Archive
1290 posts · Page 10 of 108. ← Blog
The CI/CD pipeline is one of the most privileged systems in an engineering organization — it has access to source code, secrets, and the keys to production — which makes it a prime target. Worse, it can become the delivery mechanism for an attack: compromise the pipeline and you compromise everything it ships. This post is about securing the pipeline itself and building security into it, the heart of DevSecOps.
The CI/CD pipeline is one of the most privileged systems in an org — access to source, secrets, and the keys to production — which makes it a prime target and a potential delivery mechanism for an attack. This post secures the pipeline itself (least privilege, secrets, pinned deps) and builds security into it (SAST/SCA/DAST), plus supply-chain integrity: SBOM, signing, SLSA provenance.
The EU AI Act is the world's first comprehensive AI law, and for engineers it is neither as scary nor as vague as it first appears. Underneath the legal language is a risk-based structure that translates into a concrete checklist of engineering obligations — and most of them are things a good governance program (this series) already does. This post is about reading the Act the way an engineer should: not as compliance theater, but as a specification of controls you can implement.
The EU AI Act is risk-based, so your first job is classification — then the high-risk obligations translate into a concrete checklist most mature governance already does: risk management, data governance, documentation, logging, human oversight, robustness, conformity assessment. Read the law as a specification of controls, not compliance theater.
An AI that answers coding questions is an assistant; an AI that independently reads a codebase, makes changes across many files, runs the tests, sees what broke, and fixes it is a coding agent. That shift — from suggesting code to doing the work in a real repository — is one of the most consequential developments in software engineering, and it has its own distinct engineering. This series builds coding agents from first principles, starting with what makes an agent different from autocomplete.
An AI that answers coding questions is an assistant; one that reads a codebase, edits across files, runs the tests, and fixes what broke is a coding agent. The shift from suggesting code to doing the work, why code is a near-ideal agent domain (it's verifiable), and the engineer's new role as director-reviewer.
Talking to a computer feels simple — you speak, it answers — but under that simplicity is a real-time cascade of models racing a stopwatch. Audio becomes text, text becomes a response, the response becomes audio, and all of it has to happen fast enough to feel like conversation. This series builds voice AI from the ground up, and it starts with the pipeline that makes a voice agent work.
Talking to a computer feels simple — you speak, it answers — but under that simplicity is a real-time cascade of models racing a stopwatch. Audio becomes text, text becomes a response, the response becomes audio, fast enough to feel like conversation. This series builds voice AI from the ground up, starting with the pipeline that makes a voice agent work — with an interactive diagram.
The first thing an AI gateway gives you is one interface to every model. Instead of your applications learning each provider's SDK, request format, and quirks, they speak a single API and the gateway translates. That translation layer is what decouples your code from any one vendor — and it's what makes model-swapping a config change instead of a rewrite.
The first thing an AI gateway gives you is one interface to every model. Instead of your applications learning each provider's SDK, request format, and quirks, they speak a single API and the gateway translates. That translation layer is what decouples your code from any one vendor — and makes model-swapping a config change instead of a rewrite.
The two costs of long context — quadratic attention compute and linear KV-cache memory — each have a family of solutions, and together they're why modern models can handle context lengths that were impossible a few years ago. Grouped-query attention shrinks the KV cache; FlashAttention computes exact attention far faster; sliding-window and sparse patterns break the quadratic. This post covers the techniques that made long context practical.
The two costs of long context each have a family of solutions, and together they're why modern models handle context lengths that were impossible a few years ago. Grouped-query attention shrinks the KV cache; FlashAttention computes exact attention far faster; sliding-window and sparse patterns break the quadratic. The techniques that made long context practical, and which cost each attacks.
A pipeline is only trustworthy if it's defined the same way your application is: as version-controlled code, reviewed and reproducible. "Pipeline as code" turns the path to production from clicked-together settings in a web UI into a file in your repository — and that shift, from configuration to code, brings the whole discipline of software engineering to bear on how you ship software.
A pipeline is only trustworthy if it's defined the same way your application is: as version-controlled code, reviewed and reproducible. Pipeline as code turns the path to production from clicked-together settings in a web UI into a file in your repository — bringing the whole discipline of software engineering to bear on how you ship software. The declarative model and principles for doing it well.
Two questions separate real AI governance from theater: can you stop a model that fails its checks from reaching production, and can you prove, after the fact, that the checks were done? The first is an evaluation gate; the second is evidence. Together they turn governance from a set of good intentions into something enforceable and auditable. This post is about the mechanics of gating AI systems on quality and automatically capturing the proof that it happened.
Two questions separate governance from theater: can you stop a model that fails its checks, and can you prove the checks happened? Evaluation gates that fail closed (with teeth and legitimacy), and evidence — the automatic audit trail that governance-as-code produces for free — for regulators, auditors, and incident reconstruction.
Computer-use agents are a genuine frontier capability — and also one of the most over-hyped and under-reliable, so knowing where they actually fit today is the practical skill. This closing post is the honest field guide: the real use cases, the honest limits, how to deploy them responsibly, and where the technology is heading. It turns the series into judgment about when to reach for an agent that drives the screen.
A frontier capability that's also over-hyped and under-reliable. Where computer-use agents actually fit (API-less software, cross-app workflows, assistive/supervised use), the honest limits (prefer an API when one exists; not ready for long unattended high-stakes autonomy), how to deploy responsibly, and the trajectory.
The moment your application talks to more than one model — or one model but seriously — you accumulate a pile of cross-cutting concerns: provider APIs that differ, outages you must survive, costs you must control, calls you must log. An AI gateway is the single control point that handles all of it, sitting between your applications and every model provider. This series builds one from first principles.
The moment your application talks to more than one model — or one model but seriously — you accumulate cross-cutting concerns: differing provider APIs, outages, costs, logging. An AI gateway is the single control point that handles all of it, sitting between your applications and every model provider. This series builds one from first principles, with interactive architecture diagrams.
MoE scales a model's parameters cheaply. But there's a second scaling axis that matters just as much for modern LLMs: context length — how much text the model can attend to at once. Attention's cost grows with the square of the sequence, and the memory to run it grows linearly and relentlessly, which is why long context was hard and why so much architectural ingenuity has gone into it.
MoE scales a model's parameters cheaply, but there's a second axis that matters just as much: context length. Attention's compute grows with the square of the sequence, and the KV-cache memory grows linearly and relentlessly — two distinct costs, often confused, that make long context hard. Understanding both is the setup for the efficiency techniques that solved them.
How you put new code into production is a design decision with real consequences for risk and downtime. Deploy it all at once and a bad release hits everyone; roll it out gradually and you can catch problems while they're small. Blue-green, canary, rolling, and feature flags are the core techniques — each trading complexity for safety in a different way. This post covers when and why to use each.
How you put new code into production is a design decision with real consequences for risk and downtime. Deploy it all at once and a bad release hits everyone; roll it out gradually and you catch problems while they're small. Blue-green, canary, rolling, and feature flags are the core techniques — each trading complexity for safety differently. When and why to use each.