Security – Software Engineering Daily: Recent Episodes
Security – Software Engineering Daily
SED News is a monthly podcast from Software Engineering Daily where hosts Gregor Vand and Sean Falconer break down the biggest stories shaping software engineering, Silicon Valley, and the broader tech industry.
In this episode, Gregor and Sean dig into a wave of “runaway AI” stories, including Anthropic and OpenAI disclosing that their models accessed outside organizations during cyber evaluations, and Amazon reporting a staggering budget overrun blamed on bad agent loops. They explore why most of these incidents trace back to human decisions rather than models breaking free, and the awkward reality that today’s systems can bill you for tokens without reliably counting them.
They also talk about the “Kimi moment.” Moonshot AI‘s open weight model has closed the gap with frontier models like ChatGPT and Claude at a remarkable pace, and the hosts unpack what it means for open weight strategies and how chip scarcity is pushing Chinese labs to innovate.
As always, the episode wraps up with a few standout Hacker News threads, including a JetBrains test of a “caveman speak” skill that promised big token savings, how refactoring can cut input token costs, the release of CodePen 2.0, and a build of Doom that renders through SQL queries.
Sponsorship inquiries:
sponsor@softwareengineeringdaily.com
The post SED News: The Kimi Moment, Runaway AI, and Tokenmaxxing appeared first on Software Engineering Daily.
The terminal has been a constant in software development for decades. It has remained largely unchanged while everything around it transformed. However, as AI agents have become central to the developer workflow, the terminal is emerging as a natural home for agentic development, and a new category of tooling is forming around it.
Warp is a popular Rust-based terminal and agentic development environment. The company recently open-sourced its codebase and launched Oz, its cloud agent infrastructure product aimed at helping enterprises automate software development at scale.
Zach Lloyd is the co-founder and CEO of Warp, and a former principal engineer at Google where he led engineering on the Google Docs suite. In this episode, Zach joins Gregor Vand to discuss how Warp has evolved over the years, why the terminal is better suited than the IDE for agentic development, how Oz approaches the governance and auditability challenges enterprises face with AI agents, and more.
Sponsorship inquiries:
sponsor@softwareengineeringdaily.com
The post The Terminal as an Agentic Interface appeared first on Software Engineering Daily.
Open source software underpins virtually every modern application. That ubiquity is a superpower for developers, but it is also an expanding attack surface. Software supply chain attacks were once rare but are now happening daily, with malicious actors exploiting the trust developers place in public registries, package managers, and CI/CD pipelines.
Chainguard is a secure software supply chain platform. The company started with hardened container images and has expanded to cover domains including VMs, language libraries, GitHub Actions, and agent skills.
Matt Moore is a co-founder and CTO of Chainguard, and a veteran of Google’s open source, container, and security infrastructure work. In this episode, Matt joins Gregor Vand to discuss lessons from recent supply chain attacks, why CI/CD pipelines are now a primary attack surface, the challenge of meaningful software inventories, the EU Cyber Resilience Act, and what the arrival of Anthropic’s Mythos model means for the pace of vulnerability discovery and the urgency of patching at machine speed.
Sponsorship inquiries:
sponsor@softwareengineeringdaily.com
The post AI-Powered Threats to the Software Supply Chain appeared first on Software Engineering Daily.
The most useful coding agents can mutate their environments by downloading packages, writing files, and connecting to services across the network. However, that freedom also presents dangers, and promises to usher in a new wave of security threats.
Docker recently announced Docker Sandboxes, which give each agent its own isolated micro VM while preserving the familiar ergonomics of a container. A standard container shares the host’s kernel, but a micro VM emulates hardware and runs its own kernel, giving a stronger security boundary around code that cannot be trusted.
Mark Cavage is the President and COO of Docker, and he previously worked at companies including Stripe, AWS and Oracle. In this episode, Mark joins Gregor Vand for a wide-ranging conversation that includes why agents break the immutability assumptions containers were built on, how micro VMs differ from both containers and traditional VMs, and the still-unsolved challenge of giving agents scoped, trustworthy access to sensitive services and data.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Docker and Sandboxing AI Agents appeared first on Software Engineering Daily.
Golden Gate Ventures is one of Southeast Asia’s most established early-stage venture firms, having backed companies across the region since 2011. They have invested in companies that are now household names in the region. Examples include Gojek, which started as a motorcycle taxi service in Indonesia and grew into a super app spanning payments, food delivery, and logistics, and Grab, which began as a ride-hailing service in Singapore and similarly expanded across Southeast Asia into food delivery and financial services.
Jeffrey Paine is a co-founder and partner at Golden Gate Ventures. In this episode, Jeffrey joins Gregor Vand to discuss how the Southeast Asian startup ecosystem has evolved, why the regional copycat model is giving way to globally ambitious technical founders, what companies like Manus and Supabase reveal about Singapore’s emerging role in the global tech landscape, and what advice Jeffrey gives founders today who want to build something that matters beyond their home market.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post The Startup Scene in Southeast Asia appeared first on Software Engineering Daily.
AI agents have shown remarkable potential to function as persistent digital assistants that are capable of monitoring data, managing communications, and taking action autonomously over long periods. OpenClaw was one of the first serious attempts to fulfill that vision, connecting frontier coding agents to messaging platforms like Slack and WhatsApp and letting them run continuously in the background. However, OpenClaw largely set aside questions of security to pursue that vision, leaving credentials exposed in the agent’s environment and giving agents broad access to data and services far beyond what any given task required.
NanoClaw is an open source project that takes a zero trust approach to agent orchestration. Rather than relying on instructions to constrain agent behavior, it isolates each agent in its own Docker container, keeps credentials entirely outside the agent’s environment, and enforces human-in-the-loop approval for sensitive actions.
Gavriel Cohen is the founder of NanoClaw and he joins Kevin Ball to discuss the security architecture behind NanoClaw, how the agent sandbox and proxy model work in practice, how agents communicate with each other and with the host orchestration process, how the project approaches context window management and long-lived agent sessions, and more.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post NanoClaw and the Rise of Personal AI Agents appeared first on Software Engineering Daily.
AI agents have become capable of reasoning across large amounts of data, calling tools, and taking sequences of actions autonomously. These qualities make them well suited to some of the most persistent pain points in DevOps, including the on-call engineer woken at 3 AM to diagnose an incident, the build failure that takes hours to trace back to a root cause, and the operational toil of modern software delivery. Agentic DevOps is the emerging paradigm that applies these capabilities to the full software lifecycle, with the goal of matching the velocity of modern software delivery with an equally capable operational layer.
Neha Gaswamy leads Agentic DevOps at AWS and has been at Amazon for over twenty years. In this episode, she joins Matt Merrill to discuss the AWS approach to agentic DevOps, how Amazon dogfoods its own DevOps tooling, how their DevOps agent works from alarm to root cause, why determinism still matters in an agentic world, creative MCP integrations customers are building, and what the future holds for SRE engineers as agents take on more of the operational work.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Agentic DevOps at AWS appeared first on Software Engineering Daily.
AI agents have transformed how software gets written, but the operational side of running software in production has not yet experienced a similar revolution. The same teams responsible for keeping systems healthy, investigating incidents, and managing reliability are still doing much of that work manually.
Mezmo is a Production AI company that makes autonomous operations fast, efficient, and safe. Their open source project, AURA, is a declarative agent framework specifically designed for SRE and platform engineering workflows. It takes a Kubernetes-inspired approach where teams define what they want agents to do rather than scripting every step of how to do it.
Andre Elizondo is the head of product at Mezmo, and he has a background in systems engineering, SRE, and observability. In this episode, Andre joins Kevin Ball to discuss what makes SRE agent workflows fundamentally different from coding agents, how AURA handles context engineering, AURA’s declarative configuration model, the spectrum of agent autonomy, and where the role of the SRE is headed as agents take on more of the operational work.
Full Disclosure: This episode is sponsored by Mezmo.
Kevin Ball or KBall, is the vice president of engineering at Mento and an independent coach for engineers and engineering leaders. He co-founded and served as CTO for two companies, founded the San Diego JavaScript meetup, and organizes the AI inaction discussion group through Latent Space.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post AURA and Open-Source Agents for Production Operations appeared first on Software Engineering Daily.
Eric Ries is the creator of the Lean Startup method and the author of the New York Times bestseller The Lean Startup, which transformed how a generation of founders and engineers think about building products. It introduced concepts like the MVP, the pivot, and build-measure-learn that are now so widely adopted they feel obvious. Over two decades of working with founders, CEOs, and investors, Eric has observed that some companies built on those principles eventually betray the very customers and engineers who made them great. His new book, Incorruptible: Why Good Companies Go Bad and How Great Companies Stay Great, is his attempt to answer the question of whether it is possible to build a company that resists that fate.
In this episode, Eric joins Gregor Vand for a wide-ranging discussion about why so many great companies lose their way, and what software engineers and founders can do today to build or find companies that are genuinely resistant to corruption.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Eric Ries on Why Good Companies Go Bad appeared first on Software Engineering Daily.
SED News is a monthly podcast from Software Engineering Daily where hosts Gregor Vand and Sean Falconer break down the biggest stories shaping software engineering, Silicon Valley, and the broader tech industry.
In this episode, Gregor and Sean dig into the growing tension around restricted AI models, including Anthropic‘s Fable being pulled from the Claude platform days after launch. They explore what Sean calls “vibe regulations” and the risk foreign governments and enterprises face when a model they depend on can be cut off. They also cover the FT’s reporting on London’s “DeepMind mafia,” a vibe-coding clone controversy involving YC-backed Corgi and Papermark, SpaceX‘s acquisitions of Cursor and Mesh, and Anthropic’s launch of Claude Science.
They also take on the latest round of the IDE wars, and explore who owns your dev toolchain, the vendor lock-in that now comes from context and memory rather than the model itself, and the widening cost gap between frontier tools and open weight models. As always, the episode wraps up with a few standout Hacker News threads.
The post SED News: Restricted Models, IDE Wars, and the DeepMind Mafia appeared first on Software Engineering Daily.
Advanced software systems have long been more complex than any single engineer can fully understand. Observability is the established solution to this problem, but with AI agents now generating code, deploying changes, and operating autonomously, the challenge of understanding large software systems is entering a new dimension.
Grafana is an open source observability platform, and one of the most widely used in the world. The company builds tools that help teams collect, visualize, and act on telemetry data across logs, metrics, and traces. They are now extending that capability into the agentic era with AI-powered investigation and monitoring tools.
Anthony Woods is a co-founder of Grafana Labs. In this episode, he joins Matt Merrill to discuss how AI-generated code is straining software operations, why telemetry data volume has become as much a problem as a solution, how Grafana is adapting to a world where agents are the primary consumers of observability data, and what keeps him up at night about where the industry is headed.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Grafana’s Approach to AI-Native Observability appeared first on Software Engineering Daily.
Building great software always involves technical problem solving, but the best software goes beyond function. It feels fluid, coherent, and genuinely fun to use. This quality lives at the intersection of engineering and design, and very few teams know how to reliably produce it.
Metalab is an engineering and design studio that has worked with some of the most successful companies in tech, including Apple, Slack, Uber, and Instacart. The studio is known for bringing together software engineering and design craft in a way that few studios can match.
Wesley Yu is the VP of Engineering at Metalab, where he leads the teams that design and build digital products for early-stage companies. In this episode, Wesley joins Josh Goldberg to discuss how Metalab approaches tech stack selection for client projects, why agency work demands a bias toward boring and stable technology, how iterative development and deliberately ugly apps lead to better final products, and how AI tools are changing the boundary between design and engineering.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Building Software That People Love appeared first on Software Engineering Daily.
Yacht Club Games is the studio behind the acclaimed Shovel Knight franchise. Their latest release is Mina the Hollower, which is a top-down action RPG inspired by classic Zelda and Castlevania titles. After many years in development, the game recently launched to widespread critical acclaim.
David D’Angelo is a lead programmer at Yacht Club Games. In this episode, David joins Joe Nash to discuss the custom C++ engine built for Mina the Hollower, how the team approached Game Boy Color art constraints and audio in a modern rendering pipeline, the game’s Castlevania-inspired combat philosophy, how the open world manages saving and collision without load screens, and more.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Mina the Hollower appeared first on Software Engineering Daily.
Predictive modeling is a core element in modern systems, and powers capabilities such as fraud detection, loan approvals, and recommendation systems. These systems typically operate on structured, relational data stored in enterprise databases, with rows, columns, and interlinked tables. While computer vision and natural language processing have undergone a neural network revolution, the tabular data layer underpinning predictive modeling still largely relies on manual feature engineering and task-specific models.
Relational deep learning proposes a new approach. It treats databases as graphs and applies transformer-style attention mechanisms directly over structured relational data. Researchers are now building foundation models for tabular data that aim to generalize across predictive tasks without painstaking feature engineering.
Jure Leskovec is a Professor of Computer Science at Stanford University and he previously served as Chief Scientist at Pinterest and was an investigator at the Chan Zuckerberg Biohub. Most recently, he co-founded the machine learning startup, Kumo.AI.
In this episode, Jure joins Sean Falconer to discuss the limitations of traditional predictive modeling, why structured enterprise data requires its own modality-specific neural architectures, how graph transformers generalize attention to relational databases, and more.
The post Foundation Models for Structured Data appeared first on Software Engineering Daily.
Modern web development requires an ever-growing collection of tools including formatters, linters, bundlers, and plugins. Each tool typically has its own configuration, dependencies, and performance cost. As applications grow more complex, the overhead of maintaining this toolchain becomes a real burden.
Biome is an open source toolchain for web projects that brings formatting and linting together in a single fast, opinionated tool. It’s built in Rust and is designed to be a drop-in replacement for Prettier and ESLint, with sensible defaults, minimal configuration, and consistent behavior across the CLI and editor environments. Biome also introduces a module graph that enables cross-file analysis, and type-aware lint rules that don’t require the TypeScript compiler.
Emanuele Stoppa, known as Ema, is a Senior Systems Engineer at Cloudflare, a lead at Astro, and the creator and lead maintainer of Biome. In this episode, Ema joins Josh Goldberg to discuss the history of Biome, how linters and formatters work under the hood, what makes Biome’s architecture fundamentally different from the tools it replaces, and what’s coming next for the project and its community.
Josh Goldberg is an independent full time open source developer in the TypeScript ecosystem. He works on projects that help developers write better TypeScript more easily, most notably on typescript-eslint: the tooling that enables ESLint and Prettier to run on TypeScript code. Josh regularly contributes to open source projects in the ecosystem such as ESLint and TypeScript. Josh is a Microsoft MVP for developer technologies and the author of the acclaimed Learning TypeScript (O’Reilly), a cherished resource for any developer seeking to learn TypeScript without any prior experience outside of JavaScript. Josh regularly presents talks and workshops at bootcamps, conferences, and meetups to share knowledge on TypeScript, static analysis, open source, and general frontend and web development.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Biome and the Future of JavaScript Tooling appeared first on Software Engineering Daily.
Most of the cryptography securing the internet today rests on mathematical problems that classical computers cannot solve in any reasonable timeframe. That assumption is now being tested. Recent advances in quantum computing have dramatically compressed timelines, and many in the industry have set a target of full post-quantum security by 2029, meaning a complete migration to algorithms designed to remain secure against quantum attacks.
Bas Westerbaan is a cryptography engineer at Cloudflare, where he leads the company’s efforts to migrate to post-quantum cryptography. In this episode, Bas joins Kevin Ball to discuss how quantum computers threaten public key cryptography, what post-quantum algorithms actually are and how they work, the timeline shifts that have made quantum readiness feel so urgent, and what software engineers need to do now to prepare their systems.
Kevin Ball or KBall, is the vice president of engineering at Mento and an independent coach for engineers and engineering leaders. He co-founded and served as CTO for two companies, founded the San Diego JavaScript meetup, and organizes the AI inaction discussion group through Latent Space.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Preparing for Q-Day appeared first on Software Engineering Daily.
Multiplayer games are among the hardest software systems to build, requiring developers to synchronize state across unreliable networks while maintaining fairness, performance, and a responsive player experience. Latency, cheating, server costs, and debugging distributed game logic all introduce complexity that single-player games never encounter.
Dome Keeper is a minimalist tower defense game with roguelike elements where players must protect a fragile glass dome from relentless waves of alien attackers. The game was developed with the Godot Engine and released in 2022. More recently, the development team embarked on the challenge of adding multiplayer to the game.
René Habermann is the founder of Bippinbits and the creator of Dome Keeper. Chris Ridenour is the founder of KAR Games, which is Godot focused studio that developed Drift: Space Survival. Chris is now working with the Dome Keeper team to bring multiplayer to the game. René and Chris join the show to talk about the origins of Dome Keeper, developing the game, and the process of adding multiplayer to a Godot game.
Joe Nash is a developer, educator, and award-winning community builder, who has worked at companies including GitHub, Twilio, Unity, and PayPal. Joe got his start in software development by creating mods and running servers for Garry’s Mod, and game development remains his favorite way to experience and explore new technologies and concepts.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Developing Multiplayer Games in Godot appeared first on Software Engineering Daily.
SED News is a monthly podcast from Software Engineering Daily where hosts Gregor Vand and Sean Falconer unpack the biggest stories shaping software engineering, Silicon Valley, and the broader tech industry.
In this episode, they cover Apple‘s uncertain path beyond the iPhone. They also discuss Google‘s agentic pivot at Google I/O, a surge in DuckDuckGo traffic following Google’s default switch to AI mode, and payroll platform Remote surpassing 300 million in ARR with flat headcount.
Gregor and Sean also dig into why consumer subscriptions don’t seem to correspond to actual costs, how enterprise is quietly subsidizing the AI economy, why the true moat has shifted from model quality to context management and agentic harness, and what the coming wave of token cost optimization might look like as companies start scrutinizing their AI bills.
Finally, they highlight standout threads from Hacker News including Doom running on a travel router touchscreen, a viral post asking whether AI productivity gains should translate to a day off, YouTube‘s move to automatically label AI-generated content, and SimCity 3000 running in 4K.
Gregor Vand is a security-focused technologist, having previously been a CTO across cybersecurity, cyber insurance and general software engineering companies. He is based in Singapore and can be found via his profile at vand.hk or on LinkedIn.
Sean’s been an academic, startup founder, and Googler. He has published works covering a wide range of topics from AI to quantum computing. Currently, Sean is an AI Entrepreneur in Residence at Confluent where he works on AI strategy and thought leadership. You can connect with Sean on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post SED News: Apple’s AI Problem, The Real Business Model of AI, and Token Cost Reckoning appeared first on Software Engineering Daily.
The web has quietly become one of the most capable platforms for game development. Advances in WebAssembly, WebGL, and WebGPU have given developers tools that rival native desktop performance, while game engines like Unity and Godot have added robust web export pipelines. However, building games for the browser comes with its own set of constraints including file size, browser compatibility, and the need to quickly capture and maintain the player’s attention.
Erik Dubbelboer is a Principal Engineer at Poki which is a web games platform serving over 100 million monthly users. He’s also a game developer himself, with titles including Silly Skies and Village Builder. His unusual position building developer tools that power the platform, while also shipping games on it, gives him a rare perspective on what it actually takes to succeed in web game development.
In this episode, Erik joins Joe Nash to discuss the history of web games from the Flash era to today’s renaissance, how WebAssembly and WebGPU have transformed what is possible in the browser, the tradeoffs between different game engines for web publishing, and more.
Joe Nash is a developer, educator, and award-winning community builder, who has worked at companies including GitHub, Twilio, Unity, and PayPal. Joe got his start in software development by creating mods and running servers for Garry’s Mod, and game development remains his favorite way to experience and explore new technologies and concepts.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Web Native Game Development appeared first on Software Engineering Daily.
Software engineering has developed powerful tools for observability, data management, and continuous testing, but hardware engineering has largely not kept pace. The feedback loops, tooling, and infrastructure that software engineers take for granted simply do not exist in most hardware programs.
Nominal is a data platform built to help hardware organizations move at the same speed as software teams. It manages the hardware data supply chain end to end, from ingesting high-frequency sensor data off physical assets to enabling real-time control room monitoring, post-test analysis, and simulation correlation.
Jason Hoch is the co-founder and CTO of Nominal, and he has a background spanning distributed data systems at Palantir and cloud infrastructure at Vercel. In this episode, Jason joins Kevin Ball to discuss why hardware engineering has lagged so far behind software in tooling and observability, the unique data challenges of working with high-frequency time series sensor data, how Nominal handles both real-time control room workflows and post-test analysis, why AI agents are transforming software development but have not yet made the same leap in hardware, and what it would take to close that gap.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post The Hardware Bottleneck AI Can’t Fix appeared first on Software Engineering Daily.
Autonomous drone delivery has long been the stuff of science fiction, but ongoing advances have moved the space from experimental to operational. Zipline is one of the leading companies in this space, with drones that charge between missions and fly autonomously to deliver packages directly to customers.
Kyle Madonia is the VP of Application Software and IT at Zipline, and she previously spent a decade as an engineer at SpaceX. In this episode, Kyle joins Gregor Vand to discuss how Zipline’s software stack powers end-to-end autonomous delivery, the engineering challenges of managing drone fleets at scale, and how the team approaches software releases for safety-critical systems.
Gregor Vand is a security-focused technologist, having previously been a CTO across cybersecurity, cyber insurance and general software engineering companies. He is based in Singapore and can be found via his profile at vand.hk or on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Autonomous Drone Delivery at Scale appeared first on Software Engineering Daily.
Europe’s startup ecosystem is maturing rapidly, with companies like Revolut, Lovable, and Legora demonstrating that world-class technology businesses can be built and scaled on the continent. While the US remains the dominant force in venture-backed software as home to the largest markets, the deepest capital pools, and the most ambitious exit culture, a growing number of European founders are choosing to build at home.
Edward Keelan is a Partner at Octopus Ventures, one of Europe’s largest and most active venture capital firms, where he has spent over 16 years leading the B2B software and enterprise AI fund. His portfolio spans seed through Series C, with a focus on European founders building in AI, vertical SaaS, and enterprise software. This long-view experience gives him a rare perspective on what it takes to build enduring technology companies in Europe.
In this episode, Edward joins Elena Boroda to discuss what separates great founders from the rest, how AI is reshaping the software landscape and threatening established players, the state of the European startup ecosystem and what it needs to compete globally, and what engineers and founders should be thinking about as the industry enters a new era.
Elena Boroda focuses on GTM for developer tools and AI startups, with experience in observability and building tools for MCP servers. She is based in Berlin.
https://www.linkedin.com/in/elena-boroda
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post The European Startup Scene appeared first on Software Engineering Daily.
React Native is an open source framework developed by Meta that allows engineers to build mobile applications for both iOS and Android using a single JavaScript codebase. The framework bridges the gap between web development and native mobile, which lets teams ship to both platforms simultaneously without sacrificing the look and feel of a truly native app.
Manjiri Moghe is a Staff Software Engineer at Coinbase, where she has spent five years building and scaling one of the world’s most demanding React Native applications. Her work spans performance optimization, reliability engineering, and the developer tooling that keeps large engineering teams moving quickly without sacrificing quality.
In this episode, Manjiri joins Josh Goldberg to discuss why React Native has become the framework of choice for high-velocity mobile teams, how Coinbase measures app health, how to handle data fetching and loading in production, how AI coding agents are changing the day-to-day workflow for mobile engineers, and more.
Josh Goldberg is an independent full time open source developer in the TypeScript ecosystem. He works on projects that help developers write better TypeScript more easily, most notably on typescript-eslint: the tooling that enables ESLint and Prettier to run on TypeScript code. Josh regularly contributes to open source projects in the ecosystem such as ESLint and TypeScript. Josh is a Microsoft MVP for developer technologies and the author of the acclaimed Learning TypeScript (O’Reilly), a cherished resource for any developer seeking to learn TypeScript without any prior experience outside of JavaScript. Josh regularly presents talks and workshops at bootcamps, conferences, and meetups to share knowledge on TypeScript, static analysis, open source, and general frontend and web development.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post React Native at Scale appeared first on Software Engineering Daily.
Formal methods are a branch of mathematics and computer science focused on proving the correctness of systems, and they have long promised a more rigorous foundation for software. However, their complexity has kept them confined to a small community of specialists. That is now changing as agentic AI systems take on increasingly autonomous roles. The question of how to define, enforce, and verify what those agents are allowed to do has become urgent, and automated reasoning is emerging as a critical part of the answer.
Byron Cook is a VP and Distinguished Scientist at AWS, a professor at University College London, and a program manager at DARPA. He founded the Automated Reasoning Group at AWS over a decade ago, where his team built the foundations behind products like IAM Access Analyzer, VPC Reachability Analyzer, and Bedrock Guardrails.
In this episode, Byron joins Sean Falconer to discuss how automated reasoning works and why it scales so well with AI, the rise of neurosymbolic approaches that combine formal logic with large language models, what it means to formally specify agent behavior using temporal logic, and why the convergence of agentic AI and formal methods may represent one of the most significant shifts in how software is built and verified.
Sean’s been an academic, startup founder, and Googler. He has published works covering a wide range of topics from AI to quantum computing. Currently, Sean is an AI Entrepreneur in Residence at Confluent where he works on AI strategy and thought leadership. You can connect with Sean on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Formal Methods as Agent Guardrails appeared first on Software Engineering Daily.
Open source software underpins nearly every modern application, including frameworks powering the most popular websites, to the libraries securing financial backend systems. However, while open source drives collaboration and innovation at a global scale, it also faces deep challenges in sustainability, community health, and long-term maintenance. Many of the world’s most critical dependencies are still maintained by just a handful of volunteers.
Abby Cabunoc Mayes leads Open Source Maintainer Programs at GitHub, and Brian Muenzenmeyer is a Principal Engineer, Node.js maintainer, and author of the book, Approachable Open Source. Abby and Brian join Josh Goldberg to talk about what it means to build and sustain healthy open source projects, how maintainers can foster inclusive communities, the evolving role of open source in the workplace, and how AI is reshaping the way we collaborate.
Josh Goldberg is an independent full time open source developer in the TypeScript ecosystem. He works on projects that help developers write better TypeScript more easily, most notably on typescript-eslint: the tooling that enables ESLint and Prettier to run on TypeScript code. Josh regularly contributes to open source projects in the ecosystem such as ESLint and TypeScript. Josh is a Microsoft MVP for developer technologies and the author of the acclaimed Learning TypeScript (O’Reilly), a cherished resource for any developer seeking to learn TypeScript without any prior experience outside of JavaScript. Josh regularly presents talks and workshops at bootcamps, conferences, and meetups to share knowledge on TypeScript, static analysis, open source, and general frontend and web development.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Open Source Sustainability appeared first on Software Engineering Daily.
Vector search has risen to become a foundational tool in modern search and retrieval systems, including the RAG pipelines that power many AI applications. However, the demands on retrieval systems are growing more sophisticated, which is revealing the limits of relying on a single vector similarity score.
Vespa is a popular open source search and data serving engine. Central to Vespa’s architecture is tensor-based retrieval, which is an approach that represents data as tensors rather than simple vectors. Tensor-based retrieval enables richer mathematical operations and more flexible ranking functions that can surmount the limitations of a single vector similarity score.
Radu Gheorghe is a software engineer at Vespa with a background spanning nearly 12 years of consulting and training on Elasticsearch and Solr. In this episode, Radu joins Sean Falconer to discuss why vector similarity alone falls short in production, how tensor-based retrieval generalizes to support richer ranking functions, the trade-offs in chunking and multi-stage re-ranking architectures, and where AI search is headed next.
Full Disclosure: This episode is sponsored by Vespa.
Sean’s been an academic, startup founder, and Googler. He has published works covering a wide range of topics from AI to quantum computing. Currently, Sean is an AI Entrepreneur in Residence at Confluent where he works on AI strategy and thought leadership. You can connect with Sean on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Vespa AI and Surpassing the Limits of Vector Search appeared first on Software Engineering Daily.
SED News is a monthly podcast from Software Engineering Daily where hosts Gregor Vand and Sean Falconer unpack the biggest stories shaping software engineering, Silicon Valley, and the broader tech industry.
In this episode, they cover Anthropic’s controversial “Mythos” security model and what it means for vulnerability discovery at scale. They also discuss recent layoffs at Snap and Meta, and how AI investment pressures are reshaping hiring, organizational priorities, and the economics of big tech.
Gregor and Sean then zoom out to examine the massive wave of AI infrastructure spending—hundreds of billions in capex across Amazon, Google, Microsoft, and Meta, and what it signals about the future of cloud platforms, model providers, and the engineers who build on top of them. They explore the emerging entanglement between model labs and infrastructure providers, the evolving role of engineers in an AI-native world, and the growing gap between rapid AI adoption and security readiness.
Finally, they highlight standout threads from Hacker News, including creative uses of AI coding tools to revive abandoned side projects, new approaches to training smaller yet highly capable models, surprising demographic data visualizations, and even the mathematics of “cheating” at Tetris.
Gregor Vand is a security-focused technologist, having previously been a CTO across cybersecurity, cyber insurance and general software engineering companies. He is based in Singapore and can be found via his profile at vand.hk or on LinkedIn.
Sean’s been an academic, startup founder, and Googler. He has published works covering a wide range of topics from AI to quantum computing. Currently, Sean is an AI Entrepreneur in Residence at Confluent where he works on AI strategy and thought leadership. You can connect with Sean on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post SED News: Anthropic’s Mythos, Supply Chain Hacks, and the AI Spending Surge appeared first on Software Engineering Daily.
AI coding tools have dramatically accelerated the pace of development, and the bottleneck in the software development lifecycle has shifted to code validation and testing. However, the conventional tools and workflows that QA teams have relied on were not designed for a world where a single engineer can generate thousands of lines of code in a day.
SmartBear is a software quality platform spanning test automation, API lifecycle management, and observability. The company recently launched an AI-native QA platform called BearQ, which deploys autonomous agents that explore web applications, learns their structure and behavior, and authors and maintains test cases continuously.
Fitz Nowlan is the VP of AI and Architecture at SmartBear and the co-founder of Reflect, which is a web testing platform acquired by SmartBear in 2024. In this episode, Fitz joins Kevin Ball to discuss why web UI testing is uniquely challenging, how BearQ’s multi-agent architecture coordinates exploration and testing, why test data management becomes a hard distributed systems problem at scale, and what agentic development means for the future of QA.
Full Disclosure: This episode is sponsored by SmartBear.
Kevin Ball or KBall, is the vice president of engineering at Mento and an independent coach for engineers and engineering leaders. He co-founded and served as CTO for two companies, founded the San Diego JavaScript meetup, and organizes the AI inaction discussion group through Latent Space.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post SmartBear and Multi-Agent QA appeared first on Software Engineering Daily.
Artificial intelligence is transforming warfare faster than the legal and ethical frameworks designed to govern it. Militaries around the world are deploying AI-powered decision support systems to identify targets, assess proportionality, and direct weapons. The gap between what is technically possible and what international law can effectively regulate is widening by the day.
Yuval Shany is a law professor at Hebrew University of Jerusalem and a research fellow at the Oxford Ethics in AI Institute. He also served on the UN Human Rights Committee, where he first encountered the legal and ethical challenges posed by autonomous weapons systems. His research focuses on the intersection of international humanitarian law, human rights, and emerging military technologies.
In this episode, Yuval joins Matt Merrill for a wide-ranging conversation. They cover topics including how close we are to fully autonomous lethal weapons, the accountability gap that AI-mediated warfare creates, and what lessons software engineers can draw from these challenges when building consequential AI systems of any kind.
Matt Merrill is a software engineering leader with over 20 years of experience building and scaling software teams across enterprise and product-focused organizations. His background is in backend development, cloud architecture, and distributed systems design. He currently architects and delivers software products and leads a team of engineers at DEPT® Agency. You can learn more about his work at code.theothermattm.com.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post The Ethics of Autonomous Weapons Systems appeared first on Software Engineering Daily.
Open-weight models are AI systems whose trained parameters are publicly released, which allows developers to run, fine-tune, and deploy them independently rather than accessing them only through a hosted API. While closed-weight models from companies like OpenAI or Anthropic are delivered as managed services, open-weight models give organizations direct control over how the models are deployed and used. Importantly, the performance of these models is steadily improving and they’ve become credible alternatives for production workloads, with advantages in customization and data privacy.
Fireworks AI is building a platform focused on serving and customizing open-weight models at scale. The platform includes optimized inference infrastructure, multi-hardware support across NVIDIA and AMD, and reinforcement fine-tuning capabilities.
Benny Chen is a Co-Founder of Fireworks AI. In this episode, he joins Gregor Vand to discuss his path from Meta’s ML infrastructure teams to co-founding Fireworks AI, why open-weight models are becoming increasingly competitive, how custom kernels and speculative decoding improve performance, reinforcement fine-tuning, and much more.
Gregor Vand is a security-focused technologist, having previously been a CTO across cybersecurity, cyber insurance and general software engineering companies. He is based in Singapore and can be found via his profile at vand.hk or on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Open-Weight AI Models appeared first on Software Engineering Daily.
AI coding tools have gone from novelty to core infrastructure in under three years. Today, many devs use AI daily, a substantial share of new code is AI-generated, and expectations for automation are rapidly increasing.
Sonar is a company specializing in analysis of code quality and security, and they recently released a new survey – the State of Code Developer Survey. The survey provides a deep examination of how developers are using AI in real production environments, and where the real-world gaps and risks still exist.
Chris Grams is the CVP of Corporate Marketing at Sonar, and Manish Kapur is the VP of Product Marketing and Developer Relations at Sonar. In this episode, they join Matt Merrill to discuss what the survey reveals about AI-assisted development, why 96% of developers still don’t fully trust AI-generated code, how deterministic verification layers fit into agent-driven workflows, and what engineering leaders should prioritize as AI shifts from experimentation to production infrastructure.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Hype and Reality of the AI Coding Shift appeared first on Software Engineering Daily.
AI agents are increasingly capable of reasoning and performing autonomous work over long periods. However, as agents take on more complex, longer-horizon tasks, keeping them supplied with the right information becomes the core engineering challenge. The industry is moving away from pre-loading context upfront toward a model where agents dynamically navigate and retrieve the data they need, when they need it.
Redis is approaching context management using a context engine, which is an architecture built around four pillars: on-demand context retrieval, data that is always current, fast retrieval, and a memory layer that improves over time. In practice this means building materialized views of data with a semantic layer on top, rather than giving agents direct access to production databases. A memory system sits alongside this, extracting and compacting information asynchronously as the agent works.
Simba Khadder leads AI strategy at Redis, and he previously co-founded the feature store platform FeatureForm, which was acquired by Redis in 2025. In this episode, Simba joins Kevin Ball to discuss why context has become the defining challenge in agentic AI, how context engines differ from traditional RAG architectures, how materialized views underpin reliable agent data pipelines, how memory systems can improve through async extraction and compaction, and how engineering teams need to adapt their practices as AI-driven development accelerates.
Full Disclosure: This episode is sponsored by Redis.
Kevin Ball or KBall, is the vice president of engineering at Mento and an independent coach for engineers and engineering leaders. He co-founded and served as CTO for two companies, founded the San Diego JavaScript meetup, and organizes the AI inaction discussion group through Latent Space.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Unlocking the Data Layer for Agentic AI with Simba Khadder appeared first on Software Engineering Daily.
AI agents are evolving from individual productivity tools into distributed systems components inside enterprises. The next frontier is coming into focus, and it involves large-scale ecosystems of collaborating agents embedded directly into business processes. However, multi-agent architectures introduce serious challenges around orchestration, state management, trust, governance, and observability.
Eric Broda is a veteran of the software industry, and he’s the co-author of the new O’Reilly book, Agentic Mesh: The GenAI-Powered Autonomous Agent Ecosystem.
In this episode, Eric joins Sean Falconer to discuss the architectural challenges of deploying agents as core infrastructure, how distributed computing principles apply to multi-agent systems, why trust and explainability are foundational, and what enterprises may look like as agents become full participants in business processes.
Sean’s been an academic, startup founder, and Googler. He has published works covering a wide range of topics from AI to quantum computing. Currently, Sean is an AI Entrepreneur in Residence at Confluent where he works on AI strategy and thought leadership. You can connect with Sean on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Agentic Mesh with Eric Broda appeared first on Software Engineering Daily.
Observability emerged from the need to understand complex software systems, and involves tracking metrics, logs, and traces so engineers can detect and diagnose problems before they affect users. However, modern applications often encompass hundreds of services, containers, and dependencies, generating more observability data than dashboards and alerts alone can effectively surface.
New Relic is a leading observability platform, with a history that spans the full arc of modern software operations. Today they are working to apply AI to move observability beyond passive monitoring toward active intelligence, where systems can surface what matters, reduce alert noise, and ultimately take autonomous action before problems reach engineers or users.
Nic Benders is the Chief Technology Strategist at New Relic, where he has worked for 16 years. In this episode, Nic joins Lee Atchison to discuss the evolution of observability from dashboards and alerts to AI-driven intelligence, how LLMs and statistical tools work together to surface meaningful signals from massive datasets, the emerging challenge of observing AI systems themselves, and what the rise of AI means for the future of software engineering as a profession.
This episode is hosted by Lee Atchison. Lee Atchison is a software architect, author, and thought leader on cloud computing and application modernization. His best-selling book, Architecting for Scale (O’Reilly Media), is an essential resource for technical teams looking to maintain high availability and manage risk in their cloud environments.Lee is the host of his podcast, Modern Digital Business, an engaging and informative podcast produced for people looking to build and grow their digital business with the help of modern applications and processes developed for today’s fast-moving business environment. Listen at mdb.fm. Follow Lee at softwarearchitectureinsights.com, and see all his content at leeatchison.com.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post New Relic and Agentic DevOps with Nic Benders appeared first on Software Engineering Daily.
Mobile apps have become a primary interface for critical services, including banking, payments, and healthcare. Unlike web applications, much of the logic and intellectual property in a mobile app lives directly on the user’s device, which is an environment the developer doesn’t control. That makes mobile apps uniquely exposed to reverse engineering, runtime manipulation, and fraud.
As more critical functionality shifts to mobile, the need to harden apps against sophisticated attackers continues to grow. Guardsquare builds tools to protect and test mobile applications against both static and dynamic threats. Its platform has features including layered code obfuscation, runtime application self-protection, mobile-specific security testing, threat monitoring, and API attestation.
Ryan Lloyd is the Chief Product Officer at Guardsquare. In this episode, he joins Gregor Vand to discuss why mobile security differs from desktop and web security, how reverse engineering tools have evolved, the role of compiler-based obfuscation and runtime protections, common mobile app vulnerabilities, and how LLMs are reshaping the attacker landscape.
Full Disclosure: This episode is sponsored by Guardsquare.
Gregor Vand is a security-focused technologist, having previously been a CTO across cybersecurity, cyber insurance and general software engineering companies. He is based in Singapore and can be found via his profile at vand.hk or on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Mobile App Security with Ryan Lloyd appeared first on Software Engineering Daily.
The Model Context Protocol, or MCP, gives developers a common way to expose tools, data, and capabilities to large language models, and it has quickly become an important standard in agentic AI. FastMCP is an open source project stewarded by the team at Prefect, which is an orchestration platform for AI and data workflows. The FastMCP project builds on MCP to provide high-level, ergonomic abstractions for Python developers to rapidly build and deploy MCP servers and applications.
Jeremiah Lowin is the founder and CEO of Prefect, and Adam Azzam is the VP of Product at the company. In this episode, Jeremiah and Adam join Gregor Vand to discuss the origin story of FastMCP, the three pillars of the framework, the architectural decisions behind FastMCP 3.0, and much more.
Gregor Vand is a security-focused technologist, having previously been a CTO across cybersecurity, cyber insurance and general software engineering companies. He is based in Singapore and can be found via his profile at vand.hk or on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post FastMCP with Adam Azzam and Jeremiah Lowin appeared first on Software Engineering Daily.
SED News is a monthly podcast from Software Engineering Daily where hosts Gregor Vand and Sean Falconer unpack the biggest stories shaping software engineering, Silicon Valley, and the broader tech industry.
In this episode, they cover the resurgence of ARM and CPUs as serious compute infrastructure for running local AI agents, a supply chain attack on LiteLLM that exposed API credentials across thousands of developer environments, and the arrival of OpenCode as a fully open source alternative to Claude Code and Codex. They also discuss the diverging strategies of Anthropic and OpenAI following the Pentagon contract controversy, and what it signals about where each company is positioning itself in the enterprise and government markets. Gregor and Sean then dive deep into what the AI coding boom actually means for shipping software.
Finally, they highlight standout threads from Hacker News, including Doom running entirely over DNS, the psychology of seafoam green in Cold War-era control rooms, a Tesla Model 3 computer assembled from salvaged crash components, and Apple’s quiet discontinuation of the Mac Pro.
Gregor Vand is a security-focused technologist, having previously been a CTO across cybersecurity, cyber insurance and general software engineering companies. He is based in Singapore and can be found via his profile at vand.hk or on LinkedIn.
Sean’s been an academic, startup founder, and Googler. He has published works covering a wide range of topics from AI to quantum computing. Currently, Sean is an AI Entrepreneur in Residence at Confluent where he works on AI strategy and thought leadership. You can connect with Sean on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post SED News: OpenCode, AI Code vs. Shipped Code, and the LiteLLM Breach appeared first on Software Engineering Daily.
FreeBSD is one of the longest-running and most influential open-source operating systems in the world. It was born from the Berkeley Software Distribution in the early 1990s, it has powered everything from high-performance networking infrastructure to game consoles and content delivery networks. Over three decades, it has evolved through major architectural shifts, from symmetric multiprocessing and kernel scalability to modern storage systems and predictable release engineering.
John Baldwin has spent more than 25 years working on FreeBSD as a developer, contributor, and consultant. In this episode, John joins Gregor Vand to discuss the origins of FreeBSD, how its governance model differs from other open-source projects, its role inside systems like Netflix’s CDN and the PlayStation 4, the challenges of maintaining a 30-year-old codebase, and much more.
Gregor Vand is a security-focused technologist, having previously been a CTO across cybersecurity, cyber insurance and general software engineering companies. He is based in Singapore and can be found via his profile at vand.hk or on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post FreeBSD with John Baldwin appeared first on Software Engineering Daily.
Modern cloud-native systems are built on highly dynamic, distributed infrastructure where containers spin up and down constantly, services communicate across clusters, and traditional networking assumptions break down. Linux networking was designed decades ago around static IPs and linear rule processing, which makes it increasingly difficult to achieve scale in Kubernetes environments. At the same time, modifying the Linux kernel to keep up with these demands is slow, risky, and impractical for most organizations.
The Extended Berkeley Packet Filter, or eBPF, is a Linux kernel technology that allows sandboxed programs to run safely inside the kernel without modifying kernel source code or loading kernel modules. Cilium is an open-source, cloud-native networking platform that’s built on eBPF, and provides, secures, and observes connectivity between workloads in Kubernetes and other distributed environments.
Bill Mulligan is a maintainer in the Cilium ecosystem and a member of the team at Isovalent, the company behind Cilium. He joins the show with Gregor Vand to discuss how eBPF works under the hood, why Cilium has become one of the most widely adopted Kubernetes networking projects, and how the future of cloud-native infrastructure is being reshaped by programmable kernels.
Gregor Vand is a security-focused technologist, having previously been a CTO across cybersecurity, cyber insurance and general software engineering companies. He is based in Singapore and can be found via his profile at vand.hk or on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Cilium, eBPF, and Modern Kubernetes Networking with Bill Mulligan appeared first on Software Engineering Daily.
Bennett Foddy is a legendary game designer known for creating wholly distinctive games such as QWOP, Getting Over It with Bennett Foddy, and the recently released Baby Steps. He’s also a former professor at the NYU Game Center, where he taught game design alongside developing his own experimental work.
In this episode, Bennett joins Joe Nash to discuss his systems-driven approach to game design, why frustration and difficulty are often misunderstood, how streaming and speedrunning have reshaped how games are played and experienced, and what makes his games stand out.
Joe Nash is a developer, educator, and award-winning community builder, who has worked at companies including GitHub, Twilio, Unity, and PayPal. Joe got his start in software development by creating mods and running servers for Garry’s Mod, and game development remains his favorite way to experience and explore new technologies and concepts.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Games That Push Back with Bennett Foddy appeared first on Software Engineering Daily.
Developer tooling shapes how software gets written day to day, but the best tools often disappear into the background once they succeed. Formatting, linting, and build systems can either create friction and endless debate, or quietly remove entire classes of problems from a team’s workflow. Over the past decade, the JavaScript ecosystem has wrestled with both extremes as it scaled rapidly and accumulated complexity.
Prettier emerged as a response to the surprisingly human problem of engineers spending too much time debating code style instead of building software. It offers a deterministic, opinionated formatter that helped normalize automation as part of everyday development.
James Long is a design and product engineer who has worked at Mozilla and Stripe, and he’s the creator of Prettier. He joins the show with Josh Goldberg to talk about the origins of Prettier, why formatting debates are so emotionally charged, the technical challenges of building formatters, the realities of maintaining popular open-source tools, and how the JavaScript tooling ecosystem continues to evolve.
Josh Goldberg is an independent full time open source developer in the TypeScript ecosystem. He works on projects that help developers write better TypeScript more easily, most notably on typescript-eslint: the tooling that enables ESLint and Prettier to run on TypeScript code. Josh regularly contributes to open source projects in the ecosystem such as ESLint and TypeScript. Josh is a Microsoft MVP for developer technologies and the author of the acclaimed Learning TypeScript (O’Reilly), a cherished resource for any developer seeking to learn TypeScript without any prior experience outside of JavaScript. Josh regularly presents talks and workshops at bootcamps, conferences, and meetups to share knowledge on TypeScript, static analysis, open source, and general frontend and web development.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Prettier and Opinionated Code Formatting with James Long appeared first on Software Engineering Daily.
Skateboarding games have long balanced technical precision with a sense of flow and expression, but Skate Story takes the genre in a radically different direction. It has a distinct vaporwave vibe and blends fluid skate mechanics with exploration, puzzles, and an existential narrative about freedom, pain, and obsession.
The game was created by indie developer Sam Eng, who previously released Zarvot for the Nintendo Switch. Skate Story launched to critical acclaim and was widely regarded as one of the best games of 2025.
In this episode, Sam joins the show with Joe Nash to talk about developing Skate Story.
Joe Nash is a developer, educator, and award-winning community builder, who has worked at companies including GitHub, Twilio, Unity, and PayPal. Joe got his start in software development by creating mods and running servers for Garry’s Mod, and game development remains his favorite way to experience and explore new technologies and concepts.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Skate Story with Sam Eng appeared first on Software Engineering Daily.
Retrieval-augmented generation, or RAG, has become a foundational approach to building production AI systems. However, deploying RAG in practice can be complex and costly. Developers typically have to manage vector databases, chunking strategies, embedding models, and indexing infrastructure. Designing effective RAG systems is also a moving target, as techniques and best practices evolve in step with rapidly advancing language models.
Google DeepMind recently released the File Search Tool, a fully managed RAG system built directly into the Gemini API. File Search abstracts away the retrieval pipeline, allowing developers to upload documents, code, and other text data, automatically generate embeddings, and query their knowledge base. We wanted to understand how the DeepMind team designed a general-purpose RAG system that maintains high retrieval quality.
Animesh Chatterji is a Software Engineer at Google DeepMind and Ivan Solovyev is a Product Manager at DeepMind, and they worked on File Search Tool. They joined the podcast with Sean Falconer to discuss the evolution of RAG, why simplicity and pricing transparency matter, how embedding models have improved retrieval quality, the tradeoffs between configurability and ease of use, and what’s next for multimodal retrieval across text, images, and beyond.
Sean’s been an academic, startup founder, and Googler. He has published works covering a wide range of topics from AI to quantum computing. Currently, Sean is an AI Entrepreneur in Residence at Confluent where he works on AI strategy and thought leadership. You can connect with Sean on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post DeepMind’s RAG System with Animesh Chatterji and Ivan Solovyev appeared first on Software Engineering Daily.
Interactive notebooks were popularized by the Jupyter project and have since become a core tool for data science, research, and data exploration. However, traditional, imperative notebooks often break down as projects grow more complex. Hidden state, non-reproducible execution, poor version control ergonomics, and difficulty reusing notebook code in real software systems make it hard to move from exploration to production. At the same time, sharing results often requires collaborators to recreate entire environments, limiting interactivity and slowing feedback.
Marimo is an open-source, next-generation Python notebook designed to address these problems directly. Akshay Agrawal is the creator of Marimo and he previously worked at Google Brain. He joins the show with Kevin Ball to discuss the limitations of traditional notebooks, the design of reactive notebooks in Python, how marimo bridges research and production, and where notebooks fit in an increasingly agentic, AI-assisted development world.
Kevin Ball or KBall, is the vice president of engineering at Mento and an independent coach for engineers and engineering leaders. He co-founded and served as CTO for two companies, founded the San Diego JavaScript meetup, and organizes the AI inaction discussion group through Latent Space.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Reinventing the Python Notebook with Akshay Agrawal appeared first on Software Engineering Daily.
AI agents have taken on a growing share of software development work, so much so that the hardest problems are shifting away from code generation towards something new, context. The challenge is now contextualizing why systems work the way they do, how architectural decisions were made, and the sources of truth that exist outside of the code base. As teams adopt agentic tools, gaps or inconsistencies in context have emerged as a primary reason why software fails to meet production standards.
Unblocked is a startup focused on solving this context gap. Their context engine aggregates and reasons over organizational knowledge spread across source code, pull requests, documentation, chat systems, and production telemetry. By acting as a context engine for both developers and AI agents, Unblocked aims to improve AI code quality and review, reduce interruptions, accelerate onboarding, and enable safer, more effective agentic workflows.
Dennis Pilarinos is the Founder and CEO of Unblocked. Previously, he helped build Azure at Microsoft, worked at AWS, and co-founded BuddyBuild, which is a mobile CI platform acquired by Apple. Dennis joins Kevin Ball to discuss context engineering, reconciling conflicting sources nof truth, permission to wear AI systems, the shifting bottlenecks in the software development lifecycle, and what it means to be a software engineer in an increasingly agentic world.
Full Disclosure: This episode is sponsored by Unblocked.
Kevin Ball or KBall, is the vice president of engineering at Mento and an independent coach for engineers and engineering leaders. He co-founded and served as CTO for two companies, founded the San Diego JavaScript meetup, and organizes the AI inaction discussion group through Latent Space.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Organizational Context for AI Coding Agents with Dennis Pilarinos appeared first on Software Engineering Daily.
SED News is a monthly podcast from Software Engineering Daily where hosts Gregor Vand and Sean Falconer unpack the biggest stories shaping software engineering, Silicon Valley, and the broader tech industry.
In this episode, they cover the viral rise of OpenClaw and its founder’s move to OpenAI, OpenAI’s exploration of ads inside ChatGPT, and Alibaba’s push into agent-powered commerce during Lunar New Year. They also discuss Mistral’s acquisition of Koyeb to deepen its compute stack, the growing competition between ChatGPT, Claude, and Gemini, and what these moves signal about monetization, infrastructure, and control in the AI arms race.
Gregor and Sean then dive deep into the rapid acceleration of agentic engineering. They examine how tools like Claude Code and Codex are compressing the idea-to-production cycle, what multi-agent orchestration means for software teams, whether the era of the “10x engineer” is ending, and how organizational structures may need to evolve as coding shifts from manual craft to supervised automation.
Finally, they highlight standout threads from Hacker News, including reverse engineering a 1990 DOS classic, a 3D reimagining of flight tracking data, old-school practical film effects using cloud tanks, and the privacy-focused GrapheneOS mobile operating system.
Gregor Vand is a security-focused technologist, having previously been a CTO across cybersecurity, cyber insurance and general software engineering companies. He is based in Singapore and can be found via his profile at vand.hk or on LinkedIn.
Sean’s been an academic, startup founder, and Googler. He has published works covering a wide range of topics from AI to quantum computing. Currently, Sean is an AI Entrepreneur in Residence at Confluent where he works on AI strategy and thought leadership. You can connect with Sean on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post SED News: OpenClaw Goes Viral, Mistral’s Compute Play, and the Agent Arms Race appeared first on Software Engineering Daily.
AI-assisted coding tools have made it easier than ever to spin up prototypes, but turning those prototypes into reliable, production-grade systems remains a major challenge. Large language models are non-deterministic, prone to drift, and often lose track of intent over long development sessions.
Kiro is an AI-powered IDE that’s built around a spec-driven development workflow. It’s focused on helping developers capture intent up front, translate it into concrete requirements and designs, and systematically validate implementations through tasks, testing, and guardrails. It aims to preserve the creativity of AI-assisted development while producing software that is ready for real-world use.
David Yanacek is a Senior Principal Engineer and a lead advisor on the Agentic AI team at AWS. Today, his work focuses on Kiro, frontier agents, Amazon Bedrock AgentCore, and AWS’s operational agents. He joins the show with Kevin Ball to discuss the design of Kiro, how spec-driven development changes the way teams work with AI coding agents, and what the next generation of agentic software development might look like.
Kevin Ball or KBall, is the vice president of engineering at Mento and an independent coach for engineers and engineering leaders. He co-founded and served as CTO for two companies, founded the San Diego JavaScript meetup, and organizes the AI inaction discussion group through Latent Space.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Amazon’s IDE for Spec-Driven Development with David Yanacek appeared first on Software Engineering Daily.
Enterprise IT systems have grown into sprawling, highly distributed environments spanning cloud infrastructure, applications, data platforms, and increasingly AI-driven workloads. Observability tools have made it easier to collect metrics, logs, and traces, but understanding why systems fail and responding quickly remains a persistent challenge. As complexity continues to rise, the industry is looking beyond dashboards and alerts toward agentic AI systems that can reason about operational data, reduce toil, and take action when things go wrong.
SolarWinds offers solutions to monitor, understand, and remediate issues across complex, distributed systems. The company began as a leader in network and infrastructure monitoring, and has evolved to support modern applications, cloud environments, containers, and AI workloads, with a growing focus on reducing operational toil.
Krishna Sai is the Chief Technology Officer at SolarWinds. He joins the show with Sean Falconer to discuss how SolarWinds is rethinking observability in the age of AI, what it means to design agentic systems for mission-critical environments, how AI-assisted programming is reshaping engineering workflows, and why the future of operations depends on building platforms where humans and autonomous agents work together.
Full Disclosure: This episode is sponsored by SolarWinds.
Sean’s been an academic, startup founder, and Googler. He has published works covering a wide range of topics from AI to quantum computing. Currently, Sean is an AI Entrepreneur in Residence at Confluent where he works on AI strategy and thought leadership. You can connect with Sean on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Engineering AI Systems for Autonomy and Resilience with Krishna Sai appeared first on Software Engineering Daily.
China’s Great Firewall is often spoken about but is rarely understood. It is one of the most sophisticated and opaque censorship systems on the planet, and it shapes how over a billion people interact with the global internet, influences the design of privacy and proxy tools worldwide, and continues to evolve in ways that challenge researchers, developers, and policymakers alike.
Jackson Sippe is a PhD researcher at the University of Colorado Boulder whose work focuses on uncovering how national-scale censorship systems operate. Jackson recently helped lead a groundbreaking study analyzing a previously undocumented GFW technique that quietly broke fully encrypted proxy protocols across China for more than a year.
In this episode, Jackson joins Gregor Vand to discuss how the Great Firewall works at a technical level, the 2021–2023 blocking event, the popcount-based detection algorithm his team reverse-engineered, the cat-and-mouse ecosystem of censorship circumvention, and what these findings mean for the future of the open internet.
Gregor Vand is a security-focused technologist, having previously been a CTO across cybersecurity, cyber insurance and general software engineering companies. He is based in Singapore and can be found via his profile at vand.hk or on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Inside China’s Great Firewall with Jackson Sippe appeared first on Software Engineering Daily.
LLM -powered systems continue to move steadily into production, but this process is presenting teams with challenges that traditional software practices don’t commonly encounter. Models and agents are non-deterministic systems, which makes it difficult to test changes, reason about failures, and confidently ship updates. This has created the need for new evaluation tooling designed specifically around the properties of LLMs.
Comet is a platform with Roots and MLOps, to the rapidly evolving world of agent-based systems by treating prompts, tools, and workflows as optimizable components that can be evaluated and improved over time.
Gideon Mendels is the co -founder and CEO of Comet. He previously worked at Google on hate speech and deception detection, and he founded GroupWise, which trained and deployed NLP models processing billions of chats. In this episode, Gideon joins Kevin Ball to discuss how agent development sits between software engineering and ML, why eVals are the missing foundation for most AI teams, prompt optimization as a search problem, and the future for continuously improving agents in production.
Full Disclosure: This episode is sponsored by Comet.
Kevin Ball or KBall, is the vice president of engineering at Mento and an independent coach for engineers and engineering leaders. He co-founded and served as CTO for two companies, founded the San Diego JavaScript meetup, and organizes the AI inaction discussion group through Latent Space.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Optimizing Agent Behavior in Production with Gideon Mendels appeared first on Software Engineering Daily.
AI-assisted programming has moved far beyond autocomplete. Large language models are now capable of editing entire codebases, coordinating long-running tasks, and collaborating across multiple systems. As these capabilities mature, the core challenge in software development is shifting away from writing code and toward orchestrating work, managing context, and maintaining shared understanding across fleets of agents.
Steve Yegge is a software engineer, writer, and industry veteran whose essays have shaped how many developers think about their work. Over the past year, Steve has been exploring the frontier of agentic software development, building tools like Beads and Gas Town to experiment with multi-agent coordination, shared memory, and AI-driven software workflows.
In this episode, Steve joins Kevin Ball to discuss the evolution of AI coding from chat-based assistance to full agent orchestration, the technical and cognitive challenges of managing fleets of agents, how concepts like task graphs and Git-backed ledgers change the nature of work, and what these shifts mean for software teams, tooling, and the future of the industry.
Kevin Ball or KBall, is the vice president of engineering at Mento and an independent coach for engineers and engineering leaders. He co-founded and served as CTO for two companies, founded the San Diego JavaScript meetup, and organizes the AI inaction discussion group through Latent Space.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Gas Town, Beads, and the Rise of Agentic Development with Steve Yegge appeared first on Software Engineering Daily.
Python 3.14 is here and continues Python’s evolution toward greater performance, scalability, and usability. The new release formally supports free-threaded, no-GIL mode, introduces template string literals, and implements deferred evaluation of type annotations. It also includes new debugging and profiling tools, along with many other features.
Łukasz Langa is the CPython Developer in Residence at the Python Software Foundation, and he joins Sean Falconer to discuss the 3.14 release, the future of free threading, type system improvements, Python’s growing role in AI, and how the language continues to evolve while maintaining its commitment to backward compatibility.
Sean’s been an academic, startup founder, and Googler. He has published works covering a wide range of topics from AI to quantum computing. Currently, Sean is an AI Entrepreneur in Residence at Confluent where he works on AI strategy and thought leadership. You can connect with Sean on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Python 3.14 with Łukasz Langa appeared first on Software Engineering Daily.
Engineering teams often build microservices as their systems grow, but over time this can lead to a fragmented ecosystem with scattered data access patterns, duplicated business logic, and an uneven developer experience. A unified data graph with a consistent execution layer helps address these challenges by centralizing schema, simplifying how teams compose functionality, and reducing operational overhead while preserving performance and reliability.
Viaduct is Airbnb’s open-source, data-oriented service mesh and GraphQL platform built around a single, highly connected central schema. It has played a major role in scaling Airbnb’s engineering organization.
Adam Miskiewicz is a Principal Software Engineer at Airbnb and he worked on Viaduct. He joins the podcast with Gregor Vand to talk about how Viaduct originated inside Airbnb, the architectural principles that shaped it, the challenges of scaling GraphQL to millions of queries per second, and why the team decided to open-source the platform. They also discuss the future of backend development in an AI-driven world and how unified data layers may influence the next generation of engineering systems.
Gregor Vand is a security-focused technologist, having previously been a CTO across cybersecurity, cyber insurance and general software engineering companies. He is based in Singapore and can be found via his profile at vand.hk or on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Airbnb’s Open-Source GraphQL Framework with Adam Miskiewicz appeared first on Software Engineering Daily.
SED News is a monthly podcast from Software Engineering Daily where hosts Gregor Vand and Sean Falconer unpack the biggest stories shaping software engineering, Silicon Valley, and the broader tech industry.
In this episode, they cover Starlink’s rapid rollout of free, high-speed in-flight internet, Tesla’s move to deprecate Autopilot in favor of full self-driving, and Apple’s reported decision to power Siri with Google’s Gemini models. They also discuss Meta’s $2B acquisition of Manus, Waymo’s growing pains as autonomous vehicles scale, and the competitive shockwaves triggered by Google’s advances in custom AI hardware.
Gregor and Sean then dive deep into the state of the tech job market, examining OpenAI’s decision to eliminate vesting cliffs, the escalating war for elite AI talent, and what recent layoffs really say about the future of software engineering. They explore how AI coding tools are reshaping the balance between junior and senior engineers, why fundamentals still matter, and what developers should focus on heading into 2026.
Finally, they highlight standout threads from Hacker News, including Doom running on wireless earbuds, the enduring appeal of wildly over-engineered side projects, and why hacking for fun still matters in an age of industrial-scale AI.
Gregor Vand is a security-focused technologist, having previously been a CTO across cybersecurity, cyber insurance and general software engineering companies. He is based in Singapore and can be found via his profile at vand.hk or on LinkedIn.
Sean’s been an academic, startup founder, and Googler. He has published works covering a wide range of topics from AI to quantum computing. Currently, Sean is an AI Entrepreneur in Residence at Confluent where he works on AI strategy and thought leadership. You can connect with Sean on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post SED News: Apple Bets on Gemini, Google’s AI Advantage, and the Talent Arms Race appeared first on Software Engineering Daily.
AI coding agents are rapidly reshaping how software is built, reviewed, and maintained. As large language model capabilities continue to increase, the bottleneck in software development is shifting away from code generation toward planning, review, deployment, and coordination. This shift is driving a new class of agentic systems that operate inside constrained environments, reason over long time horizons, and integrate across tools like IDEs, version control systems, and issue trackers.
OpenAI is at the forefront of AI research and product development. In 2025, the company released Codex, which is an agentic coding system designed to work safely inside sandboxed environments while collaborating across the modern software development stack.
Thibault Sottiaux is the Codex engineering lead and Ed Bayes is the Codex product designer. In this episode, they join Kevin Ball to discuss how Codex is built, the co-evolution of models and harnesses, multi-agent futures, Codex’s open-source CLI, model specialization, latency and performance considerations, and much more.
Kevin Ball or KBall, is the vice president of engineering at Mento and an independent coach for engineers and engineering leaders. He co-founded and served as CTO for two companies, founded the San Diego JavaScript meetup, and organizes the AI inaction discussion group through Latent Space.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post OpenAI and Codex with Thibault Sottiaux and Ed Bayes appeared first on Software Engineering Daily.
Engineering teams around the world are building AI-focused applications or integrating AI features into existing products. The AI development ecosystem is maturing, which is accelerating how quickly these applications can be prototyped. However, taking AI applications to production remains a notoriously complex process. Modern AI stacks demand LLMs, embeddings, vector search, observability, new caching layers, and constant adaptation as the landscape shifts week to week. Increasingly, the data layer has become both the foundation and the bottleneck to AI app productionization.
MongoDB has been expanding beyond its core document database into a full AI-ready database platform with integrated capabilities for operational data, search, real-time analytics, and AI-powered data retrieval. The company also recently acquired Voyage AI to provide accurate and cost-effective embedding models and rerankers to its users.
Fred Roma is a veteran engineer and is currently the SVP of Product and Engineering at MongoDB. He joins the show with Kevin Ball to talk about the state of AI application development, the role of vector search and reranking, schema evolution in the LLM era, the Voyage AI acquisition, how data platforms must evolve to keep up with AI’s breakneck pace, and more.
Full Disclosure: This episode is sponsored by MongoDB.
Kevin Ball or KBall, is the vice president of engineering at Mento and an independent coach for engineers and engineering leaders. He co-founded and served as CTO for two companies, founded the San Diego JavaScript meetup, and organizes the AI inaction discussion group through Latent Space.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Production-Grade AI Systems with Fred Roma appeared first on Software Engineering Daily.
Package management sits at the foundation of modern software development, quietly powering nearly every software project in the world. Tools like npm and Yarn have long been the core of the JavaScript ecosystem, enabling developers to install, update, and share code with ease. But as projects grow larger and the ecosystem more complex, this older infrastructure is beginning to show its limits with performance bottlenecks, dependency conflicts, and growing concerns around supply chain security.
Darcy Clarke and Ruy Adorno are veterans of this ecosystem. Both spent years maintaining the npm CLI and helping guide the Node.js project, where they saw firsthand the technical debt and design tradeoffs that define modern JavaScript tooling. Now they’re building vlt, a new package manager and registry that rethinks performance, security, and developer experience from the ground up.
In this episode, Darcy and Ruy join Josh Goldberg to discuss how vlt works, why they believe package management needs a server-side reboot, what lessons they’ve drawn from npm’s evolution, and how features like declarative querying, self-hosted registries, and real-time security scanning could reshape how developers build and share JavaScript in the years ahead.
Josh Goldberg is an independent full time open source developer in the TypeScript ecosystem. He works on projects that help developers write better TypeScript more easily, most notably on typescript-eslint: the tooling that enables ESLint and Prettier to run on TypeScript code. Josh regularly contributes to open source projects in the ecosystem such as ESLint and TypeScript. Josh is a Microsoft MVP for developer technologies and the author of the acclaimed Learning TypeScript (O’Reilly), a cherished resource for any developer seeking to learn TypeScript without any prior experience outside of JavaScript. Josh regularly presents talks and workshops at bootcamps, conferences, and meetups to share knowledge on TypeScript, static analysis, open source, and general frontend and web development.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Next-Gen JavaScript Package Management with Ruy Adorno and Darcy Clarke appeared first on Software Engineering Daily.
WebAssembly, or WASM, has grown from a low-level compilation target for C and C++ into one of the most influential technologies in modern computing. It now powers browser applications, edge compute platforms, embedded systems, and a growing ecosystem of languages targeting a portable and secure execution model.
Andreas Rossberg is a programming languages researcher and former member of the V8 team at Google. Andreas helped architect WebAssembly from its earliest concepts through its most recent milestone releases, including the groundbreaking 3.0 spec that introduces garbage collection, richer reference types, and major steps toward multi-language interoperability.
In this episode, Andreas joins Kevin Ball to explore the history of WebAssembly, the constraints that shaped its earliest design, the major turning points in versions 1.0, 2.0, and 3.0, and what’s coming next for WebAssembly.
Kevin Ball or KBall, is the vice president of engineering at Mento and an independent coach for engineers and engineering leaders. He co-founded and served as CTO for two companies, founded the San Diego JavaScript meetup, and organizes the AI inaction discussion group through Latent Space.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post WebAssembly 3.0 with Andreas Rossberg appeared first on Software Engineering Daily.
Surveillance technology is advancing faster than the laws meant to govern it. Across the United States, police departments are deploying automated license plate readers, facial recognition tools, and predictive systems that quietly log the daily movements of millions of people. These tools promise efficiency and safety, but critics argue that they represent a form of warrantless mass surveillance, and raise deep constitutional questions about privacy, accountability, and the limits of government power in the digital age.
Michael Soyfer is an attorney at the Institute for Justice, a nonprofit public interest law firm focused on defending individual rights. His work centers on the Fourth Amendment and the growing use of surveillance technologies by local governments. Michael joins the show with Kevin Ball to discuss the rise of Flock Safety cameras, the Institute for Justice’s lawsuit against the City of Norfolk, how decades-old legal precedents struggle to keep up with modern technology, and what citizens, technologists, and policymakers can do to protect privacy in an era of pervasive data collection.
Kevin Ball or KBall, is the vice president of engineering at Mento and an independent coach for engineers and engineering leaders. He co-founded and served as CTO for two companies, founded the San Diego JavaScript meetup, and organizes the AI inaction discussion group through Latent Space.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post America Under Surveillance with Michael Soyfer appeared first on Software Engineering Daily.
Modern software development is evolving rapidly. New tools, processes, and AI-powered systems are reshaping how teams collaborate and how engineers find satisfaction in their craft. At the same time, developer experience has become a critical function for helping organizations balance agility, security, and scale while maintaining the creativity and flow that make top tier engineering possible.
Capital One is continuously transforming its developer culture, with a focus on faster development cycles, reducing operational overhead, and boosting productivity across the organization.
Catherine McGarvey is the SVP of Developer Experience at Capital One. She joins the podcast with Sean Falconer to talk about what developer enablement means at enterprise scale, measuring developer productivity, being agile in a regulated environment, AI in enterprise development, the future for developers, and much more.
Full Disclosure: This episode is sponsored by Capital One.
Sean’s been an academic, startup founder, and Googler. He has published works covering a wide range of topics from AI to quantum computing. Currently, Sean is an AI Entrepreneur in Residence at Confluent where he works on AI strategy and thought leadership. You can connect with Sean on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Developer Experience at Capital One with Catherine McGarvey appeared first on Software Engineering Daily.
Modern software development is more complex than ever. Teams work across different operating systems, chip architectures, and cloud environments, each with its own dependency quirks and version mismatches. Ensuring that code runs reproducibly across these environments has become a major challenge that’s made even harder by growing concerns around software supply chain security.
Nix is a powerful open-source package manager that builds software in controlled, declarative environments where dependencies are explicitly defined and reproducible. Its functional approach has made it a gold standard for reproducible builds, but it can also be difficult to learn and adopt.
Flox is a company that builds on top of Nix, with increased supply chain security and abstractions that streamline the developer experience.
Michael Stahnke is the VP of Engineering at Flox and formerly worked at companies including Caterpillar, Puppet, and CircleCI. He joins the podcast with Kevin Ball to talk about Flox, building on top of Nix, how reproducibility underpins software security, the concept of “secure by construction, how deterministic environments are reshaping both human and AI-driven development, and much more.
Full Disclosure: This episode is sponsored by Flox.
Kevin Ball or KBall, is the vice president of engineering at Mento and an independent coach for engineers and engineering leaders. He co-founded and served as CTO for two companies, founded the San Diego JavaScript meetup, and organizes the AI inaction discussion group through Latent Space.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Flox, Nix, and Reproducible Software Systems with Michael Stahnke appeared first on Software Engineering Daily.
Visual Studio Code has become one of the most influential tools in modern software development. The open-source code editor has evolved into a platform used by millions of developers around the world, and it has reshaped expectations for what a modern development environment can be through its intuitive UX, rich extension marketplace, and deep integration with today’s tooling landscape. Now, in an era defined by rapid advances in AI-assisted programming, VS Code is at the center of a profound shift in how software is written.
Kai Maetzel is the Engineering Manager leading the VS Code team at Microsoft. He joins the show with Kevin Ball to talk about the origins of VS Code, how AI has reshaped the editor’s design philosophy, the rise of agentic programming models, and what the future of development might look like.
Kevin Ball or KBall, is the vice president of engineering at Mento and an independent coach for engineers and engineering leaders. He co-founded and served as CTO for two companies, founded the San Diego JavaScript meetup, and organizes the AI inaction discussion group through Latent Space.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post VS Code and Agentic Development with Kai Maetzel appeared first on Software Engineering Daily.
Blender Studio is the creative arm of the Blender Foundation and it’s dedicated to producing films, games, and other projects that showcase the full potential of Blender. The studio functions as both an art and technology lab and pushes the boundaries of 3D animation through open productions. All of their assets, production files, and workflows are shared publicly, which gives artists and developers valuable resources to learn from and build upon.
Most recently, Blender Studio released its second game, DOGWALK, where the playable character is a dog exploring snowy winter woods with a child. The project was built entirely with open-source tools including Blender, the Godot engine, Krita for concept art, Kitsu for project management, and Linux.
Simon Thommes is a Lead Technical Artist at Blender Studio and a developer on DOGWALK. He joins the podcast with Joe Nash to talk about Blender Studio, the process behind building DOGWALK, and developing a pipeline between Blender and Godot.
Joe Nash is a developer, educator, and award-winning community builder, who has worked at companies including GitHub, Twilio, Unity, and PayPal. Joe got his start in software development by creating mods and running servers for Garry’s Mod, and game development remains his favorite way to experience and explore new technologies and concepts.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Blender and Godot in Game Development with Simon Thommes appeared first on Software Engineering Daily.
JavaScript has grown far beyond the browser. It now powers millions of backend systems, APIs, and cloud services through Node.js, which is one of the most widely deployed runtimes on the planet. Keeping such a critical piece of infrastructure fast, secure, and stable is a massive engineering challenge, and the work behind it is often invisible.
Rafael Gonzaga is a Principal Open Source Engineer at NodeSource and a member of the Node.js Technical Steering Committee. He’s spent years digging into the performance and security layers of Node’s core, helping shape the direction of the runtime itself. Rafael joins the show to talk about the state of Node.js performance, how benchmarking really works, the balance between speed and stability, and what it means to contribute to one of the world’s most important open-source projects.
Josh Goldberg is an independent full time open source developer in the TypeScript ecosystem. He works on projects that help developers write better TypeScript more easily, most notably on typescript-eslint: the tooling that enables ESLint and Prettier to run on TypeScript code. Josh regularly contributes to open source projects in the ecosystem such as ESLint and TypeScript. Josh is a Microsoft MVP for developer technologies and the author of the acclaimed Learning TypeScript (O’Reilly), a cherished resource for any developer seeking to learn TypeScript without any prior experience outside of JavaScript. Josh regularly presents talks and workshops at bootcamps, conferences, and meetups to share knowledge on TypeScript, static analysis, open source, and general frontend and web development.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Node.js in 2026 with Rafael Gonzaga appeared first on Software Engineering Daily.
Zachtronics is a legendary independent game studio known for creating intricate, engineering-focused puzzle games that merge logic, creativity, and code. The studio was founded by Zach Barth in 2011, and it has become a cult favorite among programmers and tinkerers alike with titles such as SpaceChem, Infinifactory, TIS-100, and Shenzhen I/O. Most recently, Zachtronics released Kaizen: A Factory Story, in which players take on the role of an American engineer hired by a Japanese manufacturing company in the 1980s to design assembly processes for various products.
Zach Barth joins the podcast with Joe Nash to talk about the games he makes.
Joe Nash is a developer, educator, and award-winning community builder, who has worked at companies including GitHub, Twilio, Unity, and PayPal. Joe got his start in software development by creating mods and running servers for Garry’s Mod, and game development remains his favorite way to experience and explore new technologies and concepts.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Designing Innovative Puzzle Games with Zach Barth appeared first on Software Engineering Daily.
Rivals of Aether and Rivals of Aether II are indie fighting games that combine fast-paced platform combat with elemental-themed characters. The game takes inspiration from Super Smash Bros. and emphasizes skillful movement, tight controls, and competitive balance, making it popular in the fighting game community.
Dan Fornace is a game director and designer at Aether Studios, the developer of Rivals of Aether. He joins the show with Joe Nash to talk about developing platform fighting games.
Joe Nash is a developer, educator, and award-winning community builder, who has worked at companies including GitHub, Twilio, Unity, and PayPal. Joe got his start in software development by creating mods and running servers for Garry’s Mod, and game development remains his favorite way to experience and explore new technologies and concepts.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Rivals of Aether with Dan Fornace appeared first on Software Engineering Daily.
Aviation cybersecurity is becoming an urgent priority as modern aircraft increasingly rely on complex digital systems for navigation, communication, and engine performance. These systems were once isolated but are now interconnected and vulnerable to cyber threats ranging from GPS spoofing to ransomware attacks on airline infrastructure. As nation-state actors and criminal groups grow more sophisticated, the aviation sector faces a rapidly expanding attack surface, with life-or-death consequences. Understanding and addressing these risks is essential not only for passenger safety but for the resilience of global transportation networks.
Serge Christiaans is a former Dutch Air Force pilot with a background in electronic and hybrid warfare. He later flew commercially for Singapore Airlines and is now the Lead Instructor and Program Director at the Aviation Cyber Academy. He joins the podcast with Gregor Vand to discuss the convergence of aviation and cybersecurity, the aircraft as a digital attack surface, hybrid warfare, the urgent need for aviation cyber resilience, and much more.
Gregor Vand is a security-focused technologist, having previously been a CTO across cybersecurity, cyber insurance and general software engineering companies. He is based in Singapore and can be found via his profile at vand.hk or on LinkedIn.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Aviation Cybersecurity with Serge Christiaans appeared first on Software Engineering Daily.
Modern software relies heavily on open source dependencies, often pulling in thousands of packages maintained by developers all over the world. This accelerates innovation but also creates serious supply chain risks as attackers increasingly compromise popular libraries to spread malware at scale.
Feross Aboukhadijeh is the founder and CEO of Socket which is a security platform designed to protect software projects from open source supply chain attacks. In this episode he joins Josh Goldberg to talk about his career in open source, open source supply chain attacks, practical security lessons, the expanding attack surface in software development, and more.
Josh Goldberg is an independent full time open source developer in the TypeScript ecosystem. He works on projects that help developers write better TypeScript more easily, most notably on typescript-eslint: the tooling that enables ESLint and Prettier to run on TypeScript code. Josh regularly contributes to open source projects in the ecosystem such as ESLint and TypeScript. Josh is a Microsoft MVP for developer technologies and the author of the acclaimed Learning TypeScript (O’Reilly), a cherished resource for any developer seeking to learn TypeScript without any prior experience outside of JavaScript. Josh regularly presents talks and workshops at bootcamps, conferences, and meetups to share knowledge on TypeScript, static analysis, open source, and general frontend and web development.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Blocking Software Supply Chain Attacks with Feross Aboukhadijeh appeared first on Software Engineering Daily.
Python’s popularity in data science and backend engineering has made it the default language for building AI infrastructure. However, with the rapid growth of AI applications, developers are increasingly looking for tools that combine Python’s flexibility with the rigor of production-ready systems.
Pydantic began as a library for type-safe data validation in Python and has become one of the language’s most widely adopted projects. More recently, the Pydantic team created Pydantic AI, a type-safe agent framework for building reliable AI systems in Python.
Samuel Colvin is the creator of Pydantic and Pydantic AI. In this episode, he joins the podcast with Gregor Vand to discuss the origins of Pydantic, the design principles behind type safety in AI applications, the evolution of Pydantic AI, the LogFire observability platform, and how open-source sustainability and engineering discipline are shaping the next generation of AI tooling.
Gregor Vand is a security-focused technologist, having previously been a CTO across cybersecurity, cyber insurance and general software engineering companies. He is based in Singapore and can be found via his profile at vand.hk or on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Pydantic AI with Samuel Colvin appeared first on Software Engineering Daily.
SED News is a monthly podcast from Software Engineering Daily where hosts Gregor Vand and Sean Falconer unpack the biggest stories shaping software engineering, Silicon Valley, and the broader tech industry.
In this episode, they cover Jeff Bezos’s unexpected return to the CEO seat with Project Prometheus, the growing debate over whether AI investments are sustainable, and the ecosystem forming around OpenAI. They also dig into the surge of Nordic startups, and what it signals about innovation hotspots outside the Bay Area.
Gregor and Sean then dive deep into the idea of technology tipping points, when breakthrough products finally cross the threshold from fringe curiosity to mainstream adoption.
Finally, they highlight standout threads from Hacker News, including moss surviving in outer space, a typographer’s re-creation of San Francisco’s light-rail signage, CERN’s guiding principles for responsible AI adoption, and why classic Pixar films looked better on 35mm than they do in 4K.
Gregor Vand is a security-focused technologist, having previously been a CTO across cybersecurity, cyber insurance and general software engineering companies. He is based in Singapore and can be found via his profile at vand.hk or on LinkedIn.
Sean’s been an academic, startup founder, and Googler. He has published works covering a wide range of topics from AI to quantum computing. Currently, Sean is an AI Entrepreneur in Residence at Confluent where he works on AI strategy and thought leadership. You can connect with Sean on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post SED News: Bezos Returns to Building, AI’s Reality Check, and Europe’s Cloud Ambitions appeared first on Software Engineering Daily.
PICO-8 is a software-based gaming console for making, sharing, and playing small games with a retro aesthetic. It emulates the look and feel of 8-bit consoles, providing limited color palettes, screen resolutions, and memory constraints.
The PICO-8 dev environment uses Lua and is focused on being accessible to developers while offering depth for complex projects.
Johan Peitz is a games industry veteran and developer extraordinaire, having created dozens of games across many platforms. He’s an expert in PICO-8 development, and joins the podcast to talk about creating games for the console.
Joe Nash is a developer, educator, and award-winning community builder, who has worked at companies including GitHub, Twilio, Unity, and PayPal. Joe got his start in software development by creating mods and running servers for Garry’s Mod, and game development remains his favorite way to experience and explore new technologies and concepts.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Game Development on the PICO-8 with Johan Peitz appeared first on Software Engineering Daily.
Doom has seemingly been ported to every electronic device imaginable, including picture frames, lamps, and coffee machines. The meme of “it runs Doom” has become so widespread that it spawned the r/itrunsdoom sub-Reddit.
Recently, Doom made headlines again for being ported to TypeScript. The project involved representing Doom entirely in TypeScript, three and a half trillion lines of types, 90 GB of RAM to run, and a full year to complete.
Dimitri Mitropoulos is the engineer who carried out this heroic feat. He’s also a developer at Vercel, the founder of Michigan Typescript, and a co-founder of SquiggleConf. Dimitri joins the podcast with Josh Goldberg to talk about what it took to pull off one of the most mind-bending TypeScript projects to date.
Josh Goldberg is an independent full time open source developer in the TypeScript ecosystem. He works on projects that help developers write better TypeScript more easily, most notably on typescript-eslint: the tooling that enables ESLint and Prettier to run on TypeScript code. Josh regularly contributes to open source projects in the ecosystem such as ESLint and TypeScript. Josh is a Microsoft MVP for developer technologies and the author of the acclaimed Learning TypeScript (O’Reilly), a cherished resource for any developer seeking to learn TypeScript without any prior experience outside of JavaScript. Josh regularly presents talks and workshops at bootcamps, conferences, and meetups to share knowledge on TypeScript, static analysis, open source, and general frontend and web development.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Running Doom in TypeScript with Dimitri Mitropoulos appeared first on Software Engineering Daily.
Simon Shuster is a journalist who has reported on Russia and Ukraine for over 15 years, most of that time as a staff correspondent for TIME Magazine. He was born in Moscow, and he and his family came to the United States as refugees from the Soviet Union when he was six years old.
After graduating from Stanford University in 2005, Simon returned to Moscow to work as a reporter for The Moscow Times, Reuters, the Associated Press and other publications. His political coverage of Russia’s descent into authoritarianism included numerous profiles of Vladimir Putin and interviews with top Russian officials. He has also interviewed and profiled the last three presidents of Ukraine.
Simon has spent years covering the war in Ukraine from both sides of the front lines. The year after the annexation of Crimea, Russian authorities deemed Simon a security threat and banned him from entering the country.
Simon is the author of the 2024 book The Showman: Inside the Invasion That Shook the World and Made a Leader of Volodymyr Zelensky, and he recently wrote the TIME Magazine article “How Ukraine Gamified Drone Warfare.”
He is currently at work on a new book that examines the future of warfare and how the lessons and technologies that emerged from the war in Ukraine are changing warfare and security around the world.
Simon joins the podcast with Kevin Ball to discuss drone warfare, AI-assisted targeting, the gamification of drone combat, the rapid iteration cycle of drone innovation, new ethical dilemmas in warfare, the coming proliferation of war drones, and the shifting balance of global power.
Kevin Ball or KBall, is the vice president of engineering at Mento and an independent coach for engineers and engineering leaders. He co-founded and served as CTO for two companies, founded the San Diego JavaScript meetup, and organizes the AI inaction discussion group through Latent Space.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Drone Warfare in Ukraine with Simon Shuster appeared first on Software Engineering Daily.
Radix UI is an open-source library of React components. Its “headless” primitives handle the complex logic and accessibility concerns—like dialogs, dropdowns, and tabs—while leaving styling completely up to the developer. The project emphasizes usability, accessibility, and composability and has become a vital part of modern web dev, in part because it forms the foundation of shad/cn UI.
Chance Strickland is a software engineer at WorkOS and a maintainer of Radix UI. Chase joins the show with Nick Nisi to talk about Radix, its primitives, Radix’s relationship with shad/cn UI, the evolution of web primitives, and much more.
Nick Nisi is a conference organizer, speaker, and developer focused on tools across the web ecosystem. He has organized and emceed several conferences and has led NebraskaJS for more than a decade. Nick currently works as a developer experience engineer at WorkOS.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Radix UI with Chance Strickland appeared first on Software Engineering Daily.
The Stack Overflow Developer Survey is an annual survey conducted by Stack Overflow that gathers comprehensive insights from developers around the world. It offers a valuable snapshot of the global developer community, covering a wide range of topics such as preferred programming languages, tools, and technologies.
Jody Bailey is the Chief Product and Technology Officer at Stack Overflow and Erin Yepis is a Research Manager at Stack Overflow. They join the show with Sean Falconer to talk about the results of the 2025 Developer Survey, which was recently released.
Sean’s been an academic, startup founder, and Googler. He has published works covering a wide range of topics from AI to quantum computing. Currently, Sean is an AI Entrepreneur in Residence at Confluent where he works on AI strategy and thought leadership. You can connect with Sean on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post The 2025 Stack Overflow Developer Survey with Jody Bailey and Erin Yepis appeared first on Software Engineering Daily.
Byran Huang is a full stack developer who recently made headlines in the hacker space when he created the anyon_e, which is a highly integrated, open source laptop. The effort was a massive undertaking and showcased great design, hardware, and software.
In this episode, Byran joins the show with Gregor Vand to talk about his work on the anyon_e laptop.
Gregor Vand is a security-focused technologist, having previously been a CTO across cybersecurity, cyber insurance and general software engineering companies. He is based in Singapore and can be found via his profile at vand.hk or on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Building an Open-Source Laptop with Byran Huang appeared first on Software Engineering Daily.
The modern internet is a vast web of independent networks bound together by billions of routing decisions made every second. It’s an architecture so reliable we mostly take it for granted, but behind the scenes it represents one of humanity’s greatest engineering achievements. Today’s internet is also dramatically more complex and capable than in its early years.
Erik Seidel is a Network Engineer at Cloudflare, where he focuses on automating global network infrastructure. He joins the show to discuss his unique journey into tech, the fundamentals of how the internet works, the Border Gateway Protocol, peering versus transit, Cloudflare’s architecture, networking in China, and much more.
Gregor Vand is a security-focused technologist, having previously been a CTO across cybersecurity, cyber insurance and general software engineering companies. He is based in Singapore and can be found via his profile at vand.hk or on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post The Architecture of the Internet with Erik Seidel appeared first on Software Engineering Daily.
SED News is a monthly podcast from Software Engineering Daily where hosts Gregor Vand and Sean Falconer unpack the biggest stories shaping software engineering, Silicon Valley, and the broader tech industry.
In this episode, they cover the $1.7B acquisition of Security AI, LangChain’s massive valuation, and the surprise $300M funding” round for Periodic Labs. They also break down the massive AWS outage, Apple’s rare reversal on its glass UI design, and the emerging web of trillion-dollar AI infrastructure deals centered around OpenAI.
Gregor and Sean then dive deep into the world of chipmakers, exploring how Intel is fighting to survive, AMD’s new partnership and 10% investment from OpenAI, Apple’s long-term bet on on-device AI with its M5 chips, and NVIDIA’s push to defend its dominance amid growing custom-chip competition.
Finally, they highlight standout threads from Hacker News, including developers rediscovering the joy of curl, a hacker’s clever teardown of Kindle’s DRM protections, and more.
Gregor Vand is a security-focused technologist, having previously been a CTO across cybersecurity, cyber insurance and general software engineering companies. He is based in Singapore and can be found via his profile at vand.hk or on LinkedIn.
Sean’s been an academic, startup founder, and Googler. He has published works covering a wide range of topics from AI to quantum computing. Currently, Sean is an AI Entrepreneur in Residence at Confluent where he works on AI strategy and thought leadership. You can connect with Sean on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post SED News: AMD’s Big OpenAI Deal, Intel’s Struggles, and Apple’s AI Long Game appeared first on Software Engineering Daily.
Most AI agent frameworks are backend-focused and written in Python, which introduces complexity when building full-stack AI applications with JavaScript or TypeScript frontends. This gap makes it harder for frontend developers to prototype, integrate, and iterate on AI-powered features.
Mastra is an open-source TypeScript framework focused on building AI agents and has primitives such as agents, tools, workflows, and RAG.
Sam Bhagwat and Abhi Aiyer are co-founders at Mastra. They join the podcast with Nick Nisi to talk about this state of frontend tooling for AI agents, AI agent primitives, MCP integration, and more.
Nick Nisi is a conference organizer, speaker, and developer focused on tools across the web ecosystem. He has organized and emceed several conferences and has led NebraskaJS for more than a decade. Nick currently works as a developer experience engineer at WorkOS.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Building AI Agents on the Frontend with Sam Bhagwat and Abhi Aiyer appeared first on Software Engineering Daily.
X-Plane is a popular flight simulator developed by Laminar Research. It features a first-principles physics engine, realistic aircraft systems, and a wide variety of aircraft.
We wanted to understand the engineering that goes into creating a flight simulator so we invited Ben Supnik on the show. Ben is a software engineer at Laminar and he’s been working on X-Plane for the past 20 years. He joins the show with Kevin Ball to talk about X-Plane and his career working on the simulator.
Kevin Ball or KBall, is the vice president of engineering at Mento and an independent coach for engineers and engineering leaders. He co-founded and served as CTO for two companies, founded the San Diego JavaScript meetup, and organizes the AI inaction discussion group through Latent Space.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post The X-Plane Flight Simulator with Ben Supnik appeared first on Software Engineering Daily.
A common challenge in software development is creating and maintaining robust development environments. The rise of AI agents has amplified this complexity by adding new demands around permission controls, environment isolation, and resource management.
Ona is a platform for AI-native software development and engineering agents. The platform combines autonomous agents with secure, standardized environments, with a focus on giving enterprises control, security, and productivity so they can scale AI-native engineering without scaling risk.
Chris Weichel has more than two decades of experience spanning software engineering and human–computer interaction. He is currently the Chief Technology Officer at Ona – formerly Gitpod – where he leads the engineering team behind the company’s cloud-native development platform. Chris joins the podcast with Kevin Ball to talk about Ona, the impact of coding with parallel agents, the future of IDEs, choosing agent-friendly languages, code review as a new bottleneck in the software development lifecycle, and much more.
Full Disclosure: This episode is sponsored by Ona formerly Gitpod.
Kevin Ball or KBall, is the vice president of engineering at Mento and an independent coach for engineers and engineering leaders. He co-founded and served as CTO for two companies, founded the San Diego JavaScript meetup, and organizes the AI inaction discussion group through Latent Space.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Turning Agent Autonomy into Productivity with Chris Weichel appeared first on Software Engineering Daily.
Homebrew is a widely used package manager that simplifies the installation of open-source software on macOS. It was created in response to the growing demand for a lightweight, developer-friendly tool suited to an increasingly Mac-centric development ecosystem. Today, Homebrew is a near-essential part of the macOS software development toolkit.
Mike McQuaid joined the project early on and collaborated closely with its creator, Max Howell. He joins the podcast with Kevin Ball to discuss Homebrew’s origins, architecture, its emphasis on automation and CI/CD, long-term sustainability, controversial trade-offs, and much more.
Kevin Ball or KBall, is the vice president of engineering at Mento and an independent coach for engineers and engineering leaders. He co-founded and served as CTO for two companies, founded the San Diego JavaScript meetup, and organizes the AI inaction discussion group through Latent Space.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Homebrew and macOS Package Management with Mike McQuaid appeared first on Software Engineering Daily.
Modern software platforms are increasingly composed of diverse microservices, third-party APIs, and cloud resources. The distributed nature of these systems makes it difficult for engineers to gain a clear view of how their systems behave, which can slow down troubleshooting and increase operational risk.
groundcover is an observability platform that uses eBPF sensors to capture logs, metrics, and traces directly from the kernel. Critically, groundcover runs on a bring-your-own-cloud model so all data remains within the user’s own environment, which gives increased privacy, security, and cost efficiency.
The company is also focused on adapting to how AI-generated code is changing observability. Code can now be produced at superhuman speed, which increases the challenges for reviewing code before it enters production. This means that observability is likely to play a growing role in code validation and providing guardrails.
Yechezkel Rabinovich, or Chez, is the CTO and Co-founder of groundcover. He joins the podcast with Kevin Ball to discuss his journey from kernel engineering to building an eBPF-powered observability company. The conversation explores the power of eBPF, the realities of observability in modern systems, the impact of AI on software development and security, and where the future of root-cause analysis is headed.
Full Disclosure: This episode is sponsored by groundcover.
Kevin Ball or KBall, is the vice president of engineering at Mento and an independent coach for engineers and engineering leaders. He co-founded and served as CTO for two companies, founded the San Diego JavaScript meetup, and organizes the AI inaction discussion group through Latent Space.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Engineering in the Age of Agents with Yechezkel Rabinovich appeared first on Software Engineering Daily.
Dynamic languages like Ruby, Python, and JavaScript determine the types of variables at runtime rather than at compile time. This flexibility allows for rapid development and concise code, but it also makes it harder to catch certain classes of bugs before execution. Type checkers for dynamic languages add structure and safety without compromising their expressive power.
Sorbet is a static type checker developed by the Stripe team and designed specifically for Ruby. The motivation behind Sorbet stemmed from the growing complexity of production Ruby applications, where developers needed stronger guarantees and more scalable code quality tools than dynamic typing alone could offer.
Jake Zimmerman is a software engineer at Stripe and leads development on Sorbet. He joins the podcast with Josh Goldberg to discuss his background, the challenges of typing in Ruby, the motivation behind Sorbet, its architecture, performance optimizations, and more.
Josh Goldberg is an independent full time open source developer in the TypeScript ecosystem. He works on projects that help developers write better TypeScript more easily, most notably on typescript-eslint: the tooling that enables ESLint and Prettier to run on TypeScript code. Josh regularly contributes to open source projects in the ecosystem such as ESLint and TypeScript. Josh is a Microsoft MVP for developer technologies and the author of the acclaimed Learning TypeScript (O’Reilly), a cherished resource for any developer seeking to learn TypeScript without any prior experience outside of JavaScript. Josh regularly presents talks and workshops at bootcamps, conferences, and meetups to share knowledge on TypeScript, static analysis, open source, and general frontend and web development.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Static Analysis for Ruby with Jake Zimmerman appeared first on Software Engineering Daily.
The rise of language-model coding assistants has led to the creation of the vibe coding paradigm. In this mode of software development, AI agents take a plain language prompt and generate entire applications, which dramatically lowers the barriers to entry and democratizes access to software creation.
However, many enterprise environments have large, legacy codebases and these sprawling systems are complex, interdependent, and far less amenable to the greenfield style of vibe coding. Working effectively within them requires deep context awareness, something language models commonly struggle to maintain.
Augment Code is an AI coding assistant that focuses on contextual understanding of large codebases in enterprise settings. It emphasizes tooling to manage large development surface areas while automating PRs and code review.
Guy Gur-Ari is a Co-Founder at Augment. He has a PhD in physics and was previously a Research Scientist at Google where he worked on AI reasoning in math and science. Guy joins the podcast with Kevin Ball to talk about Augment Code, its focus on full context for large enterprise codebases, code review as the new bottleneck in AI-driven development, and much more.
Full Disclosure: This episode is sponsored by Augment Code.
Kevin Ball or KBall, is the vice president of engineering at Mento and an independent coach for engineers and engineering leaders. He co-founded and served as CTO for two companies, founded the San Diego JavaScript meetup, and organizes the AI inaction discussion group through Latent Space.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Scaling AI in Enterprise Codebases with Guy Gur-Ari appeared first on Software Engineering Daily.
SED News is a monthly podcast from Software Engineering Daily where hosts Gregor Vand and Sean Falconer unpack the biggest stories shaping software engineering, Silicon Valley, and the broader tech industry.
In this episode, they cover NVIDIA‘s $5B investment in Intel and $100M stake in OpenAI, Meta’s stumble with its AR glasses demo, and the surprise $50B private equity acquisition of Electronic Arts. They also break down Anthropic’s record-setting Series F round and what Google’s Genie 3 “world model” reveals about the next frontier of AI.
Gregor and Sean then zoom things out to debate the future of devices and hardware. They cover Apple’s underwhelming Vision Pro to Snap’s all-in bet on AR specs, and what form factors might actually matter for developers.
Finally, they highlight standout projects from Hacker News, including hosting a website on a disposable vape, playing Snake in your browser’s address bar, and Slack’s six-figure billing fiasco that the community helped reverse.
Gregor Vand is a security-focused technologist, having previously been a CTO across cybersecurity, cyber insurance and general software engineering companies. He is based in Singapore and can be found via his profile at vand.hk or on LinkedIn.
Sean’s been an academic, startup founder, and Googler. He has published works covering a wide range of topics from AI to quantum computing. Currently, Sean is an AI Entrepreneur in Residence at Confluent where he works on AI strategy and thought leadership. You can connect with Sean on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post SED News: NVIDIA Bets on Intel, Meta’s Demo Crash, and Anthropic’s Explosive Growth appeared first on Software Engineering Daily.
Modern software systems are composed of many independent microservices spanning frontends, backends, APIs, and AI models, and coordinating and scaling them reliably is a constant challenge. A workflow orchestration platform addresses this by providing a structured framework to define, execute, and monitor complex workflows with resilience and clarity.
Orkes is an enterprise-scale agentic orchestration platform that builds on the open-source Conductor project, which was pioneered at Netflix. The platform coordinates AI agents, humans and APIs, with a focus on scalability, compliance, and trust. It further expands on the Conductor core by adding features like security, governance, and long-running workflows.
Viren Baraiya is the Founder and CTO at Orkes, and he’s the creator of Netflix Conductor. Viren joins the show with Gregor Vand to talk about his building Conductor at Netflix, the challenge of orchestrating microservices, rule-based versus programmatic workflow orchestration, agentic orchestration, MCP integration, and much more.
Full Disclosure: This episode is sponsored by Orkes.
Gregor Vand is a security-focused technologist, having previously been a CTO across cybersecurity, cyber insurance and general software engineering companies. He is based in Singapore and can be found via his profile at vand.hk or on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Orkes and Agentic Workflow Orchestration with Viren Baraiya appeared first on Software Engineering Daily.
Vector search has become a foundational technology for AI applications, enabling everything from semantic code search to contextual retrieval for large language models. However, a major challenge with vector databases has been the cost as data storage scales.
Turbopuffer is a vector database that focuses on speed, cost and scalability. It was created by Simon Hørup Eskildsen and Justin Li in 2023 and has seen adoption from high-profile companies such as Cursor and Notion.
Simon joins the podcast with Gregor Vand to discuss the origin of turbopuffer, its unique technical design, the economics of vector storage, and more.
Gregor Vand is a security-focused technologist, having previously been a CTO across cybersecurity, cyber insurance and general software engineering companies. He is based in Singapore and can be found via his profile at vand.hk or on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Turbopuffer with Simon Hørup Eskildsen appeared first on Software Engineering Daily.
Cassette Beasts is a turn-based monster-battling RPG that lets players record creatures onto cassette tapes and transform into them during battle. The game was an indie hit, and is also one of the most successful games built with the open source Godot Engine.
Jay Baylis and Tom Coxon are the creators of Cassette Beasts at Bytten Studio. They join the show with Joe Nash to talk about the development of their game.
Joe Nash is a developer, educator, and award-winning community builder, who has worked at companies including GitHub, Twilio, Unity, and PayPal. Joe got his start in software development by creating mods and running servers for Garry’s Mod, and game development remains his favorite way to experience and explore new technologies and concepts.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Building an Indie Hit in Godot with Jay Baylis and Tom Coxon appeared first on Software Engineering Daily.
A challenge in modern frontend application design is efficiently fetching and managing GraphQL data while keeping UI components responsive and maintainable. Developers often face issues like over-fetching, under-fetching, and handling complex query dependencies, which can lead to performance bottlenecks and increased development effort.
Relay is a JavaScript framework developed by Meta for managing GraphQL data in React applications. It’s designed to optimize data fetching by colocating queries with components, ensuring that each part of the UI declares its own data dependencies.
Robert Balicki was on the Relay team at Meta and is now a Staff Software Engineer at Pinterest. He is currently developing Isograph, which provides a declarative and type-safe approach to data fetching.
Robert joins the show to talk about challenges and solutions for managing data in frontend applications.
Gregor Vand is a security-focused technologist, having previously been a CTO across cybersecurity, cyber insurance and general software engineering companies. He is based in Singapore and can be found via his profile at vand.hk or on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Rethinking GraphQL Frontends with Robert Balicki appeared first on Software Engineering Daily.
Traditional package management systems for JavaScript have faced several inefficiencies related to dependency storage, resolution, and project performance.
pnpm is a fast, disk-efficient package manager for JavaScript and TypeScript projects, serving as an alternative to npm and Yarn. Due to its efficiency and reliability, pnpm is increasingly popular for managing monorepos and large-scale applications.
Zoltan Kochan is a full stack web developer and the creator of pnpm. He joins the show with Josh Goldberg to talk about his background and package management in the web.
Josh Goldberg is an independent full time open source developer in the TypeScript ecosystem. He works on projects that help developers write better TypeScript more easily, most notably on typescript-eslint: the tooling that enables ESLint and Prettier to run on TypeScript code. Josh regularly contributes to open source projects in the ecosystem such as ESLint and TypeScript. Josh is a Microsoft MVP for developer technologies and the author of the acclaimed Learning TypeScript (O’Reilly), a cherished resource for any developer seeking to learn TypeScript without any prior experience outside of JavaScript. Josh regularly presents talks and workshops at bootcamps, conferences, and meetups to share knowledge on TypeScript, static analysis, open source, and general frontend and web development.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post pnpm with Zoltan Kochan appeared first on Software Engineering Daily.
Modern application development often involves juggling multiple types of databases to handle diverse data models. The lack of unification can lead to complex architectures with attendant security concerns and fragmented development workflows.
SurrealDB is an open-source, multi-model database developed in Rust and integrates functionalities of many databases including relational, document, graph, time series, search and vector databases. It supports both schema-less and schema-full data models and has a SQL-like query language.
The project has rapidly grown in popularity, and version 3.0 was just released with a focus on enabling AI-powered analysis of unstructured data directly within the database, along with tooling for building event-driven applications.
Tobie Morgan Hitchcock is the CEO and co-founder of SurrealDB. He joins the podcast with Kevin Ball to talk about SurrealDB, handling multi-model data, unstructured data processing, building event driven AI applications, coupling databases with AI models, and more.
Full Disclosure: This episode is sponsored by SurrealDB.
Kevin Ball or KBall, is the vice president of engineering at Mento and an independent coach for engineers and engineering leaders. He co-founded and served as CTO for two companies, founded the San Diego JavaScript meetup, and organizes the AI inaction discussion group through Latent Space.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post SurrealDB 3.0 and Building Event-Driven AI Applications with Tobie Morgan Hitchcock appeared first on Software Engineering Daily.
Modern web development faces several challenges, particularly when building scalable, maintainable, and high-performance applications. As applications grow, managing complex user interfaces, and ensuring efficient data handling and modular code structures, becomes increasingly difficult.
Angular is a TypeScript-based web framework developed by Google. It’s component-driven and designed for building single-page applications with a strong emphasis on modular architecture and performance optimization. Angular’s scalability, maintainability, and built-in features like modular architecture, TypeScript support, and robust tooling, have made it popular for enterprise applications.
Jessica Janiuk is a Staff Software Engineer at Google where she works on Angular, which just hit version 19 late last year. In this episode, Jessica joins the show with Josh Goldberg to talk about the Angular project.
Josh Goldberg is an independent full time open source developer in the TypeScript ecosystem. He works on projects that help developers write better TypeScript more easily, most notably on typescript-eslint: the tooling that enables ESLint and Prettier to run on TypeScript code. Josh regularly contributes to open source projects in the ecosystem such as ESLint and TypeScript. Josh is a Microsoft MVP for developer technologies and the author of the acclaimed Learning TypeScript (O’Reilly), a cherished resource for any developer seeking to learn TypeScript without any prior experience outside of JavaScript. Josh regularly presents talks and workshops at bootcamps, conferences, and meetups to share knowledge on TypeScript, static analysis, open source, and general frontend and web development.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Angular with Jessica Janiuk appeared first on Software Engineering Daily.
SED News is a monthly podcast from Software Engineering Daily where hosts Gregor Vand and Sean Falconer unpack the biggest stories shaping software engineering, Silicon Valley, and the broader tech industry.
In this episode, they discuss Perplexity’s headline-grabbing offer to buy Google Chrome, the U.S. government’s large stake in Intel, Meta’s abrupt pause on AI hiring, and a reality check on what “agentic” systems can actually deliver today versus the hype.
They also dive into standout discussions from Hacker News, including a proposal to curb “ghost job” postings with stricter transparency rules, an interactive Big-O explainer, and more.
Gregor Vand is a security-focused technologist, having previously been a CTO across cybersecurity, cyber insurance and general software engineering companies. He is based in Singapore and can be found via his profile at vand.hk or on LinkedIn.
Sean’s been an academic, startup founder, and Googler. He has published works covering a wide range of topics from AI to quantum computing. Currently, Sean is an AI Entrepreneur in Residence at Confluent where he works on AI strategy and thought leadership. You can connect with Sean on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post SED News: Perplexity’s Chrome Play, Meta’s AI Freeze, and Intel Becomes Too Big to Fail appeared first on Software Engineering Daily.
A common challenge in data-rich organizations is that critical context about the data is often hard to capture and even harder to keep up to date. As more people across the organization use data and data models get more complex, simply finding the right dataset can be slow and create bottlenecks.
Select Star is a data discovery and metadata platform that builds a continuously updated knowledge graph of an organization’s data by analyzing both its structure and how it’s actually used. It enriches data with context such as popularity, lineage, and semantic models, making it easier for AI and teams to discover, trust, and use the right data. These enriched metadata layers are also highly valuable for large language models, significantly improving the accuracy of generated SQL queries.
Shinji Kim is the founder and CEO of Select Star, and she joins Sean Falconer to discuss solving metadata curation challenges, managing data context at scale, using LLMs for SQL generation, emerging trends in metadata management, and more.
Full Disclosure: This episode is sponsored by Select Star.
Sean’s been an academic, startup founder, and Googler. He has published works covering a wide range of topics from AI to quantum computing. Currently, Sean is an AI Entrepreneur in Residence at Confluent where he works on AI strategy and thought leadership. You can connect with Sean on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Context-Aware SQL and Metadata with Shinji Kim appeared first on Software Engineering Daily.
Data visualization is increasingly important as organizations prioritize data-driven decision-making. Tools that transform complex datasets into intuitive, interpretable visualizations are arguably just as critical as the data itself.
Robert Kosara is a Data Visualization Developer at Observable which is a platform for creating interactive data visualizations, and which makes extensive use of the popular D3 JavaScript library. Robert previously worked at companies including Salesforce and Tableau, and has deep experience in data visualization and data visualization tools. He joins the show to talk about modern data visualization and his work at Observable.
Sean’s been an academic, startup founder, and Googler. He has published works covering a wide range of topics from AI to quantum computing. Currently, Sean is an AI Entrepreneur in Residence at Confluent where he works on AI strategy and thought leadership. You can connect with Sean on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Modern Data Visualization with Robert Kosara appeared first on Software Engineering Daily.
Werner Vogels is the Chief Technology Officer at Amazon, where he has played a pivotal role in shaping the company’s technology vision for over two decades. Before joining Amazon in 2004, Werner was a research scientist at Cornell University where he focused on distributed systems and scalability, both of which are concepts that would later influence the design of AWS. He holds a PhD in computer science and has authored numerous academic papers on the reliability and performance of large-scale systems.
As CTO, Werner has been instrumental in guiding Amazon’s transition from an online retailer to a global cloud infrastructure provider. He is one of the key architects behind Amazon’s push into cloud computing, helping to define the new model for delivering infrastructure. He is known for his pragmatic, customer-focused approach to technology and for championing ideas such as “you build it, you run it,” “APIs are forever,” and more recently, Frugal Architecting, which emphasizes cost-effective and sustainable software design.
In this episode, Kevin Ball sits down with Werner for a wide-ranging conversation. They discuss the early days of Amazon, the birth of AWS, the principles of the Frugal Architect, aligning cost to the business, engineering-business collaboration, technical debt, and much more.
Kevin Ball or KBall, is the vice president of engineering at Mento and an independent coach for engineers and engineering leaders. He co-founded and served as CTO for two companies, founded the San Diego JavaScript meetup, and organizes the AI inaction discussion group through Latent Space.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post A Conversation with Amazon CTO Werner Vogels appeared first on Software Engineering Daily.
A key challenge with designing AI agents is that large language models are stateless and have limited context windows. This requires careful engineering to maintain continuity and reliability across sequential LLM interactions. To perform well, agents need fast systems for storing and retrieving short-term conversations, summaries, and long-term facts.
Redis is an open‑source, in‑memory data store widely used for high‑performance caching, analytics, and message brokering. Recent advances have extended Redis’ capabilities to vector search and semantic caching, which has made it an increasingly popular part of the agentic application stack.
Andrew Brookins is a Principal Applied AI Engineer at Redis. He joins the show with Sean Falconer to discuss the challenges of building AI agents, the role of memory in agents, hybrid search versus vector-only search, the concept of world models, and more.
Full Disclosure: This episode is sponsored by Redis.
Sean’s been an academic, startup founder, and Googler. He has published works covering a wide range of topics from AI to quantum computing. Currently, Sean is an AI Entrepreneur in Residence at Confluent where he works on AI strategy and thought leadership. You can connect with Sean on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Redis and AI Agent Memory with Andrew Brookins appeared first on Software Engineering Daily.
Deploying and managing cloud workloads is a complex task that requires developers to handle infrastructure, scaling, CI/CD pipelines, and database hosting. Configuring and maintaining Kubernetes, ensuring smooth deployments, and integrating various services efficiently is a common challenge.
Will Stewart is the co-founder and CEO of Northflank, which is a platform focused on streamlining application deployment and management.
In this episode, he joins the show to talk about the contemporary challenges and solutions around workload deployment.
Sean’s been an academic, startup founder, and Googler. He has published works covering a wide range of topics from AI to quantum computing. Currently, Sean is an AI Entrepreneur in Residence at Confluent where he works on AI strategy and thought leadership. You can connect with Sean on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Complex Workload Deployment with Will Stewart appeared first on Software Engineering Daily.
Modern software teams typically rely on a patchwork of tools to manage planning, development, feature rollout, and post-release analysis. This fragmentation is a known challenge that can create friction and slow down software development iteration. It’s especially problematic for cross-functional teams, where differences in roles, expertise, and work culture can further complicate collaboration.
There is growing consensus that successful software product development requires continuous collaboration across functions, including design, engineering and operations.
Tobias Dunn-Krahn is the CTO and Doug Peete is the Chief Product Officer of Atono, which is a software development lifecycle platform focused on cross-functional teams. They join the podcast with Kevin Ball to talk about the challenges of modern product development, the importance of low-friction UX, the role of AI in product tooling, and how to unify product, design, engineering, and operations in a single workflow.
Full Disclosure: This episode is sponsored by Atono.
Kevin Ball or KBall, is the vice president of engineering at Mento and an independent coach for engineers and engineering leaders. He co-founded and served as CTO for two companies, founded the San Diego JavaScript meetup, and organizes the AI inaction discussion group through Latent Space.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Empowering Cross-Functional Product Teams with Tobias Dunn-Krahn and Doug Peete appeared first on Software Engineering Daily.
Carbon is a programming language developed by Google as a successor to C++, and it aims to provide modern safety features while maintaining high performance. It’s designed to offer seamless interoperability with C++ while addressing shortcomings of C++ such as slow compilation times and lack of memory safety. Carbon also introduces features like a more readable syntax, improved generics, and automatic memory management while still allowing low-level control.
Chandler Carruth is the creator of Carbon, and he leads the C++, C Lang, and LLVM teams at Google, and he also worked on several pieces of Google’s distributed build system. In this episode, he joins Kevin Ball to talk about Carbon and the future of the language.
Kevin Ball or KBall, is the vice president of engineering at Mento and an independent coach for engineers and engineering leaders. He co-founded and served as CTO for two companies, founded the San Diego JavaScript meetup, and organizes the AI inaction discussion group through Latent Space.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Carbon and Modernizing C++ with Chandler Carruth appeared first on Software Engineering Daily.
Simplifying Application Development Security
Security is an integral and often challenging component in application development. Developers focus on the functionality of the frontend and backend, but they may be unaware of potential security design flaws in their implementations and APIs. OAuth and OpenID Connect (OIDC) provide a standardized security framework for protecting applications.
Authlete is a service solution that streamlines development of security components. Software Engineering Daily’s Gregor Vand recently spoke with the Principal Architect at Authlete, Justin Richer, to discuss common authorization, identity, and security challenges, and the solution landscape. You can find their full conversation here.
The Gap Between Developers and Security Professionals
Developers’ interest, and often their time, is focused on adding functionality to applications. The security of these systems can sometimes seem obtuse, since security is a specialty that many are not totally familiar or comfortable with. As a consequence, design problems often emerge as applications are built.
“Sometimes, the security team shows up and says, you can’t connect everything together because that’s not secure,” explained Authlete’s Justin Richer. Security professionals often start with the desire to lock the system down and protect confidential information. Consequently, security gets in the way of the application developer, who wants to provide functionality to connect data, people, and processes. The functionality and security viewpoints may possibly clash because their goals are different.
Security Systems Have to be Collaborative
As a result, a fresh outlook and approach are needed. As Gregor noted, “the juxtaposition of collaboration and security does not initially sound like they can coexist, but they have to.”
Humans use the security solutions, and often how people interface with these products is not in the way that vendors designed or even considered. So, enterprises must create security checks that keep information secure but do not prevent people from completing their work, and this is often a difficult balancing act.
What are OAuth and OpenID Connect?
Two key building blocks of modern application security are OAuth, from the IETF, and OpenID Connect, from the OpenID Foundation. Each of these standards plays a key role in ensuring security, but the specifications can be challenging for developers to work with.
While often thought of as an authorization protocol, OAuth is fundamentally a delegation protocol. “OAuth excels whenever you have multiple systems and need to provide an abstract security layer,” noted Authlete’s Justin Richer. In applying a delegation protocol, a user possesses a set of system rights that perform certain tasks, such as the ability to access a record or update certain metadata. Users delegate specific subsets of their rights to applications that perform them on their behalf. How does OAuth accomplish this? OAuth creates an artifact called an access token that encompasses not only the end user’s rights but also the identity of the delegated software.
Here are the steps in the delegation process:
The OAuth delegation process. Image from OAuth 2 In Action by Justin Richer and Antonio Sanso. Manning Publications 2017. Used with permission.A user, known as the Resource Owner (RO) in OAuth terminology, has access to an API, known as the Protected Resource hosted on the Resource Server (RS). The RO wants a piece of software, known as the Client, to act on their behalf at the RS. The RO can authenticate to the system to prove who they are and that they have access, but we don’t want the RO to give those credentials to the Client. OAuth provides an Authorization Server (AS) to facilitate the RO giving the client delegated access, through the use of an access token. The access token represents the combination of all the parties in the OAuth protocol and the access being given, and it can be used by the Client to call the RS.
The OAuth standard simplifies typical API integration work by allowing the Client and RS to never deal with the user’s credentials, and it allows the user to be very deliberate about what kinds of access they want to give the Client application.
The second component, OpenID Connect, works with OAuth. OAuth enables users to securely delegate certain rights to pieces of software, but OAuth does not tell the software who the user is. OpenID Connect works by allowing the user to delegate their own identity information to the client software from the AS, which becomes an Identity Provider (IdP) in OIDC. The IdP provides information about who the user is alongside the access token from OAuth. “Let’s say an app needs all of the extended profile information, such as address, email, and other personal data. A developer writes an API call to do that. That API call is protected by an OAuth access token and it’s the same OAuth access token that I got when I made the call that said who is the user. That access token could also be used for many other functions: getting their calendar information, looking at their bank account history, checking their health record, or any other type of transaction. All these features are possible, but developers need to create them in order to use them.”
A Hosted Security Solution
When building out a protected system, developers need to have dedicated components like the AS to provide key security functionalities. Building an OAuth AS and an OIDC IdP is a formidable task, but many deployments need a level of flexibility and power that only building can provide. But how could you go about building such an important security component?
Authlete is a unique product because it’s a hosted service that provides OAuth and OpenID Connect support functions. What is different from other services is that Authlete does not host the entire platform that handles user authentication, accounts, or attributes. Instead, it supplies support for the OAuth and OpenID Connect protocol pieces where and when they are needed.
“Authlete really shines in the space where developers want to build out something custom and have it run in their environment and programming language,” explained Authlete’s Richer. A developer needs to build an IdP or AS. A request comes in to the developer’s implementation, say a token endpoint request or an authorization endpoint request. The software then calls the Authlete service, which examines the request: Is this request formed correctly? Is everything formatted properly? Which extensions are valid? What should the response be?
Authlete provides developers with an SDK that features an OAuth library they can call and use as needed, but instead of being a static library, “the solution is backed by a live service,” said Authlete’s Richer. Authlete stores the protocol state, which allows it to manage data over time. It handles tokens, keys, and other information so the application developer doesn’t need to account for these directly. Authlete also provides libraries to ease integration, “our libraries turn around and they call the right endpoint with a properly formatted REST request. The API itself is really straightforward.” Some of Authlete’s largest customers have been able to take advantage of this by integrating directly with the API without needing to use an SDK, which wasn’t available in their preferred development platform.
In essence, the developer builds their own authorization server. They provide the application rights and privileges and the OAuth and OpenID parts. Therefore, they concentrate on shipping the features of their application or service. The Authlete service provides only the security layers that matter to their applications.
As a result, instead of taking an off-the-shelf software project and building their own security system on top of it, developers have a world-class system on which they build out their own customized functionality. Nor do developers need to give over all control to a fully hosted service. With the Authlete product, customers retain the control and flexibility that a custom solution provides but don’t have to become experts in the details of the interoperability layer that OAuth and OpenID provide.
Prioritizing Security and Data Control
The solution has found adoption in multiple industries, with particular use in the banking industry. “In the financial sector, Authlete gives enterprises the ability to hold all of the sensitive information close to themselves,” explained Richer. “We don’t store user accounts. We don’t store names and passwords and addresses and account numbers and all of that other stuff. Instead, they tell us, I need an access token for the following subject identifier with the following rights and we deliver it.” Privacy-driven regulations and demand for privacy protections from consumers is changing how companies architect and deploy their systems, especially with regard to hosted services. Letting go of personal data to a cloud service is not a choice to be taken lightly, especially in highly regulated verticals. Authlete’s semi-hosted service architecture allows its customers to retain control over sensitive financial data and provide service that is hosted and controlled by the customer’s systems, while at the same time providing a state-of-the-art implementation of security protocols to protect these systems.
Security is an important but difficult aspect of modern systems, and deploying security protocols like OAuth and OIDC brings its own benefits and challenges. At the end of the day, developers want to provide the best functionality for their users, and Authlete provides a compelling and unique approach to securing that functionality.
Check out https://events.authlete.com/sed to try out Authlete for an extended 90-day free trial.
Full Disclosure: Authlete is a sponsor of Software Engineering Daily
The post Making OAuth and OIDC Accessible to Developers appeared first on Software Engineering Daily.
OAuth is an open standard for access delegation. It lets users grant websites or applications access to their information on other websites, but without giving away passwords.
OpenID Connect is an identity layer on top of OAuth. Even if you haven’t programmed using OAuth and OpenID Connect, you’ve certainly used them for authentication on Google, Facebook, Spotify, and countless other services.
Authlete is a service that provides a set of APIs to implement OAuth authorization servers, and OpenID Connect identity providers.
Justin Richer is the Principal Architect at Authlete and is part of the working group that developed OAuth 2.0. He joins the podcast to talk about the history of OAuth, OAuth as a delegation protocol, the Authlete API, and much more.
Check out https://events.authlete.com/sed to try out Authlete for an extended 90-day free trial.
Full Disclosure: This episode is sponsored by Authlete.
Gregor Vand is a security-focused technologist, and is the founder and CTO of Mailpass. Previously, Gregor was a CTO across cybersecurity, cyber insurance and general software engineering companies. He has been based in Asia Pacific for almost a decade and can be found via his profile at vand.hk.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Authlete and Making OAuth Accessible with Justin Richer appeared first on Software Engineering Daily.
Corbado is an authentication platform that provides APIs for developers to replace passwords with passkeys such as Face ID or Touch ID.
Vincent Delitz is a Co-Founder at Corbado and he joins the show to talk about the platform, the changing authentication landscape, the challenge of session management with passkeys, and more.
Gregor Vand is a security-focused technologist, and is the founder and CTO of Mailpass. Previously, Gregor was a CTO across cybersecurity, cyber insurance and general software engineering companies. He has been based in Asia Pacific for almost a decade and can be found via his profile at vand.hk.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Biometric Authentication with Vincent Delitz appeared first on Software Engineering Daily.
SimpleWebAuthn is an open source TypeScript-centric pair of libraries – frontend and backend – that make it easier for devs to implement WebAuthn on the web.
Matthew Miller started the project in 2019 and it has grown in tandem with the popularization of WebAuthn. He joins the podcast today to talk about the history of the project starting from the first commit, the problems it solves, its design, and more.
Gregor Vand is a security-focused technologist, and is the founder and CTO of Mailpass. Previously, Gregor was a CTO across cybersecurity, cyber insurance and general software engineering companies. He has been based in Asia Pacific for almost a decade and can be found via his profile at vand.hk.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post SimpleWebAuthn with Matthew Miller appeared first on Software Engineering Daily.
Security issues can often be traced back to small misconfigurations in a database or cloud service, or an innocent code commit. OpsHelm is a security platform that’s oriented around identifying and fixing these issues.
Kyle McCullough is the Co-Founder and CTO of OpsHelm and he has deep experience in backend and data engineering. He joins the show to talk about the challenges of security incident monitoring, prioritization, and response.
This episode is hosted by Tyson Kunovsky. Tyson is the co-founder and CEO of AutoCloud, an infrastructure as code platform. He is originally from South Africa, and has a background in software engineering and cloud development. When he’s not busy designing new GitOps workflows, he enjoys skiing, riding motorcycles, and reading sci-fi books. Check the show notes for more information on Tyson’s work, and where to find him.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post OpsHelm with Kyle McCullough appeared first on Software Engineering Daily.
Software supply chain security is a major challenge in the modern engineering environment. Many teams are working to establish best practices to proactively identify, fix, and prevent risks in their applications. Apiiro is a platform designed to solve this problem and gives risk visibility, prioritization, and remediation.
Yonatan Eldar is the Co-Founder and CTO at Apiiro and he joins the podcast to talk about the platform, application security posture management, and more.
Gregor Vand is a security-focused technologist, and is the founder and CTO of Mailpass. Previously, Gregor was a CTO across cybersecurity, cyber insurance and general software engineering companies. He has been based in Asia Pacific for almost a decade and can be found via his profile at vand.hk.
Please click here to see the transcript of this episode.
Full Disclosure: 10KMedia is a sponsor of Software Engineering Daily.
The post Apiiro Security Posture Management with Yonatan Eldar appeared first on Software Engineering Daily.
Ransomware attacks involve the deployment of malware that blocks access to a user’s or organization’s computer files by encrypting them. The attackers then demand a ransom payment in exchange for the decryption key that will restore access to the files. These attacks are often directed at governments and corporations, and can be costly.
Veeam is a data storage system that was designed specifically to provide protection against ransomware attacks. Object First is a system that works with Veeam to increase its safety and security.
Anthony Cusimano is the Director of Technical Marketing at Object First and he joins the podcast to talk about the growing sophistication of ransomware attacks and the emerging technologies to block them.
This episode is hosted by Lee Atchison. Lee Atchison is a software architect, author, and thought leader on cloud computing and application modernization. His best-selling book, Architecting for Scale (O’Reilly Media), is an essential resource for technical teams looking to maintain high availability and manage risk in their cloud environments.
Lee is the host of his podcast, Modern Digital Business, an engaging and informative podcast produced for people looking to build and grow their digital business with the help of modern applications and processes developed for today’s fast-moving business environment. Listen at mdb.fm. Follow Lee at softwarearchitectureinsights.com, and see all his content at leeatchison.com.
Please click here to see the transcript of this episode.
Sponsorship inquiries:sponsor@softwareengineeringdaily.com
The post Blocking Ransomware Attacks with Anthony Cusimano appeared first on Software Engineering Daily.
One of the most famous software exploits in recent years was the SolarWinds attack in 2020. In this attack, Russian hackers inserted malicious code into the SolarWinds Orion system, allowing them to infiltrate the systems of numerous corporations and government agencies, including the U.S. executive branch, military, and intelligence services.
This was an example of a software supply chain attack, which exploits interdependencies within software ecosystems. Software supply chain security is a growing issue, and is particularly important for companies that rely on large numbers of open source dependencies.
Michael Lieberman is the Co-Founder and CTO of Kusari and has an extensive background in software security from his time at Citi Bank, MUFG and Bridgewater. He’s also active in the open source and security communities, including the Open Source Security Foundation and Cloud Native Computing Foundation. Michael joins the show today to talk about challenges and strategies in software supply chain security.
Gregor Vand is a security-focused technologist, and is the founder and CTO of Mailpass. Previously, Gregor was a CTO across cybersecurity, cyber insurance and general software engineering companies. He has been based in Asia Pacific for almost a decade and can be found via his profile at vand.hk.Please click here for the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Software Supply Chain Security with Michael Lieberman appeared first on Software Engineering Daily.
This episode of Software Engineering Daily is part of our on-site coverage of KubeCon 2023, which took place from November 6th through 9th in Chicago.
In today’s interview, host Jordi Mon Companys speaks with Santiago Torres-Arias who is a contributor to Sigstore, which is a system to register software supply chain actors using federated identity management.
Jordi Mon Companys is a product manager and marketer that specializes in software delivery, developer experience, cloud native and open source. He has developed his career at companies like GitLab, Weaveworks, Harness and other platform and devtool providers. His interests range from software supply chain security to open source innovation. You can reach out to him on Twitter at @jordimonpmm
Please click here to see the transcript for this episode.Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post KubeCon Special: Sigstore with Santiago Torres-Arias appeared first on Software Engineering Daily.
The Hypertext Transfer Protocol, or HTTP, is used to load webpages using hypertext links, and it’s the foundation of the web. Tim Berners-Lee famously created HTTP version 0.9 in 1989, and defined the essential behavior of a client and a server. Version 1.0 was eventually finalized in 1996, and its secure variant called HTTPS is now used on more than 80% of websites. HTTP continues to undergo intense development and version 3 in now being actively adopted across the tech industry.
Nick Shadrin is a Software Architect at NGINX, and Roman Arutyunyan is a Principal Software Engineer at NGINX. Nick and Roman are experts in HTTP and they join the show today to tell the history of its evolution since 1989, and how NGINX is implementing support for HTTP/3.
Full disclosure: NGINX is a sponsor of Software Engineering Daily.
Mike Bifulco is CTO and co-founder of Craftwork. He’s also a developer advocate, writer, podcaster and serial startup founder. In past lives, Mike worked for Google, Stripe, Microsoft, and Gymnasium. Mike is also co-founder of APIs You Won’t Hate, a community for API Developers on the web. Mike’s publishes a weekly newsletter for product builders called Tiny Improvements at mikebifulco.com. Mike is on Mastodon at https://hachyderm.io/@irreverentmike
Please click here to view this show’s transcript.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post The Future of HTTP with Nick Shadrin and Roman Arutyunyan appeared first on Software Engineering Daily.
Cloud applications continue to grow in popularity, but ensuring the security of these applications often presents a formidable engineering challenge. This challenge motivated the creation of Jit. Jit is a continuous security platform for developers, and seeks to enable every cloud app to start with minimum viable security, or MVS, without slowing development velocity. David
The post Minimum Viable Security for Cloud Apps with David Melamed appeared first on Software Engineering Daily.
Available as a cloud service, Red Hat Trusted Software Supply Chain provides a DevSecOps framework to create applications more securely. Vincent Danen is the VP of Product Security at Red Hat and joins us in this episode. Red Hat has been a Secure Open Source software provider for very long. We discuss how the Red
The post Trusted Software Supply Chain with Vincent Danen appeared first on Software Engineering Daily.
Originally published on August 23, 2021. Application security is usually done with a set of tools and services known as SIEM – Security Information and Event Management. SIEM tools usually try to provide visibility into an organization’s security systems, as well as event log management and security event notifications. The company Panther takes traditional SIEM
The post Panther: Security as Code with Jack Naglieri appeared first on Software Engineering Daily.
Cloud computing provides tools, storage, servers, and software products through the internet. Securing these resources is a constant process for companies deploying new code to their cloud environments. It’s easy to overlook security flaws because company applications are very complex and many people work together to develop them. Wyze Labs, for example, had millions of
The post Bridgecrew: Cloud Security with Guy Eisenkot appeared first on Software Engineering Daily.
Enterprise-grade authentication is often an essential ingredient to virtually all applications in today’s world. However, companies often have a hard time understanding the value of that authentication especially during the early stages of product development. And hardening of an application is often left as an afterthought. Add enterprise-level requirements such as single sign-on and two-factor
The post WorkOS with Michael Grinich appeared first on Software Engineering Daily.
The Kubernetes ecosystem has drastically changed how development teams ship software. While Kubernetes has provided many advancements in cloud infrastructure, it has also left organizations with massive security blindspots. KSOC was created to give developers and security teams a single control plane to harden multi-cluster Kubernetes environments through event-driven analysis, least privilege enforcement, and remediation-as-code.
The post Kubernetes Security Compliance with Jimmy Mesta appeared first on Software Engineering Daily.
Benefits of fostering a culture of joint accountability. Hybrid, multi-cloud, and edge environments are becoming the standard for organizations, but securing cloud environments is substantially more complex than securing on-premise environments. In addition to accelerating security concerns, most organizations must comply with at least 13 specific regulations. These regulatory frameworks and associated policies are often
The post Lower Organizational Risk by Embracing a Culture of Compliance. appeared first on Software Engineering Daily.
The JavaScript supply chain includes numerous vulnerabilities due to its expansive nature and the long dependency chains. Socket is a new security company that can protect your most critical apps from supply chain attacks. They are taking an entirely new approach to one of the hardest problems in security in a stagnant part of the
The post JavaScript Supply Chain with Feross Aboukhadijeh appeared first on Software Engineering Daily.
The software supply chain consists of packages, imports, dependencies, containers, and APIs. These different components each have unique security risks. To ensure the security of their software supply chain, many developers use tools to analyze and scan their infrastructure for vulnerabilities. Barak Schoster works at Bridgecrew, a DevSecOps cloud security platform. He joins the show
The post Software Supply Chain with Barak Schoster appeared first on Software Engineering Daily.
Everyone is becoming increasingly aware of supply chains for physical goods. Software has its own supply chain. A supply of open source solutions exists as does a demand for these solutions by industry. Both have surely grown, but it would be nice to have a way of measuring by how much. The State of Software
The post The State of Software Supply Chain 2021 with Ilkka Turunen appeared first on Software Engineering Daily.
Microservice architecture has become a ubiquitous design choice. Application developers typically have neither the training nor the interest in implementing low-level security features into their software. For this and many other reasons, the notion of a service mesh has been introduced to provide a framework for service-to-service communication. Today’s guest is Zack Butcher. While working
The post Tetrate Service Bridge with Zack Butcher appeared first on Software Engineering Daily.
Neural networks, in particular, deep neural networks have revolutionized machine learning. Researchers and companies have pushed on the efficiency of every aspect of the machine learning lifecycle. The impact of the trained models is particularly significant for computer vision and in turn for autonomous driving and security systems. In this episode, I interview Forrest Iandola,
The post Deploying Computer Vision to the Edge at Anduril Industries with Forrest Iandola appeared first on Software Engineering Daily.
The notebook paradigm of coding is relatively new in comparison to REPLs and IDEs. Notebooks run in your browser and give you discrete cells for running segments of code. All the code in a single cell runs at once, but cells run independently. Cells can be re-run, which is a blessing and a curse. The
The post NBSafety for Jupyter Notebooks with Stephen Macke appeared first on Software Engineering Daily.
Phishing attacks, malware, and ransomware are just some of the major threats everyone connected to the internet faces. For companies, the stakes are especially high. Setting up a secure infrastructure is difficult. Your adversary only needs to find one flaw to get in. Vancord is a private cybersecurity company, based in Connecticut, that was founded
The post Cybersecurity Threats with Jason Pufahl and Russell Jancewicz appeared first on Software Engineering Daily.
Money laundering is not a new crime. However, the growth of digital communications has greatly expanded the opportunity for money launderers to find innovative new ways to hide their true intent. Some estimates suggest it could be as high as 2-5% of the world’s GDP. Unit21 is a customizable no-code platform for risk and compliance
The post Detecting Money Laundering with Clarence Chio appeared first on Software Engineering Daily.
Web applications often have some sort of login system, and once a user creates an account, they have access to features anonymous users can’t see. In time, application designers will often add an admin level of access for special users. This is often a slow trickle of technical debt. Proper execution of a programmatic authorization
The post Authorization with Sam Scott appeared first on Software Engineering Daily.
Application security is usually done with a set of tools and services known as SIEM – Security Information and Event Management. SIEM tools usually try to provide visibility into an organization’s security systems, as well as event log management and security event notifications. The company Panther takes traditional SIEM security a step further. Panther processes
The post Panther: Security as Code with Jack Naglieri appeared first on Software Engineering Daily.
According to Fugue’s new State of Cloud Security 2020 report, cloud misconfiguration remains the top cause of data breaches in the cloud, and millions of database servers are currently exposed across cloud providers. Some of the leading reasons are a lack of adequate oversight and too many APIs and interfaces to govern. (securityaffairs.co). Argos Security
The post Argos Security: Cloud Configuration Security with David O’Brien appeared first on Software Engineering Daily.
Ryan Noon is the CEO of Material Security. This interview was also recorded as a video podcast. Check out the video on the Software Daily YouTube channel. Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Material Security with Ryan Noon appeared first on Software Engineering Daily.
SOC 2 is a security audit to prove that SaaS companies have secured their company and customer data. It’s often considered the minimum audit necessary to sell software. HIPAA is a federal law regulating how sensitive medical information about patients must be handled. ISO 27001 is the global benchmark for demonstrating your information security management
The post Vanta: Maintaining Security Standards with Christina Cacioppo appeared first on Software Engineering Daily.
In this episode we discuss plug and play auth, password management, and crypto with Sean Li, co-founder and CEO of Magic. This interview was also recorded as a video podcast. Check out the video on the Software Daily YouTube channel. Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Magic with Sean Li appeared first on Software Engineering Daily.
Encryption algorithms provide the means to secure and transfer sensitive information by taking input and transforming it into an unreadable output. Usually a special key, or multiple keys, are needed to unscramble the information back to the original input. These algorithms power the security of everything from our cell phone lock screens to Fortune 500
The post Skiff: Secure Document Collaboration with Andrew Milich appeared first on Software Engineering Daily.
Static analysis is a type of debugging that identifies defects without running the code. Static analysis tools can be especially useful for enforcing security policies by analyzing code for security vulnerabilities early in the development process, allowing teams to rapidly address potential issues and conform to best practices. R2C has developed a fast, open-source static
The post Semgrep: Modern Static Analysis with Isaac Evans appeared first on Software Engineering Daily.
Security is more important than ever, especially in regulated fields such as healthcare and financial services. Developers working in highly regulated industries often spend considerable time building tooling to help improve compliance and pass security audits. While the core of many security workflows is similar, each industry and each organization may have its own idiosyncratic
The post Sym: Security Workflows with Yasyf Mohamedali appeared first on Software Engineering Daily.
Network discovery allows enterprises to identify what devices are on their network. These devices can include smartphones, servers, desktop computers, and tablets. Being able to index the devices on a network is crucial to figuring out the security profile of that network. HD Moore is a founder of Rumble Networks, a company focused on network
The post Network Discovery with HD Moore appeared first on Software Engineering Daily.
Osquery is a tool for providing visibility into operating system endpoints. It is a flexible tool developed originally at Facebook. Ganesh Pai is the founder of Uptycs, a company that uses Osquery to find threats and malicious activity occurring across nodes. Ganesh joins the show to talk about Osquery usage and his work on Uptycs.
The post Osquery with Ganesh Pai appeared first on Software Engineering Daily.
Anduril is a technology defense company with a focus on drones, computer vision, and other problems related to national security. It is a full-stack company that builds its own hardware and software, which leads to a great many interesting questions about cloud services, engineering workflows, and management. Gokul Subramanian is an engineer at Anduril, and
The post Anduril Engineering with Gokul Subramanian appeared first on Software Engineering Daily.
Logs are the source of truth. If a company is sufficiently instrumented, the logging data that streams off of the internal infrastructure can be refined to tell a comprehensive story for what is changing across that infrastructure in real time. This includes logins, permissions changes, other events that could signal a potential security compromise. Datadog
The post Security Monitoring with Marc Tremsal appeared first on Software Engineering Daily.
A large software company such as Dropbox is at a constant risk of security breaches. These security breaches can take the form of social engineering attacks, network breaches, and other malicious adversarial behavior. This behavior can be surfaced by analyzing collections of log data. Log-based threat response is not a new technique. But how should
The post Grapl: Graph-Based Detection and Response with Colin O’Brien appeared first on Software Engineering Daily.
Infrastructure-as-code tools are used to define the architecture of software systems. Common infrastructure-as-code tools include Terraform and AWS CloudFormation. When infrastructure is defined as code, we can use static analysis tools to analyze that code for configuration mistakes, just as we could analyze a programming language with traditional static analysis tools. When a developer writes
The post Static Analysis for Infrastructure with Guy Eisenkot appeared first on Software Engineering Daily.
Zoom video chat has become an indispensable part of our lives. In a crowded market of video conferencing apps, Zoom managed to build a product that performs better than the competition, scaling with high quality to hundreds of meeting participants, and millions of concurrent users. Zoom’s rapid growth in user adoption came from its focus
The post Zoom Vulnerabilities with Patrick Wardle appeared first on Software Engineering Daily.
Large software companies have lots of users, and the activity from those users results in high volumes of traffic. These companies also have a large surface area across the enterprise. There are hundreds of services and databases that are fulfilling user requests. As these requests enter the infrastructure of the enterprise, the requests travel through
The post Cloud Log Analysis with Jack Naglieri appeared first on Software Engineering Daily.
The software supply chain includes cloud infrastructure, on-prem proprietary solutions, APIs, programming languages, networking products, and open source software. Each of these software categories has its own security vulnerabilities, and each category has tools that can help protect a company from attackers that are trying to exploit known vulnerabilities. As open source software has grown
The post Snyk: Open Source Security with Guy Podjarny appeared first on Software Engineering Daily.
The modern software supply chain contains many different points of distribution: JavaScript frameworks, npm modules, Docker containers, open source repositories, cloud providers, on-prem firmware, IoT, networking proxies, and so much more. With so much attack surface, securing a large enterprise is an uphill battle. Jeff Williams is the CTO at Contrast Security, a company that
The post Security Monitoring with Jeff Williams appeared first on Software Engineering Daily.
A Kubernetes instance occupies a wide footprint of multiple servers, creating an appealing target to an attacker, due to its access to a large pool of compute resources. A common attack against an exposed Kubernetes cluster is to take it over for the purposes of mining cryptocurrency. Thus it is important to keep a cluster
The post Container Platform Security with Maya Kaczorowski appeared first on Software Engineering Daily.
Upcoming events: A Conversation with Haseeb Qureshi at Cloudflare on April 3, 2019 FindCollabs Hackathon at App Academy on April 6, 2019 Steve Herrod was the CTO at VMware and now works as a managing director at General Catalyst, where he focuses on investments relating to security. Large enterprises are difficult to secure. An enterprise
The post Security Businesses with Steve Herrod appeared first on Software Engineering Daily.
Computational integrity is a property that is required for financial transactions on the Internet. Computational integrity means that the output of a certain computation is correct. If I deposit money into my bank, my bank sends me a number that represents the new balance in my account. I assume that the number they have sent
The post StarkWare: Transparent Computational Integrity with Eli Ben Sasson appeared first on Software Engineering Daily.
The nature of software projects is changing. Projects are using a wider variety of cloud providers and SaaS tools. Projects are being broken up into more git repositories, and the code in those repositories are being deployed into small microservices. With the increased number of tools, repositories, and deployment targets, it can become difficult to
The post Policy Enforcement with Shimon Tolts appeared first on Software Engineering Daily.
When Aran Khanna was a college student, he accepted an internship to work at Facebook. Even before his internship started, he started playing around with Facebook’s APIs and applications. Aran built a Chrome extension called Marauder’s Map, which used Facebook Messenger’s web APIs to track where people lived, what their schedule was, and other highly
The post Digital Privacy with Aran Khanna appeared first on Software Engineering Daily.
If you have ever stayed in a short-term rental (like an Airbnb, HomeAway, or CouchSurfing), you have probably used the wifi network at that rental property. Why wouldn’t you? It’s no different than hopping on an open wifi network at an airport, or a Starbucks, or your friend’s house, right? One major difference: the hardware
The post Hacking Your Short-Term Rental with Jeremy Galloway appeared first on Software Engineering Daily.
Last year, the WannaCry ransomware attack shut down hospitals, public transportation systems, and governments, demanding payment to unlock key computer systems. A programmer named Marcus Hutchins was able to stop WannaCry by registering a DNS entry buried in the WannaCry code. Not long after he stopped the WannaCry attack, Marcus Hutchins was arrested at a
The post WannaCry’s Gray Hat with Reeves Wiedeman appeared first on Software Engineering Daily.
Employees often find themselves needing to do work outside of the office. Depending on the sensitivity of your task, accessing internal systems from a remote location may or may not be OK. If you are using a corporate application that shows the menu of your company’s cafe on your smartphone, your workload is less sensitive.
The post Google BeyondCorp with Max Saltonstall appeared first on Software Engineering Daily.
Last month, Software Engineering Daily had our 4th Meetup at Cloudflare in San Francisco. For this Meetup, the format was short interviews with security specialists from Pinterest, Cloudflare, and Segment. Each of these companies has unique security challenges, but they also have overlap in their security strategies. Nick Sullivan, Amine Kamel, and Evan Johnson are
The post Web Security at Cloudflare, Pinterest, and Segment appeared first on Software Engineering Daily.
Military force is powered by software. The drones that are used to kill suspected terrorists can identify those terrorists using the same computer vision tools that are used to identify who is in an Instagram picture. Nuclear facilities in Iran were physically disabled by the military-sponsored Stuxnet virus. National intelligence data is collected and processed
The post Modern War with Peter Warren Singer appeared first on Software Engineering Daily.
When I log into my bank account from my laptop, I first enter my banking password. Then the bank sends a text message to my phone with a unique code, and I enter that code into my computer to finish the login. This login process is two-factor authentication. I am proving my identity by entering
The post Secure Authentication with Praneet Sharma appeared first on Software Engineering Daily.
Public key encryption allows for encrypted, private messages. A message sent from Bob to Alice gets encrypted using Alice’s public key. Public key encryption also allows for signed messages–so that when Alice signs a message, Alice uses her private key and Bob can verify it if Bob has her public key. In both cases, Bob
The post Keybase with Max Krohn appeared first on Software Engineering Daily.
A smart contract is a program that allows for financial transactions. Smart contracts are usually associated with the Ethereum platform, which has a language called Solidity that makes it easy to program smart contracts. Someday, we will have smart contracts issuing insurance, processing legal claims, and executing accounting transactions. Smart contracts involve money, and they
The post Smart Contract Security with Emin Gün Sirer appeared first on Software Engineering Daily.
Static analysis is the process of evaluating code for errors, memory leaks, and security vulnerabilities. The “static” part refers to the fact that the code is not running. This differentiates it from unit tests and integration tests, which evaluate the runtime characteristics of code. If you use an IDE or a linter, you are using
The post Static Analysis with Paul Anderson appeared first on Software Engineering Daily.
Online advertising enables free content and services of the Internet. One of the free services that is powered by advertising is the browser. 60% of web browsing is done through Chrome, which is owned by Google, which is powered by advertising. The application that most of us use to explore the web is made by
The post Brave Browser with Jonathan Sampson appeared first on Software Engineering Daily.
When a cyber attack occurs, how do we identify who committed it? There is no straightforward answer to that question. Even if we know Chinese hackers have infiltrated our power grid with logic bombs, we might not be able to say with certainty whether those hackers were state actors or rogue Chinese hackers looking for
The post Attack Attribution with John Davis appeared first on Software Engineering Daily.
Ransomware and DDoS attacks happen all the time. Sometimes they affect large swaths of users. WannaCry ransomware froze the computer systems in hospitals. Mirai botnet DDoS attacks took down a DNS provider, making Netflix and Twitter inaccessible for a short period of time. These are innocent attacks compared to what we could face from a
The post Car and IoT Security with Chris Craig appeared first on Software Engineering Daily.
Quality assurance testing is a form of testing that closely mirrors user behavior. Sometimes it is manual, sometimes it is automated. Automated QA tests are scripts that validate correct data representation as the application mechanically runs through high-level workflows–like a login page. Manual QA testers act out use cases of an application to see if
The post QA Testing with Jonathan Alexander appeared first on Software Engineering Daily.
Shopify is a company that helps customers build custom online storefronts. Shopify has built upon the same Ruby on Rails application since the founding of their business 12 years ago starting with Rails 0.5 and moving all the way to Rails 5. MRuby is a lightweight implementation of the Ruby language. Shopify made the
The post MRuby and Language Security with Daniel Bovensiepen appeared first on Software Engineering Daily.
At Coinbase, security is more important than anything else. Coinbase is a company that allows for storage and exchange of cryptocurrencies. Protecting banking infrastructure is difficult, but in some ways the stakes are higher with Coinbase, because bitcoin is fundamentally unregulated. If a hacker were able to syphon all of the money out of Coinbase
The post Coinbase Security with Philip Martin appeared first on Software Engineering Daily.
A cryptocurrency exchange faces a uniquely difficult fraud problem. A hacker who steals my credentials can initiate a transfer of all my bitcoin to another wallet, and it is a non-reversible, non-identifiable payment. So it is really important to prevent those kinds of fraudulent transactions. At the third Software Engineering Daily Meetup, Coinbase director of
The post Fighting Fraud at Coinbase with Soups Ranjan appeared first on Software Engineering Daily.
Ransomware uses software to extort people. A piece of ransomware might arrive in your inbox looking like a PDF, or a link to a website with a redirect. Ransomware is often distributed using social engineering. The email address might resemble someone you know, or a transactional email from a company like Uber or Amazon. Tim
The post Ransomware with Tim Gallo and Allan Liska appeared first on Software Engineering Daily.
The online advertising industry is a giant casino. Giant technology companies are the casino owners, online publishers are the casino employees, the brand advertisers are the victims who keep returning to the casino to lose their money, and the small adtech companies are the sharks who make lots of money exploiting the inefficiencies of the
The post Ad Fraud In Our Own Backyard with Shailin Dhar appeared first on Software Engineering Daily.
The Internet is decreasing in privacy and increasing in utility. Under some conditions, this tradeoff makes sense. We publicize our profile photo so that people know what we look like. Under other conditions, this tradeoff does not make sense. We do not want a television that costs less to purchase because it is silently recording
The post Web Tracking with Bill Budington appeared first on Software Engineering Daily.
Thursday February 23rd was a big day in security news: details were published about the Cloudbleed bug, which leaked tons of plaintext requests from across the Internet into plain view. On the same day, the first collision attack against SHA-1 was demonstrated by researchers at Google, foretelling the demise of SHA-1 as a safe hashing
The post Cloudbleed and SHA-1 Collision with Max Burkhardt appeared first on Software Engineering Daily.
Security vulnerabilities are an important concern in systems. When we specify that we want certain information hidden, for example our phone number or our date of birth, we expect the system to hide the information. However, this doesn’t always happen due to human error in the code because programmers have to write checks and filters
The post Security Language with Jean Yang appeared first on Software Engineering Daily.
Vulnerabilities exist in every computer system. As a system gets bigger, the number of vulnerabilities magnifies. The web is the biggest, most complex computer system we have–but fortunately, the steps we can take to secure our web applications are often quite simple. Jared Smith is a cyber security research scientist with Oak Ridge National Laboratory.
The post Cyber Warfare with Jared Smith appeared first on Software Engineering Daily.
Every digital system has vulnerabilities. Cars can be hacked, locked computers can be exploited, and credit cards can be spoofed. Security researchers make a career out of finding these types of vulnerabilities. Samy Kamkar’s approach to security research is not just about dissection–it’s also about creativity. For many of the technologies he hacks on, Samy
The post Security Research with Samy Kamkar appeared first on Software Engineering Daily.
A huge percentage of online advertisements are never seen by humans. They are viewed by bots–automated scripts that are opening web pages in a browser and pretending to be a human. Advertising scammers set up web pages, embed advertisements on those pages, and then pay for bot traffic to come and view those advertisements. This
The post Ad Fraud Research with Augustine Fou appeared first on Software Engineering Daily.
Advertising fraud is easy, legal, and extremely profitable. A fraudster can set up a website, scrape content from the internet, and run programmatic advertisements against that website. The fraudster can then purchase bot traffic. Those bots will visit the page, consume advertisements, and return profit to the owner of the page. In a past life,
The post Ad Fraud Everywhere with Shailin Dhar appeared first on Software Engineering Daily.
Botnets have a massive influence on the Internet. As we have seen recently with the Mirai Botnet, IOT bots can take down companies as big as Netflix. In our recent episodes about advertising fraud, we’ve talked about how bots are being used to take billions of dollars of revenue from advertisers. Derek Muller is one
The post Botnet Facebook Likes with Derek Muller appeared first on Software Engineering Daily.
When Facebook acquired Instagram, one of the first systems Instagram plugged into was Facebook’s internal spam and fraud prevention system. Pete Hunt was the first Facebook engineer to join the Instagram team. When he joined, the big problems at Instagram were around fake accounts, harassment, and large volumes of spammy comments. After seeing the internal
The post Fraud Prevention with Pete Hunt appeared first on Software Engineering Daily.
When you visit a web page, that web page can write data to a file on your computer, known as a cookie. Scripts on that page can also read from your cookie file to understand where you have been in the past. All of this data about you is getting shared between advertising companies like
The post Ad Tracking with Larry Furr appeared first on Software Engineering Daily.
Advertising fraud takes billions of dollars out of the economy every year. We don’t know exactly how much money is being lost, because we don’t know what percentage of Internet users are bots. Are You A Human is a company designed to solve that exact problem and provide a service for verifying whether a user
The post Ad Fraud with Ben Trenda appeared first on Software Engineering Daily.
Containers have become the unit of infrastructure that many technology stacks deploy to. With the shift to containers, the attack surface of an application has changed, and we need to reconsider our security models; the resource allocation of our containers, the interactions between different containers on a single machine, and the big picture–how the external
The post Container Security with Phil Estes appeared first on Software Engineering Daily.
Security for the popular chat application Slack is a major focus for the company. A corporate Slack account is as valuable to a hacker as a corporate email account. In today’s episode, Ryan Huber and I talk through Slack’s approach to security–from philosophical discussions of how to company approaches security to the technical practices of
The post Slack Security with Ryan Huber appeared first on Software Engineering Daily.
When the US government hacks its own citizens, The Electronic Frontier Foundation is often the best source of reporting to find out what laws the government has broken. When a change to the privacy policy of Google or Facebook is made, the Electronic Frontier Foundation is the best place to find out how that change
The post Electronic Frontier Foundation with Nate Cardozo appeared first on Software Engineering Daily.
When you hear about massive data breaches like the recent ones from LinkedIn, MySpace, or Ashley Madison, how can you find out whether your own data was compromised? Troy Hunt created the website HaveIBeenPwned.com to answer this question. When a major data breach occurs, Troy acquires a copy of the stolen data and provides
The post Data Breaches with Troy Hunt appeared first on Software Engineering Daily.
Call centers are a vulnerable point of attack for large enterprises. Fraud accounts for more than $20 billion in lost money every year, and a significant portion of that fraud is due to customer service representatives being fraudulent social engineering attacks. Chris Halaschek joins the show today to discuss how Pindrop Security is addressing
The post Security and Machine Learning in the Call Center with Pindrop Security’s Chris Halaschek appeared first on Software Engineering Daily.
Every software application has secrets. User passwords and database credentials must be managed carefully, because poor access controls can lead to disaster scenarios. Vault is a tool for secret management, developed at Hashicorp, a company that builds software tools for application delivery and infrastructure management. Seth Vargo is a software engineer and open source advocate
The post Secret Management and Vault with Hashicorp’s Seth Vargo appeared first on Software Engineering Daily.
“The three legs of the stool are culture, process, and tooling, and I think process and tooling are the easy ones.”
Continue reading…
The post Internet of Things and DevOps with Anders Wallgren appeared first on Software Engineering Daily.
“If everyone is going to use TLS, people need to trust their certificate authority, and the way to gain trust is through openness.”
Continue reading…
The post Let’s Encrypt with Josh Aas appeared first on Software Engineering Daily.
Modern automated attacks using widespread botnets have evolved in sophistication, making cybercrime an increasingly relevant threat in today's internet. Security researchers and organizations have to stay vigilant in this cat-and-mouse game.
Shuman Ghosemajumder is the VP of Product at Shape Security, which defends applications from malware and bots. He is the former click fraud czar at Google, and he will be speaking at QCon San Francisco.
Continue reading…
The post Botnets and Cybercrime with Shuman Ghosemajumder appeared first on Software Engineering Daily.
“If you don’t like what you see sometimes when you look at the world, it’s incumbent on you - you do something about it.”
Adrián Lamo is a threat analyst, hacker, and writer. In the early 2000's, Adrián was a hobbyist white-hat hacker, breaking into companies to expose vulnerabilities and fix them.
Continue reading…
The post Intelligence and National Security with Adrián Lamo appeared first on Software Engineering Daily.
Keybase is an open-source key directory that allows users to encrypt messages and verify identities.
Max Krohn is the co-founder of Keybase, and previously co-founded OKCupid and SparkNotes.
Continue reading…
The post Identity and Encryption with Keybase Founder Max Krohn appeared first on Software Engineering Daily.
"What we learn again and again is that security is less about what you think of, and more about what you didn't think of."
Bruce Schneier is a security researcher and author of Data and Goliath.
Continue reading…
The post Security and Privacy with Bruce Schneier appeared first on Software Engineering Daily.
Automobiles are now computers with security vulnerabilities. Reverse engineers have begun to dissect car security.
Craig Smith is the author of The Car Hacker's Handbook and the founder of Theia Labs, a research and consulting firm.
Continue reading…
The post Car Hacking with Craig Smith appeared first on Software Engineering Daily.