Software Engineering
For “cool tech stuff” see Tech.
Development
Elided Branches: Driving Cultural Change Through Software Choices
Stupidity can be a plus in corporations — but not in software development. – Jessitron
Watchman: monitoring dependency conflicts for Python library ecosystem | the morning paper
Boring is Beautiful in Software Development | by Ben “The Hosk” Hosking | CodeX | Sep, 2022 | Medium
Unix legend, who owes us nothing, keeps fixing foundational AWK code | Ars Technica
Companies Using RFCs or Design Docs and Examples of These - The Pragmatic Engineer
Making the world’s fastest website, and other mistakes - DEV Community
Preface to an Unwritten Programming Language Book - avdi.codes
How to build stable systems. — An incomplete opinionated guide. | by Jesper L. Andersen | Medium
Microservices: Real Architectural Patterns | by Camille Fournier | Medium
Jade Rubick - Implementing Amazons single threaded owner model a retrospective
Smaller Python Docker Containers with Multi-Stage Builds and Python Wheels
How To Build A Real-Time App With GraphQL Subscriptions On Postgres
Command-line Tools can be 235x Faster than your Hadoop Cluster
Drop-Down Usability: When You Should (and Shouldn’t) Use Them
Handling the Notch on iPhone X, XS, XR, XS Max and Google Pixel 3 in CSS
How the Go runtime implements maps efficiently (without generics)
How Dropbox rolled out one of the largest Python 3 migrations ever
Things you probably don’t want to do on your [airline] website’s payment pages
Ligatures in programming fonts | Butterick’s Practical Typography
Command-line tips for effective release announcements — David Winterbottom
Investing in Internal Documentation: A Brick-by-Brick Guide for Startups | First Round Review
What complex systems can teach us about building software | Kevin Sookocheff
The technology behind GitHub’s new code search | The GitHub Blog
Getting Started With Java Development in 2023 — An Opinionated Guide - Gunnar Morling
Why inheritance never made any sense | Structure and Interpretation of Computer Programmers
You don’t have to use Nix to manage your dotfiles - jade’s www site
The 100% correct way to validate email addresses | by David Gilbertson | Medium
jpmorganchase/python-training: Python training for business analysts and traders
Engineering Transformations - Adopting Automated Testing As A Practice
Introducing an Accessibility Linter for Marko: Shortening the Accessibility Testing Pipeline
Evolving JSON Schemas - Part I - Creek Service, write business logi…
Anything can be a message queue if you use it wrongly enough - Xe Iaso
How to feel better (or, some tips on refactoring) · jml :: Jonathan Lange
Yes, you should test on production… | by Marco Chiappetta | Medium
Why not tell people to “simply” use pyenv, poetry or anaconda
Infrastructure
Terraform CLI Args, define once, use again and again | by Suraj Narwade | Dec, 2022 | Suraj in Cloud
Organize your AWS Serverless code to prevent merge conflicts | AWS DevOps Blog
The Cost of Cloud, a Trillion Dollar Paradox | Andreessen Horowitz
Learning Docker with Docker - Toying With DinD For Fun And Profit
Infrastructure is Architecture (with CDK) - Build Diligent | Build Diligent
A Practical Guide to Capturing Production Traffic with eBPF | Seekret
Paving Golden Paths On Multi-Cluster Kubernetes: Part 1 (The Theory)
Building Self-driving Kafka clusters using open source components - Slack Engineering
The Current State of Open Source Backup Management for PostgreSQL
Thou shalt not run a database inside a container - Sysadmin 4 lyfe
How GitLab used delayed replication for disaster recovery with PostgreSQL
Software Sprawl, The Golden Path, and Scaling Teams With Agency
Deploying completely serverless Django with Zappa and Aurora Serverless
How to Manage Connections Efficiently in Postgres, or Any Database
Kubernetes: The Surprisingly Affordable Platform for Personal Projects
How We Generate SSL Certificates for Custom Domains using Let’s Encrypt
Scaling Elasticsearch by Cleaning the Cluster State - Sematext
Building and operating a pretty big storage system called S3 | All Things Distributed
bregman-arie/sre-checklist: A checklist of anyone practicing Site Reliability Engineering
What SaaS CTOs need to know about the Terraform licence change - The Scale Factory
10 Small Search Platforms: Powerful Alternatives to Elasticsearch, OpenSearch, and Solr - Sematext
Rethinking infrastructure as code from scratch | Nathan Peck
How to Find and Fix Elasticsearch Unassigned Shards - Sematext
Elegant Database Migrations on ECS | by Adam Stepinski | Instawork Engineering
Platform Engineering Is Not about Building Fancy UIs - The New Stack
Building a Staging Environment for Data Teams | Riskified Technology | Riskified Technology
klothoplatform/klotho: Klotho - a CLI tool that transforms plain code into cloud native code
DeployBar — Free CI monitoring. Unsolicited platypus included.
Community | Navigating through failures, build resilient serverless systems
How an empty S3 bucket can make your AWS bill explode | by Maciej Pocwierz | Apr, 2024 | Medium
Building a GitOps CI/CD Pipeline with GitHub Actions (SOC 2)
Platform Engineering: Orchestrating Applications, Platforms, and Infrastructure
What type of investment and commitment do internal developer platforms require?
microsoft/retina: eBPF distributed networking observability tool for Kubernetes
#23 – The Danger of Unreliable Platforms (with Jade Rubick) – Boost SRE work | SREpath
Roblox Builds New Cellular Infrastructure to Improve Gaming Experience
Dynamic Environment: Streamlining Testing & Development in Microservices | Riskified Tech
philips-labs/terraform-aws-github-runner: Terraform module for scalable GitHub action runners on AWS
Security
Dropping hashes: an idiom used to demonstrate provenance of documents | Kalzumeus Software
mondoohq/cnquery: An open source, cloud-native asset inventory
Second Order Subdomain Takeovers – They DO Exist! – Tales from the Crypto
How DoorDash Governs Its Infrastructure with Open Policy Agent - The New Stack
SLSA: Securing the Software Supply Chain | All SUSE Products
sethvargo/ratchet: A tool for securing CI/CD workflows with version pinning.
scribe-public/gitgat: Evaluate source control (GitHub) security posture
reposaur/reposaur: Audit your GitHub data using custom policies written in Rego
Dev corrupts NPM libs ‘colors’ and ‘faker’ breaking thousands of apps
Put an io_uring on it: Exploiting the Linux Kernel - Blog | Grapl
Russian State Hackers Use Britney Spears Instagram Posts to Control Malware
The strange story of “Extended Random” – A Few Thoughts on Cryptographic Engineering
Your CPU May Have Slowed Down on Wednesday | Performance Matters
asecure.cloud - A free repository of customizable AWS security configurations and best practices
Which smart bulbs should you buy (from a security perspective)
The smart security behind the GB Smart Metering System - NCSC.GOV.UK
James “ubernostrum” Bennett on JWT’s fundamental security issues
Searchable encryption and the ever-expanding leakage function
They Got ‘Everything’: Inside a Demo of NSO Group’s Powerful iPhone Malware
Source Code Management Platform Configuration Best Practices | OpenSSF Best Practices Working Group
OpenSSF Releases Source Code Management Best Practices Guide - Open Source Security Foundation
World’s Biggest Data Breaches & Hacks — Information is Beautiful
CVE-2020-19909 is everything that is wrong with CVEs | daniel.haxx.se
It rather involved being on the other side of this airtight hatchway - The Old New Thing
10 Best SSL Certificate Monitoring Tools [2023 Review] - Sematext
bom-squad/protobom: A universal SBOM representation in protocol buffers
xeol-io/xeol: An end-of-life (EOL) package scanner for container images, systems, and SBOMs
What’s new in the CIS v2.0 benchmark for AWS | Steampipe Blog
Communicating Common Web App Security Threats to Developers - DevOps.com
📖 Software Bill of Materials (SBOM) - {anonymous => ‘hash’};
Talking about risk with thresholds 🔥 | by Ryan McGeehan | Starting Up Security | Mar, 2023 | Medium
Introducing vmdiff: a tool to find everything that changes on your computer
cURL audit: How a joke led to significant findings | Trail of Bits Blog
Bug #868360 “Incorrect secret key causes user details to be reve…” : Bugs : OpenStack Compute (nova)
Risk Assessments for AWS Access are Not Just for Large Companies
Compromising the Code: Inside CI/CD Pipeline Attacks | by Urshila Ravindran | May, 2025 | Medium
Fine-Grained RBAC For GitHub Action Workflows With GitHub OIDC and HashiCorp Vault
Out of the Cyber Crisis - Deming in the World of Cybersecurity - IT Revolution
Securing-the-Open-Source-Software-Ecosystem-OS3I-End-of-Year-Report-MASTERCOPY.pdf
DevOps
Rules for getting production access - GOV.UK Developer Documentation
People-Centric Software Operations Culture | by Nick Gibbon | Pareture | Sep, 2022 | Medium
What’s Inside Of a Distroless Container Image: Taking a Deeper Look
Wasting one million dollars - Tom Limoncelli’s EverythingSysadmin Blog
Announcing the 2023 State of DevOps Report | Google Cloud Blog
Multiarch, multi distro packaging in Debian land with sbuild & zfs
Richard Seroter on shifting down vs. shifting left | Google Cloud Blog
Deploys Are the ✨WRONG✨ Way to Change User Experience | Honeycomb
What Was the Least Reliable GitHub Feature in 2022 | StatusGator
The Scary Thing About Automating Deploys - Slack Engineering
Resisting compliance is futile | Tales about Software Engineering
The most visited AWS DevOps blog posts in 2023 | AWS DevOps Blog
How to be on-call: On-call often sucks but doesn’t have to. | Medium
Metrics / Observability
OpenSLO/OpenSLO: Open specification for defining and expressing service level objectives (SLO)
PostgreSQL Logs Explained: Logging Configuration Tutorial - Sematext
The point of a dashboard isn’t to use a dashboard – Terence Eden’s Blog
Client-side instrumentation for under $1 per month. No servers necessary.
Alerting: The Do’s and Don’ts for Effective Observability | by Adso | Medium | Medium
Engineer Time Saved. How measuring the cost of operations… | by Aidan Donnelly | Sep, 2023 | Medium
McKinsey Developer Productivity Review - Dan North & Associates Ltd
Service Delivery Index: A Driver for Reliability - Slack Engineering
Best Practices for Monitoring Static Web Applications | Datadog
How We Improved Our Monitoring Stack With Only a Few Small Changes
How we reduced our Prometheus infrastructure footprint by a third
If P99 Latency Is BS, What’s the Alternative? - The New Stack
OpenTelemetry Best Practices #2 Agents, Sidecars, & Collectors
Best Practices for Monitoring ML Models in Production | Datadog
Reinvent Kubernetes Logging with Telemetry Controller – Axoflow
Why I (Still) Like the Serverless Framework over the CDK | DeBrie Advisory
Effective Trace Instrumentation with Semantic Conventions | Honeycomb
Top 5 Best Practices for Naming OpenTelemetry Attributes - The New Stack
Prometheus and its storage: Architecture, challenges, and solutions – Palark | Blog
PromCon Recap: Unveiling Perses, the GitOps-Friendly Metrics Visualization Tool | Logz.io
HyperDX - Affordable full-stack production debugging & monitoring.
How to Combine Observability-driven Development and Security | by Hayk Petrosyan | ETEAM | Medium
Sofia’s Observability Odyssey: Bad Log Day | by Adso | Medium | Medium
Developer Experience (DevEx)
Assorted Tools
erikbern/git-of-theseus: Analyze how a Git repo grows over time
Orange-OpenSource/hurl: Hurl, run and test HTTP requests with plain text.
GitHub - hashicorp/go-plugin: Golang plugin system over RPC.
GitHub - RocketRace/setver: Setaceous Versioning, the revolutionary new way to maintain software
keploy/keploy: No code API testing platform. Create unit tests and data mocks from API calls.
travis.debian.net — Easily build and test your Debian packaging on travis-ci.org & GitHub
zombodb/zombodb: Making Postgres and Elasticsearch work together like it’s 2018
Build smaller, faster, and more secure desktop applications with a web frontend | Tauri Apps
bwplotka/bingo: Like `go get but for Go tools! CI Automating versioning of Go binaries in a nested, isolated Go modules. <https://github.com/bwplotka/bingo>`_
usebruno/bruno: Opensource IDE For Exploring and Testing Api’s
cirruslabs/tart: macOS and Linux VMs on Apple Silicon to use in CI and other automations
Introducing Hermes, An Open Source Document Management System
keith/reminders-cli: A simple CLI for interacting with macOS reminders
googleapis/release-please: generate release PRs based on the conventionalcommits.org spec
cyrus-and/gdb-dashboard: Modular visual interface for GDB in Python
15r10nk/inline-snapshot: create and update inline snapshots in your python tests
microsoft/markitdown: Python tool for converting files and office documents to Markdown.
janestreet/bonsai: A library for building dynamic webapps, using Js_of_ocaml
trustme: #1 quality TLS certs while you wait — trustme 1.2.0+dev documentation
coollabsio/coolify: An open-source & self-hostable Heroku / Netlify / Vercel alternative.
MightyMoud/sidekick: Bare metal to production ready in mins; your own fly server on your VPS.
wagoodman/dive: A tool for exploring each layer in a docker image
GitHub - Unleash/unleash: Open-source feature management solution built for developers.
EventCatalog: Discover, Explore and Document your Event Driven Architectures. | EventCatalog
GitHub - octoherd/octoherd: Manage multiple repository updates all at once.
Learning Through Doing
Career
Elided Branches: An incomplete list of skills senior engineers need, beyond coding
Theory-building and why employee churn is lethal to software companies – Baldur Bjarnason
Oncall Compensation for Software Engineers - The Pragmatic Engineer
How Developers Stop Learning: Rise of the Expert Beginner - DaedTech
How Software Groups Rot: Legacy of the Expert Beginner - DaedTech
How Stagnation is Justified: Language of the Expert Beginner - DaedTech
The Passionate Programmer: Too Passionate, Perhaps? – Codemanship’s Blog
Reginald Braithwaite - Product Engineering Leadership & Technical Product Management
From engineer to head of engineering | Tales about Software Engineering
11 Articles that Heavily Impacted my Career Trajectory in Tech | Thiago Ghisi
What I wish I knew when I became CTO | by David Mack | SketchDeck developer blog | Medium
How GitHub’s CTO Architects Engineering Teams That Scale | by FirstMark | Medium
Pull Requests and Code Reviews
Data Structures and Algorithms
Misc
Quick note: 4 Reasons Writing About Software is Hard | Kellan Elliott-McCrea
[archiloque.net] Why Warhammer 40,000 is a good metaphor for software development
DRMacIver’s Notebook: Defects are the responsibility of programmers
Stop blaming spreadsheets (and take a good look in the mirror)
Software Sprawl, The Golden Path, and Scaling Teams With Agency – charity.wtf
Introduction · .9 Startup Technical Due Diligence Calculator
Software development topics I’ve changed my mind on after 6 years in the industry - Blogomatano
Initial thoughts on MongoDB’s new Server Side Public License
Franken-algorithms: the deadly consequences of unpredictable code
Reverence for the Craft, Business, and Your Immortal Soul — Ludicity
I Will Fucking Haymaker You If You Mention Agile Again — Ludicity
Your Organization Probably Doesn’t Want To Improve Things — Ludicity
Enhancing Your “Definition of Done” Can Improve Your Minimum Viable Architecture
Psychotic Network Ferret: “About ten years ago, the IT bu…” - Infosec Exchange
The age of cargo cult Agile must end. | by Jason Yip | Feb, 2023 | Medium
The AWS community isn’t for Amazonians - Last Week in AWS Blog
The origin of Smoke Testing and the confusion it can cause | Thoughtworks Canada
Do-nothing scripting: the key to gradual automation – Dan Slimmon
Neither Necessary Nor Sufficient – Jay Bazuzi – Author of Unremarkable Code
Ditherpunk — The article I wish I had about monochrome image dithering
Agility and Architecture: Balancing Minimum Viable Product and Minimum Viable Architecture
- Should You Use Upper Bound Version Constraints? -
“Capping dependencies has long term negative effects, especially for libraries, and should never be taken lightly. A library is not installed in isolation; it has to live with other libraries in a shared environment. Only add a cap if a dependency is known to be incompatible or there is a high (>75%) chance of it being incompatible in its next release. Do not cap by default - capping dependencies makes your software incompatible with other libraries that also have strict lower limits on dependencies, and limits future fixes. Anyone can fix a missing cap, but users cannot fix an over restrictive cap causing solver errors. It also encourages hiding issues until they become harder to fix, it does not scale to larger systems, it limits your ability to access security and bugfix updates”
How do you cut a monolith in half? — programming is terrible
SOLID Principles: Don’t Listen to People Who Say You Don’t Need Them
The Problem with Using a UUID Primary Key in MySQL — PlanetScale
Monolith: Real Time Recommendation System With Collisionless Embedding Table
TBM 320: From Fluffy Concepts to Concrete Outcomes & Behaviors
Lessons from 4 years of weekly changelogs | Blog | incident.io
How we page ourselves if incident.io goes down | Blog | incident.io
APIs as infrastructure: future-proofing Stripe with versioning
Old school architectures making a return, part 2: Backend rendered webapps
Python Type Hints: How to Gradually Add Types for Third Party Packages - Adam Johnson
The reality of long-term software maintenance - Ashley’s blog
RDEL #75: How do interruptions impact different software engineering activities?
Monki Gras 2025: What I’ve Learned by Building to Last – alexwlchan
A note on the USB-to-PS/2 mouse adapter that came with Microsoft mouse devices - The Old New Thing
jwz: Wherein wrapping text remains the hardest problem in computer science.
Non-Project Backlog Management for Software Engineering Team
You can’t stop the business, or why rewrites fail | Swizec Teller
Agile & Multitasking: Escape the Busyness Trap - Mountain Goat Software
[Draft] Rewilding Software Engineering | by swardley | feenk | Medium
How Figma’s Databases Team Lived to Tell the Scale | Figma Blog
An epic treatise on scheduling, bug tracking, and triage - apenwarr
Reader/Reader blocking in reader/writer locks - Made of Bugs
How to Test Website Speed the Right Way [Step by Step Tutorial] - Sematext