Loading…
Latest reads
The engineering internet, summarised so you can actually read it.
How the FDA is building a secure, AI-ready data foundation on Databricks for Government
The FDA built HALO (Harmonized AI and Lifecycle Operations for Data) as a secure, governed, AI-ready enterprise data platform for modernizing siloed systems without interrupting regulatory work. Its move to Databricks on AWS GovCloud, following FedRAMP High authorization sponsorship, added Unity Catalog as a governance layer across a multi-tenant architecture, while Terraform-based security patterns, PrivateLink, customer-managed keys, and the compliance security profile support regulated workloads. The agency migrated more than 5,000 users and 8,000 jobs and pipelines with zero downtime, refactoring over 1,000 pipelines and 4,000 notebooks. After onboarding eight centers and 30 programs, FDA reported query responses improving over 30%, compute costs falling over 20%, and provisioning and sharing time dropping over 75%. HALO also supports responsible AI use cases such as MARS, with humans retaining decision authority.
Filippo Seracini, Vijay RajaClickHouse welcomes RunReveal
ClickHouse has acquired RunReveal, a company that built a security data platform on ClickHouse, and says the team’s expertise will become part of its work in security. The announcement frames security as a demanding data workload involving cloud audit logs, identity events, endpoint telemetry, and network flows, with continuous high-throughput ingest, years-long retention, and interactive query requirements. ClickHouse says the acquisition will bring sharper reference architectures, guidance on schema and retention design, and a clearer connection between customer requirements and its database roadmap, while RunReveal remains available through a bring-your-own-database model. Existing RunReveal customers will continue to receive platform support under unchanged contract terms, and the team’s work on agentic investigation is expected to inform support for analytics involving agents that hunt across sources, tune detections, and advance investigations.
The Agentic Analytics Benchmark: Measuring model accuracy and efficiency in analytical agents
The post presents data-agent-mnist, an open harness for measuring analytical agents on correctness, cost, and speed against a warehouse-shaped workload rather than a single text-to-SQL query. The authors extracted 201 production analytics questions from DWAINE, curated and anonymized them, reconstructed a deterministic synthetic warehouse with 18 tables and 865 columns, and evaluated 28 proprietary and open-weight models. The benchmark preserves schema discovery, multi-turn querying, planning, and multi-hop joins across curated marts and a dimensional CRM layer, with provider-diverse ground truth and judging described as part of the workflow. On the authors’ warehouse, Claude Fable 5.1 ranked first for correctness at 76.6%, while the full run cost $1 with DeepSeek V4 Flash versus $52 with Fable 5.1, an 11-percentage-point correctness difference. The harness is intended to identify the best production fit for a specific warehouse, not a universal winner.
Collaboration makes us all stronger
An external researcher, Mehmet Ince, reported a memory-safety flaw in PostGIS’s address_standardizer extension, where caller-controlled grammar data indexed a fixed-size array without bounds checking. Because the extension was available to ordinary tenant roles on managed Postgres services, Databricks treated the issue as a platform exposure rather than a third-party problem, while noting that its microVM architecture meant the exploit did not produce cross-customer impact on Lakebase Postgres and Neon. Detection alerted the Neon team during testing, enabling rapid validation and downstream patching while a durable fix was developed and deployed to protect tenants without customer action. The upstream fix initially missed cases; Mehmet supplied the remaining pieces, and the complete correction was returned to PostGIS, with his bounty donated and matched for the project.
Aaron Kobayashi, Mehmet D. Ince, Anurag Srivastava, Alexey KondratovNew system views in PostgreSQL 19
PostgreSQL 19 adds four system views for lock contention, recovery, autovacuum priorities, and dynamic shared memory allocations. The article presents pg_stat_lock as cumulative, cluster-wide statistics with one row per lock type, reporting waits, total wait time, fastpath_exceeded, and stats_reset; waits and wait_time count only successfully acquired locks that exceeded deadlock_timeout, while fast-path overflow attempts are counted separately. Examples reset statistics, reproduce a 2.5-second table lock, and scan 140 partitions, producing 1 wait, 2201.783 milliseconds, and 422 fast-path overflows. The post describes recovery and autovacuum views, noting that autovacuum scores suggest likely priorities rather than guarantees because scoring and worker scheduling can differ. DSM registry entries expose name, type, and size; NULL means initialization failed.
NVIDIA ·
Building an Adaptive Agentic Cybersecurity System with NVIDIA Nemotron
NVIDIA and CrowdStrike describe an agentic cybersecurity system that links red-agent attack execution with blue-agent detection engineering in a continuous offense-defense testing loop. In an isolated environment modeled on NVIDIA accelerated computing infrastructure, Falcon sensors captured telemetry while Nemotron 3 Ultra orchestrated the defensive workflow and a customized Nemotron 3 Super generated or repaired detections. The harness grounded agents in sensor schemas and attack traces, then applied linting, replay, structured correction, and independent review before deployment. Backtesting raised mean detection of the recorded attack from 16.5% to 41.9% with the optimized open pipeline across independently seeded sessions. In live-fire tests, five of 11 open detections detected an unseen attack, three qualified as gold, and those three covered all eight attacks; the authors call the result a directional case study because it used one scenario family and limited benign traffic.
Michelle HortonHow Uken Games reduces observability costs by 87% with ClickHouse
Uken Games replaced Datadog with an open-source observability stack built around ClickHouse to monitor backend services supporting mobile games with millions of players. The migration addressed rising Datadog costs and vendor lock-in while targeting pragmatic feature parity across metrics, traces, and logs. OpenTelemetry collectors run in two layers: lightweight agents on ECS instances pre-filter traces, while an autoscaling gateway batches and buffers writes to SigNoz on ClickHouse; managed Prometheus handles metrics, CloudWatch retains logs, and Grafana provides dashboards and alerts. Uken samples ordinary traces, retains errors and high-latency requests, computes alert metrics without sampling, and limits retention to two weeks. The resulting system stores all traces on one ClickHouse node using about 170 GB, operates without migration downtime, and costs about $12,000 annually—an 87% reduction.
Becoming an AI Team
Becoming an AI team requires more than adding assistants to existing workflows: it changes ownership, planning, roles, and execution. At Pinterest, infrastructure teams face the scale of serving billions of Pins, boards, ads, and real-time signals, making AI adoption an operational necessity for reliability, cost efficiency, and developer productivity. AI code-generation and transformation models can turn a widespread legacy-codebase refactor, such as replacing “foo” with “bar,” from a months-long effort into work completed and verified in a week or less. As routine execution is increasingly augmented or automated, engineers, product managers, and designers are expected to spend more time on strategy, problem definition, and user validation, while managers emphasize vision, trade-offs, mentorship, and collective impact. The conclusion is that teams must continuously optimize an AI-driven operating system rather than treat AI as a side project.
Pinterest EngineeringNVIDIA ·
How to Size GPUs for AI Inference and TCO Without Overspending
GPU sizing for AI inference depends on use case, token patterns, latency targets, concurrency, cache hit rate, model choice and deployment strategy rather than raw hardware specifications alone. The post proposes a core-and-flex capacity model, combining baseline on-prem or reserved cloud capacity with elastic spot or on-demand GPUs for surges, launches and experiments. It also recommends matching GPU memory to prompt lengths and concurrency, while using quantization, pruning and distillation to reduce footprint and operating cost. A NeMo example prunes Qwen3-8B from 36 to 24 layers or narrows its dimensions toward a roughly 6B student before teacher-student distillation. In the illustrative run, width pruning reached lower final validation loss than depth pruning, 3.21 versus 3.60, while depth pruning converged faster.
Elizabeth GoodmanOperationalizing Genie Ontology in Your Data Stack
Genie Ontology is presented as a way to give enterprise AI agents shared business context beyond a semantic model, including definitions, relationships, business rules, authoritative sources, and permissions. It combines Unity Catalog Semantics—Metric Views, Pages, and Domains—with context inferred from governed tables, queries, dashboards, notebooks, and other supported assets. The guidance recommends six progressive layers, beginning with clean gold data and resolved golden records, then metadata, semantic modeling, enterprise context, governance, and evaluation. Critical implementation details include declaring informational primary and foreign keys, defining canonical measures in Metric Views, adding synonyms and example queries, and using permissions plus human-reviewed automation. Rather than waiting for complete coverage, it advises starting with one high-value domain and metric, then using feedback, telemetry, benchmarks, and drift reviews to strengthen trust over time.
Srujan Alase, Richard TomlinsonAWS ·
Hybrid cloud orchestration: Modernizing on-premises infrastructure management with AWS
Managing distributed on-premises infrastructure across hundreds of sites creates inconsistency, manual lifecycle bottlenecks, fragmented visibility, and scalability problems, especially when hardware, operating system, Kubernetes, and application operations span thousands of servers. The proposed design centralizes orchestration in AWS while keeping execution on site, using hybrid connectivity, AWS Lambda, AWS Step Functions, Amazon EventBridge, DynamoDB, AWS Systems Manager, and supporting services. Redfish APIs provide vendor-agnostic bare-metal control for BIOS, firmware, power, and health operations, while EKS Anywhere deploys and operates management and workload clusters on local hardware; orders and inventory records track workflows and resource relationships. DynamoDB Streams also automate DNS, certificates, AWS access, and storage integrations, while centralized observability aggregates server, cluster, and application signals; the post presents architectural patterns and defers detailed implementation workflows and templates to later parts.
Sandeep SinghThe new Brickbuilder Partner Network tiers for ISVs and Data Providers are here
The Databricks Partner Network has launched Bronze, Silver, Gold, and Platinum tiers for ISVs and data providers, with placement based on customer impact, technical excellence, strategic alignment, readiness and enablement, and joint go-to-market activity. Technical Excellence is evaluated through the Partner Well-Architected Framework (PWAF), which provides prescriptive, AI-ready guidance for secure, reliable integrations and serves as the standard for validated architecture. For customers, the tiers signal that a partner solution has met a high bar for architecture, security, compliance, and joint customer success, reducing vetting effort. For partners, each tier defines requirements and a roadmap tied to greater visibility, co-selling, and go-to-market support, while Databricks plans to refine the program and expand benefits over the coming months.
Stephen OrbanHow Discovery Bank delivers hyper-personalized banking at scale: behavioral AI, governed data, and real-time decisioning
Discovery Bank’s hyper-personalized banking model addresses how to make interactions relevant to individual behavior while meeting financial-services demands for scale, speed, security, and governance. The bank combines demographic, transactional, digital-engagement, savings, borrowing, credit-risk, rewards, and lifestyle-related data on the Databricks Data and AI Platform, producing governed reusable features, indicators, scores, forecasts, and recommendations. Behavioral models and a reusable next-best-action decisioning layer support personalization, fraud detection, servicing, and banker assistance; TRUST alerts assess transactions against client-specific norms and can escalate from explanation to account locking. A four-layer architecture adds control services and specialized generative AI and agents to trusted data and analytical foundations, with governance remaining in the loop. Reported results include a 40% uplift in client engagement impact, 20x faster pipeline development and data processing, 5x faster data-product creation, more than 300 models built per day, and return on investment above 500%.
Jack Yallop, Stuart EmslieAWS ·
MCP went stateless: Is your AWS MCP server deployment well-architected?
MCP 2026-07-28 removes the initialize handshake and Mcp-Session-Id, making the protocol core stateless and changing how remote servers scale on AWS. Requests carry protocol version and client context, while server/discover can expose versions, capabilities, and identity; continuity remains possible through server-minted identifiers passed in tool arguments and stored application state. It covers round-robin routing, header-based gateway signals, cache freshness fields, W3C Trace Context, idempotent tools, and Multi Round-Trip Requests for input-dependent calls. It recommends retaining sticky routing and session stores for 2025-era clients, then migrating after legacy traffic reaches zero and validating against the official conformance suite. The conclusion is that the revision aligns remote MCP deployments with AWS Well-Architected practices and permits removal of infrastructure required only by the old protocol.
Anand KomandooruHow we could save petabytes of cache storage with Zstandard and Pingora
Cloudflare prototyped Cache Transcoding, a Pingora-based architecture that stores eligible cache responses as Zstandard (zstd) rather than their original representation. On a fill, the proxy compresses qualifying uncompressed text at zstd level 3, records the compressed representation and original content length, keeps it compressed on disk and between Tiered Cache layers, and decodes it on the client-facing path. Eligibility requires a 200 OK response, compressible text, no existing Content-Encoding, known Content-Length of at least 4 KiB, and excludes several request and binary-content cases. In initial tests, eligible assets shrank to roughly one-third of their original on-disk size, with a 2.834x ratio, while encoding cost 4.31 ns per byte and decoding 1.56 ns; the modeled CPU increase stayed within budget, though broader testing remains necessary.
Aashi PatelSentry ·
Application Metrics caught my broken size estimator
Cliparr’s video size estimator was intended to predict output size from target bitrate multiplied by clip duration, but real-world results could vary because its VBR encoder changes bitrate with content. Rather than manually testing a matrix of formats, codecs, and quality settings, the author extracted the browser-based export engine into Cliparr Convert, a standalone static converter, and instrumented it with anonymous Sentry Application Metrics. Completed conversions record actual and estimated bytes, their ratio and delta, plus attributes such as output format, quality, and estimator basis; counters also track conversion completion and the progressive web app installation funnel. The resulting dashboard exposed an estimate that was off by 83% and supports grouping real usage by conversion conditions, while sending only numeric metrics and not media, filenames, or URLs.
Kyle TryonRed Hat ·
Orchestrate production RAG with OpenShift AI
This guide shows how to move a streaming retrieval-augmented generation (RAG) workflow from a monolithic Ray Data script to modular AI pipelines on OpenShift AI. It addresses failure recovery and run traceability by separating parsing and chunking, ingestion, model download, and deployment into five reusable components. Parsed and chunked JSONL is stored in S3-compatible storage so KFP can rerun ingestion without repeating document processing, and each run records parameters, timestamps, logs, and status. The data chain uses Docling’s HybridChunker and Ray map_batches with ActorPoolStrategy, while the model chain downloads a Hugging Face model and deploys it through vLLM and KServe in parallel. For embedding ingestion, the workflow supports local CPU processing with granite-embedding-125m-english or a dedicated GPU vLLM service for larger collections and offers notebooks for deployment and query validation.
Ana Biazetti, Saad ZaherRed Hat ·
Developing LLM guardrail configs locally with NeMo Guardrails
The article presents a local workflow for developing and testing NeMo Guardrails configurations in a Jupyter notebook, avoiding repeated Kubernetes deployments and requiring no LLM, GPU, or cloud resources. It defines rails, configurations, and servers, then starts with a case-insensitive regex rail that blocks the exact phrase “ignore all previous instructions”; the test catches a direct attack but allows an accented “Ignóre” variant. A broader regex configuration is followed by a DeBERTa-based prompt-injection classifier and a manually assembled set of 13 prompts, producing 12 correct decisions out of 13, with one subtle attack allowed. The article recommends iterating locally, potentially layering targeted regexes before classifiers for fail-fast, defense-in-depth filtering, while noting that 13 prompts cannot meaningfully measure performance and pointing to standardized EvalHub evaluations as a next step.
Rob GeadaRed Hat ·
Red Hat OpenShift autoscaling using MachineSet autoscaler with KEDA
The demonstration compares OpenShift MachineSet Autoscaler with KEDA against the previously used Cluster Autoscaler, using metrics to scale a MachineSet before pods remain pending. After installing Red Hat’s Custom Metrics Autoscaler operator (KEDA 2.19), granting permissions for MachineSet scaling and Thanos/Prometheus access, it creates a ScaledObject with a Prometheus trigger targeting demo-p4p95-worker-eastus3. Because a MachineSet has no pods, the HPA path cannot use metricType: Value, so AverageValue is paired with a PromQL query that multiplies CPU request utilization by the current node count. With nine one-CPU test pods, the MachineSet scaled from one to two to three nodes as the metric crossed 75%, and all pods reached Running; two additional Standard_D4s_v3 VMs were provisioned in zone 3.
Ramon Gordillo Gutierrez, Jose Ortiz PadillaAuth0 ·
How to Make Your AI Agent Enterprise-Ready: Enabling Enterprise-Managed Authorization for Client Apps in Auth0
Auth0 is launching Early Access for Client App, or Requesting App, capabilities that support Cross App Access (XAA) for AI assistants, developer tools, and autonomous agents. In the Enterprise-Managed Authorization (EMA) model, an employee’s corporate SSO login can authorize access to external APIs or Model Context Protocol (MCP) servers through the IETF Identity Assertion Authorization Grant (ID-JAG) draft specification. Auth0’s Token Vault brokers the multi-hop exchange: it stores an upstream enterprise refresh token, retrieves a short-lived ID-JAG, exchanges it with the downstream Resource App, and returns a standard access token to the backend. Setup uses dashboard toggles and connection settings, followed by a standard /oauth/token federated exchange, while the API requires no XAA-specific changes. The release also describes audit logging, enterprise IdP policy control, OIN distribution, and caching downstream tokens because ID-JAG exchanges are rate-limited to 50% of the tier’s standard Auth API limit.
name: "Mira Sharma"
