Unread

Dropbox explains how it reduced transfer latency for distant users by deploying Points of Presence and edge proxy servers in multiple regions, absorbing the TCP slow-start and TLS handshake delays that undersea-cable round trips impose. Proxies hold persistent connections to data centers over private backbone links, with TLS 1.2, PFS, and certificate pinning preserving security. Reported gains vary by market (40% to 3x median speedups), and implementation details remain high-level.

The publisher returned HTTP 403. Open the original or retry later.

Discord replaced a Python image-resizing proxy with a Go service after the original showed uneven workload distribution and high latency variance. Because no Go resizing package could beat pillow-simd, they built Lilliput, a Go package wrapping OpenCV and C image libraries via Cgo—accepting forked dependencies, manual memory management, and hard-to-debug leaks and race conditions. The rewrite cut server instances by 60% and reduced latency variance, but required extensive profiling, fuzzing, and custom GIF and video handling.

Argues that Postgres deadlocks (SQLSTATE 40P01) usually reflect inconsistent lock ordering in transaction design, best fixed by restructuring operations into a consistent order. Case study: two seemingly identical bulk upserts deadlocked because rows were randomly ordered (a Go map converted to a slice) and Postgres acquires locks row-by-row during inserts; sorting rows solved it. Alternatives like explicit locks (FOR UPDATE, advisory locks) or jittered retries trade off parallelism and raise lock timeout risk.

An engineer traveling from the US to India found direct Tailscale connections failed due to symmetric CGNAT on Indian ISPs, forcing traffic through shared DERP relays throttled to ~2.2 Mbits/sec. Self-hosted Tailscale Peer Relays (a node with an open UDP port) restored 27-35 Mbits/sec and cut latency ~150ms by removing the Chicago relay hop. The article explains NAT diagnosis tools and relay setup; DERP remains the fallback, and the tradeoff is operating and exposing a relay on your own infrastructure.

The publisher returned HTTP 403. Open the original or retry later.

The publisher returned HTTP 403. Open the original or retry later.

Uber recounts migrating from a monolithic codebase to a microservices SOA (500+ services) to handle rapid growth, which solved coupling and deployment problems but introduced issues of obviousness, safety, and resilience. They adopted Apache Thrift for strict cross-language service contracts and built client-publishing tooling, drawing on Netflix Hystrix and Twitter Finagle for fault tolerance. Tradeoffs include immature Thrift tooling for Python and Node, and no header support complicating authentication and tracing.

The publisher returned HTTP 403. Open the original or retry later.

The article argues passkeys are technically strong—phishing-proof and breach-resistant—making them well-suited to enterprises, but a poor fit for individuals whose bigger risks are lockout, account bans, and device loss. It details pain points: hardware keys can't be backed up and have per-key credential limits, platform-synced passkeys tie you to Apple/Google accounts, export/interoperability is immature, and cross-device login is clunky. It recommends passwords in a third-party manager plus a separate TOTP app, except for habitual password reusers.

The author introduces Laya, an open-source family of bidirectional encoder models that answer typed questions (choice, ordinal score, boolean) with calibrated probabilities in roughly 33 ms, arguing generative LLMs are overkill for high-volume triage and routing. Self-reported benchmarks claim speed, calibration, and cost advantages over the proprietary Jev API. Acknowledged tradeoffs: choice questions degrade beyond ~20 options, base checkpoints are near-random zero-shot and require fine-tuning, and temperature calibration is needed.

Could not extract a readable article. The page may require JavaScript, a login, or a subscription.

Dropbox argues that as AI-driven demand grows, getting more from existing infrastructure matters as much as building new data centers. The post describes a system-level approach spanning power management (Deep Sleep), workload rebalancing, higher storage density via SMR drives, and failure-rate-driven hardware lifecycle decisions, reporting watts per petabyte improved over 50% since 2020. Tradeoffs include density versus power/cooling needs, energy savings versus latency, and longer hardware life versus reliability risk.

Dropbox built trajectory-based LLM-as-judge evaluations for its Dash chat agent, then used DSPy's GEPA and MIPROv2 optimizers in two stages: calibrating judges against a small human-labeled set, then optimizing the agent's system prompt via offline replay of historical chats. Reported gains include 26% fewer incomplete answers, 13% fewer missed key aspects, and 5.4% lower token usage. The tradeoffs: automation requires strict guardrails, and weak evaluation signals risk brittle improvements.

Dropbox describes an in-house cookie auditor built with Playwright that simulates privacy-conscious visitors (US, EU, and Global Privacy Control signals) across 200+ web surfaces, verifying consent choices persist and only appropriate cookies load. The article argues browser automation was the easy part; most effort went into translating legal concepts into testable rules, maintaining a current URL inventory via traffic-data analysis, and separating real violations from false positives. Classifications live outside the code so privacy staff can update rules without engineering releases.

An empirical eval of 26 prompt conditions (TDD, fuzzing, property-based testing, formal methods, and testing skills) given to coding agents implementing Zstd in Rust, ~80 runs each. Nothing beat the default no-instructions baseline; agents apply techniques superficially—vacuous proofs, trivial random tests—while TDD and popular testing skills underperformed. A brief hand-written skill nudging risky-area checks and structured randomization scored best, suggesting expert guidance matters more than naming techniques.

The author argues that 'brain-off' LLM use—having agents write code and just relaying failures back (being a 'meat proxy')—still produces poor-quality software, failing on out-of-distribution problems and overfitting to tests or metrics. Even if it eventually yields good software, it won't benefit the employee, since a company could run the LLM loop without them and lay them off. He contends the present is the worst time to disengage, as companies are eager to cut low-contribution roles.

Cloudflare argues that mixed-use crawlers (Applebot, Bingbot, Googlebot) forced site owners to choose between search discoverability and refusing AI training. Its new Disallow AI Training setting publishes a robots.txt preference that 'Accountable' operators honor, keeping search while blocking training; Block now applies to mixed-use crawlers too, affecting search. Settings migrate automatically on September 15, with stricter presets for ad-funded sites. Cloudflare frames AI summaries, with only partial controls today, as the next unresolved tradeoff.

Cloudflare details four malicious JavaScript campaigns found on storefronts—affiliate-commission hijacking, clickless affiliate theft, a remote-code backdoor, and a paid-traffic cloaker—that VirusTotal and URLScan largely missed, arguing behavioral ML analysis beats signature scanning for gated, conditionally executing scripts. The detection pipeline combines a graph neural network, a lightweight LLM on Workers AI, and a weighted frontier-model voting ensemble with human review. It is a vendor post promoting Cloudflare Client-Side Security, so evidence is detailed but conclusions favor the product.

Cloudflare cut ~100TB of RAM from its Pingora Backend Router by attacking pingora-ketama's consistent-hashing rings on two fronts: packing the per-point struct from 8 bytes to 6 (25% savings, done via a raw byte array because Rust's alignment rules negate simply shrinking the index field), and reducing hashes per server by 90%, justified by a derived formula (CV_k = sqrt((N-1)/(Nk+1))) showing the last 90,000 of ~100,000 hashes bought only ~0.7% error reduction while 32-bit collisions actually made error worse at high hash counts. The tradeoffs are that fewer hashes raises the theoretical load-imbalance error margin, and changing the ring re-routes cacheable requests and would invalidate cached content, so both rings ran side by side per request and the rollout proceeded data-center by data-center to limit cache churn and blast radius.

The author ran a fully autonomous 'software factory' with GPT 6 Astra for 35 hours (~$1200, 79 commits, 75k lines of code) and got nothing usable. His core complaint is that the model's token-efficient 'codegolf' Python for tool calls leaks into committed code, producing unreadable and bizarre output, and that it won't stop on oversized tasks. He argues training rewards local metrics over human readability, and doubts these costlier models still fit day-to-day software engineering versus other use cases.