Techlist.io - Korean Tech Blog Curator

cloudflareFeb 20, 20263 min readCurated summary

Code Mode: give agents an entire API in 1,000 tokens

Code Mode addresses a central MCP problem: giving agents broad tool access without overwhelming their context windows. Instead of exposing thousands of individually described tools, it provides a typed SDK and lets agents write sandboxed JavaScript to search specifications and execute API calls. Cloudflare’s new MCP server applies this approach to its entire API using only `search()` and `execute()`, reducing context usage by 99.9% to roughly 1,000 tokens. ## The Context-Window Problem - MCP makes external tools available to AI agents, but each tool’s description consumes model context. - Large APIs can require enormous token budgets merely to describe their endpoints. - A conventional MCP server for the Cloudflare API would consume approximately 1.17 million tokens. - This can exceed the context window of even advanced foundation models. ## Code Mode as a Compact API Interface - Agents write code against a typed SDK rather than selecting from thousands of separate tools. - Generated code serves as a compact, composable plan. - Agents can: - Explore available operations. - Chain multiple API calls. - Handle pagination and errors. - Return only the data needed for the task. - The tool footprint remains fixed as the underlying API grows. ## Cloudflare’s Two-Tool MCP Server - The server exposes only: - `search()` — searches the Cloudflare OpenAPI specification. - `execute()` — runs JavaScript against the Cloudflare API. - The full OpenAPI specification stays outside the model context. - `$refs` are pre-resolved, allowing agents to inspect endpoint metadata directly through code. - Agents can filter endpoints by product, path, tags, or other metadata. ## Sandboxed Execution - Both tools execute code inside a Dynamic Worker isolate based on lightweight V8 sandboxes. - The environment has: - No filesystem access. - No environment variables exposed to generated code. - External fetches disabled by default. - Outbound requests can be explicitly enabled through controlled fetch handlers. ## Example: Finding DDoS Protection Endpoints - For a request to protect an origin from DDoS attacks, an agent can first consult documentation or skills. - It then uses `search()` to inspect the OpenAPI specification. - A JavaScript query can locate zone endpoints related to WAF and rulesets. - The search narrows more than 2,500 Cloudflare endpoints to relevant operations such as: - Listing and updating WAF packages and rules. - Listing and creating zone rulesets. - Reading and updating entry-point rulesets. - Creating and updating rules within a ruleset. - Once the relevant endpoints are identified, `execute()` can perform coordinated API requests in one sandboxed run. ## SDK Availability - Cloudflare is open-sourcing a Code Mode SDK as part of the Cloudflare Agents SDK. - The same pattern can be used to build more context-efficient MCP servers and AI agents. Code Mode is most useful for large, evolving APIs: expose a small, stable tool surface, let agents discover capabilities programmatically, and execute only the focused operations required for each task.

Read original

AI Agents Model Context Protocol JavaScript Cloudflare Workers+3

gitlabFeb 20, 2026Original article

GitLab extends Omnibus package signing key expiration to 2028 (opens in new tab)

GitLab has extended the expiration of its GNU Privacy Guard (GPG) key used for signing Omnibus packages from February 2026 to February 16, 2028. This extension ensures the continued integrity of packages created within CI pipelines while remaining compliant with GitLab’s internal security policies regarding key exposure. By opting to extend the current key rather than rotating to a new one, GitLab aims to minimize administrative overhead for users who would otherwise be required to replace their trusted keys. ### Purpose and Scope of the Key Extension * The GPG key is specifically dedicated to signing Omnibus packages to prevent tampering; it is distinct from the keys used for repository metadata (apt/yum) and the GitLab Runner. * GitLab periodically extends the expiration of these keys to limit the potential impact of a compromise while adhering to modern security standards. * The decision to extend rather than rotate was made specifically to be less disruptive to the user base, as rotation mandates a manual replacement of the trusted key on all client systems. ### Impact and Required Actions * Users who do not specifically verify package signatures or have not configured their package managers to do so require no action to continue installing updates. * Administrators who validate Omnibus package signatures must update their local copies of the public key to reflect the 2028 expiration date. * The updated key can be found on GPG keyservers by searching for the ID `98BF DB87 FCF1 0076 416C 1E0B AD99 7ACC 82DD 593D` or the email `packages@gitlab.com`. * A direct download of the public key is also available through the official GitLab packages repository URL. Organizations that verify package signatures should refresh their trusted GPG keys as soon as possible to ensure seamless updates leading up to the original 2026 deadline. If technical issues arise during the update process, GitLab recommends opening an issue in the omnibus-gitlab tracker for support.

Gitlab DevSecOps Gpg Apt+3

grammarlyFeb 19, 2026Original article

10 Best AI Assistants: Top Tools for Work, Writing, and Everyday Tasks (opens in new tab)

Modern AI assistants have evolved from general-purpose chatbots into specialized productivity tools that leverage Natural Language Processing (NLP) and Large Language Models (LLMs) to automate complex workflows. By selecting an assistant based on specific task relevance, integration depth, and technical capabilities like context window size, users can significantly reduce manual effort and context switching. Ultimately, the most effective tools are those that proactively support "in-flow" work rather than requiring users to step away from their primary applications. ### Technical Foundations of AI Assistants * Assistants use NLP to interpret the intent and tone behind everyday language, moving beyond the rigid menu-based structures of traditional software. * Responses are generated by LLMs trained on massive datasets, allowing the tools to recognize linguistic patterns and provide natural-sounding outputs. * Functionality is typically driven by prompts—typed or spoken requests—that allow the AI to summarize documents, refine messaging, or brainstorm project outlines. ### Evaluation Criteria for Professional Use * **Context Awareness:** This refers to the "context window," or the amount of information an AI can hold in its active memory; larger windows allow for the analysis of entire documents or long-term conversation history. * **Proactivity versus On-demand:** Some tools wait for a specific prompt, while others are "proactive," surfacing suggestions and refinements automatically as the user works. * **Integration Ecosystem:** High-value assistants operate as extensions within browsers (Chrome, Edge) or directly inside 100+ third-party apps to pull in relevant background info without manual data entry. * **Accuracy and Verification:** For research-heavy tasks, the best tools offer citations and references to mitigate the risk of "hallucinations" or incorrect data common in LLMs. * **Privacy and Security:** Professional-grade tools provide transparent data handling and storage policies, which is essential for teams managing sensitive information. ### Specialized Assistants and Use Cases * **Go:** A communication-focused assistant that works proactively within existing workflows to draft emails and improve clarity in real-time. * **ChatGPT:** A versatile, general-purpose tool best suited for technical problem-solving, coding support, and creative ideation, though it often requires manual context switching. * **Claude AI:** Optimized for high-volume text processing, making it the preferred choice for deep document analysis and complex, long-form revisions. To achieve the best results, users should audit their daily app usage and primary tasks—such as scheduling, coding, or drafting—before committing to a platform. Prioritizing an assistant that integrates directly into your most-used software will yield the highest productivity gains by eliminating the friction of copying and pasting data between windows.

Large Language Models Machine Learning Natural Language Processing Data Privacy+2

githubFeb 19, 20263 min readCurated summary

How AI is reshaping developer choice (and Octoverse data proves it)

AI is reshaping software development not only by increasing coding speed, but also by changing which languages and tools developers choose. Octoverse 2025 shows this shift clearly: TypeScript became GitHub’s most-used language in August 2025, overtaking Python and JavaScript. The article argues that AI reduces the friction of complex technologies, while teams must establish strong architectural and testing practices to prevent faster development from producing faster degradation. ## The Convenience Loop Changes Developer Behavior - Developers form associations between convenience and particular technologies, much like sensory cues can trigger strong memories. - Eighty percent of new GitHub developers use Copilot within their first week, establishing AI-assisted development as their baseline experience. - When AI handles boilerplate and difficult syntax, developers become more willing to use powerful but traditionally costly tools. - Recent adoption figures reflect this change: - TypeScript grew 66% year over year. - JavaScript grew 24%. - Shell scripting in AI-generated projects increased 206%. - The rise in shell usage suggests developers are choosing tools based on suitability rather than avoiding them because of friction. ## Why Strong Typing Helps AI-Generated Code - Strongly typed languages provide clearer constraints for AI models. - A TypeScript declaration such as `x: string` rules out invalid operations that would remain possible in JavaScript. - These constraints help AI produce more reliable and contextually appropriate code. - More than 1.1 million public repositories now use LLM SDKs, showing that AI integration has become mainstream. - Adoption is concentrating around languages and frameworks that work effectively with AI-assisted workflows. ## Moving Faster Without Damaging Architecture ### Guidance for Developers and Teams - Establish coding patterns before generating large amounts of code; AI follows clear existing structures better than it invents them. - Use type systems as guardrails, not as proof that business logic is correct. - Test AI-generated code rigorously, even when it appears correct or passes initial checks. ### Guidance for Engineering Leaders - AI-assisted development can increase throughput by roughly 20–30%, but architectural drift can accumulate just as quickly. - Standardize practices before scaling AI adoption through documentation, template repositories, and explicit architectural decisions. - Monitor the nature and quality of generated code, not only productivity or acceptance rates. - GitHub’s Copilot usage metrics dashboard tracks active users, agent adoption, lines added and deleted, language and model usage, and other organizational patterns. - Teams can use these metrics to identify defect-prone languages, models, or workflows and target training or stricter review processes. - Greater developer productivity increases the importance of senior engineering capacity for architectural review. AI makes more technologies accessible and is actively influencing the future popularity of languages and frameworks. Organizations should embrace the productivity gains while pairing them with standardized patterns, strong type systems, rigorous testing, and continuous architectural oversight.

Read original

TypeScript Python JavaScript Github Copilot+4

spotifyFeb 19, 20263 min readCurated summary

Congratulations to the recipients of the 2025 Spotify FOSS Fund | Spotify Engineering

Spotify’s 2025 FOSS Fund provided €30,000 to FFmpeg, €15,000 to Mock Service Worker (MSW), and support to the Xiph.Org Foundation. The grants recognize both large, foundational projects and smaller efforts maintained by individuals, emphasizing that Spotify’s technology depends on volunteer-driven open source. Maintainers describe the funds as valuable for development, infrastructure, contributor support, and long-term sustainability. ## Spotify’s FOSS Fund - Established in 2022 to support open source projects that Spotify relies on and its developers value. - The 2025 recipients were: - FFmpeg - Mock Service Worker (MSW) - Xiph.Org Foundation - FFmpeg and Xiph.Org support technologies fundamental to streaming, while MSW is primarily maintained by its creator. - Despite differences in scale, all three projects depend heavily on volunteer contributions. ## FFmpeg: €30,000 - FFmpeg has been actively developed for more than 25 years and supports: - Multimedia encoding and decoding - Transcoding - Muxing and demuxing - Filtering - Streaming and playback - Its goal is to play every multimedia file ever created, making it widely used by hobbyists and companies such as YouTube, Netflix, X, and Spotify. - Maintainer Kieran Kunhya said the project is written almost entirely by volunteers. - The funding will support: - Hardware purchases - Conference travel - Development projects - FFmpeg’s maintainers argue that company donations also raise awareness of the project’s importance and demonstrate responsibility toward critical dependencies. - They identify reliable, long-term funding and dedicated company developers as major unmet needs in open source sustainability. ## Mock Service Worker: €15,000 - MSW is a JavaScript library for API mocking used by Spotify for unit testing and across its web stack. - Creator Artem Zakharchenko is the project’s sole full-time maintainer, supported by a small group of active contributors. - Major 2025 improvements included: - A new Interceptors architecture - Custom mock agents operating at the Node.js `node:net` level - First-class Server-Sent Events support - Planned work for 2026 includes: - A redesigned internal architecture - A new approach to request interception - Remote request interception, a technically difficult feature under development for several years - The previous Spotify grant primarily helped Artem support himself while working full time on open source. - The new funding will directly support continued MSW development and efforts to make external contributions more financially sustainable. - Artem notes that many contributors have been reluctant to accept payment, creating an ongoing challenge in building a sustainable maintainer and contributor community. ## Xiph.Org Foundation - The post identifies the Xiph.Org Foundation as a 2025 recipient and groups it with FFmpeg as a project representing technology fundamental to streaming. - The provided text does not include further details about the foundation’s grant amount, projects, or maintainer comments. Spotify’s grants illustrate how companies can support both major infrastructure projects and individual maintainers. Recurring funding, paid development time, contributor compensation, and practical resources such as hardware and conference travel remain important to the long-term health of open source.

Read original

TypeScript JavaScript Unit Testing Streaming+4

gitlabFeb 19, 2026Original article

Track vulnerability remediation with the updated GitLab Security Dashboard (opens in new tab)

The updated GitLab Security Dashboard addresses the challenge of vulnerability overload by shifting the focus from simple detection to contextual remediation and risk management. By providing integrated trend tracking and sophisticated risk scoring, the platform enables security and development teams to prioritize high-risk projects and measure the actual progress of their security programs. This update transforms raw security data into actionable insights that are tracked directly within the existing DevSecOps workflow. ## Transitioning from Detection to Remediation Context * Consolidates vulnerability data into a single view that spans across projects, groups, and entire business units to eliminate data silos. * Introduced initial time-based tracking in version 18.6, with version 18.9 adding expanded filters for severity, status, scanner type, and project. * Provides visualizations for remediation velocity and vulnerability age distribution, moving beyond static raw counts to show how quickly threats are being addressed. ## Data-Driven Prioritization with Risk Scoring * Utilizes a dynamic risk score calculated from multiple factors, including vulnerability age and repository security postures. * Integrates external threat intelligence such as the Exploit Prediction Scoring System (EPSS) and Known Exploited Vulnerability (KEV) scores to identify the most critical threats. * Allows teams to monitor risk scores over time to pinpoint specific areas of the infrastructure that require additional resources or immediate intervention. ## Strategic Impact for Security and Development Teams * Enables security leaders to prove program effectiveness to executives by showing downward trends in Common Weakness Enumeration (CWE) types and shrinking backlogs. * Streamlines the developer experience by highlighting critical vulnerabilities within active projects, removing the need for external spreadsheets or manual reporting tools. * Identifies specific teams or departments that may require additional remediation training based on their ability to meet company security policies. Organizations should leverage these updated dashboard features to transition from manual, reactive security tracking to an automated, risk-based posture. By integrating EPSS and KEV data into daily workflows, teams can ensure they are solving the most dangerous vulnerabilities first while maintaining a clear, measurable record of their security improvements.

Gitlab DevSecOps Vulnerability Management Data Visualization+3

spotifyFeb 19, 20263 min readCurated summary

Why We Use Separate Tech Stacks for Personalization and Experimentation | Spotify Engineering

Personalization and experimentation overlap, especially with contextual bandits, but they serve different purposes. Personalization chooses the best experience for each user, while experimentation evaluates whether a system or product change improves outcomes overall. Spotify therefore keeps personalization in its ML stack and uses its experimentation platform, Confidence, to measure the impact of those systems. ## What Personalization Does - Personalization adapts products to individual users instead of optimizing for an “average” user. - Spotify uses it for: - Personalized playlists and discovery recommendations - Search results based on listening and search history - Home-screen shortcuts tailored to user behavior - Recommendation systems use models ranging from regression and random forests to neural networks, LLMs, and reinforcement learning. - These systems combine user characteristics, historical behavior, and real-time context to select recommendations and improve them from user responses. ## Where Experimentation and Personalization Overlap - Traditional A/B tests randomly assign users to variants and identify the best option on average. - Multi-armed bandits adapt traffic allocation, sending more users to better-performing treatments. - Contextual bandits use user features to select different treatments for different users. - This creates a conceptual transition: - A/B tests seek the best average treatment. - Multi-armed bandits efficiently find the best average treatment. - Contextual bandits seek the best treatment for each user or context. - Once contextual information determines treatment assignment, the goal is no longer simply measuring one variant’s average effect. - The relevant comparison becomes the value of the personalization system versus a static treatment or an earlier personalization system. ## Why Contextual Bandits Are Not Experimentation Platforms - A contextual bandit can personalize a checkout button based on factors such as cart contents, age, and location. - The bandit is itself a product feature or recommendation system, not the experiment used to evaluate it. - Teams still need experiments to compare different versions of the bandit and determine whether personalization improves user outcomes. - Measuring average or conditional treatment effects may be less important than evaluating the overall benefit of the personalization system. ## Why Spotify Separates the Stacks - Personalization systems require specialized ML infrastructure for: - Training diverse model types - Managing rich feature sets - Serving models with low latency - Collecting real-time data - Computing recommendations at request time - Putting these capabilities into experimentation tools would either greatly expand their scope or limit the sophistication of personalization. - Combining unrelated responsibilities can create technical debt and operational complexity. - Spotify’s ML platform standardizes the development and deployment of personalization systems. - Its experimentation platform, Confidence, evaluates those systems alongside thousands of other product experiments. ## How the Systems Work Together - Personalization algorithms, including contextual bandits, remain in the ML stack. - The experimentation stack treats a personalization system as a treatment to be evaluated. - This separation lets teams improve recommendation logic independently while using controlled experiments to measure its product impact. - It also avoids confusing dependencies that arise when a bandit is both the experiment mechanism and the system being evaluated. Spotify’s approach is to separate building personalized experiences from measuring their effectiveness. Teams should use ML infrastructure for model development and real-time decision-making, then use an experimentation platform to compare personalization systems and quantify their impact.

Read original

Machine Learning Recommendation Systems Reinforcement Learning Ab Testing+4

gitlabFeb 19, 2026Original article

GitLab Threat Intelligence Team reveals North Korean tradecraft (opens in new tab)

The GitLab Threat Intelligence Team has detailed its efforts to disrupt North Korean (DPRK) cyber campaigns, specifically focusing on "Contagious Interview" malware distribution and fraudulent IT worker schemes. By analyzing internal platform data, GitLab identified that these state-sponsored actors leverage legitimate tools and fake recruitment scenarios to compromise software developers and generate illicit revenue for the regime. The report concludes that while these operations are sophisticated and persistent, proactive monitoring and cross-industry intelligence sharing are essential to mitigating these evolving threats. ### Contagious Interview Mechanics * Threat actors pose as recruiters to trick software developers into executing malicious JavaScript projects under the guise of technical interviews. * The primary goal is to deploy malware families such as BeaverTail and Ottercookie, which facilitate credential theft and provide remote control of the victim's device. * A notable evolution in tradecraft includes the use of "ClickFix," a compiled BeaverTail variant identified in late 2025. * Malicious repositories often use a specific execution pattern where base64-encoded URLs and secret headers are hidden within `.env` files, masquerading as benign configuration variables. * To execute the payload, actors utilize `Function.constructor` to load strings as executable code, often triggered by custom error handlers designed to source remote content. ### 2025 Campaign Trends and Infrastructure * GitLab banned 131 unique accounts linked to these campaigns in 2025, with activity peaking in September and averaging 11 bans per month. * Nearly 90% of malicious accounts were created using Gmail addresses, and actors typically accessed the platform through consumer VPNs or dedicated VPS infrastructure. * In more than 80% of cases, malware payloads were not stored on GitLab. Instead, actors used concealed loaders to fetch content from legitimate hosting services, most commonly Vercel. * Recent tactics include the creation of malicious NPM dependencies immediately before use and the exploitation of VS Code tasks to pipe remote content into native shells. ### IT Worker Campaigns and Sanctions Evasion * Beyond malware distribution, DPRK actors use GitLab to support "IT worker" cells that generate revenue and evade international sanctions. * One identified pipeline involved the creation of at least 135 synthetic identities, automated to generate professional connections and contact leads at scale. * Threat actors have been observed adding their own images to stolen U.S. identity documents to bypass employment verification processes. * Forensic analysis revealed financial records from cell managers detailing revenue proceeds from 2022 through 2025, often earned while operating from locations like Moscow, Russia. Organizations should remain vigilant against recruitment-themed social engineering and scrutinize unexpected requests to run external code. GitLab recommends that the security community use the provided indicators of compromise to update defensive posture, as these actors continue to refine their ability to hide malicious intent within legitimate development workflows.

Database Design Gitlab JavaScript Npm+3

gitlabFeb 19, 2026Original article

Agentic AI, enterprise control: Self-hosted Duo Agent Platform and BYOM (opens in new tab)

GitLab 18.9 introduces critical updates designed to provide regulated enterprises with governed, agentic AI capabilities through self-hosted infrastructure and model flexibility. By combining the Duo Agent Platform with Bring Your Own Model (BYOM) support, organizations in sectors like finance and government can now automate complex DevSecOps workflows while maintaining total control over data residency. This release transforms GitLab into a high-security AI control plane that balances the need for advanced automation with the rigid sovereignty requirements of high-compliance environments. ## Self-Hosted Duo Agent Platform for Online Cloud Licenses The Duo Agent Platform allows engineering teams to automate sequences of tasks, such as hardening CI/CD pipelines and triaging vulnerabilities, but was previously difficult to deploy for customers under strict online cloud licensing. This update makes the platform generally available for these environments, bridging the gap between cloud-based licensing and self-hosted security needs. * **Usage-Based Billing:** The platform now utilizes GitLab Credits to provide transparent, per-request metering, which is essential for internal chargeback and regulatory reporting. * **Infrastructure Control:** Enterprises can host models on their own internal infrastructure or within approved cloud environments, ensuring that inference traffic is routed according to internal security policies. * **Deployment Readiness:** By removing the requirement to route data through external AI vendors, the platform is now a viable option for critical infrastructure and government agencies. ## Bring Your Own Model (BYOM) Integration Recognizing that many enterprises have already invested in domain-tuned LLMs or air-gapped deployments, GitLab now allows customers to integrate their existing models directly into the Duo Agent Platform. This ensures that organizations are not locked into a specific vendor and can leverage models that have already passed internal risk assessments. * **AI Gateway Connectivity:** Administrators can connect third-party or internal models via the GitLab AI Gateway, allowing these models to function as enterprise-ready options within the GitLab ecosystem. * **Granular Model Mapping:** The system provides the ability to map specific models to individual Duo Agent Platform flows or features, giving admins fine-grained control over which agent uses which model. * **Administrative Ownership:** While GitLab provides the orchestration layer, administrators retain full responsibility for model validation, performance tuning, and risk evaluation for the models they choose to bring. For organizations operating in high-compliance sectors, these updates offer a path to consolidate fragmented AI tools into a single, governed platform. Engineering leaders should evaluate their current model investments and leverage the GitLab AI Gateway to unify their automation workflows under one secure DevSecOps umbrella.

AI Agents Machine Learning Gitlab DevSecOps+3

spotifyFeb 19, 20263 min readCurated summary

Background Coding Agents: Predictable Results Through Strong Feedback Loops (Honk, Part 3) | Spotify Engineering

Spotify argues that unsupervised coding agents become reliable only when surrounded by strong, automated feedback loops. Its “Honk” system uses component-specific verifiers, mandatory pre-PR checks, and an LLM judge to catch build failures, test failures, scope creep, and functionally incorrect changes. The conclusion is that constrained, sandboxed agents with rich verification are more predictable than flexible agents operating independently. ## Failure Modes at Scale - Agents may fail to produce a pull request, which is inconvenient but usually manageable. - They may produce PRs that fail CI, leaving engineers to repair incomplete work. - Most seriously, they may produce PRs that pass CI but are functionally wrong and potentially reach production. - These failures are more likely when components lack tests, agents modify code beyond the prompt, or agents cannot correctly run builds and tests. - Reviewing invalid or nonsensical PRs can become a significant engineering time sink. ## Verification Loops - Honk uses independent verifiers that provide incremental feedback while the agent works. - Verifiers activate automatically based on the repository contents; for example, a Maven verifier runs when a root-level `pom.xml` is present. - The agent sees an abstract MCP tool rather than the implementation details of Maven, test runners, or build systems. - Verifiers handle formatting, compilation, testing, and output parsing, returning concise error messages instead of consuming the agent’s context with raw logs. - All applicable verifiers run before a PR is opened. In Claude Code, this is enforced with a stop hook. - If verification fails, the PR is blocked and the user receives an error. ## An LLM as a Judge - Deterministic checks cannot detect every problem, especially when an agent makes unnecessary refactors or disables flaky tests. - Honk therefore sends the original prompt and proposed diff to a separate LLM judge. - The judge runs after the regular verifiers and can veto changes that exceed the requested scope. - Across thousands of sessions, the judge rejects roughly one quarter of proposed changes. - Agents successfully correct about half of the vetoed changes. - Spotify has not yet built formal evaluations for the judge, but observed that scope violations are its most common reason for rejection. ## Constrained Agents and Sandboxing - The agent has limited responsibilities: inspect the relevant code, edit files, and invoke verification tools. - Surrounding infrastructure handles prompt creation, pushing code, and user communication through systems such as Slack. - Restricting the agent’s capabilities improves predictability and provides security benefits. - Agents run in heavily sandboxed containers with limited permissions, few installed binaries, and almost no access to surrounding systems. - Spotify reports that agents solve increasingly complex tasks reliably when these feedback loops are present, but often produce unusable code without them. ## Future Expansion - Spotify plans to support more hardware and operating systems. - Current verifiers run only on Linux x86, limiting support for systems that require macOS, such as iOS applications, or ARM64 environments. - The company also intends to integrate Honk more deeply with existing CI/CD pipelines. The practical recommendation is to treat autonomous coding as an infrastructure and verification problem, not merely a prompting problem: keep agents narrowly scoped, isolate them securely, and require layered automated checks before accepting their changes.

Read original

Large Language Models AI Agents CI/CD Model Context Protocol+4

spotifyFeb 19, 20264 min readCurated summary

Inside the Archive: The Tech Behind Your 2025 Wrapped Highlights | Spotify Engineering

Spotify’s 2025 Wrapped Archive identified up to five remarkable listening days for each eligible user and turned them into personalized, LLM-generated stories. A distributed pipeline, carefully designed prompts, model distillation, and massive-scale pre-generation made it possible to create roughly 1.4 billion reports before launch. The system prioritized factual grounding, creative consistency, safety, and reliable parallel storage. ## Identifying Remarkable Listening Days - Spotify used a priority-ordered set of heuristics to evaluate each user’s full year of listening. - Straightforward categories included: - Biggest Music Listening Day - Biggest Podcast Listening Day - Biggest Discovery Day, based on first-time artists - Biggest Top Artist Day - Biggest Top Genre Day - More nuanced categories detected: - Nostalgic listening and throwback-heavy sessions - Unusual listening patterns that differed from a user’s typical taste - Contextual dates such as birthdays and New Year’s Day - Candidate days were ranked by narrative potential and statistical strength, reducing hundreds of millions of events to as many as five standout days per user. - A distributed data pipeline aggregated the results and stored listening data in object storage. - Messaging queues then moved each user’s data asynchronously into report generation. ## Prompt Engineering for Reliable Stories - Spotify spent more than three months iterating on prompts and evaluating edge cases. - The system prompt established: - Traceability to real listening behavior - A witty, sincere, and quietly playful tone - Safety constraints excluding references to drugs, alcohol, sex, violence, and offensive language - User prompts supplied: - Detailed daily listening logs - Precomputed statistics, since LLMs are unreliable at arithmetic - Overall Wrapped data - The remarkable-day category - Previously generated reports to reduce repetition - The user’s country for appropriate spelling and vocabulary - Outputs were improved through prototype comparisons, LLM-based judging, human review, and feedback from creative, technical, and safety teams. ## Distilling the Model for Scale - Larger frontier models produced strong results during prototyping but were too expensive for more than a billion generations. - Spotify generated high-quality reference outputs and curated them into a reviewed “gold” dataset. - A smaller, faster production model was fine-tuned on that dataset. - Direct Preference Optimization (DPO), based on curated human A/B evaluations, further aligned the smaller model with the preferred output style. - The resulting model achieved preference performance comparable to the larger baseline. ## Generating 1.4 Billion Reports - Approximately 350 million users were eligible, with up to five reports each. - Spotify pre-generated about 1.4 billion reports before Wrapped launch. - The system sustained thousands of model requests per second over several days. - After remarkable days were computed, snapshots were published to a pub/sub queue. - Reports were generated sequentially per user so earlier reports could inform later ones and prevent repetition. - Real-time dashboards tracked throughput, reliability, errors, and projected completion time. - The generation engine ran continuously for four days, followed by checks for missing reports, inconsistencies, and necessary re-generation. ## Designing Storage for Concurrent Writes - Completed reports were stored in a distributed, column-oriented key-value database optimized for high-throughput writes. - Each user occupied a single row, with separate columns representing completed remarkable days. - Instead of maintaining a serialized list—which could cause race conditions during read-modify-write operations—each date received its own column qualifier in `YYYYMMDD` format. - Independent reports could therefore be written concurrently to separate cells without locks or coordination. - Report content was written first, followed by lightweight metadata marking the report complete. - This ordering prevented the system from exposing a completion marker before the underlying report was safely stored. ## Practical Conclusion Building Wrapped Archive required treating creative AI generation as a large-scale production system: ground outputs in structured data, use smaller specialized models when volume demands it, evaluate continuously, and design storage schemas that make concurrency safe by default.

Read original

Database Design Large Language Models Prompt Engineering High Throughput+4

spotifyFeb 19, 20263 min readCurated summary

How We Release the Spotify App: A Look Under the Hood (Part 2) | Spotify Engineering

Spotify’s Release Manager Dashboard replaced a Jira-heavy workflow with a unified command center for mobile and desktop releases. It reduces context switching and cognitive load by aggregating release status, bugs, testing, build health, and usage metrics into one interface. A backend that caches and pre-aggregates data from roughly ten systems makes the dashboard fast and affordable. ## From Jira to a Release Command Center - Previously, Release Managers depended on Jira tickets, multiple browser tabs, and Slack conversations. - This made it easy to miss details and required constant context switching. - The dashboard was designed to: - Prioritize the Release Manager’s workflow. - Remain understandable to anyone familiar with Spotify’s release process. - Reduce cognitive load. - Support fast, accurate decisions. ## Release Data Spotify treats each platform-and-version combination as a **track**. Android, iOS, and Desktop share some libraries but are released independently. - Track-specific information includes: - Current release state. - Release-blocking bugs. - Team regression-testing sign-offs. - Final release candidate build status. - Build verification test results. - App Store upload status. - Crash, ANR, and CPU-exception rates per song. - Daily active users. - The dashboard also highlights: - Blocking bugs without an assigned version. - Bugs without a priority. - Reports from internal users and alpha/beta testers. - Release management includes finding appropriate owners for unassigned issues, even when temporary team ownership is needed. ## React, TypeScript, and Backstage - The dashboard is a Backstage plugin built with React and TypeScript. - Spotify’s Backstage ecosystem already provides: - Software Catalog functionality for distributing builds to app stores. - App-build and crash plugins with deeper detail. - Shared UI components and data across developer tools. - The interface provides a quick health overview, with drill-down capabilities for investigating blockers. - Status colors communicate urgency: - **Green:** Ready for the next stage. - **Yellow:** Something still needs attention. - **Red:** An error requires corrective action. ## Backend Aggregation and Performance - A dedicated backend acts as an API gateway for approximately ten existing systems. - It consolidates their data into one consistent API for the dashboard. - The initial implementation queried large amounts of data on every reload, making it slow and expensive. - Caching and five-minute pre-aggregation reduced load time to about eight seconds while significantly lowering operating costs. ## Dashboard Sections ### Production - Shows the currently deployed Android, iOS, and Desktop versions. - Since these releases have completed the release process, only production metrics are displayed. - Metrics include: - Crash data. - Rolling daily active users over the previous 24 hours. - This helps Release Managers detect problems shortly after rollout. ### Current - Displays the branched version that has not yet reached production. - Tracks release blockers such as: - Open blocking bugs. - Incomplete regression testing. - Crash rates above release thresholds. - Builds that do not contain the latest release-branch commits. - Yellow indicators represent pending work, while red indicators call for direct investigation or action. - The ITGC section confirms that full production rollout is permitted only after: - ITGC tests pass. - Reporting is correct. - Data loss remains below the defined threshold. - A Release Status Ping link generates a Slack update with the release’s current state. ### Upcoming - Mirrors the Current release view for the next planned version. - Sections that are not yet relevant are shown in a grayed-out state. The dashboard illustrates how a specialized aggregation layer and focused UI can turn a fragmented release process into a clear operational workflow. For organizations managing complex, multi-platform releases, combining cached cross-system data with color-coded status and drill-down details can improve both speed and release safety.

Read original

CI/CD React TypeScript Jira+4

airbnbFeb 18, 20263 min readCurated summary

Safeguarding Dynamic Configuration Changes at Scale

Airbnb’s Sitar platform is designed to make runtime configuration changes as safe and reliable as code deployments. It combines Git-based reviews, automated validation, staged rollouts, observability, and fast rollback with a highly available distribution system. Separating decision-making from config delivery, while using local caches, lets teams change behavior quickly without unnecessarily increasing outage risk. ## Requirements for a Modern Configuration Platform - Provides an end-to-end workflow for defining, reviewing, testing, and deploying configuration. - Treats configuration like code: - Versioned and reviewable - Auditable - Governed by ownership and access controls - Supports isolated local and canary testing before production rollout. - Accommodates multiple tenants with different: - Deployment triggers - Guardrails - Rollout strategies - Enables incident responders to make emergency changes while preserving auditability and visibility into who changed what, when, and which users or services were affected. ## Sitar’s Architecture Sitar consists of four major layers: - **Developer-facing layer:** Configs are usually managed through GitHub pull requests. The Sitar portal supports exceptions and administrative operations, including emergency deployments. - **Control plane:** Validates schemas, enforces ownership and authorization, selects rollout targets, manages progressive deployment, and supports rollback and targeted testing. - **Data plane:** Stores config values and versions as the source of truth, then distributes updates reliably and efficiently. - **Agents and client libraries:** An agent sidecar fetches subscribed configs and maintains a local cache. In-process client libraries read from that cache and expose values to application code, with optional fallbacks. A typical change moves from a Git workflow through validation and rollout decisions, into the data plane, and finally to sidecars and application clients. ## Git-Based Configuration Management - GitHub is the default interface because it integrates with Airbnb’s existing CI/CD systems and review practices. - Teams can use pull requests, mandatory reviewers, approval flows, and complete change history. - Related configs are grouped into tenants with defined owners, custom tests, and dedicated continuous-delivery pipelines. - The Sitar portal remains available for teams that need a UI or for urgent changes that must bypass the standard CI/CD process. ## Progressive Rollouts and Rollbacks - CI first checks schema correctness, expected structure, types, and other automated requirements. - Config changes require review and approval before deployment. - After merging, changes roll out gradually: - Start with a limited environment, AWS zone, or percentage of Kubernetes pods. - Evaluate the change at each stage. - Expand only when results are healthy. - Authors and stakeholders are notified when regressions are detected, and bad changes can be rolled back quickly. - Limiting the initial scope reduces the blast radius of configuration errors. ## Separating Control and Data Planes - The control plane decides whether and how a change should be deployed. - The data plane stores and distributes the resulting configuration. - This separation allows rollout policies and authorization logic to evolve independently from storage and delivery infrastructure. - Changes to one layer are less likely to disrupt the other. ## Local Caching and Resilient Clients - Each service runs an agent sidecar alongside its application container. - The sidecar periodically retrieves subscribed configs and persists them locally. - Client libraries read configuration from the local cache for fast, in-process access. - If the configuration backend becomes unavailable or degraded, services can continue using the last known good values. ## Practical Takeaway A reliable dynamic configuration system should combine code-like governance with runtime flexibility. Git reviews, validation, staged deployment, strong observability, plane separation, and local caching allow teams to respond quickly while keeping configuration failures contained and reversible.

Read original

Kubernetes CI/CD AWS Config As Code+4

discordFeb 18, 2026Original article

Your Discord Checkpoint is Rolling Out! Celebrate What You Did in 2025 (opens in new tab)

Discord has introduced "Discord Checkpoint," the platform’s first comprehensive year-end recap designed to provide users with a personalized summary of their 2025 activity. By analyzing data such as message counts and voice call duration, the feature offers a nostalgic overview of a user's digital footprint and social interactions over the past year. This initiative marks a shift toward data-driven user engagement, rewarding active community members with exclusive digital collectibles based on their usage patterns. **Accessing the Activity Recap** * The feature is rolling out globally over several days and requires users to be on the latest version of the Discord application. * Desktop users can find their recap by clicking the flag icon located in the top-right corner of the interface. * Mobile users can access the experience via a Checkpoint banner located within the "You" tab at the bottom-right of the screen. * Visibility is contingent upon having "Use data to personalize my Discord experience" enabled in privacy settings and meeting a minimum activity threshold. **Key Metrics and Personal Statistics** * The recap calculates the total volume of messages sent and the cumulative time spent in voice channels throughout the year. * Users receive a breakdown of their most-frequented servers and their most-used emojis. * The system identifies a "top contact," highlighting the individual user with whom the account owner interacted the most. **Personalized Rewards and Social Integration** * Upon completion of the recap, users are assigned one of ten distinct "Checkpoint cards" that categorize their year. * Each card unlocks a corresponding Avatar Decoration that remains available to use until January 15, 2026. * The feature includes a direct sharing toggle that allows users to post a summary card into text channels, though the data remains private by default if the user chooses not to share. To ensure you can view your 2025 Checkpoint before it expires, confirm that your privacy settings allow for data personalization and that your client is fully updated. If the Checkpoint does not appear, you may need to increase your platform activity for future recaps or check the Help Center for specific troubleshooting regarding data permissions.

User Experience Discord Data Visualization Data Analytics+3

discordFeb 18, 20262 min readCurated summary

How to Change Your Theme to Bring Your Vibe to Discord

Discord’s theme settings let users personalize the app across desktop and mobile. Everyone gets four default themes, while Nitro members receive 28 additional color themes, custom theme creation, and extra app icons. Themes generally sync across devices, making it easy to maintain a consistent look. ## Changing Themes on Desktop - Open **User Settings > Appearance**. - Choose from: - **Default Themes**, available to everyone - **Color Themes**, available to Nitro members - Themes apply instantly. - Use **Preview Themes** to view any theme, including Nitro-exclusive options, before selecting it. ## Changing Themes on Mobile - Open the **You** tab. - Tap the gear icon, then go to **Appearance > Theme**. - Scroll horizontally through the available themes and select one. - Themes sync between desktop and mobile by default. - Disable **Sync Across Clients** if you want separate themes on different devices. ## Default Themes for Everyone All Discord users can choose among four themes: - Light - Ash - Dark - Onyx Additional options include: - **Sync with computer/device**, which automatically switches between Light and Dark. - **Dark Sidebar**, available with Light theme, keeping navigation areas dark while conversations remain light. ## Nitro Color Themes Nitro members get 28 additional color themes, including: - Chroma Glow - Citrus Sherbert - Midnight Blurple - Retro Raincloud These options appear under the **Color Themes** section in Appearance settings. ## Custom Themes with Nitro - Nitro members can create custom color themes using up to **five colors**. - Custom themes must currently be created on desktop. - Once created, they sync to mobile devices. ## Custom Discord App Icons Nitro also includes approximately 23 alternative app icons, with styles such as vaporwave, space, and gaming. - On desktop, the selected icon appears inside the app. - On mobile, it changes the device’s homescreen icon. - Icon choices are device-specific, so desktop and mobile can use different icons. To personalize Discord, open Appearance settings, select a theme or custom color scheme, and optionally choose a matching app icon.

Read original

Discord Desktop App Mobile App Dark Mode+1