Techlist.io - Korean Tech Blog Curator

netflix·Mar 6, 2026·3 min readCurated summary

Scaling Global Storytelling: Modernizing Localization Analytics at Netflix

Netflix is modernizing its localization analytics to support more than 300 million members across 190+ countries and 50+ languages. Rapid growth created duplicated pipelines, inconsistent business logic, and siloed dashboards, making basic questions such as who produced a dub difficult to answer reliably. The company’s solution is to consolidate data foundations, improve usability, and centralize reusable business logic. ## The Challenge of Fragmented Localization Data - Localization metrics were historically built independently across different teams and workflows. - Determining who created a dub or subtitle required combining multiple sources with complex, frequently changing rules. - Duplicated logic led to: - Inconsistent reporting across tools - High maintenance costs when upstream systems changed - Siloed analytics and dashboards ## Auditing and Consolidating Analytics - Netflix audited more than 40 dashboards and tools for usage, quality, and code health. - The focus shifted from repeatedly fixing frontend visualizations to consolidating backend data pipelines. - Three legacy dashboards covering dubbing-partner operations, capacity, and finances are being unified around a shared data and backend layer. - This foundation can support multiple future frontend experiences instead of forcing each dashboard to maintain separate logic. ## Reducing User Experience Debt - Netflix defines “Not-So-Tech Debt” as stakeholder friction caused by confusing tools or weak analytical storytelling. - The Language Asset Consumption tool was redesigned to combine audio and text languages into a single consumption-language view. - This distinguishes: - Original-language viewing from localized consumption - Subtitle, dubbing, or combined preferences - Recurring member preferences for a given language - The result is more intuitive analysis aligned with real stakeholder questions. ## Centralizing Reusable Business Logic - Netflix is adopting a “write once, read many” architecture. - Shared tables, including a Language Asset Producer table, solve common questions in one centralized location. - The same trusted data can feed downstream domains such as Dub Quality and Translation Quality. - Updates to business rules propagate across the analytics ecosystem instead of requiring changes in multiple pipelines. ## Moving Toward Event-Level Analytics - Future work will analyze individual timed-text events rather than only complete language assets. - A generic model will capture details such as individual subtitle lines and reading speed. - Netflix plans to connect subtitle characteristics with member engagement. - These findings can improve style guidelines for subtitle linguists and ultimately enhance the localized viewing experience. Netflix’s recommendation is to treat analytics modernization as both a technical and product-quality effort: consolidate data foundations, centralize business logic, and design tools around how stakeholders actually make decisions. This creates more trustworthy reporting while enabling deeper analysis of how localization affects member enjoyment.

Read original(opens in new tab)

Database DesignPostgreSQLData ModelingData Pipelines+4

cloudflare·Mar 6, 2026·2 min readCurated summary

From the endpoint to the prompt: a unified data security vision in Cloudflare One

Cloudflare One presents data security as a unified problem spanning networks, SaaS applications, endpoints, and AI prompts. Its strategy is to follow data wherever it moves, combining visibility, policy controls, and enforcement rather than relying on siloed products. The latest updates extend this model from browser-based RDP clipboard controls to SaaS operation logging, endpoint DLP, and Microsoft 365 Copilot scanning. ### Browser-Based RDP Clipboard Controls - Administrators can control whether users copy or paste data between local devices and browser-based RDP sessions. - Policies can be directional and context-specific: - Allow copying into a remote session for productivity. - Block copying sensitive information out to unmanaged endpoints. - The feature is configured through Access Application Policies for browser-based RDP applications. - Granular controls aim to reduce risky workarounds such as screenshots, manual retyping, or use of unsanctioned tools. ### Operation-Level Visibility in SaaS Logs - Cloudflare’s operation-mapping process interprets HTTP request details as recognizable actions, such as `SendPrompt` in ChatGPT. - Related operations are grouped into higher-level Application Controls such as “Share” or “Upload.” - These mapped operations now appear automatically in log events for matching SaaS traffic. - Log details include both the application control and the specific operation, helping teams investigate activity and refine policies more quickly. ### Endpoint DLP for Data in Use - The Cloudflare One Client now provides Endpoint DLP enforcement, beginning with clipboard-based data movement. - This protects sensitive content after it leaves a browser or managed SaaS application and enters the operating system clipboard. - The feature addresses risks such as copying customer records or proprietary code into personal tools or unauthorized AI assistants. - Organizations can extend existing Gateway, DLP, CASB, and API-based controls without deploying a separate endpoint agent. ### Microsoft 365 Copilot Scanning - API CASB can now analyze Microsoft 365 Copilot activity for data-security risks. - Scanning covers Copilot chats and uploads that match configured DLP detection profiles. - Findings include contextual information such as referenced files, matching DLP profiles, and interaction metadata. - This extends Cloudflare’s existing API integrations for OpenAI ChatGPT, Anthropic Claude, and Google Gemini. Cloudflare’s recommendation is effectively to treat data movement as one continuous security problem: control access in transit, monitor activity in SaaS, enforce protections on endpoints, and inspect how data is used in AI prompts. Together, these capabilities are intended to keep policy attached to the data rather than limited to a particular application or product boundary.

Read original(opens in new tab)

Database DesignAi SecurityCloudflare OneSaas Security+4

line·Mar 6, 2026·3 min readCurated summary

On-Device Image Model Training for Mess

This post describes an on-device image captioning system for mobile messenger apps. Because autoregressive vision-language models took more than five seconds to generate captions, the team replaced them with a non-autoregressive decoder, reducing latency to roughly 200–400 ms. They then used LLM-based acceptance evaluation, caption re-generation, and multi-stage knowledge distillation to improve quality while keeping the model at 172 MB. ## Why Conventional Captioning Was Unsuitable - Models such as BLIP-2, MobileVLM, PaliGemma, and MiniCPM were too large or slow for mobile deployment. - BLIP-1 was selected as a practical baseline because of its smaller size and clear licensing, but still required more than five seconds after quantization. - Autoregressive decoding generates tokens sequentially, requiring one decoder pass per token. - On a Samsung Galaxy Fold 4, the initial model required about 142 ms per token, or approximately 2.8 seconds for 20 tokens. - Mobile UX required stable latency in the hundreds of milliseconds, including cold-start and variable-device conditions, so simple model compression was insufficient. ## Non-Autoregressive Caption Generation - The system predicts all caption tokens in parallel using a fixed set of learnable query tokens. - This changes the decoding cost from roughly O(T) for autoregressive generation to near O(1) through parallel processing. - The architecture consists of: - An image encoder reused from the previous system - Image embeddings injected as a prefix, following the ClipCap approach - A 66.4-million-parameter Transformer-based text decoder - Twenty learnable query tokens for short captions - Query-CTC loss addresses the alignment problem caused by predicting tokens simultaneously. - The resulting model generated captions in about 200 ms, achieving the required speed improvement. ## Speed Improved, but Caption Quality Declined - Standard metrics such as CIDEr and CLIPScore appeared acceptable. - Manual inspection revealed frequent: - Repeated words, such as “a desk with a computer on a desk” - Spelling errors, such as “a people ons” - Grammatical problems - Incomplete captions, such as “a” - These defects made the model unsuitable for direct use in a messaging product. ## LLM-Based Acceptance Evaluation - The team introduced an “accept ratio” based on GPT-4o mini judgments. - Captions were classified as either `accept` or `non-accept`. - The evaluation checked for: - Duplicate content - Errors - Clarity and grammatical correctness - This better reflected production usability than conventional image-captioning benchmarks. - The low acceptance rate confirmed that CIDEr and CLIPScore alone could not measure whether captions were appropriate for users. ## Data Quality and Knowledge Distillation - Analysis showed that the training data contained inconsistent and noisy captions: - A mixture of very short and overly long descriptions - Unnecessary OCR-like attempts to describe text in images - Uneven language quality - The smaller 66.4-million-parameter model also had less representational capacity than BLIP-1’s 110 million parameters. - Generating an entire sentence in one pass was especially difficult for the compact non-autoregressive model. - The training pipeline was redesigned as an iterative quality-improvement loop: - Train a baseline using the original data - Identify failures with LLM-based acceptance evaluation - Re-caption poor-quality training examples - Distill knowledge from a larger teacher model into the student model - Replace or refine rejected samples and repeat - Architectural scaling and metric optimization did not consistently improve acceptance rates, while re-captioning and knowledge distillation produced more meaningful gains. The practical recommendation is to design on-device captioning around the actual product experience: prioritize parallel decoding for latency, measure quality with production-oriented acceptance criteria, and use carefully curated data plus knowledge distillation to make compact models reliable.

Read original(opens in new tab)

Database DesignLarge Language ModelsKnowledge DistillationNon Autoregressive+3

line·Mar 6, 2026·4 min readCurated summary

On-Device Image Model

The post describes building an on-device image understanding system for messaging apps, with semantic image search as the first focus. Its central strategy was knowledge distillation: a multilingual student text encoder learned to reproduce the embedding space of a strong, English-only teacher model. This preserved most English retrieval quality while enabling Japanese, Traditional Chinese, Thai, and Korean search, achieving an average Recall@5 above 78%. ## Why Messaging Apps Need On-Device Image Understanding - Images are often treated simply as “a photo,” unlike text messages, which can support search, summaries, and notification previews. - Image understanding could improve: - Notifications: “Sent one photo” → “Sent a photo of a dog” - Search: queries such as “dog,” “puppy,” or “a cat inside a box” - Recommendations: automatic image classification and organization - Shared image-text embeddings allow semantically equivalent phrases—such as “dog,” “puppy,” and “개”—to retrieve the same images. ## Why the Model Had to Run On-Device - **Latency:** Network round trips make notifications and search less predictable and responsive. - **Privacy:** Sending photos, captions, or embeddings to a server increases privacy risks. - **Offline support:** The feature should work in subways, airplanes, roaming environments, and unstable networks. - **Mobile constraints:** The model needed to run on both Android and iOS with limited memory and compute resources. - The project targeted a model under **200 MB**, response times within a few hundred milliseconds including cold start, and LiteRT compatibility. ## Project Goals and Evaluation - The image search system needed to: - Retrieve images by semantic meaning rather than keyword matching. - Support English, Japanese, Traditional Chinese, Thai, and Korean. - A separate captioning system was designed to generate short, natural descriptions of roughly eight words or fewer. - Search quality was measured using: - Image-to-Text Recall@5 - Text-to-Image Recall@5 - Caption quality was evaluated with CIDEr, CLIPScore, and an LLM-based acceptance ratio designed to detect repetition, typos, and grammatical problems. ## Why Translation Was Not Enough The initial approach translated each query into English before using an English-only image-text model: ```text Query → Language detection → Translation → English text encoder → Embedding → Search ``` This approach introduced several problems: - **Quality loss:** Informal terms or short queries could be mistranslated. For example, “멍멍이” might be interpreted as “barking” instead of “dog.” - **Additional latency:** Translation adds a fixed cost before text encoding. - **Inconsistent results:** Translation quality varies by language pair and wording. - **Operational complexity:** Each additional language requires more models, updates, and failure handling. Training a multilingual image-text model from scratch would require substantial data and compute. Instead, the project retained the proven English image embedding space and expanded only the text encoder. ## Knowledge Distillation for Multilingual Search - The original English text encoder served as the frozen **teacher**. - A copied text encoder served as the trainable **student**. - English text was passed to the teacher, while corresponding multilingual text was passed to the student. - The student was trained to match the teacher’s embeddings using mean squared error (MSE). ```text teacher_embedding = teacher(English text) student_embedding = student(Multilingual text) loss = MSE(teacher_embedding, student_embedding) ``` The image encoder remained frozen so that the established image-text embedding space would not be disrupted. Important implementation considerations included: - Ensuring the tokenizer handled multilingual characters correctly. - Defining consistent case-insensitivity rules. - Balancing training samples across languages. - Matching training-time preprocessing and tokenization with mobile inference behavior. ## Retrieval Results - English performance declined slightly: - Image-to-Text Recall@5: **79.58% → 76.56%** - Text-to-Image Recall@5: **75.89% → 74.47%** - Multilingual performance improved from below **10% average Recall@5** to above **78%**, roughly a sevenfold improvement. - Japanese achieved **81.94%**, exceeding the original English model in the reported evaluation. - Traditional Chinese, Thai, and Korean also reached practically usable retrieval quality. The trade-off—slightly lower English performance in exchange for four additional languages—provided substantially greater overall product value. ## Converting the Model to LiteRT - LiteRT was selected because it officially supports both Android and iOS and provides mobile-oriented operators, quantization, and optimization tools. - Core ML was rejected because it is iOS-specific and introduced conversion and long-term cross-platform maintenance concerns. - Conversion required addressing unsupported PyTorch operators. - For example, LiteRT did not support `erf`, so the model’s implementation had to replace it with a compatible pseudo-`erf` operation. The resulting approach demonstrates that knowledge distillation can efficiently extend an existing English image-text model to multiple languages while preserving its on-device deployment advantages.

Read original(opens in new tab)

PytorchKnowledge DistillationLitertEmbedding Model+4

google·Mar 6, 2026·3 min readCurated summary

WAXAL: A large-scale open resource for African language speech technology

WAXAL is an open speech dataset designed to address the severe lack of technology resources for African languages. Covering 27 Sub-Saharan African languages spoken by more than 100 million people, it offers 1,846 hours of transcribed speech for ASR and over 565 hours of high-quality recordings for TTS under the permissive CC-BY-4.0 license. Built with African academic and community organizations, WAXAL aims to support inclusive speech systems while preserving and expanding access to the continent’s linguistic diversity. ## The Need for African-Language Speech Data - Voice assistants and transcription tools primarily support high-resource languages. - Hundreds of millions of African speakers remain underserved, despite Sub-Saharan Africa having more than 2,000 languages. - Limited training data makes it difficult to build accurate systems for tonal, morphologically complex, and code-switching languages. - WAXAL was developed beginning in 2021 to provide openly accessible resources for research and commercial innovation. ## WAXAL-ASR: Natural, Spontaneous Speech - Contains approximately 1,846 hours of transcribed audio. - Participants described image prompts across more than 50 topics rather than reading prepared scripts. - The method captured: - Natural linguistic variation - Tonal distinctions - Spontaneous speech patterns - Code-switching - Image-based elicitation produced more realistic speech data than conventional scripted recordings. ## WAXAL-TTS: High-Quality Voice Recordings - Includes more than 565 hours of phonetically balanced, high-fidelity audio. - Community members collaborated in pairs to create scripts of 10,000–20,000 words and alternate between reading and recording. - Some participants built custom studio boxes to improve recording quality. - Audio was segmented, aligned with transcripts, and reviewed for accuracy. - The clean recordings support natural-sounding synthetic voices and conversational systems. ## Supporting Full-Duplex Conversational Systems - The ASR data represents varied, real-world speech input. - The TTS data provides high-quality material for generating clear and natural speech. - Together, the datasets can support systems that both understand and respond using African languages. ## Community-Led Development - African universities and community organizations led the data collection, with guidance from Google Research. - Makerere University contributed data for nine languages. - The University of Ghana worked on eight languages, including image-prompted ASR collection. - Digital Umuganda and Addis Ababa University supported ASR collection for regional languages. - Media Trust, Loud n Clear, and the African Institute for Mathematical Sciences Senegal led studio-quality TTS recordings. - Partners retain ownership of the data while making it openly available under CC-BY-4.0. ## Research Enabled by the Project - A community-driven impaired-speech collection cookbook produced an open Akan dataset covering conditions such as cerebral palsy and stammering. - A separate project introduced a 5,000-hour corpus for five Ghanaian languages: Akan, Ewe, Dagbani, Dagaare, and Ikposo. - Benchmarking of Whisper, XLS-R, MMS, and W2v-BERT across 13 African languages showed that scaling benefits depend on linguistic complexity and domain alignment. - A literature review cataloged 74 datasets spanning 111 African languages and emphasized the need for conversational, multi-domain data and metrics such as Character Error Rate (CER). WAXAL provides a strong foundation for building more accurate and inclusive African-language speech technologies. Researchers and developers should use the openly licensed corpus, contribute derivative work, and help extend the collection to additional languages and communities.

Read original(opens in new tab)

Machine LearningData CollectionWaxalAsr+4

toss·Mar 6, 2026·3 min readCurated summary

Foreign User Research: Why

Toss investigated why many foreign users struggle to use Korea’s financial services, even after signing up. Research showed that confusing identity verification, name formatting, and address entry often prevented users from completing registration, forcing them to visit bank branches for routine tasks. By redesigning the name-entry and authentication process, Toss increased the foreign-user verification completion rate by about 15% and eliminated the gap with Korean users. ## Investigating Foreign Users’ Financial Experiences - Foreigners often perceive Korea’s banking system as complex and difficult to navigate without assistance. - Toss wanted to make its “finance for everyone” vision include foreign residents. - The team suspected that several verification steps caused users to abandon registration: - Preparing a foreigner registration card - Mismatches in telecom-provider information - One-won account verification - Difficulties entering names and personal details ## Field Research with Blue-Collar Workers - The team focused especially on blue-collar foreign workers, whose financial habits were less understood than those of students or white-collar workers. - Initial attempts to arrange factory interviews failed, so researchers visited the Siheung Industrial Complex during lunch hours. - Street interviews were difficult because formal clothing, identification badges, and consent documents made passersby cautious. - A more casual approach helped the team conduct several interviews. - Researchers later visited a multicultural center in Pocheon, where they met foreign residents from different countries and with varying lengths of stay. ## Why Foreign Users Rely on Bank Branches - Mobile banking often felt like a complicated system that users could access only after repeated trial and error. - Many users abandoned the process before reaching any financial-service features. ### Name Entry and Identity Verification - Users were unsure how to format their names: - Where to place spaces - Whether to enter family names first - Whether to match their foreigner registration card, bank account, or telecom records - A name such as “BRAD PITT” might need to be entered in an unexpected format, such as “BR AD.” - Some users repeatedly failed verification because their name format differed across institutions. - One participant had never successfully completed online identity verification under their own name in eight years. - Error messages rarely explained the actual cause of failure. - After five or more failed attempts, users could no longer continue. ### Address Entry - Entering Korean addresses was another major barrier, especially for users unfamiliar with typing Korean. - Users tried postal codes, English addresses, and lot numbers, then searched through address lists. - Search results often displayed too many options, making the correct address difficult to locate. - Repeated unsuccessful searches led some users to abandon registration and visit an offline branch instead. ## Improving the Authentication Funnel - Research identified name entry and authentication as the primary causes of foreign-user drop-off. - Toss’s product team redesigned the name-input structure and authentication flow. - The changes increased the foreign-user authentication completion rate by approximately 15%. - The completion-rate gap between Korean and foreign users was ultimately eliminated. Toss’s research demonstrates that inclusive financial services require understanding users who are often overlooked. Removing small but fundamental barriers in registration and authentication can make digital banking accessible to a much broader population.

Read original(opens in new tab)

Database DesignUser ExperienceUser ResearchMobile App+4

google·Mar 6, 2026·3 min readCurated summary

Where wild things roam: Identifying wildlife with SpeciesNet

SpeciesNet is an open-source AI tool that identifies wildlife in camera-trap images, making large-scale monitoring faster and more practical. Trained on more than 65 million labeled images, it can classify nearly 2,500 animal categories and process tens of thousands of images per day. Its adoption by researchers, governments, and conservation groups is expanding wildlife research and enabling more responsive conservation efforts. ## A New Era for Wildlife Monitoring - Motion-triggered camera traps generate enormous volumes of images, often far beyond what human teams can classify manually. - Automated identification helps researchers: - Track population health and changes. - Study migration and climate-related movement. - Estimate population sizes. - Detect rare or endangered species. - SpeciesNet uses deep learning to identify animals in camera-trap photos, accelerating analysis and improving wildlife-management decisions. - The tool is part of Google Earth AI, a collection of geospatial AI tools intended to support environmental and conservation work. ## SpeciesNet’s Training and Performance - SpeciesNet classifies 2,498 categories of mammals, birds, reptiles, and other animals. - It works with MegaDetector, another open-source model that identifies which images and pixels contain animals. - The system provides: - Species names. - Confidence scores. - Multiple identifications when several animals appear in one image. - Processing capacity is approximately: - 30,000 images per day on a standard laptop. - 250,000 or more images per day on a low-end gaming GPU. - SpeciesNet was trained on more than 65 million images from Wildlife Insights and public repositories. - On held-out camera-trap projects, it: - Detected animals in 99.4% of relevant images. - Reached species-level classification 83% of the time. - Produced correct species-level predictions in 94.5% of those cases. - Human-verified labels from Wildlife Insights can be reused as additional training data, creating a feedback loop for improving the model. ## Conservation Projects Using SpeciesNet - **Snapshot Serengeti:** Researchers can analyze roughly 11 million images collected since 2010 in just days, rather than relying exclusively on citizen scientists. Field processing also allows cameras to be redeployed based on recent sightings. - **Wildlife Observatory of Australia:** The organization trained a regional version of SpeciesNet to recognize Australian species missing from the original label set, including musky rat-kangaroos and orange-footed scrubfowl. - **Idaho Department of Fish and Game:** SpeciesNet serves as a first-pass classifier for images of deer, elk, black bears, coyotes, and other wildlife, speeding up human verification. - **Public and private platforms:** Tools including Animl and AddaxAI have integrated SpeciesNet, while companies such as Okala use it alongside Google’s Perch audio model to monitor biodiversity in Africa. - The model has also supported studies of pumas and ocelots in Colombia, cassowaries in Australia, and lions and elephants in Tanzania. SpeciesNet demonstrates how open-source AI can turn massive camera-trap datasets into usable scientific evidence. Its strongest role is as a scalable first-pass system combined with human review, while regional adaptations can extend its usefulness to local and threatened species.

Read original(opens in new tab)

Deep LearningData AnalysisGoogle CloudSpeciesnet+3

discord·Mar 6, 2026·2 min readCurated summary

Discord Patch Notes: March 6, 2026

Discord’s March 6, 2026 patch focuses on safer mentions, faster desktop startup, accessibility, and a broad collection of platform-specific bug fixes. Escaped `@everyone` and `@here` mentions are now correctly ignored by the backend, preventing accidental mass notifications. Discord also reports an 11.8% median improvement in desktop time-to-interactive after changing API payload ordering. ## Safer Mention Handling - Escaped mentions such as `\@everyone` previously appeared harmless in the client but could still notify roles when sent. - Backend handling now respects escape characters for `@everyone` and `@here`, ensuring these messages do not trigger mentions. - The change addresses cases where users received no warning before unintentionally notifying large server populations. ## Desktop Performance - Discord changed the order of API payloads sent to desktop clients. - The update reduced median launch time, or p50 time-to-interactive, by 11.8%. - The improvement builds on navigation performance work released the previous week. ## Accessibility Improvements - Discord completed a broad accessibility pass covering Quest, Events, Profiles, Activities, and Nitro surfaces. - The changes are intended to improve screen-reader navigation and usability across these areas. ## General and Platform Fixes - Non-Nitro users can once again forward messages containing large attachments from Nitro users. - iOS startup times after a full device restart were fixed; an asset request had been competing with the busy boot-time background queue. - Mobile animations no longer remain stuck mid-transition. - League of Legends game invites and Overlay “Join” invites were repaired. - Android fixes include the Forest theme gradient, duplicate server-invite information, modal layering, role colors, and server-onboarding alignment. - Search-result keyboard selection no longer remains stuck on the first item. - Desktop fixes address private-channel role setup, oversized hyperlinks, broken embeds, Quick Switcher shortcuts, tooltip links, and copying webhook URLs without confirmation. - Server administration fixes include role sorting, role-selector scrolling, onboarding dropdown positioning, audit-log deletion reasons, permission-panel alignment, and non-removable role controls. - iOS fixes restore back-swipe navigation, correct switch styling, reduce overly aggressive settings scrolling, and prevent the device from being kept awake unnecessarily. - Browser and mobile layout issues were corrected across server lists, profiles, Nitro Home, boost flows, and message controls. Discord recommends trying the iOS TestFlight build for early features and reporting remaining bugs through the community bug megathread. Fixes had been merged but could still be rolling out gradually across platforms.

Read original(opens in new tab)

DiscordAccessibilityAndroidiOS+3

github·Mar 5, 2026·3 min readCurated summary

60 million Copilot code reviews and counting

Copilot code review has grown tenfold since launch, surpassing 60 million reviews and accounting for more than one in five GitHub code reviews. GitHub argues that effective AI review is not about maximum coverage or comment volume, but about accurate, actionable feedback delivered quickly enough to support development. Its newer agentic architecture, informed by user feedback and continuous evaluation, is designed to improve context, reduce noise, and help teams merge with greater confidence. ## Redefining a “Good” Code Review - GitHub’s focus has shifted from exhaustive review coverage to high-signal feedback that helps pull requests move forward. - The system evaluates reviews across three dimensions: - **Accuracy:** Identifying consequential logic and maintainability problems. - **Signal:** Prioritizing useful findings over a high number of comments. - **Speed:** Providing a timely first pass while accepting some latency for deeper analysis. ## Measuring Accuracy - Copilot combines internal tests against known code issues with production data from real pull requests. - Key production indicators include: - Developer thumbs-up and thumbs-down reactions. - Whether flagged issues are fixed before the pull request is merged. - GitHub says these measures help distinguish useful scrutiny from feedback that merely slows development. ## Prioritizing Signal Over Volume - Copilot produces actionable feedback in 71% of reviews and remains silent in the other 29% when it finds nothing worth reporting. - It now averages approximately 5.1 comments per review without increasing review churn or lowering quality standards. - Examples of high-signal findings include missing React hook dependencies and retry loops that could run indefinitely when an API returns HTTP 429 without a `Retry-After` header. ## Trading Some Speed for Better Reasoning - GitHub treats latency as a deliberate trade-off: deeper analysis is preferable to fast but noisy feedback. - A recent switch to a more advanced reasoning model increased positive feedback by 6% while increasing review latency by 16%. - The team continues to optimize speed, but not at the expense of findings developers can trust. ## Agentic Architecture and Repository Context - The redesigned system retrieves context, explores repositories, and reasons about architecture and invariants instead of examining changes in isolation. - This architectural shift produced an initial 8.1% increase in positive feedback. - Improvements include: - Identifying issues during analysis rather than waiting until the end, reducing forgotten findings. - Retaining memory across reviews to recognize recurring patterns. - Creating explicit plans for long or complex pull requests. - Reading linked issues and pull requests to compare code against project requirements. ## Making Reviews Easier to Navigate - Multi-line comments attach feedback to logical code ranges, making problems and suggested fixes easier to understand. - Related comments are clustered into a single unit instead of cluttering the pull request timeline. - Batch autofixes allow developers to resolve entire classes of bugs or style issues at once. - More than 12,000 organizations automatically run Copilot code review on every pull request. Copilot code review is most valuable when treated as a trusted first-pass reviewer rather than a replacement for human judgment. Teams should favor configurations and workflows that maximize actionable findings, preserve developer context, and accept modest delays when they produce materially better reviews.

Read original(opens in new tab)

AI AgentsReactGithub CopilotCode Review+4

github·Mar 5, 2026·3 min readCurated summary

Scaling AI opportunity across the globe: Learnings from GitHub and Andela

GitHub and Andela argue that AI opportunity should not depend on geography or employer resources. Their AI Academy trained 3,000 engineers by embedding GitHub Copilot into real production work rather than isolated exercises. The approach improved developers’ ability to understand unfamiliar systems, work with legacy code, and focus more time on higher-value decisions—while preserving human review and accountability. ## Unequal Access to AI Skills - Developers across Africa, South America, and Southeast Asia have substantial technical talent but uneven access to: - Emerging AI tools - Mentorship and structured training - Reliable connectivity and high-performance computing - Affordable cloud services and data - Much existing training assumes constant internet access, well-resourced environments, and localized content. - Contract-based or informal work can leave developers with limited time and financial capacity for reskilling. - Without affordable access and regionally relevant learning communities, AI could deepen existing technology inequalities. ## Learning AI Within Production Work - Mid-career developers generally cannot leave live systems and deadlines to experiment with new tools. - Simply giving teams access to AI does not guarantee adoption; organizations also need: - Clear role and use-case definitions - Training tied to actual responsibilities - Updated review and quality standards - Andela selected developers whose work involved complex production systems and incorporated Copilot into: - IDE workflows - Pull request reviews - Refactoring and maintenance - This made training practical and exposed AI tools to legacy code, architectural complexity, and real production risks. ## Faster Orientation in Unfamiliar Systems - One of the first benefits was not raw code-generation speed but faster understanding of existing systems. - Developers used AI to: - Generate unit tests before changing legacy code - Reveal system behavior and architectural patterns - Draft refactors and clarify control flow - Sketch diagrams of system boundaries - Tests provided safer boundaries for modifying poorly covered legacy code. - AI suggestions still required cleanup and could introduce subtle errors, making disciplined review essential. ## Confidence and Productivity Gains - After several weeks, developers reported: - Faster onboarding - Greater confidence handling ambiguous work - Less time spent on setup and more on business and engineering decisions - Senior engineer Daniel Nascimento estimated that Copilot increased his productivity by about 50%. - The main value was not merely completing tasks faster, but freeing time to understand business needs and focus on meaningful impact. ## Practical Model for AI Adoption - AI training is most effective when it is: - Embedded in everyday development - Based on real systems and responsibilities - Supported by structured guidance - Evaluated through production-quality standards - Organizations should treat AI as a capability developed through practice, not as a standalone certification or experiment. The GitHub–Andela experience suggests that inclusive AI adoption requires more than tool access. Pairing affordable, structured training with real production work can help developers worldwide build confidence, improve productivity, and participate more fully in the AI-driven future.

Read original(opens in new tab)

AIReactGithub CopilotRefactoring+3

cloudflare·Mar 5, 2026·2 min readCurated summary

Ending the "silent drop": how Dynamic Path MTU Discovery makes the Cloudflare One Client more resilient

Cloudflare’s Dynamic Path MTU Discovery (PMTUD) helps prevent connections from silently failing when network paths cannot carry large encrypted packets. Using active probing through MASQUE and QUIC, the Cloudflare One Client determines the largest reliable packet size and adjusts its virtual interface accordingly. This makes applications more resilient across restrictive, changing networks without relying on ICMP error messages. ## The PMTUD Black Hole Problem - Networks have a maximum transmission unit (MTU), typically 1500 bytes on Ethernet. - Encryption and security metadata reduce the space available for application data. - LTE/5G, satellite, public safety, and other specialized networks may support smaller MTUs, such as 1300 bytes. - Routers should send ICMP messages when packets are too large, but firewalls and middleboxes often drop those messages. - The sender continues transmitting oversized packets, leaving uploads, video calls, SSH sessions, or other applications stuck until they time out. ## Active Path Discovery with MASQUE - Cloudflare implements RFC 8899 Datagram Packetization Layer PMTUD. - The Cloudflare One Client sends encrypted probes of different sizes to the Cloudflare edge. - By observing which probes arrive, it identifies the usable MTU without depending on blocked ICMP feedback. - Probing narrows the range from the supported maximum toward the precise path capacity. - The process runs in the background and is designed not to disrupt active connections. ## Adapting to Changing Networks - The client dynamically changes its virtual interface MTU based on the discovered path. - It periodically revalidates the path, allowing it to respond when users move between networks. - For example, a connection can transition from 1500-byte Wi-Fi to 1300-byte cellular connectivity without interrupting application sessions. ## Benefits for Critical and Everyday Connectivity - First responders can maintain stable CAD and other mission-critical connections across NAT layers, tower handoffs, and fluctuating signal conditions. - Hybrid workers benefit from fewer stalled transfers and more reliable video calls on hotel, cellular, and double-NAT networks. - The client hides much of the underlying network instability from applications. Cloudflare One Client users running the MASQUE protocol can use PMTUD on Windows, macOS, and Linux at no additional cost.

Read original(opens in new tab)

CloudflareNetworkingQuicEncryption+4

cloudflare·Mar 5, 2026·2 min readCurated summary

A QUICker SASE client: re-building Proxy Mode

Cloudflare rebuilt the Cloudflare One Client’s proxy mode to address performance problems caused by translating TCP traffic into IP packets through WireGuard. The new design uses HTTP/3 and QUIC streams for direct Layer 4 proxying, eliminating the smoltcp translation layer. Internal tests showed download and upload speeds doubling while latency decreased significantly. ## Limitations of the Original Proxy Architecture - Proxy mode exposed a local SOCKS5 or HTTP proxy for broad application compatibility. - WireGuard operates at Layer 3, while proxy traffic arrives as Layer 4 TCP streams. - The Client used the Rust-based `smoltcp` stack to convert TCP streams into IP packets. - Cloudflare’s edge then converted those packets back into TCP streams. - This added overhead, limited access to modern TCP features, and caused sluggish performance for media-heavy websites, large transfers, and video calls. ## Direct Layer 4 Proxying with QUIC - Cloudflare deprecated WireGuard for proxy mode and adopted QUIC-based transport. - HTTP/3’s `CONNECT` method encapsulates proxy traffic directly in QUIC streams rather than breaking it into Layer 3 packets. - The new architecture: - Removes the smoltcp translation layer. - Uses QUIC’s built-in congestion and flow control. - Allows the Client and Cloudflare edge to tune transport parameters for performance. - Testing showed approximately doubled upload and download speeds and substantially reduced latency. ## Use Cases That Benefit - **Third-party VPN coexistence:** Users can combine legacy VPNs for on-premises resources with zero trust web security without imposing as much performance loss. - **Application partitioning:** Specific browser traffic can be routed through Cloudflare Gateway while other operating-system traffic remains on the local network. - **High-bandwidth workloads:** Streaming, large dataset transfers, and other data-intensive applications receive faster proxy connections. - **Developer and CLI workflows:** Tools using the SOCKS5 listener benefit from lower-latency API calls and data transfers. ## Availability and Configuration - The improvement requires Cloudflare One Client version `2025.8.779.0` or later on Windows, macOS, or Linux. - In the Cloudflare One dashboard: - Go to **Teams & Resources > Devices > Device profiles > General profiles**. - Set **Service mode** to **Local proxy mode**. - Set **Device tunnel protocol** to **MASQUE**. - Verify the active protocol with: ```bash warp-cli settings | grep protocol ``` Organizations using proxy mode should upgrade the client and switch to MASQUE to gain the new QUIC-based performance improvements.

Read original(opens in new tab)

CloudflareSaseQuicHttp3+4

cloudflare·Mar 5, 2026·2 min readCurated summary

How Automatic Return Routing solves IP overlap

Cloudflare’s Automatic Return Routing (ARR) addresses overlapping private IP ranges by routing return traffic based on the tunnel that initiated a connection, rather than relying solely on destination IPs. This allows identical networks to coexist without NAT, VRFs, or manually maintained route mappings. ARR is being introduced as an optional Closed Beta capability for Cloudflare One customers. ## The Ambiguity of Overlapping Private Networks - Public Internet routing assumes each IP address identifies one logically unique destination. - Private networks often reuse the same ranges, such as `10.0.1.0/24`, creating ambiguity when connected through Cloudflare. - Common causes include: - Mergers and acquisitions involving duplicate internal addressing. - Extranets connecting partners or vendors with conflicting IP schemes. - Repeated “cookie-cutter” architectures across branches or customer deployments. - If two sites use the same source IP, return traffic cannot be distinguished by a conventional routing table and may be sent to the wrong site. ## Limitations of Traditional Solutions - **Virtual Routing and Forwarding (VRF):** - Separates overlapping networks with independent routing tables. - Adds operational overhead. - Route leaking between VRFs becomes complex and brittle at scale. - **Network Address Translation (NAT):** - Maps overlapping ranges to unique managed addresses. - Works reliably but requires administrative mappings for every site or partner. - Cloudflare designed ARR to eliminate this per-site configuration for common use cases such as Internet and private data center access. ## How Automatic Return Routing Works - ARR replaces ambiguous route-based decisions with stateful flow tracking. - When a packet begins a flow, Cloudflare records the specific connection or tunnel that delivered it. - Supported originating connections include: - IPsec tunnels - GRE tunnels - Network Interconnects - For subsequent packets, Cloudflare checks whether they match an existing flow. - Existing flows reuse their stored forwarding decisions instead of being evaluated from scratch. - New flows are processed through the relevant Cloudflare One components—such as Gateway, DLP, and Firewall—and ARR records the initiating tunnel. - Return traffic is then sent back through that same tunnel, answering “where did this conversation originate?” rather than “which network owns this IP?” ## Practical Implication ARR enables overlapping private networks to communicate through Cloudflare One without NAT or complex VRF designs. It is intended as a zero-touch approach to reducing routing administration, and is available initially in Closed Beta.

Read original(opens in new tab)

Cloudflare OneAutomatic Return RoutingStateful TrackingNetwork Address Translation+4

gitlab·Mar 5, 2026·3 min readCurated summary

A complete guide to GitLab Container Scanning

GitLab provides multiple container-scanning methods to detect vulnerabilities throughout the container lifecycle, from CI builds to registry monitoring. The guide emphasizes scanning early to identify risks in base images, operating-system packages, and application dependencies before they reach production. It covers pipeline-based scanning in detail and introduces registry scanning for continuously monitoring published images. ## Why Container Scanning Matters - Container vulnerabilities can arise during image creation or while containers are running in production. - Base images, OS packages, and application dependencies may contain exploitable flaws. - Scanning supports a shift-left security strategy by detecting issues before deployment. - Container scanning is part of Software Composition Analysis (SCA), helping teams understand and secure external dependencies. ## Pipeline-Based Container Scanning Pipeline-based scanning analyzes container images during CI/CD execution. - **Purpose:** Detect vulnerabilities before deployment and help prevent unsafe images from reaching production. - **Scanner:** GitLab uses Trivy to identify known vulnerabilities. - **Availability:** Free, Premium, and Ultimate tiers, with additional features in Ultimate. - **Automatic setup:** Use **Secure > Security configuration** and configure Container Scanning through a generated merge request. - **Manual setup:** Include the following template in `.gitlab-ci.yml`: ```yaml include: - template: Jobs/Container-Scanning.gitlab-ci.yml ``` ### Common Configuration Options - Scan a specific image by overriding `CS_IMAGE`: ```yaml include: - template: Jobs/Container-Scanning.gitlab-ci.yml container_scanning: variables: CS_IMAGE: myregistry.com/myapp:latest ``` - Restrict findings to a severity threshold with `CS_SEVERITY_THRESHOLD`: ```yaml container_scanning: variables: CS_SEVERITY_THRESHOLD: "HIGH" ``` This example reports only High and Critical vulnerabilities. ### Merge Request Integration - Findings appear in the merge request’s **Security Scanning** section. - Developers can review newly introduced and existing vulnerabilities during code review. - Each finding includes severity, affected packages, and remediation guidance. - This integrates container security into the development workflow instead of treating it as a separate post-deployment gate. ### Vulnerability Report The centralized Vulnerability Report is available under **Security & Compliance > Vulnerability Report**. - Aggregates container vulnerabilities across project branches. - Supports filtering by severity, status, scanner type, and container image. - Vulnerabilities can be assigned to team members and marked as detected, confirmed, resolved, or dismissed. - Teams can add comments and link related issues to track remediation. - Details show the affected images and layers, helping identify the source of a vulnerability. ### Dependency List and SBOM GitLab’s Dependency List provides a software bill of materials for container images. - Lists packages, libraries, and dependencies detected by Container Scanning. - Shows both base operating-system packages and application dependencies. - Supports filtering by package manager, license type, and vulnerability status. - Connects dependencies with their vulnerabilities for security and compliance analysis. ## Container Scanning for the Registry Registry scanning automatically analyzes images pushed to GitLab’s Container Registry with the `latest` tag. - **Purpose:** Continuously monitor registry images without requiring manual pipeline triggers. - **Availability:** Ultimate tier only. - **Trigger:** GitLab’s security policy bot scans `latest` images against the default branch. - **Continuous monitoring:** Works with Continuous Vulnerability Scanning to detect newly disclosed vulnerabilities. ### Enabling Registry Scanning - Go to **Secure > Security configuration**. - Find **Container Scanning for Registry**. - Toggle the feature on. ### Prerequisites - The user must have the Maintainer role or higher. - The project must contain at least one commit on its default branch. - Container Registry notifications must be configured. - The Package Metadata Database must be configured; it is enabled by default on GitLab.com. GitLab’s scanning options support both preventive CI/CD checks and ongoing registry monitoring. Teams should use pipeline-based scanning to catch vulnerabilities before deployment and registry scanning when they need continuous visibility into published images.

Read original(opens in new tab)

CI/CDGitlabSecurityTrivy+3

gitlab·Mar 5, 2026·3 min readCurated summary

Extend GitLab Duo Agent Platform: Connect any tool with MCP

GitLab Duo Agent Platform can connect to Jira and other MCP-compatible tools, allowing developers to manage project data through natural-language requests inside their IDE. The post explains how to configure Atlassian OAuth, register Jira as an MCP server, and verify the connection in GitLab and VS Code. It concludes with practical workflows for backlog planning and creating or triaging issues directly from code context. ## MCP Architecture - GitLab Duo Agent Platform operates as the MCP client. - The Atlassian MCP server: - Authenticates users - Converts natural-language requests into Jira API calls - Returns structured results to GitLab Duo - Maintains security and audit controls - This integration reduces context switching between Jira, GitLab, and the IDE. ## Configure the Jira OAuth Application - Create an OAuth 2.0 integration in the Atlassian Developer Console. - Add Jira API permissions: - `read:jira-work` for issues, projects, and boards - `write:jira-work` for creating and updating issues - `read:jira-user` for user information - Configure the callback URL: - `https://gitlab.com/oauth/callback` - Copy the generated Client ID and Client Secret and store them securely. ## Configure GitLab Duo MCP - Create `.gitlab/duo/mcp.json` in the GitLab project. - Register the Atlassian MCP endpoint at: `https://mcp.atlassian.com/v1/mcp` - Configure OAuth authorization and token URLs: - `https://auth.atlassian.com/oauth/authorize` - `https://auth.atlassian.com/oauth/token` - Replace the placeholder credentials with the Jira OAuth values. - Enable **Allow external MCP tools** under **Group Settings → GitLab Duo → Configuration**. ## Verify the Connection - Ask GitLab Duo: - “What MCP tools do you have access to?” - “Test the MCP JIRA configuration in this project” - Approve access on the Atlassian MCP website and select the relevant Jira instance. - Use **GitLab: Show MCP Dashboard** from the VS Code or VSCodium Command Palette to inspect: - MCP server connection status - Available tools such as `jira_get_issue` and `jira_create_issue` - Real-time server logs and tool calls ## Planning and Backlog Prioritization - Query Jira from the GitLab Duo chat without leaving the IDE. - Find unassigned issues in a project. - Ask the assistant to: - Recommend the top issues to prioritize - Summarize their context - Assign selected issues to the current user - This supports sprint planning by combining Jira data with AI-generated prioritization. ## Issue Triage and Creation from Code - Developers can investigate bugs while reviewing code and interact with Jira conversationally. - Example workflows include: - Searching for an existing bug related to a code-level error - Creating a Jira issue if no matching ticket exists - Including relevant code context in the issue - Identifying possible blockers - Linking the issue to the current branch The integration is most useful when teams want Jira actions, planning, and issue management available directly within their development environment. Teams should configure OAuth scopes carefully, protect client credentials, and use the MCP Dashboard to monitor connections and tool activity.

Read original(opens in new tab)

Machine LearningModel Context ProtocolAutomationNatural Language Processing+4