low latency
- Slowing Down to Speed Up – Circuit Breakers for Slack’s CI/CD
- Delivery Lead Time In Practice
- HashiCorp 2023 State of Cloud Strategy Survey: Cloud maturity drives operational efficiency
- Application architecture: A quick guide for startups
- Locking Engineering Hierarchy
- Locking Engineering Principles
- A Look at AzOps for Azure Infrastructure Management
Assorted links for Monday, April 22:
- Improving Meta’s SLO workflows with data annotations
- Patterns of Distributed Systems: Request Batch
- Patterns of Distributed Systems: Fixed Partitions
- Patterns of Distributed Systems: Emergent Leader
- Patterns of Distributed Systems: Clock-Bound Wait
- Faster ML Experimentation at Etsy with Interleaving
- Towards Machine Learning Observability at Etsy
- Announcing built-in container support for the .NET SDK
- A primer on Roaring bitmaps: what they are and how they work
- A Developer’s Guide to Terraform
Assorted links for Friday, April 19:
- APIs as infrastructure: future-proofing Stripe with versioning
- Versioning releases from a monorepo
- Securing the Supply Chain of Nothing
- Does the GitOps Emperor Have No Clothes?
- Ninja Van’s monitoring stack
- Continuous Load Testing: Building a culture of performance with Koi Pond
- Open Source Software (OSS) Secure Supply Chain (SSC) Framework Simplified Requirements
- Git’s database internals I: packed object store
- Scaling Git’s garbage collection
- Viewing the world as a computer: Global capacity management
Assorted links for Thursday, April 18:
- How to Roll Your Kafka Cluster With Zero Downtime and No Data Loss
- Risk Assessments for AWS Access are Not Just for Large Companies
- How DoorDash Governs Its Infrastructure with Open Policy Agent
- State of AWS Security: A Look Into Real-World AWS Environments
- The Future of Ops Is Platform Engineering
- Announcing the 2022 Accelerate State of DevOps Report: A deep dive into security
- What’s Inside Of a Distroless Container Image: Taking a Deeper Look
- The Art of Logging: Creating a human- and machine-friendly logging format
- How to select technology for Data Mesh
- Enabling static analysis of SQL queries at Meta
Assorted links for Wednesday, April 17:
- Introducing Wolfi: The first Linux (un)distro designed for securing the software supply chain
- The Top 5 kubectl Plugins by GitHub Stars
- Why and How eBay Pivoted to OpenTelemetry
- Boosting Kubernetes container runtime observability with OpenTelemetry
- Common mistakes in DevOps metrics
- Container Tools, Tips, and Tricks - Issue #2
- Introducing Finch: An Open Source Client for Container Development
- Seeing through hardware counters: a journey to threefold performance increase
- The Evolution of DevOps
- The Importance of Just-in-Time Access for Least Privilege in the Cloud
Assorted links for Tuesday, April 16:
- Shared Responsibility Model
- Estimating the effort to build a Bazel CI/CD
- The Secret Sauce of Tik-Tok’s Recommendations
- Tulip: Modernizing Meta’s data platform
- How the GitHub Docs team uses GitHub Projects
- io_uring and networking in 2023
- The technology behind GitHub’s new code search
- Fast and Furious: Doubling Down on SBOM Drift
- How DoorDash Upgraded a Heuristic with ML to Save Thousands of Canceled Orders
- How to Increase Deployment Observability and Simplify Deployment Pipelines
Assorted links for Monday, April 15:
- cURL audit: How a joke led to significant findings
- Incident travel time: The real investment is how fast you get there
- Introducing Hermes, An Open Source Document Management System
- Unreadable Metrics: Why You Can’t Find Anything in Your Monitoring Dashboards: A Guide to Effective Dashboard Design for DevOps and SRE
- A Complete Guide to Google’s Core Web Vitals and How to Optimize Them
- What Are Structured Logs and How Do They Improve Performance?
- The life of a DNS query in Kubernetes
- Building a Staging Environment for Data Teams
- Getting Started With Java Development in 2023 — An Opinionated Guide
- Fairness in multi-tenant systems
Assorted links for Friday, April 12:
- Software Supply Chain Attestation the Easy Way
- How Many Is Too Much? Exploring Costs of Coordination During Outages
- How We Keep Our Government Apps Running With High Reliability: A Peek at Our Incident Management Strategy
- Infrastructure as Code is Not the Answer!
- 20 Terraform Best Practices to Improve your TF workflow
- SBoMs with Dracon, cheaper, faster, more accurate, better
- The State of Secrets Sprawl 2023
- The COGS Problem
- Presets for bazelrc
- The Biggest Cloud Native Strategy Mistake
Assorted links for Thursday, April 11:
- GNU Stow 2.4.0 released – I use stow whenever I’m installing custom-compiled software.
- Security Vulnerability of HTML Emails
The email your manager received and forwarded to you was something completely innocent, such as a potential customer asking a few questions. All that email was supposed to achieve was being forwarded to you. However, the moment the email appeared in your inbox, it changed. The innocent pretext disappeared and the real phishing email became visible. A phishing email you had to trust because you knew the sender and they even confirmed that they had forwarded it to you.
- Improved Alerting with Atlas Streaming Eval
- Why choose sum types over exceptions?
- Refresh vs. Long-lived Access Tokens
- Why you should use io_uring for network I/O
- Clocks and Causality - Ordering Events in Distributed Systems
- Twitter’s Recommendation Algorithm
- Introducing self-service SBOMs
- Practical tips for rightsizing your Kubernetes workloads
Assorted links for Wednesday, April 10:
- Windows debugger trick: Breaking when a specific debugger message is printed
- Security research without ever leaving GitHub: From code scanning to CVE via Codespaces and private vulnerability reporting
- Developers with AI assistants need to follow the pair programming model
- How Copilot is being used by the Time Travel Debugging team for repetitive C++ coding
- Anatomy of a credit card rewards program
- How do mixture-of-experts layers affect transformer models?
- What is retrieval-augmented generation, and what does it do for generative AI?
- Timeline of the xz open source attack
- Bullying in Open Source Software Is a Massive Security Vulnerability
- Reverse Searching Netflix’s Federated Graph
Assorted links for Tuesday, April 9:
- OpenBSD system-call pinning
- The Rise and Fall of Silicon Graphics
- Fine-grained RBAC for GitHub Action workflows With GitHub OIDC and HashiCorp Vault
- Using the Platform Engineering Maturity Model to Understand the Commitment Required for an Internal Developer Platform
- Best practices for monitoring software testing in CI/CD
- File Monitoring with eBPF and Tetragon (Part 1)
- Documentation as code: Principles, workflow, and challenges
- The lifecycle of a code AI completion
- What we know about the xz Utils backdoor that almost infected the world
- Bringing enterprise-level security and even more power to GitHub-hosted runners
Assorted links for Monday, April 8:
- GNU Coreutils 9.5 Can Yield 10~20% Throughput Boost For cp, mv & cat Commands: The speed increase is by increasing the default block size from 128KiB to 256KiB. Anyone still working in 4KiB or 64KiB blocks? Time to increase!
- Biden orders every US agency to appoint a chief AI officer
As chief AI officers, appointees will serve as senior advisers on AI initiatives, monitoring and inventorying all agency uses of AI. They must conduct risk assessments to consider whether any AI uses are impacting “safety, security, civil rights, civil liberties, privacy, democratic values, human rights, equal opportunities, worker well-being, access to critical resources and services, agency trust and credibility, and market competition,” OMB said.
- Oregon Just Passed a Monumental ‘Right to Repair’ Law
[W]hat sets this Oregon law apart from the other three states is that is bans “parts pairing,” a term that describes when companies prevent unauthorized parts from functioning in their devices.
- Bing on .NET 8: The Impact of Dynamic PGO: .NET continues to deliver significant performance improvements release after release, with near-perfect backwards compatibility.
- Google says running AI models on phones is a huge RAM hog: Is it possible that the largest barrier to Artificial General Intelligence (AGI) will be the amount of computing resources (RAM, GPU, electricity, etc.) necessary to run it?
- Why the Department of Justice Cares About Green Bubbles on iPhones
- Garbage Collection for Systems Programmers
- Making AI powered .NET apps more consistent and intelligent with Redis
- Improvements to static analysis in the GCC 14 compiler
- Running local tools installed by Bazel
Assorted links for Friday, April 5:
- Scaling up the Prime Video audio/video monitoring service and reducing costs by 90% – a case study of moving from distributed microservices back to a monolith application
- Shaping live sports publishing traffic through a distributed scheduling system
- Debugging a FUSE deadlock in the Linux kernel
- Enum Class Bitmasks
- Bazel in CI (Part 1): Commit Under Test
- Bazel in CI (Part 2): Worker Setup
- Bazel Caching Explained (pt. 3): Repository Cache
- Fast builds, secure builds. Choose two. – How Stripe uses Bazel for build and test pipelines.
- Bazel roadmap
- Introducing rules_oci – A replacement for rules_docker which builds container images.
Assorted links for Thursday, April 4:
- Why SQLite is so great for the edge
- OpenTelemetry: The Star of KubeCon 2023
- Awesome Load Management
- Warden: Real Time Anomaly Detection at Pinterest
- Packaging Open Policy Agent policies with Nix
- OpenSearch vs Solr: Which One Is Better to Use?
- 7 Core Elements of an Internal Developer Platform
- Native Frame Rate Playback – Netflix Technology Blog
- Applying GitOps principles to your operations
- Highlights from Git 2.41
Assorted links for Wednesday, April 3:
- Imaginary Problems Are the Root of Bad Software
- DevOps uses a capability model, not a maturity model
- Read Every Single Error
- Ditch the Template: Incident Write-ups They Want to Read
- Load Balancing
- 10+ Best Tools & Systems for Monitoring Ubuntu Server Performance (2023 Comparison)
- How We Improved Our Monitoring Stack With Only a Few Small Changes
- What Every Developer Should Know About AWS Vault
- Move over, Dockerfiles! The new way to craft containers
- Software Bill of Materials (SBOM)
Assorted links for Tuesday, April 2:
- How we host Ars Technica in the cloud, part two: The software
- Hosting Ars, part three: CI/CD, or how I learned to stop worrying and love DevOps
- Scaling the Instagram Explore recommendations system
- How Meta is improving password security and preserving privacy
- Fixit 2: Meta’s next-generation auto-fixing linter
- Four tips to keep your GitHub Actions workflows secure
- How we build containerized services at GitHub using GitHub
- Scaling merge-ort across GitHub
- Metrics for issues, pull requests, and discussions
- A developer’s guide to prompt engineering and LLMs
Assorted links for Monday, April 1:
- Thousands of servers hacked in ongoing attack targeting Ray AI framework: Researchers say it’s the first known in-the-wild attack targeting AI workloads.
- An Alerting strategy for the cloud
- Parsing Protobuf at 2+GB/s: How I Learned To Love Tail Calls in C
- Advances in document understanding
- From U2F to passkeys
- Protecting Secrets with Docker
- Improve Docker Compose Modularity with
include - Container Security and Why It Matters
- vcpkg integration with the GitHub dependency graph
- Introducing Immortal Objects for Python
Assorted links for Friday, March 29:
- Use ‘Jan’ to Chat With AI Without the Privacy Concerns
- Uncovering the Seams in Mainframes for Incremental Modernisation: A Case Study of Legacy Displacement
- Bringing HDR photo support to Instagram and Threads
- Is Your Container Image Really Distroless?
- containerd vs. Docker: Understanding Their Relationship and How They Work Together
- Some choices for encrypting data so that it can be decrypted only by the same user or computer
- How to Start a ‘Backdoor’ Roth IRA (and When You Should)
- Microsoft opens a crack in console gaming’s decades-old walled garden
- Intel, Microsoft discuss plans to run Copilot locally on PCs instead of in the cloud
- Quantum computing progress: Higher temps, better error correction
Assorted links for Thursday, March 28:
- The RedMonk Programming Language Rankings: January 2024
- How Figma’s databases team lived to tell the scale
- Global products, global monitoring: Terraform Strategies for Seamless Grafana Dashboards Across Regions – this feels like using Terraform as the core of a GitOps strategy, which doesn’t sound like too bad of an idea to me
- Licensing AI Engineers
- TDD: You’re Probably Doing It Just Fine
- Governments Setting Limits on AI: Many countries and regions are considering, or trying to implement, regulations on the training and use of artificial intelligence
- Combining Machine Learning and Lifetime-Based Resource Management for Memory Allocation and Beyond
- How to use GitHub Copilot in your IDE: Tips, tricks, and best practices
- Unpatchable vulnerability in Apple chip leaks secret encryption keys
- Use the ‘Hawthorne Effect’ to Increase Your Productivity
Assorted links for Wednesday, March 27:
- SDL Storage API Merged For SDL 3.0
- The Return of the Frame Pointers
- Sequential A/B Testing Keeps the World Streaming Netflix Part 2: Counting Processes
- Logarithm: A logging engine for AI training workflows and services
- AI and the Evolution of Social Media
- GoFetch: Breaking Constant-Time Cryptographic Implementations Using Data Memory-Dependent Prefetchers
- Found means fixed: Introducing code scanning autofix, powered by GitHub Copilot and CodeQL
- UN General Assembly adopts landmark resolution on artificial intelligence – sadly, this is a nonbinding agreement and thus effectively toothless
- Linux Crisis Tools – install these Linux tools on your production servers before a crisis hits
- The Danger of Unreliable Platforms (with Jade Rubick)
Assorted links for Tuesday, March 26:
- Building Meta’s GenAI Infrastructure
- Inside the gamedays: how we tested Signals for reliability
- Octoverse: The state of open source and rise of AI in 2023
- Get started with .NET 8 and AI using new quickstart tutorials
- Automakers Are Sharing Consumers’ Driving Behavior With Insurance Companies
- Generate Local .NET Secrets from Azure Deployments
- Preventing production code depending on experiments – Bazel specific
- SMB for Linux with SMB3 POSIX extensions (FOSDEM 2024)
- FUSE Passthrough Mode Merged For Linux 6.9
- CODEOWNERS and Bazel
Assorted links for Monday, March 25:
- Miles Davis and the Recording of a Jazz Masterpiece
- Publishing Bazel rules that depend on tools: take 2
- Revolutionize Your CI/CD Pipeline: Integrating Testcontainers and Bazel
- How the Great Green Wall is Holding Back the Sahara Desert
- BuildKit in depth: Docker’s build engine explained
- Scaled Agile DevOps Maturity Framework
- eBPF Documentary
- eBPF Observability Tools Are Not Security Tools
- LLVM’s ‘RFC: C++ Buffer Hardening’ at Google
- C++ safety, in context
Assorted links for Friday, March 22:
- ComPromptMized: Unleashing Zero-click Worms that Target GenAI-Powered Applications
- Evolving from Rule-based Classifier: Machine Learning Powered Auto Remediation in Netflix Data Platform
- Chrono Trigger Director Asks What Fans Would Want In A Remake
- Keeping repository maintainer information accurate
- European crash tester says carmakers must bring back physical controls. When shopping for cars, I insist on physical controls.
Assorted links for Thursday, March 21:
- Fetching ML models under Bazel
- Hugging Face, the GitHub of AI, hosted code that backdoored user devices
- Researchers create AI worms that can spread from one system to another
- You Should Set ‘Anti-goals’ Too
- Financial systems take a holiday
- Building Meta’s GenAI Infrastructure
- Measuring Developer Productivity via Humans
- eBPF Observability Tools Are Not Security Tools
- LLVM’s ‘RFC: C++ Buffer Hardening’ at Google
- C++ safety, in context
Assorted links for Wednesday, March 20:
- Zalando RESTful API and Event Guidelines
- Zally: A minimalistic, simple-to-use OpenAPI 2 and 3 linter
- Top 10 common Dockerfile linting issues
- 2023 State of DevOps Report: Culture is everything
- BPFAgent: eBPF for Monitoring at DoorDash
- The Case for Memory Safe Roadmaps: Why Both C-Suite Executives and Technical Experts Need to Take Memory Safe Coding Seriously
- P2816R0: Safety Profiles: Type-and-resource Safe programming in ISO Standard C++
- SafeInt: A portable library that can be used with MSVC, GCC or Clang to help prevent integer overflows that might result when the application performs mathematical operations.
- Bluesky’s Stackable Approach to Moderation
- HTTP/2 and HTTP/3 explained
Assorted links for Tuesday, March 19:
- Platform Engineering: Orchestrating Applications, Platforms, and Infrastructure
- Recent troubleshooting cases from our SREs, part 5. An unexpected crash due to unrelated software changes
- Elevating Microservices Testing and Development using DynamicEnv
- Code Review Security Checklist
- OpenSSF Malicious Packages – A collection of reports of malicious packages identified in Open Source package repositories, consumable via the Open Source Vulnerability (OSV) format.
- 11 Small Search Platforms: Powerful Alternatives to Elasticsearch, OpenSearch, and Solr
- Migrating Netflix to GraphQL Safely
- Monitoring is a Pain
- Classifying Event Driven Architecture
- How to Manage Schemas and Handle Standardization
Assorted links for Monday, March 18:
- This Clock Made Power Grids Possible
- How we applied advanced fuzzing techniques to cURL
- GitHub is enabling secret push protection for all users. This means that, by default, GitHub will detect and help prevent developers from accidentally committing secrets to repositories.
- White House: Future Software Should be Memory Safe. The pressure on C/C++ continues to grow.
- AI-generated articles prompt Wikipedia to downgrade CNET’s reliability rating. I did not realize that CNET was posting AI-written articles, but I am not shocked.
- Solving Cold Start Timeouts with AWS Lambda and API Gateway
- Transactions in a Microservice World
- Service Delivery Index: A Driver for Reliability
- From Blind Spots to Clear Insights: The Evolution of Observability Tools and Practices at Greenlight
- Best practices for monitoring static web applications
Assorted links for Friday, March 15:
- Automating data removal
- 5 tips for making your GitHub profile page accessible
- How to gain insight into your project contributors
- Streaming SQL in Data Mesh
- Integration testing your container images with Bazel
- Zero Configuration Service Mesh with On-Demand Cluster Discovery
- Debugging .NET Apps with Time Travel Debugging (TTD)
- If P99 Latency Is BS, What’s the Alternative?
- Exploring Event-Driven Architecture: A Beginner’s Guide for Cloud Native Developers
- A Taste of Policies
Assorted links for Thursday, March 14:
- Prometheus and centralized storage: When you need it, how it works, and what Mimir is
- Prometheus and its storage: Architecture, challenges, and solutions
- ConfigureAwait in .NET 8
- The architecture of today’s LLM applications
- Automating dead code cleanup
- Source Code Management Platform Configuration Best Practices
- Visual Studio Code 1.21 Text Buffer Reimplementation
- 3 strategies to expand your threat model and secure your supply chain
- Memory-Mapped Files and Overlaid Structs
- Traffic 101: Packets Mostly Flow
Assorted links for Wednesday, March 13:
- Q&A: Patrick Debois on the Past, Present and Future of DevOps
- Google Zanzibar vs OPA - Graph vs. Code Based Authorization
- Infrastructure as Code Will be Written by AI
- State of DevOps 2023 Highlights
- Incident Response and DevOps in the Age of Generative AI
- Threads of the next wave of DevOps
- Better DevOps with Generative AI (VMUG 2023 preso)
- Adam Jacob Discusses DevOps, Modelling Infrastructure, and Increasing Collaboration
- Software Delivery Enablement, Not Developer Productivity
- The API Gateway and the Future of Cloud Native Applications
Assorted links for Tuesday, March 12:
- An intuitive documentation strategy
- The Architecture Of Serverless Data Systems
- A Practical Guide to Debugging Browser Performance with OpenTelemetry
- What Do Developers Need to Know About Kubernetes, Anyway?
- Your guide to better incident status pages
- Build reliable and secure C++ programs
- How GitHub uses GitHub Actions and Actions larger runners to build and test GitHub.com
- Releasing Bazel rulesets that publish tools
- Second Wave DevOps
- The New DevOps With Adam Jacob
Assorted links for Monday, March 11:
- Why courtyard buildings aren’t allowed in Chicago anymore
- FUSE Passthrough Support May Land For Linux 6.9 To Help Boost I/O Performance
- Upgrading GitHub.com to MySQL 8.0
- .NET 8 Networking Improvements
- A deep dive into CPU requests and limits in Kubernetes
- Surveillance through Push Notifications
- Are Containers Only for Microservices? Myth Debunked
- How GitHub uses merge queue to ship hundreds of changes every day
- Sofia’s Observability Odyssey: The Do’s and Don’ts for Effective Observability
- Consistency Models
Assorted links for Friday, March 8:
Assorted links for Thursday, March 7:
Assorted links for Wednesday, March 6:
Assorted links for Tuesday, March 5:
Assorted links for Monday, March 4:
Assorted links for Friday, March 1:
Assorted links for Thursday, February 29:
Assorted links for Wednesday, February 28:
Assorted links for Tuesday, February 27:
Assorted links for Monday, February 26: