Jordan Loeser: Web Engineer
Tell us more about working on Spotify Wrapped…
Introducing Natural Language Search for Podcast Episodes
Until recently, Search at Spotify relied mostly on term matching. For example, if you type the query “electric cars climate impact”, Elasticsearch will return search results that contain everything that has each of those query words in its indexed metadata (like in the title of a podcast episode).
Chantal Delfeld: Engineer
My early mornings are spent running about after my children – getting them dressed, giving them breakfast and putting on their sunscreen, so they’re all ready for the day ahead. At 8am, I drive my daughter to preschool, while my mom looks after my one-year-old son – she’s been living with us since the start of the pandemic and has been a huge help when it comes to family life and childcare.
Introducing NerdOut@Spotify: A New Podcast for Developers
TL;DR For years, Spotify’s official engineering blog has been giving you a peek behind the curtain at Spotify R&D. Today, we’re announcing , our new R&D podcast that gives you another view into our tech world. In each episode I’ll talk with Spotify developers about challenging tech problems and give you a firsthand look into what we’re doing, what we’re building, and what we’re nerding out about a
Comparing Quantiles at Scale in Online A/B Testing
TL;DR: Using the properties of the Poisson bootstrap algorithm and quantile estimators, we have been able to reduce the computational complexity of Poisson bootstrap difference-in-quantiles confidence intervals enough to unlock bootstrap inference for almost arbitrary large samples. At Spotify, we can now easily calculate bootstrap confidence intervals for difference-in-quantiles in A/B tests with
Incident Report: Spotify Outage on March 8, 2022
On March 8, we experienced a global outage triggered by issues in a cloud-hosted service discovery system used at Spotify. We were made aware of issues with login at 18:12 UTC / 13:12 ET and started implementing fixes to critical systems at 18:39 UTC / 13:39 ET. This outage affected our users and we apologize for the inconvenience it may have caused. Our service has now fully recovered.
Zela Taino: iOS Engineer
Tell us more about working on Spotify Wrapped…
Web Component Pseudo-Classes and Pseudo-Elements are Easier Than You Think
We’ve discussed a lot about the internals of using CSS in this ongoing series on web components, but there are a few special pseudo-elements and
What’s new in Figma: February 2022
A round-up of updates and improvements to Figma and FigJam
When Command-V (or CTRL-V) is your "copilot"
We All Are Ukraine 🇺🇦 — Smashing Magazine
As a design community, we all can’t be silent in these times. We need to be united in our fight against the war, for democracy, for those dreams that children are entitled to have when they are growing up. It’s our obligation to help as much as we can. **We are donating all proceeds** of the “[Interface Design Checklists PDF](https://www.smashingmagazine.com/printed-books/checklist-cards/)” to sup
March For Equality (2022 Desktop Wallpapers Edition) — Smashing Magazine
Following our monthly tradition, artists and designers from across the globe challenged their creative skills and designed desktop wallpapers to welcome March. They come in versions with and without a calendar and can be downloaded for free.
A Recipe For A Good Design System — Smashing Magazine
Maintaining a design system is a lot of work. In this article, we will have a look at what solutions fit inside the umbrella of a Design System, and a few important steps and checkpoints you need to keep an eye on throughout your projects. Here, Atila Fassina shares his lessons learned and how a platform such as Backlight can help put together a series of tools to speed up your architecture setup.
C++ header files and inter-class connections
Post-quantumify internal services: Logfwrdr, Tunnel, and gokeyless
A big challenge is coming: to change all internal connections at Cloudflare to use post-quantum cryptography. Read how we are tackling this challenge!
The post-quantum future: challenges and opportunities
The story and path of post-quantum cryptography is clear. But, what are the future challenges? In this blog post, we explore them
Trailing Slashes on URLs: Contentious or Settled?
A fun deep dive from Zach. Do you have an opinion on which you should use?
When to Avoid the text-decoration Shorthand Property
In my recent article about CSS underline bugs in Chrome, I discussed text-decoration-thickness and text-underline-offset, two relatively new and
Manuel Matuzovic's CSS Specificity Demo
If you're looking for a primer on CSS specificity, we've got that. And if you're trying to get ahead of the game, you should be aware of CSS Cascade Layers as
HPKE: Standardizing public-key encryption (finally!)
HPKE (RFC 9180) was made to be simple, reusable, and future-proof by building upon knowledge from prior PKE schemes and software implementations. This article provides an overview of this new standard, going back to discuss its motivation, design goals, and development process
Cloudflare re-enforces commitment to security in Germany via BSIG audit
As Cloudflare expands globally, Rebecca Rogers, Manager of Security Validations, discusses an exciting update to Cloudflare’s commitment to customer security for our German customers
Using EasyCrypt and Jasmin for post-quantum verification
This blogpost will touch upon how to practically use Jasmin and EasyCrypt to achieve better security guarantees when verifying KEMs
Building Confidence in Cryptographic Protocols
This blogpost refers to the efforts to use formal/verification/implementation for post-quantum algorithms to achieve better assurance for them. It also touches on our Cloudflare efforts on this
My white whale: A use case for will-change
The will-change property landed in major browsers in August 2015, and I've been on the lookout for when to use it ever since.
How To Benchmark And Improve Web Vitals With Real User Metrics — Smashing Magazine
How would you measure performance? Unfortunately, there is no silver bullet for measuring performance. Different products will have different benchmarks and two apps may perform differently against the same metrics, but still rank quite similarly to our subjective “good” and “bad” verdicts. Web Vitals are the new gold standard in performance due to their direct correlation with the user’s experien
Why we are acquiring Area 1
Earlier today we announced that Cloudflare has agreed to acquire Area 1 Security
Making protocols post-quantum
Post-quantum key exchange and signature algorithms come with different trade-offs that we’re familiar. How do we handle that when updating protocols, is this an opportunity to revisit the status quo?
BGP security and confirmation biases
On February 1, 2022, a configuration error on one of our routers caused a route leak of up to 2,000 Internet prefixes to one of our Internet transit providers. This leak lasted for 32 seconds and at a later time 7 seconds
A new way to understand your GitHub-hosted runner capacity
Explore and understand your overall GitHub-hosted Actions runner capacity with the new runner view.
Codespaces for the largest repositories just got faster
The ability to prebuild codespaces is entering public beta. Enable fast environment creation times, regardless of the size and complexity of your repositories.
Some things about getaddrinfo that surprised me
Some things about getaddrinfo that surprised me
Using The WordPress Editor And CPTs To Configure Plugins — Smashing Magazine
If we want our WordPress plugins to offer a settings page that is fully powered by blocks, how can we do it? Since *Full Site Editing* doesn’t support this feature yet, we need to code a custom solution. In this article, we will learn how we can do it.
Deep dive into a post-quantum key encapsulation algorithm
In this blog post, we will look at what Key Encapsulation Mechanisms are and why they matter in a post-quantum world
Deep dive into a post-quantum signature scheme
How can one attest to an identity and prove it belongs to one self? And how can one do it in the face of quantum computers? In this blog post, we examine these questions and explain what post-quantum signatures are
Internet is back in Tonga after 38 days of outage
Tonga, the South Pacific archipelago nation (with 169 islands), was reconnected to the Internet this early morning (UTC) and is back online after successful repairs to the undersea cable that was damaged on Saturday, January 15, 2022, by the January 14, volcanic eruption
Before I go: When it comes to complaining about web browsers
That's a damn one-two punch from Dave. He goes for the ultimate clickbait title¹, then follows up with a pile of epic advice for us all. If you want web
Reliably Send an HTTP Request as a User Leaves a Page
On several occasions, I’ve needed to send off an HTTP request with some data to log when a user does something like navigate to a different page or submit a
Google Cloud PostgreSQL under pgwatch2 monitoring
Find out how to monitor PostgreSQL databases on Google Cloud with the pgwatch2 monitoring solution to get extended metrics for added clarity!
Lean Inception
An inception is an activity done at the start of a project to gather together the people involved and set a common direction and working style for the on-going work. The lean inception is a focused form of inception, which can be done in a single week. During this time we understand the key features and customers for the product, and build a canvas to formulate the characteristics of a Minimum Via
Get started with ease using security workflows!
GitHub Actions workflows in the Security category will now appear among the workflow recommendations based on a repository’s content.
GitHub Advisory Database now open to community contributions
Anyone can now provide additional information to further the community’s understanding and awareness of security advisories.
How To Develop A Text Editor For The Web — Smashing Magazine
How do text typing and editing work on the web? Although this process might seem straightforward, there is a lot of technical nuance behind its apparent simplicity. In this article, Ilya Medvedev will explain the challenges his company faced and the solutions they used to create a text widget in their application. He’ll also dive into how they implemented it and what they learned along the way — a
Smashing Podcast Episode 45 With Jeremy Wagner: What Is Responsible JavaScript? — Smashing Magazine
In this episode, we’re talking about Responsible JavaScript. What does it mean for code to be responsible, and how should we approach projects differently? Drew McLellan talks to expert Jeremy Wagner to find out.
The post-quantum state: a taxonomy of challenges
At Cloudflare, we strive to help build a better Internet, which means a quantum-protected one. In this post, we look at the challenges for migrating to post-quantum cryptography and what lies ahead using a taxonomy
The quantum solace and spectre
What is quantum computing and what advances have been made so far on this front? In this blog post, we will answer this question and see how to protect against quantum adversaries
Results without all of the brackets
Testing Pipeline 101 For Frontend Testing — Smashing Magazine
Automated testing can give you much confidence in merging your changes, especially in extensive refactoring or working with your teammates. As a result, you might have thought about including testing as part of your build routine to get the most value out of it. Don’t know where to start? Let’s implement your testing pipeline together from scratch.
Things that used to be hard and are now easy
Things that used to be hard and are now easy
Returning values and errors
Detecting Magecart-Style attacks with Page Shield
How we’re using content-based analysis to identify Magecart-style attacks
(Jay Freestone’s) Front-End Predictions for 2022
I linked to Jay's front-end predictions last year and I think they panned out pretty well.
How to Get an Engineering Internship at Shopify: A Complete Guide - Shopify
The complete guide to getting an internship at Shopify. Interns work on real projects, solve hard problems, and gain practical feedback along the way.
Changing a polymorphic_type in Rails - Shopify
How my team redefined the way we store one of the polymorphic associations in the Shopify codebase. This post is the solution we wish we found when we were looking.
Balancing Safety and Velocity in CI/CD at Slack
In 2021, we changed developer testing workflows for Webapp, Slack’s main monorepo, from predominantly testing before merging to a multi-tiered testing workflow after merging. This changed our previous definition of safety and developer workflows between testing and deploys. In this project, we aimed to ensure frequent, reliable, and high-quality releases to our customers for a…
Thoughts On Markdown — Smashing Magazine
Markdown in all its flavors, interpretations, and forks won’t go away. However, it’s important to look at emerging content formats that try to encompass modern needs. In this article, Knut shares his advice against Markdown by looking back on why it was introduced in the first place, and by going through some of the major developments of content on the web.
Production ready eBPF, or how we fixed the BSD socket API
We are open sourcing the production tooling we’ve built for the sk_lookup hook we contributed to the Linux kernel, called tubular
Top Things You Didn’t Know You Could Do With Netlify CLI
First things first, if you didn't know Netlify had a CLI, they do. One of my favorite things about it running the command netlify dev on nearly any
Subsetting Font Awesome to Improve Performance
By subsetting Font Awesome, we can remove any unused glyphs from the font files that it provides to reduce the overall file size.
Code scanning finds more vulnerabilities using machine learning
Today we launched new code scanning analysis features powered by machine learning. The experimental analysis finds more of the most common types of vulnerabilities.
Leveraging machine learning to find security vulnerabilities
A behind-the-scenes peek into the machine learning framework powering new code scanning security alerts.