Software Engineering

For “cool tech stuff” see Tech.

Development

• conventionalcomments.org

• conventionalcommits.org

• jpmorganchase/python-training: Python training for business analysts and traders

• What makes a good REST API? - Apitally Blog

• Engineering Transformations - Adopting Automated Testing As A Practice

• Introducing an Accessibility Linter for Marko: Shortening the Accessibility Testing Pipeline

• Evolving JSON Schemas - Part I - Creek Service, write business logi…

• Anything can be a message queue if you use it wrongly enough - Xe Iaso

• Cutting edge debugging · jml :: Jonathan Lange

• How to feel better (or, some tips on refactoring) · jml :: Jonathan Lange

• Work Is Work | codahale.com

• Welcome to the world of Statecharts - Statecharts

• An intuitive documentation strategy | Abstraction.blog

• Yes, you should test on production… | by Marco Chiappetta | Medium

• Why not tell people to “simply” use pyenv, poetry or anaconda

Infrastructure

• Artificial Intelligence Infrastructure-as-Code Generator

• bridgecrewio/checkov: Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.

• 7 Core Elements of an Internal Developer Platform

• How to make an Impact as a Platform Product Manager

• Automating safe, hands-off deployments

• Awesome Load Management

• The Service Mesh Landscape

• It’s Time to Retire Terraform. Terraform exists in many people’s… | by Eric Larssen | Real Kinetic Blog

• supabase/index_advisor: PostgreSQL Index Advisor

• What Is Amazon Resource Name (ARN)?

• Community | Navigating through failures, build resilient serverless systems

• MemoryDB: Speed, Durability, and Composition. - Marc’s Blog

• How an empty S3 bucket can make your AWS bill explode | by Maciej Pocwierz | Apr, 2024 | Medium

• leg100/pug: Drive terraform at terminal velocity.

• Building a GitOps CI/CD Pipeline with GitHub Actions (SOC 2)

• Platform Engineering: Orchestrating Applications, Platforms, and Infrastructure

• What type of investment and commitment do internal developer platforms require?

• microsoft/retina: eBPF distributed networking observability tool for Kubernetes

• Terraform Strategies for Grafana | by tb.lx | tb.lx insider

• #23 – The Danger of Unreliable Platforms (with Jade Rubick) – Boost SRE work | SREpath

• Roblox Builds New Cellular Infrastructure to Improve Gaming Experience

• 10 Strategies to Build and Manage Scalable Infrastructure

• Dynamic Environment: Streamlining Testing & Development in Microservices | Riskified Tech

• The LinkedIn DPH Framework

• Loco | Loco

• ElasticSearch Search Capabilities Baked Into PostgreSQL

• (Almost) Every infrastructure decision I endorse or regret after 4 years running infrastructure at a startup · Jack’s home on the web

• 2024 State of Internal Developer Portals | Port

• pgxman

• SBOMit (GitHub)

• Scaling Kafka to Support PayPal’s Data Growth | by Monish Koppa | The PayPal Technology Blog | Medium

• Practical Guide to Internal Developer Portals

• Envoy Gateway

• Radius

• philips-labs/terraform-aws-github-runner: Terraform module for scalable GitHub action runners on AWS

Security

• Threat models

• I use Zip Bombs to Protect my Server

• PuTTY vulnerability vuln-p521-bias

• Distributed Authorization

• Everything I know about the XZ backdoor

• CERT-EU - Critical Vulnerability in XZ Utils

• The massive bug at the heart of the npm ecosystem

• Fine-Grained RBAC For GitHub Action Workflows With GitHub OIDC and HashiCorp Vault

• Out of the Cyber Crisis - Deming in the World of Cybersecurity - IT Revolution

• Cybersecurity Isn’t Special | Sensemaking by Shortridge

• Securing-the-Open-Source-Software-Ecosystem-OS3I-End-of-Year-Report-MASTERCOPY.pdf

• Introducing MavenGate: a supply chain attack method for Java and Android applications | Oversecured Blog

DevOps

• DevOps uses a capability model, not a maturity model

• Minimizing on-call burnout through alerts observability

• 2024 DORA survey now open | Google Cloud Blog

• The Scary Thing About Automating Deploys - Slack Engineering

• Continuous Integration

• Onboarding roulette: deleting our employee accounts daily

• Best Practices to Prevent Alert Fatigue | Datadog

• Resisting compliance is futile | Tales about Software Engineering

• The most visited AWS DevOps blog posts in 2023 | AWS DevOps Blog

• Solomon Hykes Discusses Dagger, DevOps, and Docker

• How to be on-call: On-call often sucks but doesn’t have to. | Medium

• State of DevOps 2023 Highlights - Semaphore

Metrics / Observability

• You Only Get 3 Metrics - Which Ones Would You Pick?

• OpenTelemetry Tracing in 200 lines of code | Jeremy Morrell

• All you need is Wide Events, not “Metrics, Logs and Traces”

• A Practitioner’s Guide to Wide Events | Jeremy Morrell

• Data Strategy for SREs and Observability Teams | Honeycomb

• Don’t Get Lost in the Metrics Maze: A Practical Guide to SLOs, SLIs, Error Budgets, and Toil | by Lokesh Aggarwal | May, 2024 | Medium

• SRE Stories | Prathamesh Sonpatki | Substack

• If P99 Latency Is BS, What’s the Alternative? - The New Stack

• OpenTelemetry Best Practices #1: Naming | Honeycomb

• OpenTelemetry Best Practices #2 Agents, Sidecars, & Collectors

• Best Practices for Monitoring ML Models in Production | Datadog

• Key Metrics for Monitoring Etcd | Datadog

• Tools for Collecting Etcd Metrics and Logs | Datadog

• Reinvent Kubernetes Logging with Telemetry Controller – Axoflow

• Why I (Still) Like the Serverless Framework over the CDK | DeBrie Advisory

• Effective Trace Instrumentation with Semantic Conventions | Honeycomb

• Alerts Are Fundamentally Messy | Honeycomb

• Top 5 Best Practices for Naming OpenTelemetry Attributes - The New Stack

• Prometheus and centralized storage: When you need it, how it works, and what Mimir is – Palark | Blog

• Prometheus and its storage: Architecture, challenges, and solutions – Palark | Blog

• perses/perses: The CNCF candidate for observability visualisation. Already supports Prometheus - more data sources to come!

• PromCon Recap: Unveiling Perses, the GitOps-Friendly Metrics Visualization Tool | Logz.io

• HyperDX - Affordable full-stack production debugging & monitoring.

• How to Combine Observability-driven Development and Security | by Hayk Petrosyan | ETEAM | Medium

• Sofia’s Observability Odyssey: Bad Log Day | by Adso | Medium | Medium

• Observability Is About Confidence | Honeycomb

Developer Experience (DevEx)

• How To Get Buy-in for DevEx Initiatives: Strategies From GitHub, Notion, and More

• DevEx: What Actually Drives Productivity

• DevEx in Action - ACM Queue

Assorted Tools

• googleapis/release-please: generate release PRs based on the conventionalcommits.org spec

• cyrus-and/gdb-dashboard: Modular visual interface for GDB in Python

• 15r10nk/inline-snapshot: create and update inline snapshots in your python tests

• microsoft/markitdown: Python tool for converting files and office documents to Markdown.

• janestreet/bonsai: A library for building dynamic webapps, using Js_of_ocaml

• High-Performance SBOM Analysis Tools | Bitbom

• trustme: #1 quality TLS certs while you wait — trustme 1.2.0+dev documentation

• simeji/jid: json incremental digger

• frectonz/pglite-fusion: Embed an SQLite database in your PostgreSQL table. AKA multitenancy has been solved.

• coollabsio/coolify: An open-source & self-hostable Heroku / Netlify / Vercel alternative.

• MightyMoud/sidekick: Bare metal to production ready in mins; your own fly server on your VPS.

• Task

• wagoodman/dive: A tool for exploring each layer in a docker image

• Tiny Toolkits

• Pongo

• ONCE — Writebook

• GitHub - Unleash/unleash: Open-source feature management solution built for developers.

• FeatureFlag 101 - DZone

• EventCatalog: Discover, Explore and Document your Event Driven Architectures. | EventCatalog

• WerWolv/ImHex: 🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.

• wolfpld/tracy: Frame profiler

• SBOMit

• GitHub - octoherd/octoherd: Manage multiple repository updates all at once.

• crashappsec/chalk: Chalk allows you to follow code from development, through builds and into production.

• SeaGOAT

• GitHub Actions could be so much better

• How to express OR in Rego - Styra

• OpenFeature

• MatthewJohn/Terrareg: Open source Terraform module registry with UI, optional Git integration and deep analysis

• Home | Pipelight

• openappsec/openappsec: open-appsec is a machine learning security engine that preemptively and automatically prevents threats against Web Application & APIs. This repo include the main code and logic.

Learning Through Doing

• The Missing Semester of Your CS Education

• Introducing “Implement DNS in a Weekend”

• Writing a Simple Garbage Collector in C

• Write your Own Virtual Machine

• Building a distributed log using S3 (under 150 lines of Go) - blag

Career

• The 25 Year Old Architect Problem - by James Sperring

• From engineer to head of engineering | Tales about Software Engineering

• 11 Articles that Heavily Impacted my Career Trajectory in Tech | Thiago Ghisi

• The Best Programmers I Know | Matthias Endler

• What I wish I knew when I became CTO | by David Mack | SketchDeck developer blog | Medium

• How GitHub’s CTO Architects Engineering Teams That Scale | by FirstMark | Medium

Pull Requests and Code Reviews

• Code Reviews

• Your code sucks, and I hate you · jml :: Jonathan Lange

• Levelling up Pull Requests

• (PDF) Gender bias in open source: Pull request acceptance of women versus men

• Code Review Security Checklist

Data Structures and Algorithms

• arXiv:1608.03960v1 [cs.DC] 13 Aug 2016 1 A Conflict-Free Replicated JSON Datatype

Misc

• I want off Mr. Golang’s Wild Ride

• Read Every Single Error

• Amir’s 10 Laws of Tech

• My Approach to Building Large Technical Projects

• Page Weight Matters

• A beginner-friendly introduction to Kubernetes

• Lullaby Language

• Talk Like A Systems Engineer: Yaks All The Way Down

• Ditherpunk — The article I wish I had about monochrome image dithering

• Whose Cert Is It Anyway?

• Netreap: A Practical Guide to Running Cilium in Nomad

• Building Customer-Facing Real-Time Dashboards with Postgres

• Language Tooling Antipatterns

• Technology Decision Making (and Boring Technology)

• Refactoring CI/CD for a Moderately Large C++ Code Base

• Agility and Architecture: Balancing Minimum Viable Product and Minimum Viable Architecture

• Augmenting Agile with Formal Methods

• Modeling Zero-Downtime Deployments with TLA+

• Learn TLA+ — Learn TLA+

• User Story Template: What It Is and Why It Works So Well

• Avoiding the Rewrite Trap

• Should You Use Upper Bound Version Constraints? -

  • “Capping dependencies has long term negative effects, especially for libraries, and should never be taken lightly. A library is not installed in isolation; it has to live with other libraries in a shared environment. Only add a cap if a dependency is known to be incompatible or there is a high (>75%) chance of it being incompatible in its next release. Do not cap by default - capping dependencies makes your software incompatible with other libraries that also have strict lower limits on dependencies, and limits future fixes. Anyone can fix a missing cap, but users cannot fix an over restrictive cap causing solver errors. It also encourages hiding issues until they become harder to fix, it does not scale to larger systems, it limits your ability to access security and bugfix updates”

• DevOps Notebooks Built with Markdown

• How do you cut a monolith in half? — programming is terrible

• Bugs Optional? - by Kent Beck

• Random musings on the Agile Manifesto – NeoPragma LLC

• On IBM acquiring HashiCorp. On April 24th, 2024, IBM confirmed they… | by Fintan Ryan | Apr, 2024 | Medium

• Monoliths are not dinosaurs | All Things Distributed

• SOLID Principles: Don’t Listen to People Who Say You Don’t Need Them

• Much ado about “nothing” - Xe Iaso

• Choose Boring Technology Culture – charity.wtf

• the sudoku affair • Buttondown

• Tolerating full cloud outages with Monzo Stand-in

• Loopwerk: uv just keeps on getting better

• Dependency Management Data

• XOR

• The Problem with Using a UUID Primary Key in MySQL — PlanetScale

• Monolith: Real Time Recommendation System With Collisionless Embedding Table

• Cognitive load is what matters

• Institutional memory and reverse smuggling

• TBM 320: From Fluffy Concepts to Concrete Outcomes & Behaviors

• Tossed Salads And Scrumbled Eggs — Ludicity

• Lessons from 4 years of weekly changelogs | Blog | incident.io

• Egoless Engineering

• Elliptical Python Programming - Susam Pal

• My Red Hot ADHD Programming ‘Affliction’

• The Practical Guide to Scaling Django

• How we page ourselves if incident.io goes down | Blog | incident.io

• APIs as infrastructure: future-proofing Stripe with versioning

• Old school architectures making a return, part 2: Backend rendered webapps

• Python Type Hints: How to Gradually Add Types for Third Party Packages - Adam Johnson

• The reality of long-term software maintenance - Ashley’s blog

• RDEL #75: How do interruptions impact different software engineering activities?

• 5 mindset shifts needed to grow from engineer to leader

• Infrastructure Platform Teams - Infrastructure as Code

• 1x Engineer

• Monki Gras 2025: What I’ve Learned by Building to Last – alexwlchan

• Everything I Know About Shipping Code Faster

• Take This On-Call Rotation and Shove It § Scott Smitelli

• Postel’s Law and the Three Ring Circus · Alex Gaynor

• Notes on coreutils in Rust · Alex Gaynor

• Against Vibecoding (Sorta) | shimweasel.com

• The Software Engineering Identity Crisis - Annie Vella

• A note on the USB-to-PS/2 mouse adapter that came with Microsoft mouse devices - The Old New Thing

• The 300% Production Problem | lbr.

• The Product Engineer – Rands in Repose

• Why speaking to users is a good idea. - by Jeff - JoT

• Just F**cking Ship - Commoncog

• jwz: Wherein wrapping text remains the hardest problem in computer science.

• Non-Project Backlog Management for Software Engineering Team

• Fix your flaky tests first. - by Jeff - JoT

• Scrum Doesn’t Say… - adrianhoward.com

• Scrum Guide | Scrum Guides

• Common misconceptions of Trunk-based development | Bucket

• Is ops a bullshit job? – Dan Slimmon

• What Is a Modular Monolith? - by Dr Milan Milanović

• You can’t stop the business, or why rewrites fail | Swizec Teller

• Agile & Multitasking: Escape the Busyness Trap - Mountain Goat Software

• Programming With Chronic Pain | Thomas Vogelaar

• [Draft] Rewilding Software Engineering | by swardley | feenk | Medium

• Don’t make these feature flag mistakes - by Ian Vanagas

• Parsing JSON is a Minefield

• The 13 software engineering laws - by Anton Zaides

• The Explosive Nature of ‘Big Bang’ Rewrites

• Keep the monolith, but split the workloads | incident.io

• BuildKit in depth: Docker’s build engine explained

• How Figma’s Databases Team Lived to Tell the Scale | Figma Blog

• Refactoring – Not on the backlog!

• Documentation as code: Principles, workflow, and challenges

• Linux Crisis Tools

• Two Hard Things

• Why naming things is hard - Peter Hilton

• Naming Things - A Comprehensive Guide - John Farrier

• An epic treatise on scheduling, bug tracking, and triage - apenwarr

• Reader/Reader blocking in reader/writer locks - Made of Bugs

• Home-Cooked Software and Barefoot Developers

• Automerge CRDT | Automerge CRDT

• The cost of convenience — surma.dev

• How to Test Website Speed the Right Way [Step by Step Tutorial] - Sematext

• Safe to Fail: A Journey in Reviving My Creativity

• Blockbuster: The #1 Mental Model For Writers Who Want To Create High-Quality, Viral Content | by Michael Simmons (blockbuster.thoughtleader.school) | Accelerated Intelligence | Medium

• Solo Dev Report: 50 Solo Developers Making $10K+/Month

• command center: Simplicity

• Nginx is Probably Fine | Navendu Pottekkat

• Deciphering Glyph :: Safer, Not Later

Other

• Technical Debt
  • Metrics and categories and approaches
  • Financial Analogies
  • Other Debts
  • See Also