Skip to main content

Posts

Speeding Up Software Delivery Is Changing How We Debug Performance

Deployment frequency has become one of the clearest markers of a mature engineering organization. Teams that once shipped monthly now ship daily, and teams that shipped daily now ship several times a day. This shift has largely delivered on its promise. Smaller changes are easier to reason about, rollbacks are faster, and feedback loops are shorter. What has received less attention is the effect this same shift has had on the practice of debugging performance issues. Several assumptions that previously held, a stable release to compare against, a known change set behind a given incident, sufficient time between deployments to observe a system before the next one lands, no longer apply in the same way. A Moving Baseline Performance debugging has traditionally depended on comparison. An engineer examines current behavior against a known good state, typically the previous release, and narrows down what changed. This approach works well when releases are infrequent enough that the previ...
Post a Comment
Read more
Recent posts

AWS Adds Harness to Open Source SDK for Building AI Agents

Amazon Web Services (AWS) this week revealed it has added a harness to the open source software development kit (SDK) it makes available for building artificial intelligence (AI) agents. First introduced last year, the Strands SDK makes it simpler for application developers to use AI models to build and deploy AI agents. The Strands harness provides a fully assembled, customizable AI agent that developers can use as a foundation for building agents designed to automate specific tasks. Marc Brooker, vice president and a distinguished engineer at AWS, said the overall goal is to make it simpler for application developers to build an AI agent that has been trained to automate a task that is unique to their organization. In many cases, those AI agents are now being built and deployed by DevOps teams much like any other workload, he noted. The challenge is that bringing together the right set of primitives required to build a custom AI agent can be difficult. The Strands harness provide...
Post a Comment
Read more

Avalara Ushers in New Era of Agentic Tax and Compliance with Avalara Aviator


Avalara’s new agent hub brings together specialized AI agents to execute complex tax and compliance workflows while keeping people in control of the decisions that matter. FORT LAUDERDALE, Fla. — September 23, 2026 — Avalara, Inc. , the agentic AI leader in global tax and compliance, today unveiled Avalara Aviator at its CRUSH customer and partner conference. The new agent hub for tax and compliance turns days of manual work into minutes of oversight, with an audit-defensible record for every action. As businesses expand across markets, channels, and business models, tax and compliance requirements are becoming more interconnected, more digital, and increasingly real-time. For years, tax software has automated individual compliance tasks, but much of the work between those tasks has remained manual and siloed. Avalara Aviator is designed to close that gap with intelligent agents that can understand context, coordinate work, monitor variance, and take action. Humans delegate the wor...
Post a Comment
Read more

Cycode Extends DevSecOps Reach to Software Packages Developers Download

Cycode today revealed it is providing early access to an extension of its platform for securing software supply chains that prevents developers from downloading malicious or suspicious software packages onto their workstations. A Workstation Protection capability that has been added to that platform enables DevSecOps teams to apply policies and controls that prevent developers from downloading potentially malicious instances of software packages from a software repository. Specifically, the Cycode agentic development lifecycle (ADLC) Protection platform applies two controls in real time. The first inspects software packages against a threat intelligence feed to prevent downloads of known malicious software packages. The second will automatically prevent the download of any software package that has been too recently updated on the assumption that there has not been enough time to properly vet it, otherwise known as a cool down period. Devin Maguire, senior product marketing manager ...
Post a Comment
Read more

Your AI Coding Assistant Has the Keys to the Repo. Z.ai Just Showed Why That Matters

Most developers who install an AI coding assistant assume it reads the files it needs. Few expect it to package the entire workspace and ship it somewhere else. That’s what users say happened with ZCode, the AI coding assistant from Chinese AI company Z.ai, also known as Zhipu. After a week of public backlash, the company disabled the features involved, apologized, and brought in outside firms to confirm the data was gone, Reuters reported. The trouble surfaced when an independent Chinese blogger who goes by Ferstar noticed abnormal disk usage and traced it to ZCode background processes. He found that whenever a user was logged in, ZCode packaged the entire workspace, including the full .git history, Git LFS cache, reflogs and global app configs. It then encrypted the bundle and uploaded it to Aliyun OSS, Alibaba Cloud’s object storage service. The source was a Codebase Indexing feature that supported session checkpoints, version rollbacks, and wiki generation. It was on ...
Post a Comment
Read more

Why Shift Left is Dead

Shift left is dead. For more than two decades, it has been the default philosophy of secure software development : Catch problems as early as possible, and everything downstream gets faster, cheaper, and safer. That philosophy no longer holds, because AI-driven development has broken the assumptions it was built on. The concept was introduced in 2001 by software engineer Larry Smith, who argued that testing and quality assurance should move earlier in the development process rather than be left until the end. It went on to become one of the most influential ideas in the software development ecosystem. In the security niche specifically, it helped dev teams find and fix vulnerabilities during design and coding rather than waiting for testing or deployment, turning security from a roadblock into an accelerator of rapid, secure releases. That’s because AI-driven development has introduced a new category of risk that shift left was never built to address: Exposure that happens befor...
Post a Comment
Read more

New npm Threat Bypasses Install Script Protections

A malicious npm package that has been downloaded millions of times comes with a new way of spreading the malware that makes it easier to bypass security protections, say researchers with security vendor Checkmarx. Rather than using more common preinstall or postinstall scripts, the bad actors instead created a malicious package – indexed-btree – that mimics the legitimate sorted-btree package and hides the malware in the package’s runtime code, according to Checkmarx security researcher Bruno Dias. Indexed-btree “runs entirely from application code at runtime,” Dias wrote in a report . “Additionally, this package achieved almost 2 million weekly downloads, which shows not much has changed in the npm ecosystem despite the limitations put on lifecycle scripts.” The latest malware targeting npm packages hides inside the Btree.prototype.set, the standard method in JavaScript B-Tree data structures. Because there’s no install hook inside the package.json file, installing the packag...
Post a Comment
Read more