Podcasts about SQL

Topics covered in this episode: Web UIs for your reverse proxy Wagtail 8.0 is hot off the presses RISC-V is now officially supported by CPython Django's annual releases make every version an LTS Extras Joke Watch on YouTube About the show Sponsored by Logfire from Pydantic: pythonbytes.fm/logfire Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedIn Calvin: Mastodon / BlueSky / X / LinkedIn Show: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Michael #1: Web UIs for your reverse proxy Traefik, nginx, and Caddy all sit in front of a lot of self-hosted infrastructure, and all three are configured by hand-editing files. Three active projects put a control plane on top: Traefik Manager (Python + Flask), Nginx UI (Go + Vue), and caddy/ui (React + Node). All three are additive rather than replacements - none of them take ownership of your config away from you - which is the part that matters when the thing has write access to production routing. Traefik Manager is the Python one: Flask 3.1 and Gunicorn for the control plane, a lightweight Go agent for remote instances, currently v1.10.0 with an Android companion app. Nginx UI is a single Go binary at 11.3k stars, with a block-style config editor, an Ace editor doing LLM completion on nginx syntax, and an MCP server so agents can drive it. caddy/ui runs as two containers next to your existing Caddy, reads and writes your Caddyfile directly, and uses Caddy's /adapt API to validate before reload - no Docker socket required. Each one edits the config the underlying server already reads, so your files stay the source of truth and you can drop the UI without unwinding anything. Undo is a first-class feature across all three - timestamped backups with optional Git history, config version compare and restore, Caddyfile snapshots with one-click rollback. Observability is where they diverge: Traefik Manager does CrowdSec and a visual route map, Nginx UI does server metrics, caddy/ui streams access logs over SSE and pulls p50/p95/p99 off Caddy's Prometheus endpoint. Maturity spread is wide - Nginx UI has 11.3k stars, caddy/ui has 4 and was built in a single Claude session - and caddy/ui ships with auth off by default, so set CADDY_UI_USER and JWT_SECRET before it goes anywhere near a public interface. Calvin #2: Wagtail 8.0 is hot off the presses Link: https://github.com/wagtail/wagtail/releases/tag/v8.0 Custom base page models are now supported, so projects aren't locked into subclassing Wagtail's Page as shipped (Matt Westcott). New v3 REST API handles both read and write CMS operations, a first for Wagtail's API. A global registry for permission policies, plus full customizability for the remaining page views via PageViewSet. AVIF and WebP images are no longer auto-converted to PNG by default, a real behavior change to watch on upgrade. Five security fixes: page admin API restrictions, document identification by SHA1 hash, descendant collections in the Documents/Images API, snippet copy permissions, and the page translation endpoint. Formalized Django 6.1 support, and CI now runs on uv with a lockfile. Sponsor: Logfire from Pydantic Your AI agent failed at 2am. Was it the model? A tool call? The database? Most observability tools can't tell you, because they only see part of your stack. Pydantic Logfire sees all of it. One trace across your agents, LLMs, APIs, and database. Down to the infrastructure: services, Kubernetes, and hosts. It's built on OpenTelemetry, with SDKs for Python, TypeScript, and Rust, and it works with any OTel-compatible language. Every prompt, token count, and cost, right next to your vector searches and API calls. You query everything with Postgres-compatible SQL. And so can your coding agent, through the Logfire MCP server. Stop guessing. Read the trace. Pydantic Logfire. AI, it's still just engineering. Visit pythonbytes.fm/logfire today and sign up today. Get 10M records free every month, no card required. You can even click “Onboard with your coding agent” to copy a prompt to have claude or codex integrate Logfire into your app. Thanks to Pydantic for supporting the show. Calvin #3: RISC-V is now officially supported by CPython Link: https://blog.python.org/2026/08/riscv-now-officially-supported/ CPython added RISC-V as a tier 3 platform under PEP 11, specifically the 64-bit Linux target riscv64-unknown-linux-gnu. RISC-V is an open ISA anyone can implement, unlike x86 and ARM, and its market is projected to quadruple by 2032. The RISE Project donated real RISC-V machines for buildbots; the author's work was funded by a Sovereign Tech Agency fellowship. What changes: the port is now a maintained compatibility target, so CPython changes are less likely to quietly break it. What doesn't: no python.org installers, no binary wheel parity for native extensions. Next up: RISC-V runners in CPython CI for pre-merge feedback, then a push toward tier 2, plus architecture-specific optimizations. The ask is testing. If you have RISC-V hardware, build CPython, run your test suite, file what breaks. Tier 3 is the weakest support tier. PEP 11 tier 3 requires a core developer contact and a buildbot, but failures on tier 3 platforms explicitly do not block a release. Saying "ongoing CI/testing expectations" oversells it. The honest bit is "someone is now on the hook for it, and breakage gets noticed," not "it's guaranteed working." Worth the caveat that this is Linux SBCs, not microcontrollers. A VisionFive 2 counts, an ESP32-C6 or Pico 2 does not. Those are 32-bit non-Linux parts where MicroPython is still the answer. Michael #4: Django's annual releases make every version an LTS Starting with Django 2028, Django will move to one January feature release per year, adopt calendar-based version numbers, and support every release for three years. The old distinction between standard and LTS releases disappears, giving teams a predictable annual upgrade path that aligns more closely with Python's own release and support cadence. Every Django release becomes the safe, long-supported choice, so teams no longer need to wait for a specially designated LTS version or absorb two years of changes at once. Each release gets one year of mainstream bug fixes followed by two years of security and data-loss fixes. New releases support the three latest Python versions and add the next Python release during their first year. Calendar versioning begins with Django 2028, followed by Django 2029 and so on. Three Django versions will be supported at any time, giving third-party packages a clearer rolling target. Nothing changes before 2028, and existing commitments for Django 5.2 LTS and 6.2 LTS remain in place. Extras Calvin: The Python docs now document the time complexity of built-in types https://docs.python.org/3.16/library/time-complexity.html Thinking in Python - Bruce Eckel's free book https://thinkinginpython.com/ Michael: prune_uv_pythons.py - Prune uv-managed Python installs, keeping only the newest patch per minor version Runs automatically in my system “upgrade” script: upgrade-output-2026.png Started using Ollama cloud models for my Hermes assistant. Thanks to Jeff Triplett I learned they are not just local models. Joke: The Tao of Programming - Book Seven: Corporate Wisdom

Nik and Michael are joined by Shaun Thomas to discuss estimating work_mem, memory management in general, and writing an extension to help. Here are some links to things they mentioned: Shaun Thomas https://postgres.fm/people/shaun-thomaswork_mem https://www.postgresql.org/docs/current/runtime-config-resource.html#GUC-WORK-MEMpg_stat_database https://www.postgresql.org/docs/current/monitoring-stats.html#MONITORING-PG-STAT-DATABASE-VIEWALTER ROLE SET configuration_parameter https://www.postgresql.org/docs/current/sql-alterrole.html#SQL-ALTERROLE-PARAMS-CONFIGURATION-PARAMETERhash_mem_multiplier https://www.postgresql.org/docs/current/runtime-config-resource.html#GUC-HASH-MEM-MULTIPLIERRecent Postgres releases with 28 CVEs fixed https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/Systemic Risks in the Managed PostgreSQL Industry (part 1 of 6, Mehmet Ince) https://mehmetince.net/part-1-6-systemic-risks-in-the-managed-postgresql-industry-extension-risks-are-real-exploiting-postgis-memory-corruption-bug-at-neondb-supabase-and-many-more/Improving Postgres Connection Scalability: Snapshots (blog post by Andres Freund) https://techcommunity.microsoft.com/blog/adforpostgresql/improving-postgres-connection-scalability-snapshots/1806462~~~What did you like or not like? What should we discuss next time? Let us know via a YouTube comment, on social media, or by commenting on our Google doc!~~~Postgres FM is produced by:Michael Christofides, founder of pgMustardNikolay Samokhvalov, founder of Postgres.aiWith credit to:Jessie Draws for the elephant artwork

Topics covered in this episode: Python 3.12.14, 3.11.16, 3.10.21 - security releases Codeberg's AI-code ban tests its role as a GitHub alternative Brett Cannon: what's missing for reproducible builds on PyPI nothing records the source code a distribution came from. direct_url.json captures it when you install from a repo or archive, so the fix is putting the same info in sdist/wheel metadata. recording the build tools. Wheels can already do this via PEP 770 SBOMs in .dist-info/sboms/ - sdists can't, since they're a tarball plus a precalculated PKG-INFO with nowhere to hang extra metadata. Either "don't use sdists" or an sdist v2. Extra extra extra, hear all about it Extras Joke Watch on YouTube Sponsored by Logfire from Pydantic pythonbytes.fm/logfire This episode is brought to you by Pydantic Logfire. It's observability for AI apps from the team behind Pydantic - agents, LLMs, APIs, database, and infrastructure in a single trace, queried with Postgres-compatible SQL. Your coding agent can query it too, through their MCP server. I'll tell you more later. Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedIn Calvin: Mastodon / BlueSky / X / LinkedIn Show: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Calvin #1: Python 3.12.14, 3.11.16, 3.10.21 - security releases https://blog.python.org/2026/08/python-31214-31116-31021/ Source-only security releases for the three branches now in security-fix-only mode; release team blamed the European solar eclipse for the timing. tarfile hardening. Multiple path-traversal bypasses of the data filter closed, including a symlink escape that bypassed the CVE-2025-4330 fix; extract() now applies the filter to link targets too. Four fresh CVEs: CVE-2026-2297 (SourcelessFileLoader not using io.open_code() for .pyc), CVE-2026-4224 (expat crash on deeply nested content models), CVE-2026-3644 (control chars in http.cookies.Morsel), plus the completed CVE-2021-4189 fix in ftplib.ftpcp. Quadratic-complexity DoS cleanup across the stdlib: HTMLParser, configparser regexes, unicodedata.normalize(), csv.Sniffer.sniff(), and ElementTree XPath index predicates. Header/injection fixes: CR/LF rejected in HTTPConnection.set_tunnel(), control chars blocked in wsgiref.handlers status, and webbrowser now rejects leading dashes (plus a %action prefix bypass). http.client now caps chunked trailer lines and 1xx interim responses at 100 each - a hostile server could previously hang the client forever despite a socket timeout. Memory-safety odds and ends: stale pointers in lzma/bz2/zlib decompressors after MemoryError, a bz2 stack overflow on reuse-after-error, and bundled libexpat bumped to 2.8.3. If you're still on 3.10, 3.11, or 3.12 - and you extract tarballs from anywhere you don't fully control - this one's not optional. Michael #2: Codeberg's AI-code ban tests its role as a GitHub alternative Armin's article “Codeberg Divides” Armin Ronacher argues that Codeberg's new terms, which prohibit projects mostly written with generative AI, create a vague and difficult-to-enforce boundary. His larger concern is that a democratically governed host can still be unpredictable or ideologically narrow, weakening Codeberg's potential as a broad European alternative to GitHub. The strongest question for Python developers is whether repository hosting should judge legal open source by how code was produced, or focus on behavior and resource abuse. “Mostly generated” is hard to measure in modern codebases where developers mix handwritten code, completions, agents, and generated refactors. Ronacher suggests clearer alternatives: ban all LLM involvement, or target autonomous repository spam, abusive resource use, and low-quality generated contributions directly. Codeberg is free to choose a values-driven community, but that may conflict with being predictable, neutral infrastructure and a serious GitHub competitor. Worth discussing: can open-source communities set meaningful AI boundaries without driving maintainers and projects into opposing camps? Very first search for these terms lands on this page. Codeberg looked like a viable alternative. … Unfortunately, the latest update to its terms of service seems to mark a first step in changing one part I moved there for, namely the “freedom” part. Sponsor: Logfire from Pydantic Your AI agent failed at 2am. Was it the model? A tool call? The database? Most observability tools can't tell you, because they only see part of your stack. Pydantic Logfire sees all of it. One trace across your agents, LLMs, APIs, and database. Down to the infrastructure: services, Kubernetes, and hosts. It's built on OpenTelemetry, with SDKs for Python, TypeScript, and Rust, and it works with any OTel-compatible language. Every prompt, token count, and cost, right next to your vector searches and API calls. You query everything with Postgres-compatible SQL. And so can your coding agent, through the Logfire MCP server. Stop guessing. Read the trace. Pydantic Logfire. AI, it's still just engineering. Visit pythonbytes.fm/logfire today and sign up today. Get 10M records free every month, no card required. You can even click “Onboard with your coding agent” to copy a prompt to have claude or codex integrate Logfire into your app. Thanks to Pydantic for supporting the show. Calvin #3: Brett Cannon: what's missing for reproducible builds on PyPI Framing came out of his 2026 Python Packaging Council nomination - the secure-supply-chain gap he found is that Python has no defined way to do reproducible builds at all. Design goal is zero friction: producers uploading to PyPI shouldn't have to do anything. The work lands on build backends and installers. Gap #1: nothing records the source code a distribution came from. direct_url.json captures it when you install from a repo or archive, so the fix is putting the same info in sdist/wheel metadata. Gap #2: recording the build tools. Wheels can already do this via PEP 770 SBOMs in .dist-info/sboms/ - sdists can't, since they're a tarball plus a precalculated PKG-INFO with nowhere to hang extra metadata. Either "don't use sdists" or an sdist v2. The replay mechanism already exists: [build-system] in pyproject.toml is a defined entry point, so if backends recorded their own environment, you could reinstall and re-run the build. Payoff idea: trusted third parties report successful reproductions back to PyPI, which displays "independently reproduced by X" - surfaced in the index API so installers could prefer reproduced files. Explicitly framed as a perk, not a requirement - roughly SLSA build level 1, no shaming projects that don't opt in. Verbal kicker option: "And don't think pure-Python wheels are off the hook. Something built that wheel, and if that something was compromised, so is your wheel. SolarWinds was a build-process attack." Michael #4: Extra extra extra, hear all about it Python 3.14.7 Upgraded the MCP servers to 2026-07-28 v2 protocols (talk python, python bytes) Got agentsview running synced via postgres Talk Python courses, teams trial offering Talk Python courses, government procurement offering Lean TDD audio book is out Extras Calvin: uv now prefers post-quantum key exchange - https://github.com/astral-sh/uv/releases/tag/0.12.4 Joke: Beware of dog

What if AI could transform how your entire data team works—without replacing them? In this episode, Benjamin Wagner explores with Xavier Gumara Rigol, Head of Data at Manychat, how natural language-to-SQL tools are reshaping data analyst and data scientist roles, why building a strong data platform is essential for AI-powered self-serve analytics, and the critical strategies for evaluating text-to-insight solutions in 2026. Whether you're leading a data organization or building your next analytics capability, discover how to balance build versus buy decisions and position your team for the AI-driven future of data engineering.

James Pope is on site in Las Vegas more than a week before the doors open. As SOC lead for the Black Hat NOC and Senior Director of Security Product Research and Technical Marketing Engineering at Corelight, his show starts with switches and access points rather than alerts. The team brings in the ISP, the firewall, the switches, and the access points, deploys them across the conference, and then moves into SOC mode. If there is no network, there is nothing to secure. The tooling arrives through partnership rather than sponsorship. James Pope says a company cannot buy or sponsor its way into the NOC, and that the team picks what it wants and fills gaps as it finds them. Cisco covers Umbrella and file malware analytics, Palo Alto Networks provides the firewall and XSIAM as the log aggregator, Arista handles switching and access points, Jamf runs MDM across the registration devices, and Lumen supplies the internet. Corelight is the network visibility layer. That layer carries different weight here than it would inside a company. Asking attendees to install a certificate or an endpoint agent so the NOC can inspect their traffic is a request nearly everyone declines. In most corporate environments the endpoint is one of the richest sources of signal. At Black Hat, visibility into attendee activity comes from network data. A Black Hat positive is malicious activity that is legitimate in context. Attendees pay to learn attack techniques against real targets, and researchers demonstrate new exploits on stage. Those events generate true detections no corporate SOC would ignore. The NOC lets them run rather than killing a paid training exercise or a live demo. So how does the team tell a training exercise from a real attack? It baselines each classroom and spends its time on the outliers. When seventy students in a room run the same attacks against the same destinations, the activity is probably sanctioned. The curriculum is ingested as a JSON file and the system moves through a series of gates, asking whether this is a class, whether multiple sources are reaching the same destination, and whether the attack would be expected in that curriculum. Anything that does not fit comes back for a human. The team informs far more often than it blocks. On the day of the recording, James Pope went to the trade show floor to tell someone that command and control traffic was running from their machine, and handed over logs for their IT and security team. He is not their manager, and what happens next is their call. Illegal activity is treated differently, and a handful of times per show the team asks a room to stop. At Black Hat Asia, traffic from a Corelight sensor showed a double RAT infection on one machine, a single APT running one implant for exfiltration and another for command and control. Working from traffic, James Pope established that the person was a reporter, the region they covered, and the company they worked for. Open source intelligence narrowed it to a single name, registration confirmed the person was on site, and the NOC invited them in. The reporter arrived expecting a product demo. The laptop was reset with everyone present, sessions were revoked, passwords were changed, and the reporter left in a secured state. This year the team opened the Outpost, running real Black Hat network logs from Corelight behind application guardrails, LLM guardrails, and a kill switch, where visitors query the data with text to SQL. Agentic triage stitches alerts into detections and detections into a timeline, and James Pope treats the ability to drill down to raw logs as a requirement rather than a preference. Success is measured largely by what does not happen: no compromise of registration, the switches, or the access points, and people who arrive infected leaving better than they got here. This is a Brand Briefing. A Brand Briefing is an on-location conversation recorded on site at Black Hat USA 2026, putting a spotlight on the guest and their company and pairing it with the editorial reach of ITSPmagazine. Learn more: https://www.studioc60.com/performance/#briefing GUEST James Pope, Senior Director of Security Product Research and Technical Marketing Engineering at Corelight, and SOC lead for the Black Hat NOC RESOURCES Black Hat USA 2026 event coverage from ITSPmagazine: https://www.itspmagazine.com/black-hat-usa-2026-cybersecurity-event-coverage-in-las-vegas Learn more about Corelight: https://corelight.com Corelight blog, including the Black Hat NOC series: https://corelight.com/blog Are you interested in telling your story? ▶︎ Full Length Brand Story: https://www.studioc60.com/content-creation#full ▶︎ Brand Spotlight Story: https://www.studioc60.com/content-creation#spotlight ▶︎ Brand Highlight Story: https://www.studioc60.com/content-creation#highlight ▶︎ Get your own Brand Briefing at an upcoming event: https://www.studioc60.com/buy-brand-briefings KEYWORDS james pope, corelight, sean martin, marco ciappelli, brand briefing, brand story, brand marketing, marketing podcast, black hat usa 2026, network detection and response, network evidence, security operations center, threat hunting, agentic triage, ai in the soc, conference network security, black hat noc, command and control, incident response Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

Nik and Michael are joined by Michael Malis, co-creator of pgrust, to discuss their Postgres rewrite, including reliability problems, compatibility testing, faster analytics, and a new JIT-compiled query engine. Here are some links to things they mentioned: Michael Malis https://postgres.fm/people/michael-malispgrust https://github.com/malisper/pgrust The four horsemen behind Postgres outages (blog post by Michael Malis) https://malisper.me/the-four-horsemen-behind-thousands-of-postgres-outagesRebuilding Postgres for faster analytics: batching, operator fusion, and SIMD (blog post by Michael Malis) https://malisper.me/how-we-made-postgres-hundreds-of-times-faster-the-query-engine/kani https://github.com/model-checking/kaniAntithesis https://antithesis.comfsyncgate mailing list thread https://www.postgresql.org/message-id/flat/CAMsr%2BYHh%2B5Oq4xziwwoEfhoTZgr07vdGG%2Bhu%3D1adXx59aTeaoQ%40mail.gmail.comHow AI Changes the Economics of JIT Compilers (blog post by Michael Malis) https://malisper.me/how-ai-changes-the-economics-of-jit-compilers/Umbra DB https://umbra-db.com~~~What did you like or not like? What should we discuss next time? Let us know via a YouTube comment, on social media, or by commenting on our Google doc!~~~Postgres FM is produced by:Michael Christofides, founder of pgMustardNikolay Samokhvalov, founder of Postgres.aiWith credit to:Jessie Draws for the elephant artwork

Max Corbridge, an ethical hacker and red teamer who is co-founder and CEO of Secure Agentics, speaks with SE Radio host Amey Ambade about how AI agents get attacked and what engineers can actually do to defend them. Drawing on years of offensive security work, Corbridge frames agents as a new and largely undefended attack surface: the industry has handed AI systems autonomy and the ability to act in the real world while carrying forward prompt injection, a flaw the frontier labs themselves describe as effectively unsolvable. He likens the moment to the early, lawless days of the web, when SQL injection was everywhere and adoption ran far ahead of security. The conversation builds from first principles as Corbridge explains what separates an agent from ordinary software and why three properties make them hard to secure: they are non-deterministic, their language-model core can be coerced, and they are increasingly interconnected through MCP servers, other agents, databases, and email. Turning to the attack surface, Corbridge lays out his "lethal trifecta" (a vulnerable core, dense interconnection, and security tooling that has not caught up) and contrasts the decades of layered defenses protecting an ordinary email inbox with the thin protection around agents that take autonomous actions on critical systems. The heart of the episode is defense. Corbridge orders practices by leverage: least-privilege access and privilege separation, sandboxing where feasible, imperfect-but-useful guardrails as one layer of defense in depth, and human-in-the-loop for irreversible actions (which he notes is contentious and does not scale). The discussion closes on detecting a compromised or drifting agent, the value of watching an agent's chain-of-thought reasoning alongside its actions, the open-source tooling landscape (including Corbridge's own project, Adrian), and his central advice: build security in proactively, define what good agent behavior looks like up front, and avoid bolting it on after agents have already spread across the business.

A bi-weekly news show informing you on the latest in Bitcoin, privacy and open source tech hosted by Ungovernables, Max and Q. THIS IS THE TWEET Q WANTS YOU TO SEE: https://x.com/justh0dl/status/2086202393998291138AOBWhat a fucking weekKeyOS v1.3.1 now publicly availableSomething exciting to share on Friday's FTF (delayed by 2 weeks)NEWSThe Coldcard entropy catastropheSources: Coinkite technical backgrounder / The Rage, L0la L33tz / TRM Labs / coldcard.rip / cktripwire.com / Bitcoin Magazine victim surveyEXPLAINERThe largest self-custody theft on record, and it traces back to a single wrong conditional. In March 2021 a build guard checked whether Coldcard's hardware random number generator was defined rather than whether it was enabled, so seed generation silently fell back to a deterministic software PRNG. Every seed made on an affected device from that point carried roughly 40 bits of entropy on Mk2 and Mk3, and about 72 on Mk4, Mk5 and Q, instead of the intended 128. That is guessable. Someone did the maths offline, derived the addresses, checked them against the public chain, and swept everything with a balance. Somewhere between 1,400 and 1,800 bitcoin gone, depending on whose forensics you trust, with a median victim loss of one BTC. The part people keep missing: updating the firmware does not fix an existing seed. A weak seed is weak forever.ACTION FOR LISTENERSMove funds to a brand new seed BEFORE upgrading firmware (Lopp's guidance, on reports of update problems).Use high fees. If you see your own coins in the mempool, the attacker opted into RBF and you can outbid them. Window is minutes.Multisig users: consider a private mempool like Marathon's Slipstream.Keep the device; the UID may prove ownership in any recovery process.Updating does NOT fix an existing seed. A weak seed is weak forever.You are exempt only if you added 50+ fair independent private dice rolls, or used a strong unique BIP39 passphrase stored separately.BTCPay Server: unauthenticated LND macaroon theft, actively exploitedSources: BTCPay security advisory / v2.4.2 release / CoinDesk / TFTCCRITICAL FRAMING NOTE: this is ONE story, not two. The "BTCPay bug" and the "LND credential exploit" are the same event. The vulnerability is the macaroon leak. The Aug 8-9 wave of coverage is follow-up hardening, not a new incident. Do not present them separately.REMEDIATION (updating alone is NOT enough)Update to v2.4.2. Verify "2.4.2" in the footer.Update NBXplorer to 2.6.10+.Revoke and regenerate LND macaroons. Updating stops new theft but does nothing about already-stolen credentials. Deleting files is insufficient; the macaroon root signing key must be destroyed at node level. v2.4.2 does this automatically for standard Docker deployments. Custom reverse proxies, separate Tor services or port forwarding must rotate manually.Move funds out of any BTCPay-generated on-chain hot wallet and recreate it.Update LND to 0.21.1. Audit for unrecognised channel closures, unknown peers, unexplained balance changes.SIDE EFFECT WORTH FLAGGING: v2.4.2 removes public LND API access on Docker deployments, which breaks remote wallet connections such as Zeus connecting to your own BTCPay node. Intentional, no restoration timeline published.BREAKING CHANGE: Greenfield Basic authentication disabled by default five minutes after account creation (#7492). BTCPay: "We are not aware of any user impacted by this breaking change, as API Keys authentication is generally used."Boltz suspends all swaps indefinitelySources: Boltz statement / canary.boltz.exchange / The Defiant / TFTC / Bull Bitcoin statementCORRECTION TO THE COMMON FRAMING: Boltz has not shut down. It suspended swap services indefinitely. And the canary sequence runs the opposite way to the rumour: lapsed → suspended → renewed clean.The Bitcoin Red TeamSources: Calle and Rob Hamilton on Nostr/X / Bitcoin Magazine / CoinDesk / TFTC / OpenSats Red Team FundSUMMARYThis is the story that explains the other four. After the Coldcard exploit, Calle and Rob Hamilton pointed frontier AI models at the open-source Bitcoin stack and started auditing everything. In 108 hours, 25 developers scanned 501 projects and produced 7,958 findings, 1,280 of them rated high or critical, at a compute cost north of 58,000 dollars. They found the BTCPay bug's neighbours, and Boltz cited exactly this dynamic when it switched itself off. The uncomfortable symmetry is that the same capability doing the defending is what an attacker almost certainly used on Coldcard in the first place. And the bottleneck turns out not to be finding bugs, it is telling anyone: only 19.5% of the projects they scanned even have a SECURITY.md file, and only 13.1% list a security contact. The scanners move at machine speed. Responsible disclosure is still hunting around for an email address.BIP-110: the fork that mined two blocks and frozeSources: bip110monitor.com / Peter Todd code review / Aaron van Wirdum, Bitcoin Magazine / Lopp's Layman's Guide / Saylor essay / CoinDeskRELEASESBitcoin core / protocollibsecp256k1 v0.8.0 - 2026-08-03Adds a native Silent Payments (BIP-352) module directly into the crypto library nearly every self-custody wallet builds on, plus up to ~11% faster signature verification. Quietly the most consequential positive release of the fortnight: it lowers the bar for every wallet to ship reusable static receive addresses.Bitcoin Knots v29.4 - 2026-08-08Non-urgent maintenance: fixes a chainstate DB bug causing repeated large rewrites, and adds corruption-detection safeguards around BIP-110 mandatory signaling. No critical fixes. (No Bitcoin Core release in window; latest is v31.1 from 2026-07-08.)Hardware / signingColdcard Firmware 4.2.0 (Mk2/Mk3) - 2026-08-03The patch for the entropy catastrophe. Affected ranges: Mk2/Mk3 4.0.1 through 4.1.9; Mk4/Mk5 all before 5.6.0; Q all before 1.5.0Q. Companion fixes shipped the same day: 5.6.0 Mk4/Mk5, 1.5.0Q, 6.6.0X Edge, 6.6.0QX Edge Q. Updating does NOT fix an existing seed - changelog says Mk3 users "must regenerate any seeds made on earlier versions as their entropy is critically low at just ~40 bits." TAPSIGNER, OPENDIME and SATSCARD unaffected.Krux 26.08.0 - 2026-08-04Maintainer odudex is stepping down and the project may be archived. "Krux was not created by me: Jeff started it and passed it on to me, and now it is my turn to pass the torch." On succession: "Krux may be carried on by another maintainer, if a proof-of-work backed Krux contributor accepts the role. Otherwise the Krux project will be put in sunset mode and gracefully archived in a few months." Cause is hardware, not drama: "K210 chips are no longer produced, and Canaan dropped the Kendryte line entirely." Substantial release regardless: fixes a heap buffer overflow in the camera entropy module, adds stricter PSBT fee-calculation checks, replaces the Python UR stack with a faster C module, and makes Krux Installer fully offline.Frostsnap v0.3.0 - 2026-08-05FROST threshold-signing device ships reproducible/deterministic builds and "a fresh release signing key as part of an overhauled release-signing pipeline." Well timed in a fortnight where "can you verify what is running on your signer" is the whole conversation. Catch: the new key breaks in-place Android updates, so direct-APK users must uninstall, reinstall, and re-visit their threshold devices to restore.Trezor Suite v26.7.4 - 2026-08-04Lowers minimum Normal-priority fee rate to 0.2 sat/vB and ships updated Safe 7/5/3 and Model T firmware with security improvements.BitBoxApp 4.51.4 - 2026-08-07Bundles new BitBox02 firmware v9.26.5.Specter Desktop v2.1.11 - 2026-08-09Genuinely security-relevant: adds auth and CSRF protection to the HWI bridge settings, restores validation of active API tokens so revoked JWTs are rejected, and warns that Specter's auth layer does not encrypt the data folder. Also ships an in-app Coldcard Mk3 seed-entropy advisory.Bitkey source/2026-08-02-0031 - 2026-08-02Block's consumer hardware wallet, routine source drop.LightningBTCPay Server v2.4.2 - 2026-08-07Actively exploited, funds already stolen. "This release contains fix of a critical vulnerability that is being actively exploited. You need to update as fast as you can." Unauthenticated remote .macaroon disclosure for LND, plus a TOTP 2FA bypass via Greenfield Basic auth. Requires NBXplorer 2.6.10. Breaking change: Basic auth disabled by default five minutes after account creation. See News item 2 for full remediation.lnd v0.21.2-beta.rc1 and v0.20.3-beta.rc1 - 2026-08-08Not security releases and not related to the BTCPay exploit. Migration/stability fixes only: KV-to-SQL payment migration edge case, channeldb migration recovery, invoice handling, data races, bounded memory on graph sync.Zeus v13.1.3 - 2026-07-27Adds LND v0.21.1-beta support for embedded and remote nodes; patches known vulnerabilities in the ws, js-yaml and markdown-it dependencies. (Note: Zeus also shipped an unreleased swap-security sprint on 08-04 - verify…

SED News is a monthly podcast from Software Engineering Daily where hosts Gregor Vand and Sean Falconer break down the biggest stories shaping software engineering, Silicon Valley, and the broader tech industry. In this episode, Gregor and Sean dig into a wave of “runaway AI” stories, including Anthropic and OpenAI disclosing that their models accessed outside organizations during cyber evaluations, and Amazon reporting a staggering budget overrun blamed on bad agent loops. They explore why most of these incidents trace back to human decisions rather than models breaking free, and the awkward reality that today’s systems can bill you for tokens without reliably counting them. They also talk about the “Kimi moment.” Moonshot AI‘s open weight model has closed the gap with frontier models like ChatGPT and Claude at a remarkable pace, and the hosts unpack what it means for open weight strategies and how chip scarcity is pushing Chinese labs to innovate. As always, the episode wraps up with a few standout Hacker News threads, including a JetBrains test of a “caveman speak” skill that promised big token savings, how refactoring can cut input token costs, the release of CodePen 2.0, and a build of Doom that renders through SQL queries.Sponsorship inquiries:sponsor@softwareengineeringdaily.com The post SED News: The Kimi Moment, Runaway AI, and Tokenmaxxing appeared first on Software Engineering Daily.

SED News is a monthly podcast from Software Engineering Daily where hosts Gregor Vand and Sean Falconer break down the biggest stories shaping software engineering, Silicon Valley, and the broader tech industry. In this episode, Gregor and Sean dig into a wave of “runaway AI” stories, including Anthropic and OpenAI disclosing that their models accessed outside organizations during cyber evaluations, and Amazon reporting a staggering budget overrun blamed on bad agent loops. They explore why most of these incidents trace back to human decisions rather than models breaking free, and the awkward reality that today’s systems can bill you for tokens without reliably counting them. They also talk about the “Kimi moment.” Moonshot AI‘s open weight model has closed the gap with frontier models like ChatGPT and Claude at a remarkable pace, and the hosts unpack what it means for open weight strategies and how chip scarcity is pushing Chinese labs to innovate. As always, the episode wraps up with a few standout Hacker News threads, including a JetBrains test of a “caveman speak” skill that promised big token savings, how refactoring can cut input token costs, the release of CodePen 2.0, and a build of Doom that renders through SQL queries.Sponsorship inquiries:sponsor@softwareengineeringdaily.com The post SED News: The Kimi Moment, Runaway AI, and Tokenmaxxing appeared first on Software Engineering Daily.

SED News is a monthly podcast from Software Engineering Daily where hosts Gregor Vand and Sean Falconer break down the biggest stories shaping software engineering, Silicon Valley, and the broader tech industry. In this episode, Gregor and Sean dig into a wave of “runaway AI” stories, including Anthropic and OpenAI disclosing that their models accessed outside organizations during cyber evaluations, and Amazon reporting a staggering budget overrun blamed on bad agent loops. They explore why most of these incidents trace back to human decisions rather than models breaking free, and the awkward reality that today’s systems can bill you for tokens without reliably counting them. They also talk about the “Kimi moment.” Moonshot AI‘s open weight model has closed the gap with frontier models like ChatGPT and Claude at a remarkable pace, and the hosts unpack what it means for open weight strategies and how chip scarcity is pushing Chinese labs to innovate. As always, the episode wraps up with a few standout Hacker News threads, including a JetBrains test of a “caveman speak” skill that promised big token savings, how refactoring can cut input token costs, the release of CodePen 2.0, and a build of Doom that renders through SQL queries.Sponsorship inquiries:sponsor@softwareengineeringdaily.com The post SED News: The Kimi Moment, Runaway AI, and Tokenmaxxing appeared first on Software Engineering Daily.

SED News is a monthly podcast from Software Engineering Daily where hosts Gregor Vand and Sean Falconer break down the biggest stories shaping software engineering, Silicon Valley, and the broader tech industry. In this episode, Gregor and Sean dig into a wave of “runaway AI” stories, including Anthropic and OpenAI disclosing that their models accessed outside organizations during cyber evaluations, and Amazon reporting a staggering budget overrun blamed on bad agent loops. They explore why most of these incidents trace back to human decisions rather than models breaking free, and the awkward reality that today’s systems can bill you for tokens without reliably counting them. They also talk about the “Kimi moment.” Moonshot AI‘s open weight model has closed the gap with frontier models like ChatGPT and Claude at a remarkable pace, and the hosts unpack what it means for open weight strategies and how chip scarcity is pushing Chinese labs to innovate. As always, the episode wraps up with a few standout Hacker News threads, including a JetBrains test of a “caveman speak” skill that promised big token savings, how refactoring can cut input token costs, the release of CodePen 2.0, and a build of Doom that renders through SQL queries.Sponsorship inquiries:sponsor@softwareengineeringdaily.com The post SED News: The Kimi Moment, Runaway AI, and Tokenmaxxing appeared first on Software Engineering Daily.

SED News is a monthly podcast from Software Engineering Daily where hosts Gregor Vand and Sean Falconer break down the biggest stories shaping software engineering, Silicon Valley, and the broader tech industry. In this episode, Gregor and Sean dig into a wave of “runaway AI” stories, including Anthropic and OpenAI disclosing that their models accessed outside organizations during cyber evaluations, and Amazon reporting a staggering budget overrun blamed on bad agent loops. They explore why most of these incidents trace back to human decisions rather than models breaking free, and the awkward reality that today’s systems can bill you for tokens without reliably counting them. They also talk about the “Kimi moment.” Moonshot AI‘s open weight model has closed the gap with frontier models like ChatGPT and Claude at a remarkable pace, and the hosts unpack what it means for open weight strategies and how chip scarcity is pushing Chinese labs to innovate. As always, the episode wraps up with a few standout Hacker News threads, including a JetBrains test of a “caveman speak” skill that promised big token savings, how refactoring can cut input token costs, the release of CodePen 2.0, and a build of Doom that renders through SQL queries.Sponsorship inquiries:sponsor@softwareengineeringdaily.com The post SED News: The Kimi Moment, Runaway AI, and Tokenmaxxing appeared first on Software Engineering Daily.

Se a IA já escreve SQL, cria pipelines e automatiza tarefas, qual passa a ser o papel do engenheiro de dados? Neste episódio, recebemos Pedro Guimarães Alongi, e Pedro Dourado Campos, ambos Engenheiros de Dados na dti digital, para discutir como a IA está transformando a profissão. A conversa passa por qualidade de dados, governança, observabilidade, RAG, bancos vetoriais e pelos novos desafios de construir plataformas preparadas para IA. Dê o play e ouça agora!Assuntos abordados:Engenharia de dados;IA generativa;Qualidade de dados;Governança;Observabilidade;RAG;Bancos vetoriais;Shadow AI;AI Ready;Engenharia de software.Dê o play e ouça agora!Links importantes:Vagas disponíveisNewsletterDúvidas? Nos mande pelo LinkedinContato:  entrechaves@dtidigital.com.brO Entre Chaves é uma iniciativa da dti digital, uma empresa WPP #carreiradev

An airhacks.fm conversation with Donald Raab about: the Epson HX-20 as the world's first laptop and learning Basic, an acoustic coupler modem, the Atari 2600 and Pitfall, Montezuma's Revenge, Apple II clones and the Franklin Ace, running a bulletin board system, learning BASIC, Pascal, fortran, COBOL, Turbo prolog and Turbo Pascal, dBASE III Plus as language and database management system, DBF file format by Ashton-Tate, Clipper by Nantucket as a dBASE compiler with Blinker linker, T-Browse and cursor-based table access, FoxPro and the x-based language family, NDX/NTX/CDX index formats, SQLJ embedded SQL, Paradox and Delphi, learning Smalltalk at IBM Object Technology University, Alan Kay and pure object orientation, blocks as lambdas in Smalltalk and Clipper (via the Classy library), ENVY version control with method-level editions, VisualAge for Smalltalk and VisualAge for Java, method categories for organizing methods, migrating a Clipper application to Java using interfaces and static methods in a procedural style, transparent persistence with TopLink and EclipseLink, memory constraints in 32-bit Java on Solaris, building a custom caching framework, the origins of Eclipse Collections in 2004, waiting ten years for lambdas, the JSR 335 expert group with Brian Goetz, select/collect/inject versus filter/map/reduce, eager methods on collections versus lazy streams, code folding regions in IntelliJ to simulate method categories, the book "Eclipse Collections Categorically", JRuby and Asciidoctor, meeting Yukihiro Matsumoto at OOPSLA 2002 Donald Raab on twitter: @TheDonRaab

Nik and Michael are joined by Radim Marek to discuss MVCC, including his recent article on how Postgres chose to implement it compared to other systems. Here are some links to things they mentioned: Radim Marek https://postgres.fm/people/radim-marekBoringSQL https://boringsql.comPostgreSQL's MVCC is bad. So is everyone else's (blog post by Radim) https://boringsql.com/posts/mvcc-bad-bad/PostgreSQL MVCC documentation https://www.postgresql.org/docs/current/mvcc-intro.htmlPostgreSQL Storage Internals series by Radim https://boringsql.com/guides/postgresql-storage-internals/PgQue https://github.com/NikolayS/pgqueThe next ten years of Postgres (talk slides by Álvaro Herrera) https://www.postgresql.eu/events/pgconfde2026/sessions/session/7744/slides/866/edb-keynote-pgconfde-2026.pdfEpisode on RegreSQL https://postgres.fm/episodes/regresqlDryRun MCP https://github.com/boringsql/dryrun~~~What did you like or not like? What should we discuss next time? Let us know via a YouTube comment, on social media, or by commenting on our Google doc!~~~Postgres FM is produced by:Michael Christofides, founder of pgMustardNikolay Samokhvalov, founder of Postgres.aiWith credit to:Jessie Draws for the elephant artwork

Every so often, the tech industry declares something dead. Data warehousing is dead. Data modeling is dead. Semantic layers are dead. SQL is dead. Now AI is supposedly making entire professions obsolete. I get it. Ragebait gets the clicks and comments. But it's also lame and disingenuous.In this Freestyle Friday, I unpack the logical fallacies behind these claims, why technology almost always evolves instead of replaces, and how separating fundamentals from shapeshifting implementations gives you a much clearer view of where the industry is actually headed.-----------------------Sponsor: FivetranWith the rise of AI and agents, having centralized, trustworthy data is the absolute foundation for building tools and training models. Fivetran automates your data pipelines, removing the need to build fragile connectors so your data arrives clean and reliable. By handling the messy infrastructure behind the scenes, Fivetran allows your team to focus on building the future. Visit ⁠⁠⁠fivetran.com⁠⁠⁠ to learn more.The Joe Reis Show is invitation-only. Unsolicited guest pitches and PR outreach are not considered.

Este episodio va de ser vago. Pero vago en el buen sentido, eh. De esos que prefieren que una herramienta haga el trabajo pesado mientras tú te quedas con lo divertido. Resulta que hay todo un ecosistema de herramientas TUI con el prefijo "lazy" que te evitan tener que memorizar cientos de flags y opciones de comandos como git, docker, rsync o SQL. Y no, no es cutrez: son interfaces de terminal que funcionan a golpe de tecla, sin ratón, sin salir de la terminal, y encima molan.Te cuento cómo nació todo esto, quién es Jesse Duffield (el creador de lazygit y lazydocker, con más de 80K y 52K estrellas en GitHub respectivamente) y por qué esta filosofía de "una tecla, una acción" ha enganchado a tanto linuxero. Y lo mejor: te hago demo de las cuatro herramientas principales para que veas cómo funcionan en vivo y en directo, con sus paneles, sus atajos y sus trucos.Empezamos con lazygit, el rey indiscutible del ecosistema. 80.900 estrellas en GitHub, escrito en Go, y con una comunidad que no para de crecer. Desde stage línea a línea hasta rebase interactivo, pasando por undo/redo vía reflog. Te enseño cómo hacer commits, gestionar ramas, stash y hasta cherry-pick sin tener que acordarte de los flags raros de git.Seguimos con lazysql, el gestor de bases de datos en terminal de Jorge Rojas. Soporta MySQL, PostgreSQL, SQLite, MongoDB, MSSQL y Oracle. Navegación por teclado, autocompletado de queries, exportación a CSV y configuración por proyecto. Ideal para cuando no te apetece abrir DataGrip o DBeaver solo para hacer una consulta rápida.Luego viene lazyrsync, escrito en Rust con ratatui, y con una filosofía muy clara: que no se te olvide el flag ese que evita que borres todo. Perfiles reutilizables, dry-run con previsualización, protección contra --delete accidentales y paths dinámicos con variables. Perfecto para backups sin sustos.Y cerramos con lazydocker, también de Jesse Duffield. Cuatro paneles: contenedores, métricas, imágenes y logs en vivo. Con un vistazo ves qué contenedor consume más CPU, entras en el terminal de uno con una tecla, o ejecutas docker-compose sin acordarte del comando. Y sí, también funciona con Podman.Además te menciono otras herramientas del ecosistema: lazyssh, lazyjj para Jujutsu, lazykube, lazyprune para limpiar node_modules olvidados... Vamos, que hay lazy para todo.Capítulos del episodio:0:00 — Introducción: el problema de memorizar comandos2:05 — La filosofía lazy: scripts, TUIs y el ecosistema lazy4:30 — LazyGit: historia, filosofía "una tecla una acción" y +80K estrellas6:45 — LazyGit: demo de paneles, stage, commits, ramas y stash9:10 — LazySQL: Jorge Rojas, 4K estrellas y soporte multi-base de datos11:30 — LazySQL: demo con autocompletado, consultas y exportación CSV14:00 — LazyRsync: dry-run, perfiles y protección contra errores16:30 — LazyRsync: demo con columnas de estado y confirmación de borrado19:10 — LazyDocker: Jesse Duffield, 52K estrellas y soporte para Podman21:45 — Otras herramientas lazy: lazy-ssh, lazy-jj, lazy-kube, lazy-npm23:15 — Cierre: sé un vago inteligente, valoración y despedidaMás información y enlaces en las notas del episodio

Would you like access to our advanced agency training for FREE? https://www.agencymastery360.com/training Do your clients show up to calls with AI-generated strategies that are mostly wrong, and you then spend half the engagement correcting their assumptions instead of doing the work? Have you had clients who used to trust your expertise now question everything, armed with a chatbot and a YouTube video? Today's featured guest is an agency owner who came up through programming, crossed into digital strategy, ran creative and media operations inside major holding company networks, and eventually went independent in search of the entrepreneurial freedom that corporate agency life could not offer. He goes into what AI is actually doing to the client relationship and what it means to train a team that can think rather than one that just produces faster. Devon MacDonald is the president of Cairns Oneil, a Canadian media agency serving clients across North America. His career began in computer programming in the 1990s, working in HTML and SQL for clients in sales and marketing before moving into digital strategy and eventually running a creative agency and then a media agency network inside major holding company structures. Five years ago, he went independent. He built a cross-functional AI team at his agency that includes both technical and non-technical members, operating from the belief that consumer insight and cultural understanding matter as much as data fluency in how AI gets applied. In this episode, we'll discuss: Clients who have decided AI makes them the expert Is the funnel dead because of AI? Will this skill disappear once we've completely stopped using it? Subscribe Apple | Spotify | iHeart Radio Sponsors and Resources E2M Solutions: Today's episode of the Smart Agency Masterclass is sponsored by E2M Solutions, a web design and development agency that has provided white-label services for the past 10 years to agencies all over the world. Check out e2msolutions.com/smartagency and get 10% off for the first three months of service. The Problem With Clients Who Have Decided AI Makes Them the Expert Devon knows there was already an education deficit in marketing before AI arrived. A generation of performance marketers came into positions of influence having skipped foundational thinking around brand, audience, and strategy. AI compounded that gap by giving them the ability to produce high volumes of output that look credible but are built on faulty premises. As a result, clients now show up with hundred-question emails generated by a chatbot, convinced they have done the strategic work when they have not done any of it. The agency response to this cannot be frustration alone. It requires teaching. Devon's approach is to build client literacy around an abductive strategy: start with the vision, align everything to it, and use that alignment as the filter for which AI-generated inputs are worth pursuing and which are distractions. That kind of structured thinking is precisely what a client who watched one YouTube video about replacing their agency does not have. And it is exactly what keeps the agency relationship valuable even when the client has access to the same tools. Why the Funnel Is Not Dead, It Has Just Accelerated Devon once heard at a conference that the funnel is dead because of AI. He pushes back on this claim saying that the path to purchase has changed. The speed of it has changed. The surfaces where awareness, attraction, and acquisition happen have shifted. But the underlying logic, that a buyer needs to become aware of something before they can want it, and want it before they can buy it, has not changed and will not. The practical implication for agencies is that LLM optimization and branded search strategy are now front-line service offerings, not future considerations. Devon describes seeing this in RFPs already: clients are asking explicitly about model optimization and how agencies will help them show up in AI-generated answers. The agencies that can answer that question with a coherent framework are in a different conversation than the ones still positioning around traditional search rankings alone. The Skill That Disappears When You Stop Using It Devon shows genuine concern about what happens when a team stops doing the critical thinking and starts outsourcing it to AI. For instance, nobody knows how to navigate without Google Maps anymore. The skill atrophied because the tool made it unnecessary. The same thing happens to strategic thinking inside an agency when AI handles every first-order question without the team being required to form their own answer first. Devon's response to this is to build the AI team cross-functionally, including people whose value is not technical. The consumer insight person, the culture reader, the account lead who understands what a client actually means when they say something: those perspectives shape how AI gets applied. Removing them from the process in favor of pure technical fluency produces faster output that misses the point. Let's not forget that human judgment is embedded in the workflow, not bypassed by it. Do You Want to Transform Your Agency from a Liability to an Asset? Looking to dig deeper into your agency's potential? Check out our Agency Blueprint. Designed for agency owners like you, our Agency Blueprint helps you uncover growth opportunities, tackle obstacles, and craft a customized blueprint for your agency's success.

Episode: 00330 Released on August 3, 2026 Description:  What happens when you review 850 analytical job postings spanning nearly three years? Dr. Jessica Herbert did exactly that, and what she found should make every law enforcement leader rethink how they hire analysts. In this episode, Jason and Jessica discuss the disconnect between job postings and the actual work today's analysts perform. They examine why many agencies continue recycling outdated job descriptions, why technical skills like SQL and Python are often overlooked, and how organizations should rethink hiring, onboarding, and professional development. Whether you're hiring your first analyst, managing an established crime analysis unit, or planning your own career, this conversation provides practical guidance on preparing the analytical workforce for the future.  

Hey friends! Today's episode comes to you from a parking lot in the rain, with a mint hot cocoa in hand and your host absolutely dragging his butt (D-R-A-G-G-I-N-G, not D-R-A-G-O-N – I've never seen a dragon's butt and can't speak to how mine compares). I've had a bunch of internals back to back lately and I'm basically a drooling dog who found a frisbee and refuses to put it down. Sleep be darned. So instead of walking through one test start to finish, I want to share a few things that have helped me claw out a foothold in environments that are otherwise really locked down: The "good problem" of a mature client – several of these engagements are third- or fourth-year tests, and the clients actually clear findings off the board. Which is great for them and rough for me, because this year's test shouldn't look anything like last year's. All my favorite go-tos came up empty – machine account quota set to zero, no broadcast traffic tomfoolery (Responder and mitm6 got me nothing), SMB signing on everywhere, ADCS either absent or buttoned up, and a low-priv account that BloodHound says has zero interesting permissions and zero local admin anywhere. Cool cool cool. When the network's clean, go file-hunting – which means firing up Snaffler and letting it comb the shares. Normally that wraps up in about an hour. On these engagements it was running three and four hours. Then Windows told me I was out of disk – I like having Snaffler pull down copies of interesting files so I can review them locally instead of authenticating to each share. Turns out it had grabbed 50-60 gigs and left me with about eight gigs of breathing room. Tip #1: put a 1 TB drive in your drop boxes – I ran with tiny drives for years early in the 7MS days and it was always a pinch. Beyond situations like this one, sometimes you find a giant backup file or VMDK on a share and you need somewhere to put it so you can crack it open and go shopping. Tip #2: you can grow a VM disk on the fly – in Proxmox you can resize the disk on a running VM, then hop into Disk Management inside Windows and extend the C drive. Instant elbow room, no downtime. Death by a million tiny files – the real culprit was one file extension I should have excluded, and the client had hundreds of thousands of them. Rather than restart a run I was already hours into, I had AI whip up a little PowerShell loop that swept the Snaffler dump folder every 10 minutes and deleted the extensions I didn't care about. Woke up the next morning to a finished run and plenty of free space. Making a gig-sized log file readable – I fed the log into Chimas, a slick web interface for Snaffler output that lets you filter down to just the red stuff or just the likely-credential files, and sort by modified date. Watch those timestamps – I kept finding AD creds in documents, then comparing the doc's date against the account's last password reset in BloodHound and discovering the file was a year stale. Son of a biscuit. The tool that actually cracked it open: Copernic Desktop Search – my pal Jeff McJunkin recommended this to me years ago, I talked about it on the show once, and then inexplicably forgot about it. Not a sponsor, no kickbacks, just a paid tool that's earned its keep. It's basically Google for your hard drive. How I use it – install it on the Windows VM, clear out the default indexing scope entirely, and point it only at the Snaffler dump folder. The top tier (about a hundred bucks a year) will chew through PSTs, DWGs, Office docs, PDFs and more, and it OCRs images too. Indexing took the better part of a day on these engagements, but then search is instant, and it previews basically every file type without Office installed.  Years ago this same tool surfaced a photo on a file share of a piece of printer paper where a sysadmin had handwritten a 40-character admin password in Bic pen. OCR for the win. What I search for – the obvious stuff like "password," plus the domain name, "plain text," and things like "=sa" to sniff out SQL admin creds. Nuggets and threads to pull – sometimes a hit is the gold. Other times it just tells you where to go dumpster-diving like a raccoon on the live share. That's how I found upgrade project plans with multiple teams and contractors involved, half-cleaned-up temp work, and high-privilege system, database and local admin creds just sitting there. Worth the hours – these didn't all end in domain admin, but they were rich, real findings, and a great teaching opportunity about what's sitting wide open to Domain Users. (Bonus: Copernic can also point straight at a UNC path with your AD creds and index it live.) Know a free alternative? – one of my favorite parts of doing this podcast is when someone writes in with "hey, there's an open source thing that does that." If that's you, I'd love to hear it! Also, on this week's TuesdayTOOLSday I walked through getting a self-hosted Bitwarden password vault (and file sender) up and running on Linux, and there's now a cheat sheet over at 7MinSec.wiki that'll get you there in about seven minutes – all the commands from the official install guide in one place, with a couple of gotchas flagged. Last thing: subscriptions to 7MinSec.club are free, but paid subs help cover hosting and the time this takes each week, and they're getting some exclusive content soon. No guilt trip here, Mom – I'm going to keep barfing up everything I learn either way. But if you've got the means, I'd sure appreciate it.

Nik and Michael are joined by Tudor Golubenco, CTO of Xata, to discuss their architecture, progress, and open source tooling. Here are some links to things they mentioned: Tudor Golubenco https://postgres.fm/people/tudor-golubencoXata https://xata.ioXata is now open source https://xata.io/blog/xata-is-now-open-sourceDBLab Engine https://postgres.ai/docs/database-labpgstream https://github.com/xataio/pgstreamXata acquires Privacy Dynamics for advanced anonymization https://xata.io/blog/xata-acquires-privacy-dynamicsTonic AI https://www.tonic.aiA thousand Postgres branches for one dollar https://xata.io/blog/a-thousand-postgres-branches-for-1pgroll https://github.com/xataio/pgrollCloudNativePG https://github.com/cloudnative-pg/cloudnative-pgPGSimCity https://nikolays.github.io/PGSimCityDeltaX https://github.com/xataio/deltax~~~What did you like or not like? What should we discuss next time? Let us know via a YouTube comment, on social media, or by commenting on our Google doc!~~~Postgres FM is produced by:Michael Christofides, founder of pgMustardNikolay Samokhvalov, founder of Postgres.aiWith credit to:Jessie Draws for the elephant artwork

Richard Luna grew up in New York, never living more than 35 from where he grew up. He is a self proclaimed super nerd, and has been one since he was 13 - at which point, he started coding on an HP calculator. He's always been fascinated to know how things work, and how patterns repeat - which he has observed in the industry throughout the years. Outside of tech, he has 2 kids, one of which is in the business with him. He's an avid cyclist, traveling on average, 120 miles a week.Richard has been a life long technologist, doing everything from desktops, to coding, to hosting. When he and his team saw the limits of what hosting can do, they dove into developer operations (DevOps), and found where they could add the most value - through SaaS infrastructure.This is the creation story of Protected Harbor.SponsorsUnblockedTECH DomainsMezmoBraingrid.aiLinkshttps://protectedharbor.com/https://www.linkedin.com/in/richardluna/Timestamps0:01 Teaser on solving complex database report bottlenecks beyond standard SQL servers0:47 Show intro and setting the stage for application-aware infrastructure1:32 Host intro: How Richard Luna established application-aware infrastructure1:49 Guest introduction: Richard Luna's background, coding at age 13, and cycling 120 miles a week2:21 The career path from desktops, coding, and traditional web hosting to DevOps and SaaS infrastructure2:41 Origin story: The creation of Protected Harbor2:48 Defining application-aware infrastructure and why traditional hosting reaches a hard ceiling4:10 Why "infinite compute" fails when underlying database architecture and queries are broken6:05 Moving beyond basic server ping tests to deep application transaction monitoring8:30 The case for "boring" IT: Prioritizing stability, predictability, and uptime over hype11:15 Strategic trade-offs in hybrid cloud setup and managing hardware accountability14:00 Aligning MSP incentives with client business outcomes and application performance17:30 Common pitfalls in legacy system cloud migrations21:00 The role of operational discipline in modern cybersecurity and IT governance27:00 Where managed infrastructure services are heading and closing thoughtsAdvertising Inquiries: https://redcircle.com/brandsPrivacy & Opt-Out: https://redcircle.com/privacy

Send us Fan MailIn this episode, we sit down with Isaac Evans, co-founder and CEO of Semgrep, to talk about how AI is reshaping application security faster than almost anyone expected. Isaac walks us through why CI is losing its place as the central security control point, replaced by deep background jobs that hunt for vulnerabilities using large models and real-time plugins that sit inside coding agents and force them to regenerate code until it meets an organization's security bar. We dig into what this means for the role of the security engineer, why customization is replacing universal rule sets, and how trust, verification, and the limits of reasoning about model behavior remain the hardest problems in the room. We also talk about vibe coding at scale, the return of business logic flaws as SQL injection becomes easier for models to catch, and why Isaac sees more opportunity than threat in this shift, even as he expects a wave of new vulnerabilities and cleanup work along the way.FOLLOW OUR SOCIAL MEDIA:➜Twitter: @AppSecPodcast➜LinkedIn: The Application Security Podcast➜YouTube: https://www.youtube.com/@ApplicationSecurityPodcastThanks for Listening!~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Nik and Michael are joined by Qian Li and Peter Kraft to talk about DBOS, an open source platform for durable workflows built on Postgres.  Here are some links to things they mentioned: Qian Li https://postgres.fm/people/qian-liPeter Kraft https://postgres.fm/people/peter-kraftDBOS https://www.dbos.devTemporal https://temporal.ioGadget's use of Postgres https://postgres.fm/episodes/gadgets-use-of-postgresPostgres LISTEN/NOTIFY blog post from Recall AI https://www.recall.ai/blog/postgres-listen-notify-does-not-scalePostgres 19 commit that improves LISTEN/NOTIFY, avoiding waking backends that have no need to process the notification messages https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=282b1cde9 PgQue https://github.com/NikolayS/pgquepg_durable https://github.com/microsoft/pg_durableAbsurd https://github.com/earendil-works/absurdLISTEN/NOTIFY performance considerations (docs patch submitted by Nik) https://www.postgresql.org/message-id/flat/CAM527d8oDVb2K%2BtTjpjLkd7g14HLDiwwnvv%3Drcn4BMEs%3DMatkQ%40mail.gmail.com#1b6fa752a96aad22bd8ef794fbaf3ea1~~~What did you like or not like? What should we discuss next time? Let us know via a YouTube comment, on social media, or by commenting on our Google doc!~~~Postgres FM is produced by:Michael Christofides, founder of pgMustardNikolay Samokhvalov, founder of Postgres.aiWith credit to:Jessie Draws for the elephant artwork

Strategic Technology Consultation Services This episode of The Modern .NET Show is supported, in part, by RJJ Software's Strategic Technology Consultation Services. If you're an SME (Small to Medium Enterprise) leader wondering why your technology investments aren't delivering, or you're facing critical decisions about AI, modernization, or team productivity, let's talk. Show Notes "In the agentic world that makes a lot of people really uncomfortable because what ends up happening is the agent has it, the agent has its own ID and then interacts with your data database."— Jerry Nixon Hey everyone, and welcome back to The Modern .NET Show; the premier .NET podcast, focusing entirely on the knowledge, tools, and frameworks that all .NET developers should have in their toolbox. I'm your host Jamie Taylor, bringing you conversations with the brightest minds in the .NET ecosystem. Today, Jerry Nixon returned to the show to talk about SQL MCP Server, something of a new product _and_ the evolution of Data API Builder; which we talked to Jerry about back in episode three of this season (there'll be a link in the show notes). Jerry does a much better job of introducing it than I can, but suffice it to say that SQL MCP Server is an MCP Server which abstracts away intracting with a SQL database... of almost any flavour. SQL Server, CosmosDB, Postgres, you name it. "I mean there is nothing better for any agent than saying "new session." That is how you like create better answers all the time. You might feel like you have this session, you've been training it so long and you've told it so much, it has so much context that now when you ask it, it'll finally have the answer that you're looking for."— Jerry Nixon Along the way, Jerry shared a lot of solid gold nuggets of advice about MCP servers, best practices for interacting with agents and models, and even context management. And, of course, we talk about how simple is almost always the best solution (and how SQL MCP Server might be one of the ways for you to achieve that). Before we jump in, a quick reminder: if The Modern .NET Show has become part of your learning journey, please consider supporting us through Patreon or Buy Me A Coffee. Every contribution helps us continue bringing you these in-depth conversations with industry experts. You'll find all the links in the show notes. So let's sit back, open up a terminal, type in `dotnet new podcast` and we'll dive into the core of Modern .NET. Full Show Notes The full show notes, including links to some of the things we discussed and a full transcription of this episode, can be found at: https://dotnetcore.show/season-8/giving-ai-agents-safe-access-to-your-data-sql-mcp-server-with-jerry-nixon/ Useful Links: Data API Builder & SQL MCP Serverdocumentation Data API Builder on GitHub Book time with Jerry to discuss SQL MCP an your projects Agentic Design Patterns by Antonia Gulli Supporting the show: Leave a rating or review Buy the show a coffee Become a patron Getting in Touch: Via the contact page Joining the Discord Remember to rate and review the show on Apple Podcasts, Podchaser, or wherever you find your podcasts, this will help the show's audience grow. Or you can just share the show with a friend. And don't forget to reach out via our Contact page. We're very interested in your opinion of the show, so please get in touch. You can support the show by making a monthly donation on the show's Patreon page at: https://www.patreon.com/TheDotNetCorePodcast. Music created by Mono Memory Music, licensed to RJJ Software for use in The Modern .NET Show. Editing and post-production services for this episode were provided by MB Podcast Services.

SHOW NOTES Ask the Right QuestionsEntering the analytics profession and discovering that 80 per cent of the job is cleaning dirty data is a reality check that no course prepares you for. Some say that analysts who thrive in an AI-augmented data science career, will be defined not by their ability to prompt a model, but by their capacity to ask the right questions and critically evaluate the answers. Today we learn how the team at RBI is building knowledge graphs to ground LLMs in real organisational context, why SQL coding skills are declining in value while critical analysis is rising and what should change about the MSBA curriculum, including a stronger focus on ethics, data lineage, and AI-augmented workflows. We are joined by Naida Dzigal, a 2023 graduate of the CEU Master of Science in Business Analytics programme and IT expert at Raiffeisen Bank International. With a PhD in technical physics and prior experience as a nuclear specialist at the International Atomic Energy Agency, Naida brings a rare combination of scientific rigour, multilingual diplomacy, and real-world analytics leadership to this conversation.  THINGS WE SPOKE ABOUT- From nuclear physics to banking analytics via the MSBA- Dirty data, frustration tolerance and the analytics reality check- Using AI for 80 per cent of the working day at RBI- Building knowledge graphs and context layers to ground LLMs- Redesigning the MSBA curriculum for an AI-augmented analytics world GUEST DETAILSNaida Dzigal is an IT expert at Raiffeisen Bank International (RBI), where she is part of a strategic data transformation team reshaping how data is managed across the bank's entire network, influencing data processes that affect billions of euros annually. A physicist by training, she holds a PhD in technical physics from Technical University Vienna and previously served as a nuclear specialist at the International Atomic Energy Agency. She completed her Master of Science in Business Analytics at CEU in 2023 and speaks five languages, bringing scientific rigour and cross-cultural professional experience to the field of data and AI. QUOTES- "I was just so surprised that I was getting paid for essentially cleaning up data and spending maybe 20% of my time actually doing real analytical work." - Naida Dzigal- "The biggest experts always have the highest frustration tolerance." - Naida Dzigal- "I think where we fail most of the time is in our critical analysis of the answer." - Naida Dzigal- "LLMs are very powerful. AI in general is very powerful, but it lacks context." - Naida Dzigal- "The students that will succeed are the students who are able to ask the right questions." - Naida Dzigal KEYWORDS #AiDataScience #AnalyticsCareer #KnowledgeGraphs #DataTransformation #BusinessAnalytics

Topics covered in this episode: django-orjson Best Django Redis configuration for speed and size Linus Torvalds puts the foot down against Anti-AI Kernel Maintainers Django Steering Council backs the Triptych Project Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Consulting from Six Feet Up Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedIn Calvin: Mastodon / BlueSky / X / LinkedIn Show: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Michael #1: django-orjson Adam Johnson dropped django-orjson - drop-in replacements for the Django and DRF pieces that touch JSON, swapping stdlib json for orjson, the Rust-based library. Headline numbers: 10x faster serialization, 2x faster deserialization. The interesting question is why this needs to be a package at all. pip install orjson is the easy part. Adam's actual pitch: adopting it "isn't easy, especially when your framework uses json in many different parts." Django scatters JSON across JsonResponse, the test client and test case classes, the json_script template tag, and more. There's no single hook to grab, so you get a library that catches them all. Adam is refreshingly honest about the scale of the win. His words: "While database queries tend to dominate the typical Django application's runtime, the time spent in serialization and deserialization can still be significant." He calls it "a nearly free performance win" - not "this will 10x your app." That's a claim about cost, not magnitude, and it's worth keeping those straight. Worth flagging what the post doesn't cover: caveats. There are none in the article, but orjson has real ones. Django and Flask both render datetimes as RFC 822 HTTP-date (Wed, 15 Jul 2026 12:00:00 GMT); orjson does ISO 8601. It can't do ensure_ascii, it rejects NaN and Infinity (which stdlib happily emits), and it raises on Decimal. If you've got a JS client parsing dates, that's a wire-format change. Who should actually take this? If you're a DRF shop shoveling JSON all day, yes - it's cheap and it's real. If your app mostly renders HTML templates, you're optimizing a slice of runtime that's already near zero. The problem Adam's package solves doesn't exist in Flask or Quart. They already centralize every JSON operation - jsonify, request.get_json(), the test client, the |tojson filter - behind one provider object at app.json. So there's no library to install. It's about ten lines: import orjson from quart.json.provider import JSONProvider # or flask.json.provider class OrjsonProvider(JSONProvider): def dumps(self, obj, **kwargs) -> str: return orjson.dumps(obj).decode() # provider must return str def loads(self, s, **kwargs): return orjson.loads(s) app.json = OrjsonProvider(app) The numbers on talkpython.fm Evaluated it, measured it, and skipped it. The biggest JSON payload we serve is our MCP server returning a cached episode transcript, about 139 KB. Swapping the provider saves 0.119 milliseconds per request. That total response takes 1.1 ms We got 4.1x, not 10x - and the reason is the good lesson. Payload shape decides your speedup. The 10x is for structure-heavy data, lots of small keys where stdlib burns time in Python-level dispatch per item. Our hot payload is one giant transcript string, so the work is escaping and memcpy Calvin #2: Best Django Redis configuration for speed and size Peter Bengtsson revisits a classic: his 2017 "Fastest Redis configuration for Django" benchmark now has a 2026 update posted this week. The 2017 post pitted django-redis serializers (json, ujson, msgpack, pickle) and compressors (zlib, lzma) against each other; conclusion was msgpack + zlib as the sweet spot - avoid the json serializer, it's fat and slow. The 2026 update narrows focus to just compressors: default (no compression), zlib, lzma, and newcomer zstd. New results: lzma compresses best but is slowest; zstd is the fastest compressor on Ubuntu; differences between them are very small. Big takeaway across both: compression buys you a lot of space (2–3.5x smaller) for very little speed cost - worth it for Redis where memory is the constraint. Caveat from the author: results depend heavily on your data - his test stores short strings of numbers, so benchmark your own workload. Michael #3: Linus Torvalds puts the foot down against Anti-AI Kernel Maintainers Write up on Ars. Really good coverage by Maximillian: Time to wake up (for some) Torvalds said that “Linux is not one of those anti-AI projects, and if somebody has issues with that, they can do the open-source thing and fork it. Or just walk away.” I agree with Max, putting your head in the sand and waiting for AI to go away will likely mean you won't be working professionally in software development in the coming years. The statement came amid a lengthy thread arguing about the use of Sashiko, an “agentic Linux kernel code review system” that its creators claim can, in tests, independently find 53.6 percent of the bugs that would end up being fixed by human coders in later commits. “We're not forcing anybody to use [LLM tools], but I will very loudly ignore people who try to argue against other people from using it,” Torvalds said. “Anybody who points to the problems at AI had better be looking in the mirror and pointing at themselves at the same time,” Torvalds wrote. Calvin #4: Django Steering Council backs the Triptych Project Django Steering Council issued a Letter of Collaboration backing Carson Gross & Alex Petros's funding bid for the Triptych Project - three proposals to make HTML more expressive natively, in every browser. The three additions: PUT/PATCH/DELETE methods for forms, button actions (buttons that fire HTTP requests without a wrapping form), and partial page replacement. Distills the core ideas from HTMX/Unpoly/Turbo into the HTML standard itself - no JS, no library, nothing to ship or maintain. Current focus is button actions (WHATWG #12330): Logout instead of wrapping a button in a form. Relevant to Django directly - think the admin submit row and disguised delete links; Django 6.0's template partials were already inspired by these patterns. How to help: companies can send non-binding letters of support on letterhead; individuals can read the proposals and weigh in on the WHATWG issues. Extras Calvin: DOOMQL - A playable first-person shooter whose framebuffer is a SQL query. Michael: Granian 2.7.9 fixes WSGI threadpool scheduler starvation/underscaling Welcome Calvin post Joke: Solving all bugs

Bun quitte Zig pour Rust en 11 jours à coups de Claude Code, pour 165 000$ payés par Anthropic : la réaction du créateur de Zig ne se fait pas attendre. TypeScript 7 débarque, réécrit en Go, 8 à 12x plus rapide. Entre les deux, Vidocq réimplémente Jakarta EE en souverain, le COBOL met un uppercut aux microservices, et un CTO demande à son équipe combien de temps il lui faudrait pour revenir à sa vélocité antérieure sans Claude Code. De quoi réfléchir avant le prochain rewrite. Enregistré le 17 juillet 2026 Téléchargement de l'épisode LesCastCodeurs-Episode-342.mp3 ou en vidéo sur YouTube. News Langages Est-ce qu'on peut aussi utiliser des double, des longs, ou autre pour gérer les montants monétaires en Java ? https://blog.frankel.ch/bigdecimal-vs-double/ double (IEEE 754) Usage : Calculs scientifiques, métriques, statistiques. Avantages : Très performant (matériel), idéal pour l'approximatif. Risques : Erreurs d'accumulation, égalité (==) trompeuse, NaN / -0.0. Bonnes pratiques : Utiliser une tolérance (epsilon ou ULP) pour comparer ; utiliser des algorithmes de sommation compensée (Kahan/Neumaier) pour la précision. BigDecimal Usage : Finance, comptabilité, fiscalité (précision décimale stricte). Avantages : Contrôle total des arrondis et de l'échelle. Risques : Lent (allocations), immutabilité (risque de mauvaise réaffectation), confusion equals() vs compareTo(). Bonnes pratiques : Initialiser via String ou valueOf() ; utiliser compareTo pour l'égalité. Point fixe (long) Usage : Trading, systèmes haute performance, paiements. Avantages : Très rapide, déterministe, zéro allocation. Risques : Gestion manuelle de l'échelle et des débordements (Math.addExact). Points de vigilance en production Sérialisation (JSON) : Préférer les String pour BigDecimal pour éviter la perte d'échelle. Atomicité : double n'est pas atomique ; utiliser volatile ou DoubleAdder (pour les compteurs). Tests : Toujours définir un delta ou Offset pour les tests de flottants. Bibliothèques recommandées Moneta (JSR 354) : Standard bancaire complet. decimal4j : Optimisé pour le point fixe haute performance. Apache Commons Numbers : Outils robustes pour la précision et les sommations. Typescript 7 est de sortie devblogs.microsoft.com/typescript/announcing-typescript-7-0 Performance majeure : Portage natif en Go offrant des gains de vitesse de 8x à 12x et une consommation mémoire réduite. Architecture optimisée : Utilisation du multithreading (mémoire partagée) et parallélisation native (analyse, vérification de types,émission). Nouvelles options de contrôle : Introduction des flags –checkers, –builders (parallélisation) et –singleThreaded (mode mono-cœur). Nouvel observateur de fichiers : Passage à une solution basée sur @parcel/watcher pour une meilleure réactivité et stabilité du mode –watch. Compatibilité et transition : Compatible avec les bases de code TypeScript 6.0. Utilisation du package @typescript/typescript6 recommandée pour maintenir des outils dépendants de l'ancienne API. Changements de configuration : Durcissement des défauts (ex: strict activé par défaut) et suppression de nombreuses options obsolètes (target: es5, baseUrl, etc.). Amélioration de l'expérience éditeur : Serveur de langage (LSP) plus stable avec une réduction de 80 % des erreurs et 60 % des crashs. Limitations actuelles : Support incomplet pour les frameworks utilisant des plugins de langage (Vue, Svelte, Astro, Angular) en attendant une API stable. "Java, the documentary" est sur YouTube, retraçant l'histoire du langage youtube.com/watch?v=… La vidéo n'était pas encore disponible à l'heure de l'enregistrement. Sortie officielle le 17 juillet. Avec des interviews de James Gosling, Brian Goetz, Venkat Subramaniam, et bien d'autres. Librairies What's New in 8.0 - Hibernate docs.hibernate.org/orm/8.0/whats-new L'intégration de Jakarta Persistence 4.0 apporte des nouveautés majeures comme EntityAgent (qui standardise la StatelessSession), les mappings de result set en SQL natif, et de nouvelles options de configuration de session et de requêtes (Session Creation Options, Query Options). Le support de Jakarta Data 1.1 est ajouté pour les Hibernate Data Repositories, incluant l'intégration avec les requêtes statiques JPA4, les projections @Select, et les repositories asynchrones via Jakarta Concurrency ou Hibernate Reactive. L'introduction du Graph-based Flushing remplace l'ancienne approche basée sur des heuristiques par un modèle de dépendances utilisant les contraintes relationnelles, afin d'améliorer la fiabilité des tris, la gestion des batchs et les performances globales (bien que l'ancienne méthode reste temporairement disponible). L'API ProcedureCall a été améliorée pour faciliter le casting des résultats (asResultSetOutput) et permettre la déclaration paresseuse (lazy) du mapping des ResultSet. Hibernate supporte désormais la sécurité au niveau de la ligne (Row-Level Security) de manière native pour les bases de données compatibles (PostgreSQL, Db2, SQL Server, CockroachDB) afin de gérer la visibilité en contexte multi-tenant. Une nouvelle méthode getReference() permet dorénavant de récupérer la référence d'une entité directement à partir de son natural id. Le mode Safe Mode Validator (hibernate.query.safe_mode_enabled=true) fait son apparition pour bloquer les opérations risquées comme sql(), function() ou column() dans les requêtes HQL et Criteria, ce qui est particulièrement utile pour les applications exposées aux LLMs. La gestion des associations bidirectionnelles lors de la phase de flush peut maintenant être prise en charge automatiquement par Hibernate (hibernate.bidirectionality_management=true), synchronisant la référence côté inverse de l'association. Le Subselect Fetching est considérablement amélioré, supportant dorénavant les associations "to-one" pour le bulk select fetching (au lieu de se limiter aux collections) et devenant une option de premier ordre via FetchMethod.BY_SUBQUERY. Un des papas de Cucumber et Gherkin lance Var, une alternative pour le test et le BDD var.oselvar.com Lancement de Vár : Nouvel outil de test créé pour pallier les défauts de Cucumber. Limites de Cucumber : Syntaxe Gherkin trop rigide, intégration difficile avec les exécuteurs de tests et support éditeur limité. Usage avec l'IA : Conçu spécifiquement pour vérifier que les agents IA respectent les intentions et spécifications de l'utilisateur. Fonctionnement : Utilisation du Markdown plutôt que du Gherkin ; sert à la fois de guide et d'outil de vérification. Développement assisté : Code et documentation générés en grande partie par Claude sous supervision humaine. Appel aux retours : Projet ouvert aux tests et aux critiques de la communauté. Web Une nouvelle méthode HTTP : QUERY https://kreya.app/blog/new-http-query-method-explained/ Méthode HTTP QUERY (RFC 10008) pour les recherches complexes. Problème : GET (limité par l'URL) vs POST (sémantique inadaptée). Avantages : Permet un corps de requête, sûr, idempotent et cacheable. Limites : Support infrastructurel faible, non partageable par lien, cache complexe. Usage : À réserver aux requêtes complexes si l'environnement le permet. Comment je fais du design en tant que dev backend eventuallycoding.com/p/comment-je-fais-du-design-en-tant-que-dev-backend Hugo Lassiège retrace l'évolution de son workflow de création d'interfaces en tant que développeur backend, depuis ses débuts avec Bootstrap jusqu'à l'ère de l'intelligence artificielle. L'article explique comment la structuration des éléments visuels a progressé grâce à l'Atomic Design, l'émergence des design systems et l'adoption des design tokens via un framework comme Tailwind. L'auteur détaille son processus actuel qui s'appuie fortement sur Claude Design pour générer et itérer sur des maquettes à partir d'un brief, d'un screenshot ou d'un design system de référence. Il aborde également le risque de slopification et de standardisation extrême apporté par ces outils, rappelant que si l'IA simplifie la technique, il reste crucial d'injecter de l'identité et de l'originalité pour éviter un web trop aseptisé. Data et Intelligence Artificielle De l'utilisation de SKILL.md et de "loop engineering" pour augmenter sa productivité glaforge.dev/posts/…/of-skills-and-loops-with-ai-assistance Les skills permettent d'encoder une procédure de manière répétable et automatisable Le loop engineering enlève l'humain de la boucle afin que l'agent atteigne un objectif donné de façon plus autonome Pour écrire des Codelabs (sorte de tutoriel guidé pas à pas) Guillaume a transformé une séance de création de codelab avec son agent préféré (Antigravity) en skill réutilisable pour l'écriture de ses prochains codelabs Il a également utilisé l'approche de "loop engineering" à la mode en ce moment pour que son agent IA compile, exécute, teste les instructions et le code de son codelab, pour qu'il soit complètement fonctionnel Gain estimé : passer de 2 jours de travail à moins de 2 heures ! Redeploying Claude Fable 5 anthropic.com/news/redeploying-fable-5 Anthropic a annoncé le rétablissement de l'accès à ses modèles Claude Fable 5 et Mythos 5, qui avaient été suspendus suite à des restrictions d'exportation imposées par le gouvernement américain le 12 juin 2026. Cette suspension faisait suite à un rapport d'Amazon démontrant une méthode pour contourner les garde-fous de Fable 5, lui permettant d'identifier et d'exploiter une vulnérabilité logicielle (un jailbreak). Pour y remédier, Anthropic a renforcé ses mécanismes de sécurité en déployant un nouveau classifieur capable de bloquer cette technique spécifique dans plus de 99 % des cas, acceptant en contrepartie une augmentation des faux positifs sur des requêtes bénignes. Face à l'absence de consensus sur l'évaluation des jailbreaks, Anthropic s'associe à Amazon, Microsoft, Google et d'autres partenaires pour développer un standard industriel évaluant la sévérité de ces failles selon quatre critères : gain de capacité, étendue du gain, facilité d'arsenalisation et découvrabilité. L'entreprise s'engage également à approfondir sa collaboration avec le gouvernement américain, notamment via des évaluations pré-déploiement, un partage rapide d'informations sur les failles, et des ressources dédiées à la recherche conjointe sur la sécurité de l'IA. Outillage La réécriture de Bun en Rust et la réaction du créateur de Zig bun.com/blog/bun-in-rust et andrewkelley.me/post/my-thoughts-bun-rust-rewrite.html Bun, le runtime JavaScript et TypeScript écrit à l'origine en Zig, a été entièrement réécrit en Rust pour des raisons de stabilité et de gestion de la mémoire. Cette migration massive d'un demi-million de lignes de code a été bouclée en seulement 11 jours grâce à l'utilisation intensive de Claude Code fonctionnant en parallèle, pour un coût d'API estimé à 165 000 dollars financé par Anthropic. Andrew Kelley, le créateur de Zig, a réagi publiquement en qualifiant l'ancienne base de code de Bun de "slop" remplie de hacks et de fuites mémoire accumulées par une course aux fonctionnalités. Kelley exprime son soulagement face à ce départ, expliquant que les plantages incessants de Bun devenaient un passif réputationnel toxique pour le langage Zig et sa fondation. Le rachat de Bun par Anthropic fin 2025 avait déjà mis fin aux donations financières de Bun envers la Zig Software Foundation, facilitant cette séparation. La nouvelle version Rust de Bun passe désormais la quasi-totalité des tests, réduit la taille du binaire et est déjà déployée de manière transparente en production dans Claude Code. Nouveautés de Git 2.55 github.blog/open-source/git/highlights-from-git-2-55 Support natif de FSMonitor sous Linux via inotify pour accélérer les commandes comme git status sur les grands dépôts Intégration de la compaction incrémentale MIDX (multi-pack index) dans git repack pour optimiser la réécriture des métadonnées Amélioration drastique des performances de génération des bitmaps et des pseudo-merge bitmaps lors des tâches de maintenance Nouvelle commande expérimentale git history fixup pour intégrer facilement des modifications locales dans un commit antérieur Possibilité d'exécuter des hooks configurés en parallèle pour optimiser le temps de build et de validation Utilisation d'un autostash automatique lors d'un git checkout -m en cas de conflit de fusion pour éviter de bloquer l'espace de travail Nouvelle commande git format-rev permettant de formater rapidement des commits reçus via l'entrée standard (stdin) Support du push simultané vers un groupe de remotes configuré Protection contre l'exécution de séquences de contrôle de terminal malveillantes via les flux de progression distants Vidocq, une réimplémentation souveraine et sans dépendance de Jakarta EE et Microprofile vidocq.dev/posts/vidocq-a-sovereign-jakarta-ee-and-microprofile-runtime Lancement de Vidocq : Runtime Java open source complet, compatible Jakarta EE Core Profile et Souveraineté numérique : Projet européen hébergé sur Codeberg, sous licences EUPL 1.2, EPL 2 et GPL 2.0. Standardisation totale : Implémentation fidèle des spécifications (CDI, REST, JSON, etc.), validée par 5 650 tests TCK officiels. Sécurité radicale : Zéro dépendance externe et aucune bibliothèque tierce. Aucune manipulation de bytecode à l'exécution (« magie » générée à la compilation via JDK 25). Compatible JPMS, AOT, GraalVM et Leyden CDS. Disponibilité : Projet en phase alpha, code et documentation accessibles sur vidocq.dev. Article complémentaire qui revient sur la genèse de Vidocq, en utilisant l'IA et les TCKs pour driver l'aspect spec-driven development vidocq.dev/posts/the-story-of-vidocq Le "selfware" : Guillaume s'est fait plais' en vibe-codant son propre éditeur de texte glaforge.dev/posts/…/selfware-building-my-own-text-editor-without-knowing-swift Concept de « Selfware » : création de logiciels conçus exclusivement pour soi-même, sans monétisation ni contraintes liées aux utilisateurs tiers. Le rôle de l'IA : les agents de programmation (comme Antigravity) suppriment la barrière technique de l'apprentissage des langages (Swift, APIs) pour les non-développeurs. Développement minimaliste : privilégier la performance et l'utilité directe (démarrage instantané, interface native) au détriment des fonctionnalités complexes (plugins, télémétrie, gestion de comptes). Absence de pression : libération des contraintes liées à la compatibilité, à la maintenance logicielle et aux retours utilisateurs ; le logiciel n'a besoin d'être « assez bon » que pour ses propres besoins. Incitation à l'autonomie : encourager la création d'outils sur mesure pour résoudre les frictions quotidiennes plutôt que de subir les limitations des logiciels commerciaux. Architecture Le cobol a donné un uppercut au microservices https://freedium-mirror.cfd/@maahisoft20/your-microservices-lost-to-cobol-let-that-sink-in-8ce2e236d007 Retour d'expérience sur la migration d'un système COBOL vers des microservices cloud-native qui s'est soldée par un retour en arrière après avoir constaté que le traitement batch initial était plus rapide, moins cher et plus fiable Là où le batch COBOL traitait 2.4 millions d'enregistrements en 11 minutes, le système distribué modernisé à base de message queues, retries et Kubernetes prenait 47 minutes et tombait sous la charge COBOL brille par ses caractéristiques conçues spécifiquement pour la finance comme le calcul décimal précis sans floating point errors et l'absence totale d'overhead réseau, de conteneurs ou de cold starts Rappel que distribuer un système multiplie les points de défaillance silencieux et complexifie la gestion de la cohérence transactionnelle par rapport à une exécution locale séquentielle Une invitation à se demander si les projets de décomposition en microservices apportent réellement un gain de performance de bout en bout pour l'utilisateur final ou s'ils optimisent seulement le diagramme d'architecture Méthodologies Ma meilleure question d'entretien Spring beaufume.fr/articles/spring-interview Florian beaufumé partage sa question d'entretien favorite pour évaluer des développeurs Spring de niveau intermédiaire à avancé : "Que pouvez-vous me dire sur le paramètre spring.jpa.open-in-view ?". Ce paramètre détermine l'activation du pattern Open Session In View (OSIV) qui, lorsqu'il est à true (la valeur par défaut dans Spring Boot), maintient l'un EntityManager JPA ouvert durant toute la requête HTTP. Si l'OSIV facilite le développement en évitant les fameuses LazyInitializationException lors de la sérialisation des entités en JSON, il pose d'importants problèmes de performance en provoquant des requêtes SQL non maîtrisées (comme le problème du N+1 select) en dehors de la couche service. Maintenir l'OSIV actif augmente également le temps de rétention des connexions au sein du pool de la base de données, limitant la scalabilité de l'application. La recommandation est de désactiver ce comportement en le positionnant à false, et de gérer explicitement le chargement des données requises au sein des transactions (via des DTOs, des requêtes JOIN FETCH ou des Entity Graphs) pour garder le contrôle sur les accès à la base de données. 10 points à retenir du rapport AI Engineering 2026 : The Acceleration Whiplash faros.ai/blog/ai-acceleration-whiplash-takeaways L'IA a franchi un cap et est devenue l'auteur principal du code : le taux d'acceptation du code généré est passé de 20% à 60% dans les équipes étudiées par Faros AI. La vélocité métier est bien réelle, avec une augmentation de 66% des epics livrées et une hausse de 33,7% du throughput des tâches par développeur. Ce volume cache un code churn massif (+861%), ce qui signifie qu'une quantité énorme de code est supprimée ou remplacée peu après avoir été ajoutée. La qualité en aval se dégrade fortement : les bugs par développeur ont augmenté de 54% et le nombre d'incidents par pull request a explosé de 242,7%. Le processus de code review est complètement saturé, entraînant un temps médian de relecture multiplié par cinq et une augmentation de 31,3% des PRs mergées sans aucune revue. Le système repose de plus en plus sur les développeurs seniors qui subissent une "senior engineer tax", devant relire un volume insoutenable de code à l'apparence correcte mais structurellement fragile. Contrairement à certaines hypothèses récentes de DORA, une forte maturité DevOps ne protège pas les entreprises contre cette détérioration ; le "Acceleration Whiplash" frappe de la même manière les équipes très performantes. En résumé, les outils d'IA inondent les pipelines de livraison avec un volume de code pensé pour un rythme machine, alors que les systèmes de vérification reposent toujours sur un rythme de validation humain. Loi, société et organisation Le coût d'une equipe d'engineering qui ne sait plus ce qu'elle fait dans un contexte d'augmentation de coût des coding agents https://freedium-mirror.cfd/@developer_programmer/i-spent-47-000-on-claude-code-in-90-[…]-asked-me-one-question-and-i-couldnt-answer-it-af3b203f81bb Une équipe de 8 ingénieurs a vu sa vélocité de développement exploser en utilisant Claude Code de manière intensive, jusqu'à recevoir une facture d'API salée de 47 213 $ pour seulement trois mois d'utilisation. Face à cette dépense, la question piège du CTO n'était pas sur le montant, mais sur la dépendance : "Si nous arrêtions Claude Code demain, combien de temps faudrait-il pour que notre vélocité revienne à son niveau initial ?". L'auteur s'est rendu compte qu'il était incapable de répondre car son équipe, en particulier les profils juniors, avait commencé à perdre l'habitude de concevoir et d'implémenter des fonctionnalités complexes sans l'aide permanente d'un agent. Le deuxième risque stratégique soulevé est celui de la dépendance tarifaire et du vendor lock-in : si l'outil devient une infrastructure indispensable au quotidien, l'entreprise perd tout pouvoir de négociation face aux augmentations de prix de l'éditeur d'IA. Pour éviter que l'IA ne devienne une béquille qui atrophie les compétences de l'équipe, l'article suggère de poser des limites budgétaires strictes, d'organiser régulièrement des sprints sans IA ("AI-free sprints") et de concevoir des processus de développement portables. Retour de Nicolas Delsaux sur jqwik qui donne une perspective plus complète concernant jqwik, il me semble que vous oubliez (comme tous les gens qui parlent de LLM dans "l'industrie") que l'auteur n'a pas fait ça juste pour faire chier le monde, mais parce que ces outils ont des externalités incroyablement négatives, ce dont l'auteur s'explique dans son blog (blog.johanneslink.net/2026/06/09/the-jqwik-anti-ai-affair) Vous oubliez également de signaler que le ticket (github.com/jqwik-team/jqwik/issues/708) par lequel un utilisateur se plaint de cette fonctionnalité a été écrit par un agent. N'oubliez pas non plus que l'enthousiasme pour ces technologies n'est en fait pas universel, et que ces technologies sont loin d'être inévitables (les gains de vitesse ne sont, d'après circle CI - circleci.com/resources/2026-state-of-software-delivery, pas des gains de productivité ) OkHttp, Okio, Retrofit et SQLDelight rejoignent Commonhaus ! commonhaus.org/activity/315.html La fondation Commonhaus, via une publication de Andres Almiray, annonce l'arrivée de quatre projets majeurs de l'écosystème Java et Kotlin : OkHttp, Okio, Retrofit et SQLDelight. Ces projets, initialement créés chez Square (devenu Block), sont désormais regroupés et gérés sous la bannière lysine.dev au sein de la fondation. Jesse Wilson et Jake Wharton, créateurs et mainteneurs historiques de ces outils, rejoignent Commonhaus en tant que leaders de lysine.dev. Suite à leur départ de Block, ils expliquent avoir choisi Commonhaus pour offrir à leur immense communauté d'utilisateurs un cadre de gouvernance pérenne, stable et digne de confiance. Conférences La liste des conférences provenant de Developers Conferences Agenda/List par Aurélie Vache et contributeurs : 28-30 août 2026 : State of the Map - Champs-sur-Marne (France) 4 septembre 2026 : JUG Summer Camp 2026 - La Rochelle (France) 10-11 septembre 2026 : Nantes Craft - Nantes (France) 17 septembre 2026 : dotAI - Paris (France) 17-18 septembre 2026 : API Platform Conference 2026 - Lille (France) 18 septembre 2026 : WordCamp Bretagne - Rennes (France) 18 septembre 2026 : dotJS - Paris (France) 18 septembre 2026 : WordCamp Bretagne - Rennes (France) 22 septembre 2026 : Salon Data 2026 - Nantes (France) 22-23 septembre 2026 : Agile en Seine & IA 2026 - Paris (France) 24 septembre 2026 : aMP Day Montpellier 2026 - Montpellier (France) 24 septembre 2026 : OWASP AppSec Days France 2026 - Paris (France) 24 septembre 2026 : PlatformCon Paris - Paris (France) 24 septembre 2026 : React Native Connection 2026 - Paris (France) 24-26 septembre 2026 : Paris Web 2026 - Paris (France) 25 septembre 2026 : SAP Inside Track Paris 2026 - Paris (France) 28-29 septembre 2026 : 4th Tech Summit on AI & Robotics - Paris (France) & Online 1 octobre 2026 : WAX 2026 - Marseille (France) 1-2 octobre 2026 : Volcamp - Clermont-Ferrand (France) 2 octobre 2026 : DevFest Perros-Guirec 2026 - Perros-Guirec (France) 5-9 octobre 2026 : Devoxx Belgium - Antwerp (Belgium) 8-9 octobre 2026 : Forum PHP 2026 - Marne-la-Vallée (France) 12 octobre 2026 : Dev With AI - Paris (France) 22-23 octobre 2026 : Agile Tour Bordeaux 2026 - Bordeaux (France) 26 octobre 2026 : Agile Tour Montpellier - Montpellier (France) 27-29 octobre 2026 : Directions EMEA 2026 - Paris (France) 29-30 octobre 2026 : Campus Agile Grenoble - Grenoble (France) 29-30 octobre 2026 : BDX I/O 2026 - Bordeaux (France) 29-30 octobre 2026 : Agile Tour Nantais 2026 - Nantes (France) 29 octobre 2026-1 novembre 2026 : Pycon FR - Biarritz (France) 30 octobre 2026 : Cloud Nord 2026 - Lille (France) 4-5 novembre 2026 : Devoxx Morocco - Casablanca (Morocco) 14-15 novembre 2026 : Capitole du Libre - Toulouse (France) 19 novembre 2026 : DevFest Toulouse 2026 - Toulouse (France) 19 novembre 2026 : Agile Laval 2026 - Laval (France) 19 novembre 2026 : OVHcloud Summit - Paris (France) 19 novembre 2026 : Codeurs en Seine - Rouen (France) 27 novembre 2026 : DevFest Paris 2026 - Paris (France) 1-3 décembre 2026 : Apidays Paris - Paris (France) 2-3 décembre 2026 : Cloud Native AI Summit Europe - Paris (France) 4 décembre 2026 : DevFest Lyon 2026 - Lyon (France) 4 décembre 2026 : DevFest Dijon 2026 - Dijon (France) 9-10 décembre 2026 : OpenSource Expérience - Paris (France) 9-10 décembre 2026 : DevOps REX - Paris (France) 10 décembre 2026 : KCD Provence - Aix-en-Provence (France) 10 décembre 2026 : DevCon 28 : sécurité | post-quantique | hacking édition 2027 - Paris (France) 14-16 janvier 2027 : SnowCamp 2027 - Grenoble (France) 7-9 avril 2027 : Devoxx France 2027 - Paris (France) 3 juin 2027 : Cloud Native Days France 2027 - Paris (France) Nous contacter Pour réagir à cet épisode, venez discuter sur le groupe Google https://groups.google.com/group/lescastcodeurs Contactez-nous via X/twitter https://twitter.com/lescastcodeurs ou Bluesky https://bsky.app/profile/lescastcodeurs.com Faire un crowdcast ou une crowdquestion Soutenez Les Cast Codeurs sur Patreon https://www.patreon.com/LesCastCodeurs Tous les épisodes et toutes les infos sur https://lescastcodeurs.com/

Nik and Michael are joined by Fabrízio Mello to discuss his new extension pg_stat_log.Here are some links to things they mentioned: Fabrízio Mello https://postgres.fm/people/fabrizio-de-royes-melloTimbira https://www.timbira.com.brPlanetScale https://planetscale.compg_stat_log https://github.com/fabriziomello/pg_stat_logCustom Cumulative Statistics (docs) https://www.postgresql.org/docs/current/xfunc-c.html#XFUNC-ADDIN-CUSTOM-CUMULATIVE-STATISTICSCustom Cumulative Statistics (wiki page) https://wiki.postgresql.org/wiki/CustomCumulativeStatslogerrors https://github.com/munakoiso/logerrorspgFouine https://www.postgresql.org/ftp/projects/pgFoundry/pgfouine/pgFouinepgBadger https://github.com/darold/pgbadgerpg_stat_checkpointer https://www.postgresql.org/docs/current/monitoring-stats.html#MONITORING-PG-STAT-CHECKPOINTER-VIEWpg_wait_sampling https://github.com/postgrespro/pg_wait_samplingRFC: pg_stat_logmsg (patch proposal by Joe Conway) https://www.postgresql.org/message-id/flat/89742024-d51a-c66b-90b9-67f837072cd2%40joeconway.com~~~What did you like or not like? What should we discuss next time? Let us know via a YouTube comment, on social media, or by commenting on our Google doc!~~~Postgres FM is produced by:Michael Christofides, founder of pgMustardNikolay Samokhvalov, founder of Postgres.aiWith credit to:Jessie Draws for the elephant artwork

nFactorial Intelligence - еженедельный обзор новостей из мира стартапов и ИИ   Рекомендации от nFactorial  Ежегодный nFactorial Incubator Demo Day 2026. ​​24 июля, пятница, 13:00-17:00, г. Алматы. Вход свободный. Narxoz University, актовый зал, главный учебный корпус, Жандосова 55. Подать заявку: https://nfactorialschool.typeform.com/to/syWrSaRy 22-недельный буткамп по аналитике данных, 44 урока. 6 модулей: Google Sheets, Power BI, SQL, Python, Product Analytics, AI для Аналитика Данных - https://courses.nfactorial.school/da

An airhacks.fm conversation with Stanislav Bashkyrtsev about: discussion about testing terminology and the difference between unit tests, component tests, System Tests, and integration tests, defining component tests as in-process invocations without HTTP, using RestAssured with MockMvc-style direct endpoint calls, avoiding mocks in favor of real system tests, why code coverage is a misused management metric, the anti-pattern of using reflection to inflate coverage, distinguishing line and branch coverage from actual verification, using coverage from system tests to detect dead code for pruning, mutation testing with PIT to measure assertion quality, testing Quarkus applications, the default Guice and Guava dependencies in Quarkus RESTEasy, starting a new microservice with a separate system-test module, calling endpoints over HTTP with the MicroProfile REST Client or the Java HTTP client, deploying Quarkus on AWS Lambda as a production-like environment, backward compatibility testing with multiple production versions, turning system tests into stress and load tests, testing connection pools and metrics under load, introducing a test-only private API to verify state changes in serverless systems, contract-driven work in large consulting projects, generating JSON and JSONB directly in PostgreSQL and returning it over JDBC, mapping database rows to Java records instead of DTOs, running GraalVM inside the Oracle Database for stored procedures and table triggers, the pendulum between database-centric and application-centric logic, the convergence of SQL and NoSQL databases, CI/CD pipelines with Jenkins and manual production deployment steps, avoiding Jenkins access to production via CGI shell scripts behind nginx, AWS CodePipeline and CodeBuild with CDK-defined infrastructure, event-driven pipelines triggered by S3 put-object events, multi-account roles with short-lived STS credentials, the size of the AWS SDK and reducing it by excluding unused HTTP clients, health checks and Kubernetes liveness and readiness probes, why health checks make little sense for short-lived Lambdas, a version endpoint for deployment smoke tests Stanislav Bashkyrtsev on twitter: @sbashkirtsev

A short rant based on my new article this week, "The Database Is Not the Data Model""In discussions with data practitioners, I keep seeing the same confusion. Someone pulls up a DDL file, a folder of dbt or SQL, or an ERD reverse-engineered from a Postgres instance and says: “Here's our data model.”Not to be pedantic, but that's a schema. Schemas are great. But data modeling is more than just schema design."Let's dive into the difference in this podcast and the article.Article: https://practicaldatamodeling.substack.com/p/the-database-is-not-the-data-model

Build a fully working model-driven app from your existing Dataverse, SharePoint, or SQL data in under a minute — screens, navigation, and forms included. Generate new pages from a natural language prompt with Generative Pages, auto-populate records from any document in seconds with Automatic Form Fill, and embed Copilot to query your app data directly. Layer in an Agent Feed to proactively surface decisions, missing data, and action items, then connect to Outlook and Microsoft 365 through Work IQ to act on your app data without leaving your inbox. Jed Brown, Power Platform Group Product Manager, shares how to turn existing business data into a modern, AI-powered app.  ► QUICK LINKS:  00:00 - Create apps using Power Apps 01:07 - Create an app from existing data 02:26 - Copilot + Form Fill Assist 03:46 - AI-generated pages from a prompt 04:53 - Agent feed for proactive intelligence 06:16 - M365 integration via Work IQ 06:46 - Wrap up ► Link References Build your first Power App today at https://make.powerapps.com ► Unfamiliar with Microsoft Mechanics? Microsoft's Official Video Series for IT - Subscribe https://www.youtube.com/c/MicrosoftMechanicsSeries - Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog - Podcast: https://microsoftmechanics.libsyn.com/podcast ► Join us on social: - https://twitter.com/MSFTMechanics - https://www.linkedin.com/company/microsoft-mechanics/ - https://www.instagram.com/msftmechanics/ - https://www.tiktok.com/@msftmechanics    

Topics covered in this episode: The trusted-publishing debate: how to do it right vs. why you shouldn't trust it JupyterLab 4.6 and Notebook 7.6 are out! Tau – new small, readable terminal coding agent Django Tasks and Django 6.1 Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Consulting from Six Feet Up Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedIn Calvin: Mastodon / BlueSky / X / LinkedIn Show: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Calvin #1: The trusted-publishing debate: how to do it right vs. why you shouldn't trust it https://snarky.ca/how-to-publish-to-pypi-using-github-actions-securely/ (Brett Cannon) and https://blog.yossarian.net/2026/07/07/You-shouldnt-trust-trusted-publishing (William Woodruff) Trusted Publishing (PyPI's OIDC-based auth scheme, also now used by npm, RubyGems, crates.io, NuGet) replaces long-lived API tokens with short-lived, auto-scoped credentials tied to CI/CD machine identity. Yossarian's post: it's purely an authentication mechanism between a machine identity and a package — it says nothing about package safety or quality. PyPI deliberately avoids any "verified/trusted" badge for it, unlike its verified-URL checkmarks. Same logic applies to PyPI attestations: anyone can sign with any machine identity they control, so an attestation's presence isn't itself a trust signal. Bottom line from that post: don't confuse "trusted" (machine-to-machine) with "trustworthy" (human judgment about the package). Snarky.ca's companion piece is more practical: given GitHub Actions compromises in the news, the real fix is 3 concrete steps — run zizmor to lock down workflow permissions/checkout credentials and pin actions to commit hashes, adopt Trusted Publishing to eliminate stored PyPI tokens, and require manual approval via a GitHub environment before any publish job runs. Takeaway for listeners: Trusted Publishing is good hygiene for how you authenticate to PyPI, but it's not a substitute for securing your CI pipeline itself — or for actually vetting the packages you install. Michael #2: JupyterLab 4.6 and Notebook 7.6 are out! Michał Krassowski's rundown - a chunky minor release: 68 features, 97 bug fixes, 95 contributors, one of the biggest ever. Scratchpad console (Notebook 7.6 headliner) - a console next to your notebook sharing its kernel, for throwaway experiments. Ctrl+B. Jump to last-edited cell - new commands hop through recently edited cells. File browser glow-up - Date Created column, editable breadcrumbs with Tab-completion, and Open in Terminal. Debugger - sources open in the main area, floating step/continue overlay, live kernel-sources filter. Custom layouts (Lab) - activity bar top/bottom, draggable panels, four-way tab splits, per-panel Ctrl+scroll zoom. ~5x faster extension builds - webpack → Rspack, and jupyter-builder means no full Lab install needed to build extensions. Keyboard/a11y - add shortcuts from the UI (no JSON), Find & Replace in Edit menu (Ctrl+H). Calvin #3: Tau – new small, readable terminal coding agent Tau – new small, readable terminal coding agent (Python 3.12+), built as both a working tool and a teaching project for how coding agents work under the hood Install via uv tool install tau-ai, pipx, or pip; ships a tau CLI Three-layer architecture: tau_ai (provider-neutral model layer) → tau_agent (reusable "brain": messages, tools, events, loop) → tau_coding (CLI/TUI, file & shell tools, sessions) Supports OpenAI, Anthropic, OpenAI Codex, OpenRouter, Hugging Face, and custom/local OpenAI-compatible endpoints Built-in tools (read/write/edit/bash), durable JSONL sessions with resume/branching, project instructions via AGENTS.md, and context compaction Core harness is UI-agnostic — same brain can power the TUI, print mode, or a custom frontend — usable as a standalone library too Michael #4: Django Tasks and Django 6.1 Django 6.0 finally ships first-party background tasks (django.tasks) - out of Jake Howard's DEP 14, accepted May 2024, after two decades of everyone bolting on Celery/RQ/Huey. It's an API, not a worker. Django handles task definition, validation, queuing, and result storage - it does not execute them. You bring the backend. The default backend traps people. ImmediateBackend runs tasks inline on the request thread and blocks until done - so out of the box .enqueue() backgrounds nothing (a 5-second task means a 5-second response). The other built-in, DummyBackend, runs nothing at all. Both are dev/test only. Nice API otherwise: slap @task on a function, call .enqueue(), get back a TaskResult you look up later by id - with async twins like aenqueue(). Gotcha: args and return values must survive a JSON round-trip, so a tuple sneakily comes back as a list. The community local backend to know: django-tasks-local by Chris Beaven (SmileyChris). A ThreadPoolExecutor backend that gives real background threads with zero infrastructure - no Redis, no Celery, no database - plus a ProcessPoolBackend for CPU-bound work → github.com/lincolnloop/django-tasks-local Its catch: results live in memory, so pending tasks vanish on restart or deploy. Great for dev and low-traffic production; for persistence, drop to Jake Howard's django-tasks (DatabaseBackend + worker command). Extras Calvin: Fixing the dictionary with Python 3.14 — Hugo van Kemenade stumbled on - and got fixed - a markup bug in the OED's own citation of a 1706 use of the pi symbol. Michael: Bunny DNS is now free Jokes: What's the object-oriented way to become wealthy? Inheritance To understand what recursion is... You must first understand what recursion is 3 SQL statements walk into a NoSQL bar. Soon, they walk out They couldn't find a table.

Curious how AI can query your enterprise data without moving it or making things up? AWS and Teradata break down a trustworthy analyst agent built for real production use.Topics Include:Neha Wadhera (AWS) introduces Trinath Yarlagadda and the Teradata Analyst AgentEnterprise AI data prep is costly, stalling most orgs at experimentationAgent answers plain-English questions via traceable SQL, zero data movementBarrier removal drives 3.7x ROI and 40% productivity gainsHealthcare demo setup: hospital COPD readmissions, ~$10K cost per incidentFour design principles: traceability, no data movement, deterministic-first, governance as codeMain orchestrator agent plans, writes SQL, calls Teradata MCP serverComplex questions escalate to a context-isolated data scientist agentBuilt on Claude Agent SDK, running Bedrock Claude Sonnet/Haiku/OpusLive demo: COPD readmission rates explored through iterative agent reasoningDelegation demo: data scientist agent runs in-database analysis, surfaces factorsPre/post tool hooks log every step and cost to CloudWatchAgent hosted on Amazon Bedrock AgentCore, fully serverless and scalableAgentCore delivers runtime, memory, identity, and observability out of the boxLessons learned: guardrails first, deterministic ops, multi-agent registry, ongoing evaluationParticipants:Trinath Yarlagadda – Principal Solution Architect – Agentic AI, TeradataNeha Wadhera – Sr Solutions Architect, Amazon Web Services See how Amazon Web Services gives you the freedom to migrate, innovate, and scale your software company at https://aws.amazon.com/isv/

If you've ever wished you could flip a switch and instantly generate more leads, this episode is for you. Guy Bauer explains why "getting leads" is the wrong goal, and why leads are actually the byproduct of a disciplined, long-term marketing system. Using Umault's own experience, he shares why it took more than a year to generate the agency's first inbound lead, introduces David C. Baker's water pump analogy for building marketing momentum, and explains why consistency beats quick fixes every time. Then, Guy delivers on the promise with two practical ways to generate leads faster: targeting the 5% of buyers who are already in-market through bottom-of-funnel marketing, and creating one bold, opinionated video that earns attention and fills your pipeline. If you're tired of "get leads fast" marketing promises and want a more realistic framework for building demand, this episode is for you.

Lords: Chall RT-55J https://samarantes.neocities.org/ https://metroidconstruction.com/hack.php?id=878 Topics: Remembering the Dynowarz Instagram private server, and social media thoughts every Mastodon user had already Why don't CPUs do analog arithmetic? Leaves, by Ursula LeGuin https://www.poetryfoundation.org/poems/148293/leaves-5bd9e153d78b2 Microtopics: DogTroid, the first Metroid ROM hack to star a dog. Self-finishing games. Sparkling water: it's like water but a lot more interesting. Caffeine Free Diet Pepsi. What sodas foam the most in response to a mento. Foam persistence. Foaminess reactions of a mento on various vintagesn of Diet Coke. Jolt Cola: all the sugar, twice the caffeine, three times the foam. A can of soda that's safe to open in a bathroom stall. Artisanal Coca Cola cans on Etsy that finally allow you to open a can of soda in a bathroom stall without anyone realizing you're drinking a Coke on the toilet. Flushable soda cans: as flushable as a flushable wipe. Why do toilets have pee traps when the pee deserves to be free? The second worst game in your NES collection. Desert Chrome title screens. Playing as a little spaceman until you enter the dinosaur mech. Shooting some alien brain or maybe a heart. 8bitnintendo.science How to pick what video games to buy in the late 1980s. How Metroid improved on the maze-with-keys genre. Nanosaur. A velociraptor with a techno-backpack. A game that is exhilarating and scary and endless when you're a child turning out to be a twenty minute trifle when you're an adult. Trespasser (1998) Simulation dinosaur emotions but you can't find a good balance so you just permanently lock them all to angry. Installing a violent action game about dinosaurs in the elementary school computer lab because dinosaurs are technically educational. Revisiting games that perplexed you as a child. Playing bad video games because no matter how bad they are they're still better than going outside and talking to people. The one where Kirby eats a car. The Roblox-like games you can find by logging into third party Minecraft servers. Starting your own Pixelfed server. Following the only person you know on Mastodon. Bluesky's recommendation algorithms recommendeding you nothing but bots. Inventing Internet forums from first principles. When your brain makes up garbage and you need a void to shove it into. Doing your part to make AI worse. CSS Crimes. How to find people to follow on Cohost. Signing up for a social media site and looking around and realizing you doing know anyone here. Mining and reposting. The ongoing maintenance requirements of running a Mastodon server. Ways you can interact with your family that only work if you have an iOS developer in the family. Off-box SQL database backup. Hypothetical IRC servers that support chat logs. Hardware random number generation. The pot of boiling water every Intel CPU draws thermal noise from for random number generation. The most commonly used analog computers in 2026. The market forces that led to semi-modular synthesizers being available for $300. Using your analog CPU to run a million instances of Lunar Lander at once. A rustic summer retreat ranch in the hills of Napa Valley, California. What makes us perceive the gradient of identities over the course of someone's life as a single identity. The most ephemeral thing possible. Musing for a few sentences and then thinking "hmm, I could put some line breaks in here and then publish it." Musing about the nature of identity, with line breaks. Topic Slingers. Topics: throw them around a lil bit. They love it. A lot of people don't know that.

In this Azure Friday episode, Scott Hanselman and Sajee demonstrate the Azure Cosmos DB Agent Kit — a skill you install with one command that gives your coding agent 100+ Cosmos DB best-practice rules across data modeling, partitioning, query optimization, and SDK usage and much more. Using a multi-agent fitness coaching app as an example, they show how the kit caught a missing partition key filter that was leaking member data across tenants, recommended hierarchical partitioning for multi-tenant scale, and fixed a fan-out query—all before the code shipped to production. Chapters 00:00 - Introduction 00:33 - Meet Sajee & overview of the Cosmos DB Agent Kit 00:50 - The problem: partition key & query mistakes that cost money in production 02:32 - How the Agent Kit works: one install, 100+ rules across 12 categories 04:52 - Demo setup: fitness coaching multi-agent app with Cosmos DB 06:26 - Showing the data: missing partition key filter exposes other members' data 08:23 - Agent Kit findings: SQL injection, singleton pattern, fan-out queries 10:46 - Indexing best practices & query optimization recommendations 12:34 - Applying the fix: correct results and single-partition RU cost 13:13 - Wrap up & how to get started Recommended resources Azure Cosmos DB Agent Kit Agent Kit Repository Connect Scott Hanselman | Twitter/X: @SHanselman Sajeetharan | Twitter/X: @sajeetharan Azure Friday | Twitter/X: @AzureFriday Azure | Twitter/X: @Azure

In this Azure Friday episode, Scott Hanselman and Sajee demonstrate the Azure Cosmos DB Agent Kit — a skill you install with one command that gives your coding agent 100+ Cosmos DB best-practice rules across data modeling, partitioning, query optimization, and SDK usage and much more. Using a multi-agent fitness coaching app as an example, they show how the kit caught a missing partition key filter that was leaking member data across tenants, recommended hierarchical partitioning for multi-tenant scale, and fixed a fan-out query—all before the code shipped to production. Chapters 00:00 - Introduction 00:33 - Meet Sajee & overview of the Cosmos DB Agent Kit 00:50 - The problem: partition key & query mistakes that cost money in production 02:32 - How the Agent Kit works: one install, 100+ rules across 12 categories 04:52 - Demo setup: fitness coaching multi-agent app with Cosmos DB 06:26 - Showing the data: missing partition key filter exposes other members' data 08:23 - Agent Kit findings: SQL injection, singleton pattern, fan-out queries 10:46 - Indexing best practices & query optimization recommendations 12:34 - Applying the fix: correct results and single-partition RU cost 13:13 - Wrap up & how to get started Recommended resources Azure Cosmos DB Agent Kit Agent Kit Repository Connect Scott Hanselman | Twitter/X: @SHanselman Sajeetharan | Twitter/X: @sajeetharan Azure Friday | Twitter/X: @AzureFriday Azure | Twitter/X: @Azure

There's a problem that's bugged the database industry since the 1980s: you run an expensive query over millions of rows, cache the result, and then a single new row arrives. Logically that's one small update, but most engines throw the cached answer away and recompute everything from scratch. Some will handle changes incrementally, but only for "simple" queries - and the rules for what counts as simple are arbitrary and brittle. So can you incrementally maintain *any* SQL query, no matter how complex? For decades the answer was no. Then an award-winning paper called DBSP proved that the answer is yes - all queries are simple enough.Joining me to explain how that works is Lalith Suresh, CEO of Feldera, the company built on top of DBSP. We start with the problem itself, then trace how a group of VMware researchers arrived at it from the unlikely direction of Kubernetes and network control planes. Lalith walks through Z-sets, the weighted data structure that turns database changes into something you can add and subtract, and the four DBSP operators - including one borrowed straight from digital signal processing - that let you compile any SQL program into an incremental version deterministically. Along the way we get into which operations need state and which don't, how the delta join falls out for free, building a standalone query engine with its own storage layer and Calcite front-end, backfills as the real Achilles heel, and how this all differs from stream processors like Kafka Streams and Flink.If you've ever fought with materialized views that won't refresh, watched a nightly batch job recompute three years of data to capture last night's changes, or you're just curious how one elegant bit of maths unifies batch and stream processing, Lalith has some genuinely satisfying answers. There's an MIT-licensed open source edition and a sandbox at try.feldera.com if you want to play along.---Support Developer Voices on Patreon: https://patreon.com/DeveloperVoicesSupport Developer Voices on YouTube: https://www.youtube.com/@DeveloperVoices/joinFeldera: https://www.feldera.com/Feldera Sandbox (try it online): https://try.feldera.com/Feldera on GitHub (open source): https://github.com/feldera/felderaDBSP Rust crate: https://crates.io/crates/dbspDBSP Paper - "Automatic Incremental View Maintenance for Rich Query Languages" (VLDB 2023 Best Paper): https://arxiv.org/abs/2203.16684Mihai Budiu - "Streaming Queries Without Compromise" (Current 2024): https://www.youtube.com/watch?v=cn1Yaxwl6x8Mihai Budiu - DBSP talk at CMU Database Group: https://db.cs.cmu.edu/events/dbsp-incremental-computation-on-streams-and-its-applications-to-databases/Differential Dataflow: https://github.com/TimelyDataflow/differential-dataflowApache Calcite (Feldera's SQL front-end): https://calcite.apache.org/Kafka Streams: https://kafka.apache.org/documentation/streams/Apache Flink: https://flink.apache.org/ksqlDB: https://ksqldb.io/Apache Spark: https://spark.apache.org/Snowflake: https://www.snowflake.com/Databricks: https://www.databricks.com/Kris on Bluesky: https://bsky.app/profile/krisajenkins.bsky.socialKris on Mastodon: http://mastodon.social/@krisajenkinsKris on LinkedIn: https://www.linkedin.com/in/krisjenkins/

Unlocking billions in cloud marketplace revenue. Subscribe to our Newsletter: https://theultimatepartner.com/ebook-subscribe/ Check Out UPX: https://theultimatepartner.com/experience/ This powerful panel discussion featuring leaders from Google, Tackle, and dbt Labs dives deep into the explosive growth of cloud marketplaces and the radical shift toward AI-driven go-to-market strategies. With hyperscaler backlogs nearing half a trillion dollars, the conversation unpacks how top-tier organizations are transforming their compensation models, aligning executive buy-in, and navigating the complexities of co-selling to capture committed customer budgets. From the rise of AI agents acting as metered SaaS to the essential operational investments required to scale marketplace revenue from 10% to over 50%, this session provides an actionable roadmap for software companies ready to dominate the 2026 partner ecosystem. https://youtu.be/LSj49f5FEII Key Takeaways Hyperscaler backlog commitments represent a massive, nearly half-trillion-dollar addressable market that completely changes the budgeting conversation. Successful marketplace selling requires complete executive alignment, right down to the CFO, and strategic adjustments like spiffing sales teams for marketplace transactions. The AI category is experiencing staggering 18x year-over-year growth, forcing companies to pivot toward an “agent-first” go-to-market model. Shifting from traditional channels to cloud go-to-market demands a multi-year, intentional investment in operations, people, and technology. System integrators are evolving into software companies as they build orchestration agents to manage fragmented, end-to-end workflows. Leveraging cloud commitments bypasses standard 12-15 month budget cycles, allowing for significantly faster deal closures and larger initial lands. If you're ready to lead through change, elevate your business, and achieve extraordinary outcomes through the power of partnership—this is your community. At Ultimate Partner® we want leaders like you to join us in the Ultimate Partner Experience – where transformation begins. Key Tags: Google Cloud Marketplace, hyperscaler backlog, cloud commitments, co-selling strategies, AI agents, metered SaaS, product-led growth, rev ops, B2B sales transformation, ecosystem shift, channel strategy, system integrators, Deal registration, private offer APIs, digital transformation, software procurement. Transcript: Insight to Revenue- The State of Cloud GTM [00:00:00] Dai Vu: These are all things everyone has to do to get to that first five to 10 deals, and then 10, 20, 30% of your business through Marketplace. [00:00:09] Vince Menzione: You can feel it happening. The ecosystem is shifting beneath us, the way Hyperscalers are partnering, how AI is remaking the channel and what it means to win in 2026. [00:00:21] Vince Menzione: Welcome to the Ultimate Partner Podcast. I’m Vince Menzi, own your host, and each week I sit down with leaders at the intersection of technology. Partnerships and outcomes. The voices shaping how ecosystems actually work. We talk about what’s real, what’s changing, and what it takes to lead in this era where the partner channel isn’t just part of the strategy. [00:00:43] Vince Menzione: It is the strategy because being in the room changes [00:00:46] John Janke: everything. Let’s start. [00:00:52] Vince Menzione: And we have an incredible session. The way that we wanted today to, to, to start the day up was like, let’s talk about what’s happening right now and let’s get three leaders in this space to come up and talk about the world and how it’s a rapidly evolving. So I want to invite to the stage dvu from Google is a great friend of Ultimate Partner. [00:01:14] Vince Menzione: Are you guys ready? Are you guys micd up already? Okay, good. Good. John Yanke, the CEO and Founder of Tackle, and Sean Todo, who is an incredible leader with DBT, but also an old friend of mine. We worked together on Microsoft Days. Good to see you gentlemen. Thanks Sean. Great to have you with us. [00:01:37] John Janke: They stuck me on the side ’cause they said I’d block the screen if I sat in the middle. [00:01:41] Shawn Toldo: You still block it a little bit. [00:01:42] John Janke: And that picture’s from like 1985. I, I, we do have to get that. I had way darker hair. It was, uh, 10 year, 10 years at a startup. Makes you turn white. [00:01:52] Shawn Toldo: Mine’s the exact same right now. So it’s all good. [00:01:55] Shawn Toldo: Mine’s AI generated. Yeah. [00:01:57] Vince Menzione: Well, you know, guys, I just took it all off at that point, you know, it’s like good. Yeah, but you lose enough of it. You pull it out over the years. Yeah. So, uh, some really exciting times. Uh, you, we gotta spend some time at you at our breakfast. That’s right. A couple weeks ago. [00:02:13] Dai Vu: A lot of folks here, too. [00:02:14] Vince Menzione: A lot of folks that are here were at that breakfast, and I thought we’d spend a few moments with you talking about all the exciting things that have been happening at, at Google. I mean the, yeah, the businesses just to, first of all, the numbers were house. Outstanding. Congratulations. [00:02:28] Dai Vu: That’s right. [00:02:28] Vince Menzione: Yep. [00:02:28] Vince Menzione: Really, some really great numbers. Commitments are off the charts. [00:02:32] Dai Vu: Yes. [00:02:32] Vince Menzione: Crazy off the charts. [00:02:33] Dai Vu: Yes. [00:02:34] Vince Menzione: Yes. Uh, and then there’s a lot happening in this little world called ai, which makes a ton of sense. Yep. I was critical about Google in the beginning because you had all the assets, but Microsoft leaned in first. [00:02:45] Vince Menzione: Uh, but now it’s like things have evolved, uh, quite a bit since those first days. Absolutely. In, in November of 2022. So, uh, take us through a little bit. Let’s, let’s go through [00:02:56] Dai Vu: it. Yeah. I could talk for quite a bit of time because obviously we came out next, yeah. At the end of April, and then we had our earnings announced, but shortly thereafter. [00:03:03] Dai Vu: But, but real quick on next, uh, for folks who attended, uh, you know, the way they framed, uh, the discussion was they showed this AI integrated stack, and that’s how they frame the keynote because we position ourselves as being the only vendor that provides this. Fully integrated stack from custom silicon all the way to the apps and agents. [00:03:23] Dai Vu: And a lot of the announcements were, were focused in those areas. Um, uh, I won’t go through the, the long list, but I think the big ones coming out of next were, uh, certainly the eighth generation TPU we announced, so we actually split this into two specialized chips for training and inference. Uh, so that’s, uh, that was a big piece. [00:03:41] Dai Vu: Uh, but the big one that we announced was this, uh, Gemini Enterprise. Uh, agent platform. So think of it as the comprehensive platform for companies to basically build scale, govern and optimize their agents. And of course, once they have that, they can bring that into, uh, what we call a Gen Gemini enterprise app, which is really the front door for AI for. [00:04:03] Dai Vu: All customers and all employees to manage a mix of agents, um, as part of their daily workflow. And, uh, and a big part of it is, you know, certainly they’ll have some custom agents, but we think a lot of the agents will come from the ecosystem. And obviously there was a big announcement around what we’re doing there. [00:04:21] Dai Vu: Um, and in fact, one of the things that’s interesting is this shows the evolution of, of marketplace in our, in our partnership, which is we’ve taken a lot of the marketplace experience. And brought it into Gemini exp uh, Gemini Enterprise app, right? So search, discovery, uh, the ability to invoke agents, uh, in context. [00:04:39] Dai Vu: I think that’s gonna be very powerful as we think about the evolution, uh, of, of go to market. And then the last thing maybe I’ll highlight is this, um, is. 750 million, uh, investment fund that we’re gonna drive with the broad partnership. So this cuts across all partner types, global system integrators, uh, uh, you know, AI, pure plays, uh, ISVs, uh, the big management consultants as well, uh, because we recognize that partners are gonna be critical to drive business transformation with our end customers. [00:05:08] Dai Vu: So we’re investing around things like. Technical enablement, access to our product teams, access to our FDE for deployment engineers, and then a lot of incentives to drive usage and deployment. So, um, so a lot of, a lot of activity and obviously the ecosystem’s gonna be very critical for us to drive that impact’s. [00:05:25] Dai Vu: Fine. And the last thing, I know we’ve going on and on fine, but the last thing I’ll just mention is just on the earnings announcement, uh, Vince touched on the backlog, so people have been tracking Yeah. Two quarters ago. We were 155 billion on the backlog, and then a quarter later we were 240 billion. And then in the last quarter, just recently, 462 billion. [00:05:46] Dai Vu: So obviously that’s a, a massive signal of customer intent, but more importantly, it’s a, it’s, it’s a addressable market for this ecosystem to go after as well. [00:05:54] Vince Menzione: Yeah. Almost a half a trillion dollars. Yes. In commitment. So a lot, a lot of reason why we should be on the marketplace. [00:06:01] Dai Vu: Absolutely. Absolutely. [00:06:02] Vince Menzione: Um, each of these gentlemen have some things to talk about as well, about their companies and the exciting things that have been happening. [00:06:08] Vince Menzione: I’m gonna start, John, I’m gonna start with you because Tackle has, has transformed quite a bit since the last time you were on stage with us. I thought maybe introduce the company. Take us through the transformation and then we’re gonna do the same thing with Sean with his organization. [00:06:21] John Janke: Yeah. Thanks. Uh, thanks Vince. [00:06:23] John Janke: Great to see everybody. Uh, John Yanke, GM of Tackle at App Direct. So the big news there is Tackle was acquired in Q4 by a company called App Direct, and I think the why behind this app, direct Powers, marketplaces, they run 400 marketplaces around the world for telcos, for ISVs, for system integrators, channel partners. [00:06:42] John Janke: And we were talk like, when you build a marketplace and diagnose this, stocking the shelves is actually really hard. Uh, and we were talking to them about how could we connect the dots between the hyperscaler marketplaces, the iscs we support, and these additional routes to market. Uh, and that became more strategic and we ended up joining forces in December. [00:07:00] John Janke: And since then, the other part that’s really hard when you build a marketplace is how do you generate demand? Uh, so four weeks ago we acquired a company called Partner Stack. And Partner Stack does affiliate content. They have an affiliate content platform that allows you to connect with 150,000 content providers to be able to start to tell your story to drive leads to. [00:07:23] John Janke: Marketplace. So we think there is a tremendous opportunity to continue. We’re in the earliest days. I think the, you know, Jay, I was with Jay at Channel Partners a few weeks ago and he is like, we under called it, he didn’t say this on stage yesterday, but he is like, uh, the 82% growth. He’s like, we totally under called it. [00:07:40] John Janke: Uh, and I think just listening to dies commit level increase mm-hmm. Reinforces the fact that we’ve under called it. But I also think we’re at this tipping point in the market where all of the new capabilities coming out, we have to all rethink our better together stories. So I think the challenge to all partner leaders, it’s like, how do we. [00:07:58] John Janke: Figure that out. So it’s, it’s a, it’s a fun time. As we transform the way we worked. We wrote the first helping people kind of list, launch and sell through the marketplaces. And now to be able to take that to the next level to hopefully unlock the next a hundred billion of marketplace throughput. [00:08:13] Vince Menzione: And are we at a hundred billion? [00:08:15] Vince Menzione: ’cause that was the number, right? [00:08:16] John Janke: I mean that’s, that’s, that’s the number that’s talked about. I mean, we’re seeing the data signals we see, I mean, we will process 20 billion plus this year. Uh, and that number’s growing faster than Jay’s stated number. So I think we’re excited to see where this year lands. [00:08:30] Vince Menzione: We’ve come a long way from three years ago and we all got on stage and talked about marketplaces together. Right. It’s been, it’s been amazing. And then Sean, let’s talk about DBT. You’ve had some excitement. I know some things maybe we can’t even talk about yet on stage. [00:08:43] Shawn Toldo: Uh, yeah, go ahead. [00:08:44] Vince Menzione: No, I was saying I, I could, I’ll pre-announce things, but No, I’m just, uh, tell, tell us about DBT for those who don’t know in the room, sure. [00:08:49] Vince Menzione: Mean Yeah, that might help. [00:08:51] Shawn Toldo: So, uh, Sean Todo, I lead the partner business at DBT. I’ve been here about 18 months. Um, DBT really started as an open source tool. That help data engineers be successful in SQL transformation with cloud data warehouses? Right. And so back even to the Redshift days now into what I would call more the BigQuery, snowflake, Databricks fabric led days, um, DBT is the tool of choice amongst the data engineering community in terms of how they wanna drive SQL transformation. [00:09:21] Shawn Toldo: And so more recently, we kind of jumped into this kind of paid world. Which is why we needed to bring in additional experience leadership around go to market product, sales, et cetera. And so when I walked in the door, one of the things I noticed really quickly was we were running on AWS, which was great. [00:09:40] Shawn Toldo: We were doing some AWS marketplace stuff. We were running on Azure in Europe only. And one of my first strategies was we have to be everywhere, right customer. We have to meet customers where they are. And so we, uh, made some major investments to be on Google Cloud platform to then be able to really take advantage of marketplace, to then really be able to take advantage of the co-sell opportunities that exist in the field from a day, day-to-day AI perspective with Google. [00:10:07] Shawn Toldo: And it has been a hell of a ride. We launched on, uh, Google Marketplace in July of last year. We went to Google next and we were Google Partner of the Year. Wow. For data and analytics in a very rapid way. We’re now in three, uh, data centers around the, the world. So we’re here in the us, we’re in Frankfurt, we’re in uh, uh, UK as well. [00:10:30] Shawn Toldo: And so it’s been a pleasure to work with D and the broader team. Because the enablement we’ve had and the support we’ve had from that group has really helped our growth be up and to the right. The data point I would give is that when I walked in the door, we were 10% of our business from an A RR perspective was transacting through marketplace. [00:10:48] Shawn Toldo: Last quarter we cracked 40%. Whoa. We will be at north of 50, uh, next quarter. [00:10:53] Dai Vu: Wow. [00:10:54] Shawn Toldo: The other piece that Vince was talking about is we’re getting ready to merge with a company called Five Tran. And so there will be a new company name at some point down the road. Uh, pay attention on June 1st for a public announcement around that merger. [00:11:06] Shawn Toldo: Uh, but we’re really looking forward to what we’re gonna be able to do with folks like DI and the Google team as well as others in the ecosystem. Um, ’cause I think in this data world that we’ve played for so long. This trusted foundational element of data and what it’s gonna mean to context in the AI world. [00:11:23] Shawn Toldo: We’re in a very interesting place to really continue our growth rate at a high level. [00:11:28] John Janke: Yeah, that maybe just a comment something there. Start there. I think we, we used to hear people say we wanted to be strategic with cloud, go to market and get to say 10 or 20% of revenue. I think this like 40, 50%. Yeah. Th that’s where people are setting the bar these days. [00:11:43] John Janke: Yeah. So the numbers are getting really crazy. Yeah. Uh, and people are showing up and being like, I have to go big. Mm-hmm. So a huge change over the last few years. [00:11:52] Vince Menzione: Yep. What’s the experience you’re seeing as well? I mean, it, it was a huge amount of buzz at next. [00:11:57] Dai Vu: Yeah. I mean, so interestingly, um, you know, typically when, when people get started on the, on the marketplace in Cosal journey, I always try to caution them and say, this is, uh, this is like a multi-year. [00:12:07] Dai Vu: Yeah. Uh, process. You have to be very intentional. You have to invest. It’s not gonna be a thing where you just list and, and, and, and, and, and sort of this channel opens up. So in some ways, Sean is describing an acceleration that is not common, right? Uh, so they’ve done, we’ve done some amazing things together and we hope to keep that acceleration going. [00:12:22] Vince Menzione: What does that require, by the way? Is it engineering resource? I mean, there’s, I talk about executive commitment and maniacal focus. Yeah. But it’s all those things, right? [00:12:29] Shawn Toldo: Well, all of it. But we went to a QBR in Austin, and I put up a slide and I said, we have to do this. And everybody in our ETE agreed. So when you have a chief financial officer that’s bought into the partner business. [00:12:43] Shawn Toldo: Yeah. And I guess qualifying coming into this role at this company, I qualified the C-level staff. Uh, like are they really serious about partner or not? And it’s one of the reasons I took the role. So I think executive commitment was one thing. I think the second thing is we were really well supported, um, by the Google team across the board, right? [00:13:02] Shawn Toldo: Yeah. So folks, Indy’s team that we would work with regularly on, these are the things you need to do to have an effective marketplace offering. Here’s what you need to do operationally with folks like John and team and others that are in the market, right? That helped us a ton to be able to scale. And then the other thing that we did is we changed comp. [00:13:20] Shawn Toldo: So from our VP of sales levels down, we have a 5% kicker for everything that goes through marketplace. [00:13:26] Vince Menzione: Hear [00:13:26] Shawn Toldo: that everyone. So as soon as we incented the sales team, I love that, right? We, we created the foundation on the partner side, but then from top down on the sales side, they were all in. And as a result of that, the question would become, okay, which marketplace stage two sales cycle are we gonna go use? [00:13:42] Vince Menzione: Yeah. [00:13:43] Shawn Toldo: Who’s the right partner to go partner with? And then my team is reaching out to make sure that co-sell connection happens. [00:13:48] Vince Menzione: That is such a best practice, Sean, to, because there is, as a seller out in the field and we talk about, you talk to John, talks about rev ops all the time. But getting rev ops eng getting the field engaged in the right way. [00:14:01] Vince Menzione: ’cause it feels like it’s more work for them. ’cause they have to think, they have to have more conversations with their customer about their cloud commitments and things like that. Mm-hmm. And then getting them incentive to do the right things. The right behavior. [00:14:12] John Janke: Yeah. It’s a strategy process. People, technology problem. [00:14:17] John Janke: Yeah. It’s not just some flip API automation, go list something if you don’t like that top down view. I think the other thing. Like there’s a, there’s a theme in startups where VCs fund second time founders. I think Sean and team have done this before and they took a lot of learnings over the years and reapplied them, which I think helps them go faster. [00:14:36] John Janke: It’s like that second time. Yeah. Second time cloud go to market Founder theme. [00:14:41] Vince Menzione: Yeah. Yeah. Um, so we could talk about the platform and all the changes there on the. The, the commitments and everything. Mm-hmm. Uh, what separates ISPs generating real incremental revenue on your, in your marketplace? What, what do you see? [00:14:58] Dai Vu: Yeah, so I mean, I, I think there are a couple things. Number one is, uh, the, the foundation has to be, uh, this better together story, uh, with Google Cloud. Um, so this idea that what, you know, what do you bring, what does the Google platform bring and how does that drive impact with customers? And I think this is the reason why Sean and DBT Labs has been very effective. [00:15:16] Dai Vu: ’cause our field recognized they, they can recognize that better together story and communicate it to their customers. So I think that’s the foundation. For everything. Right. And I think as you get started, uh, you know, we do tell partners that they probably need to lean in a little bit, uh, in terms of focus, uh, you know, pick a vertical, a customer segment, um, you know, a geography where they’re particularly strong and, you know, get that momentum going. [00:15:39] Dai Vu: And once you do that, the field knows about it and starts to pull you into deals. Um, so I think that’s the other big opportunity. And then the other thing I just mentioned. Which, uh, the panel already touched on, which is be very intentional around all the things you need to do to invest. Whether it’s like, uh, you know, the business functional alignment, uh, the policies around like, uh, pricing and, and comp, uh, making sure you have the operational capabilities. [00:16:02] Dai Vu: These are all things everyone has to do to get to that. First five to 10 deals, and then 10, 20, 30% of your business through marketplace. And not to, not to top you Sean, but our very top partners are driving 80 to 90% of their business on marketplace. And in fact, some of these partners are actually only marketplace first, uh, uh, because they started out that way. [00:16:21] Dai Vu: Obviously it’s the bigger challenge if you have an existing channel, you’re trying to shift that. But, uh, the aspiration to be more marketplace focus, uh, is up there. [00:16:28] Shawn Toldo: So I just set a new goal for the business plan for me. So that’s exciting. I love it. Looking forward to seeing you in six months on that. [00:16:35] Shawn Toldo: It’s good. [00:16:36] Vince Menzione: I love [00:16:37] Dai Vu: it. Work together on that. [00:16:38] Vince Menzione: Well, di I’m just gonna add, add this because I, I got to see operationally with some of the things you do. Mm-hmm. You, you have an overlay organization. [00:16:45] Dai Vu: Yes. Yes. [00:16:46] Vince Menzione: And so you put accelerants in place within your own organization Yeah. To drive the ISVs into the, into the lines of business. [00:16:54] Vince Menzione: Right. You have, you, you do some of that to accelerate. [00:16:57] Dai Vu: Yeah, I mean, I think, I think this is somewhat unique. I don’t, I don’t wanna speak to the other [00:17:00] Shawn Toldo: hyperscalers, [00:17:01] Dai Vu: but we do have, um, uh, you gotta know the field roles, right? [00:17:04] Shawn Toldo: Yeah. So [00:17:04] Dai Vu: obviously at Google Cloud in the regions, we have, uh, ISV sales specialists who are effectively quoted on marketplace revenue, right? [00:17:12] Dai Vu: So they’re a hundred percent focused on that. And, uh, in addition to that, uh, we also have these, uh, co-sell teams, partner teams where, you know, opportunistically if there’s an opportunity, uh, in a, in a, in a particular area. This team is responsible for connecting the regional sales leadership, uh, the regional, uh, sales teams with, with the partner on the opportunity. [00:17:32] Dai Vu: So there’s a lot of things we’re doing to sort of accelerate that. And of course, the foundation for all this is, you know, our, our, you know, registering deals. And as you definitely get started on that, it’s very important to be very mindful around when you register deals. Uh, be very clear around what the ask and the engagement is with the field reps. [00:17:51] Dai Vu: But once you have that going and get the right rhythm, it becomes sort of a natural way to sort of register all your deals and get that engagement. And then, um, and then maybe the last thing I would say is it isn’t always the sales specialists. It’s, you know, the FSR, our field sales rep as well as our customer engineers are also very motivated. [00:18:08] Dai Vu: To work, uh, with, uh, with our partners because they know that this, you know, whether it be solution completeness or it’s part of a bigger workload or helps unlock greenfield opportunity, they really are motivated to engage with the partners. [00:18:21] Vince Menzione: Nice. [00:18:22] Shawn Toldo: Yeah. I’ll just add, I’ll just add to that statement too. I think, um, it’s one thing to have a story as it relates to. [00:18:30] Shawn Toldo: Google Cloud and what you do with marketplace. It’s another thing to have a story in terms of how you impact data and analytics in our world. And there’s a set of specialist sellers inside of Google mm-hmm. That really care about us because we drive a lot faster consumption of big query. And our ability to tell that story across the world effectively has really created a pull now. [00:18:54] Shawn Toldo: And so I, I would say it’s almost, you know, back to, you know, being 12 years at Microsoft and watching kind of that. Phase and how that went. As we went to the cloud and we picked specialty areas, um, Google is doing that as well and they’re doing it extremely fast in a very, very productive way with partners. [00:19:12] Shawn Toldo: And so, you know, I’ll get comments from like Levi who runs west in north region for us, and he’s a, he was at Google next and he was like, I, I gotta, I, I just gotta go to bed. I’m tired. Like we wore him out over two days with their sales team and gave him a host of follow ups and actions related to specific sales areas as well as specific accounts. [00:19:34] Shawn Toldo: And I think that’s the other thing that, um, Google’s done a good job of, but we’ve pushed and we’ve had to work really hard to earn that seat at the table. To help make those people successful from a comp perspective inside of Google as well. [00:19:45] John Janke: Yeah, and this is a huge failure zone for partners with the clouds because they think enablement’s a one and done thing. [00:19:51] John Janke: Like I did a training for the field and I told them the better together story. That doesn’t work. Like you have to literally. Have consistency around this message every day. Oftentimes you need experts who can partner with your reps to give them the confidence. ’cause they may be able to ask the first line question, but someone asks a follow up and they fold up ’cause they know your product. [00:20:11] John Janke: That’s right. They don’s don’t understand all of the nuances of Google and the clouds and the questions that may come back. But if you do that well, it is a huge unlock. [00:20:20] Vince Menzione: Talk about the coaching you provided on the tackle side of that as well and kind of helping. Through this maturity model? [00:20:26] John Janke: Yeah. I mean we, we, over the years, I mean we started as a pure SaaS company and over the years our customers would consistently ask us for more help and we would struggle to figure out how to do that, and we had to invest in services and we actually acquired a company. [00:20:42] John Janke: Five years ago now, that was the foundation. Aaron Feiger, who’s in the room. The core consulting was the foundation of our services business. And that continues to evolve with us. And you know, we see customers at scale saying, I wanna operate my cloud, go-to market really consistently, and I want you to do all the backend operations so my teams can be outselling our products, selling the better together value with Google and others, and not have to figure out how to run the machinery. [00:21:09] John Janke: So we’ve invested a lot there. We have services around strategy, like how to help people think about their business strategy and translate it into a better together story and able to get executive buy-in. And then we have coaching, which is really a phone, a friend, because I think these things get complicated. [00:21:24] John Janke: And I had a customer who was doing the largest deal in their company history. It was the end of the quarter and it was Friday, and they’re like, this is going to be the most complex transaction we’ve ever done and we have no idea how to do it. Our team gets on the phone with them, they work through, what are you selling? [00:21:40] John Janke: How are you selling it? Is your listing set up the right way? Can we actually create all the offers? In a way you have confidence to execute. ’cause those are failure modes. You try to build a cloud, go to market business, and you mess up the largest deal in the company. On the last day of the quarter, uh, that’s something you can’t recover from. [00:21:55] John Janke: So we try to really wrap support around our customers to help them have the confidence to grow. [00:22:02] Vince Menzione: Di you’ve seen tremendous growth in marketplace. Mm-hmm. We don’t publish the numbers specifically. Yeah. We kind of try to figure it out on the back end, but [00:22:09] Dai Vu: Yep. [00:22:09] Vince Menzione: I know you’re accelerated. Your, your marketplace numbers are astounding. [00:22:13] Dai Vu: Yes. I can share some numbers, if that’s [00:22:15] Vince Menzione: okay. Please. Yeah, let’s go. [00:22:18] Dai Vu: So, um. I would say that for a few years now, we’ve been talking about growth. So we’ve been consistently, uh, you know, north of a hundred percent year over year growth. Uh, for the last few years we’ve been processing, uh, what I say, uh, billions of dollars, uh, annually and, uh, uh, millions of transactions. [00:22:36] Dai Vu: And again, that’s for a few years now. Now for 24 to 25, that full year we also doubled. Wow. Uh, which is, uh, which is amazing when you think about the scale in which we operate. But more importantly, if you look at specific category areas, right? So, you know, historically, marketplace has always cater to, uh, those solution pillars that are tied to cloud migrations, like, uh, like security and data and analytics. [00:22:59] Dai Vu: And those continue to be very strong areas for us. But the biggest growth area is, uh, is in the areas of business app. So obviously, you know, the, the ServiceNow workday, uh, Salesforce of the world, as well as the AI category. So one number that we threw out next was 18 x. Year over year growth for the AI category. [00:23:17] Dai Vu: Wow. So in one year now, a lot of it is models, right? So foundational models with our, with our ecosystem. But a lot of that is around agents. So this whole agent go to market model is gonna be, continue to grow and it’s gonna be a huge focus area for, for the coming years. [00:23:32] Vince Menzione: Fantastic. Yeah. Fantastic growth. [00:23:34] Shawn Toldo: Yeah, and, and I’ll add, Diane and I talked about this at Google next. This is a. Very complex thing for DBT, where today we sell seats. [00:23:42] Vince Menzione: Mm-hmm. Yeah. [00:23:43] Shawn Toldo: To data engineers. [00:23:44] Yeah. [00:23:44] Shawn Toldo: And now we have all these agentic things that are hitting our engine. And di and I are talking and we’re like, okay, so how does this work in an ag agentic marketplace? [00:23:54] Shawn Toldo: Yeah. Kind of a scenario. And what should we build? Where should we play it? ’cause we’re gonna spin the meter in a different way, so to speak. [00:24:01] Dai Vu: Yep. [00:24:01] Shawn Toldo: And so candidly, we got stuff to figure out related to that. Um, I think what’s been fascinating for DBT is our partner ecosystem changed overnight. So now it’s like I talked to x.ai on Monday. [00:24:15] Shawn Toldo: Mm-hmm. We got time with open AI on Thursday and we have a call with Anthropic and our, uh, CEO and co-founder and uh, chief Product Officer next week. [00:24:26] Vince Menzione: Mm. [00:24:27] Shawn Toldo: We don’t have anybody managing those partners. [00:24:29] Vince Menzione: Right. [00:24:30] Shawn Toldo: Today our focus is on managing the large, uh, hyperscalers plus Snowflake and, uh, Databricks. [00:24:36] Vince Menzione: Mm-hmm. [00:24:36] Shawn Toldo: And then the SI ecosystem and some tech partners. So we’re having to like, to your point on Agile yesterday. Yeah. Mm-hmm. Like we’re having to change our strategy, operating model and organizational model to support that. And candidly, we don’t have all the answers yet, so we have a lot of things to figure out fast, which is a little bit scary. [00:24:54] Shawn Toldo: And challenging, but it’s also a huge opportunity we have to kind of embrace and get into. Yeah. [00:24:59] Vince Menzione: And they’re figuring out as well. ’cause they’re, they’re new to partnering as well. Yeah. As organizations [00:25:03] John Janke: and these AI agents. I think to demystify for a lot of people, and what Sean said is totally right. [00:25:08] John Janke: They’re disrupting everyone’s business model. But in reality from a marketplace standpoint, they’re metered SaaS. This is a thing that’s existed for a long time. Yeah. They look like product-led growth products. There is a lot of patterns around how product-led growth products work in marketplace. Mm-hmm. [00:25:24] John Janke: But you have to bring your business strategy, your product and pricing strategy to those two categories. Metered SaaS and product-led growth. Put that all together to get cross-functional alignment. So we are seeing like. A lot of people get tripped up here and it really does go back to more of the company strategy, product strategy questions, and a lot of partner leaders are not in the room for those conversations. [00:25:48] John Janke: So I think at, at this point in time, as you see big pivots with the partners to go all in on agents, you have to go elevate. Those discussions to be like, what is our plan here? ’cause I, I mean, pricing and packaging will be the thing that trips almost everyone up. [00:26:02] Dai Vu: If I could, if I just build on what John John mentioned, um, so I do agree. [00:26:06] Dai Vu: P it looks a lot like POG, but, uh, but the difference I think is POG has. More historically been in like the data and developer space, now it’s like the general business user, right? So this idea that you want a business user to be able to search and discover, um, agents that could actually be part of their like everyday workflow is going to be very critical. [00:26:26] Dai Vu: And uh, you know, I do think that when we think about the ecosystem building agents. Uh, you know, a lot of the ISV partners aren’t necessarily gonna own end-to-end workflows, right? They’ll, they’ll have a very specific, uh, domain and scope area, but you have to enable yourself to be orchestrated and managed by, you know, orchestration agents or, or, or meta agents that are gonna span end, end workflows. [00:26:49] Dai Vu: And sometimes that includes system integrators and, and others who can stitch that, that automation. So I think, I think that’s, that’s one piece of it. But the other area that I think is gonna be different is, um. There’s going to be a lot of agents. I mean, literally you’re gonna have a very fragmented set of, uh, uh, of players, right? [00:27:07] Dai Vu: It’s not just gonna be the incumbents, it’s gonna be a lot of disruptors and, and, and, and startups. And so the, uh, for the incumbents in the room, it is a mandate that you need to, to innovate because if you do not identify and go to like an agent first, go to market model. Uh, you’re gonna be, you know, disintermediated. [00:27:25] Dai Vu: Somebody’s gonna go build an agent that’s going to leverage you as a dumb database. Um, and they’re gonna own the workflow. So you have to, you have to push the, the, the, the limits here. And I think it’s creates a big opportunity for everyone in this room. [00:27:39] John Janke: I’m going off script. I’m curious. Let’s do it. I’m curious on your take on the system integrators. [00:27:44] John Janke: ’cause I think this, this puts like they’re all, a lot of them are creating agents for people and I think that’s turning them almost more into software companies than they’ve ever been. [00:27:53] Dai Vu: They are, and I think they’re, you know, obviously they’re being, uh, impacted from like, you know, typical like, you know, SOW you know, time and materials type type business models. [00:28:02] Dai Vu: But I do think they play a big role because a lot of the system integrators are bringing, um, you know, vertical and business process expertise. And, um, like I said, I said before, a lot of the ISVs are not gonna necessarily have big enough scope in their area to own end-to-end workflows. And that’s really the promise of agents, right? [00:28:20] Dai Vu: You really need. This cognitive, you know, reasoning, planning, executing across end to end workflows. And I think, you know, the system integrators are gonna bring that capability either, either through, you know, these custom, uh, orchestration or meta agents or if they’re able to productize that and bring that to a model, they can also sort of go through the marketplace model as well. [00:28:41] Dai Vu: So who knows is how it’s gonna evolve. But you know, we’ve always been talking about. Marketplace being a broader opportunity for all partner business models. And I think that will extend to not only, uh, you know, traditional sort of, uh, sell and services partners, but also some of these system integrators as well. [00:28:58] Shawn Toldo: If I could comment on that, please. Yeah. I, I was in London two weeks ago and we did an SI partner day. Mm-hmm. We had 25 sis in a room, probably about 50 people. We had no, um, hyperscalers or cloud data warehouse providers. And when we started talking about open data infrastructure. The role that they can play. [00:29:17] Vince Menzione: Mm-hmm. [00:29:18] Shawn Toldo: Cross platform in a cost efficient manner for customers and the advisory orientation of that. They all leaned in and we, we stopped talking and they started talking. [00:29:28] Vince Menzione: Right. [00:29:28] Shawn Toldo: So they’re all facing this kind of same problem, which is actually causing a little bit of a shift, I think, in how they think about, I’m a Databricks partner. [00:29:38] Shawn Toldo: Uh, you sure you wanna do that? [00:29:39] Vince Menzione: Yeah. [00:29:40] Shawn Toldo: So this, this whole thing that’s kind of evolved in the last six to 12 months, when you kind of pick one horse to ride, I, I would tell you be cautious about what that means. You may pick a horse to lead with mm-hmm. But you’re gonna have to flank yourself a bit in terms of other providers that can help you be successful with that, that that partner you’re gonna roll with. [00:30:00] Vince Menzione: So you’re suggesting data vendor agnostic. [00:30:04] Shawn Toldo: I’m suggesting you really have to think about your strategy. Yeah. Because I think the AI, AI disruption is gonna make you think about that strategy. [00:30:13] John Janke: Yeah, I mean there’s, someone mentioned anthropics First Partner Summit. I was not there, but I’ve heard from a bunch of people were there. [00:30:20] John Janke: You know, they had a hundred partners in the room. 95 of them were system integrators. Five were technology companies, the three Clouds, Databricks and Snowflake. Like if you just think about the, the one of the major disruptors in ai, ISVs, were not in the mix. So I, I think, are they trying to disrupt all of us? [00:30:40] John Janke: Uh, do they need us? And they haven’t figured out how to work with us. I, I think. It’s, it’s, [00:30:44] Vince Menzione: and I’ve heard they only have five people in their partner organization, so I just, it’s, [00:30:49] Shawn Toldo: it’s 11 now, but it’s 11, [00:30:51] Vince Menzione: so it was five [00:30:51] Shawn Toldo: last growing fast in the, in the new company I have 50. So like, to put it in perspective, they have to make some pretty big priority. [00:30:59] John Janke: Yeah. And everyone’s been there a hot second, [00:31:00] Vince Menzione: like, right, exactly. Yeah, they, well, we will talk about the learnings we’ve had over the years, getting to where they need to get to. It’s exciting times. We got a lot to talk about here. Um, I, you know, we have about 15 minutes. I I, I want to kind of gauge, ’cause we could talk, we, we have a few things we could talk about, I could ask about, but I want to see if there’s an, like, an interest in opening up to the room for questions. [00:31:25] Vince Menzione: ’cause I feel like we’ve got a very interesting group here. [00:31:28] Shawn Toldo: You got a hand here? [00:31:29] Vince Menzione: Uh, are there hands that wanna Yeah, there’s some people that wanna ask some questions. So Yeah. We have a mic? Yeah, [00:31:37] Dai Vu: we have [00:31:37] Shawn Toldo: a mic. We, [00:31:37] Vince Menzione: we [00:31:38] Shawn Toldo: got one here. [00:31:38] Vince Menzione: We got one here. One here. Thank you. Sorry we went off script, but [00:31:44] Shawn Toldo: that’s fine. [00:31:45] Vince Menzione: It’s fine. [00:31:45] Dai Vu: Off [00:31:45] Vince Menzione: script. Better is good. [00:31:46] Shawn Toldo: I’m sure you planted the questions outta anyway. It’s okay. We [00:31:48] Vince Menzione: did, we did. [00:31:55] Audience Guest: Okay. All Eva, Sean Lightner, quick question to your, uh, increase on the marketplace, and you said you spiff the salespeople by fifth percent. 5%. Mm-hmm. So, and that obviously drives a very large adoption of, uh, marketplace transactions. How are you accounting for the margin you’re losing on, uh, you know, going through the marketplace? [00:32:14] Audience Guest: And also have you done analysis? I’m sure you have, how much is, uh, shape shifting or shifting from existing versus incremental? [00:32:22] Shawn Toldo: Yeah, it’s a great question. Um, um, lemme make three points. Number one, the backlog statement makes the margin statement not matter. So do you wanna play in that space where a customer’s already bought or not? [00:32:36] Shawn Toldo: Yeah. Or do you wanna force a budget conversation that you have to drive on your own in a direct model? That to me, I think it was 484 4 62 [00:32:43] Dai Vu: 4 6 [00:32:44] Shawn Toldo: 2. [00:32:44] Vince Menzione: That’s new Tam available to you? [00:32:46] Shawn Toldo: Yeah. That, that’s just with one. Right. And we are, we are, uh, running on four marketplaces. So that just increases our tam and makes our, our sellers lives easier. [00:32:55] Shawn Toldo: So on that piece, yes, there’s an expense, but we believe it’s right for growth. So there’s a balance there. Um, I think the, and then the second part of your question again. Sorry, [00:33:05] Vince Menzione: shapeshift. [00:33:05] Shawn Toldo: Oh, shift. We, we actually don’t think we would’ve won the business. So if I go back to our Q4 and I can probably point to three or four deals that went, um, Google Marketplace, we would not have won those deals because we couldn’t have created the budget cycle and that quarter. [00:33:23] Shawn Toldo: To make it happen. Generally a budget cycle is gonna take anywhere from 12 to 15 months. Bingo. Because of the spend that was available to us, we were able to close it in that quarter, and we had the largest Q4 in company history. [00:33:35] Vince Menzione: That is such an important point. I’m sorry. [00:33:37] Dai Vu: Okay. [00:33:38] Vince Menzione: But I, I just wanna, that is such an important point of the budget cycle. [00:33:42] Dai Vu: Yeah. [00:33:43] Vince Menzione: Being a year to a year and a half versus being able to tap into a commitment that’s already been made. Yeah, so I just emphasize that [00:33:51] Dai Vu: I was, I was just gonna add real quick, even, even when we see sort of a, uh, a channel shift renewal, which is, you know, it’s on partner paper and it moves to marketplace as part of the renewals, we do consistently see that the, uh, renewal rates on marketplace and the incremental a CB on the expansion and new opportunities tend to be better when it’s on the platform marketplace than than offline. [00:34:12] Dai Vu: And that’s why partners choose to continue to drive renewals on marketplace at a reduced to rev share. But uh, because they see that that growth, [00:34:20] John Janke: we, we, sorry. [00:34:22] Shawn Toldo: We see that as well. Yeah. And I would also make the statement on our land business, when we go through marketplace, we are two x higher across marketplaces. [00:34:30] Shawn Toldo: We’re three x higher with them. [00:34:32] John Janke: Yeah, I think separate new from renewals and then instrument deeply. [00:34:37] Shawn Toldo: Yeah, [00:34:38] John Janke: go proactively talk to your CFO and your head of rev ops to understand their mindset. Because I was with a billion dollar seller a couple weeks ago, their CFO still creates friction in the process, even though they’re selling a billion dollars through these channels. [00:34:52] John Janke: But when they broke it down, their deals are three times bigger. They do them faster. They use more components of the product, which I thought was a really cool one. So customers who buy this platform, many component platforms through a marketplace, end up using six components of the product. Versus a normal land customer who uses two increases gross in net retention. [00:35:12] John Janke: So you have to get to the point where you have the data and you can tell that story real really clearly to your finance team to get support ’cause that they will trip you up if you don’t get them on board. [00:35:23] Vince Menzione: And you’re saying there’s friction in that company. I’m just kind of curious ’cause a billion dollar company. [00:35:27] John Janke: There’s a billion dollar marketplace seller [00:35:29] Vince Menzione: market marketplace company. That’s what I meant. Yeah. But, but the fact that this, their CFO friction, like, is it, is it because they’re not doing a good enough job or? [00:35:37] John Janke: Uh, in, of educating, I, the root of the question is from this person is, would they win without it? [00:35:44] Vince Menzione: Yeah. [00:35:45] Shawn Toldo: Oh, and is it worth the three points? [00:35:46] John Janke: Right. It’s, it is And, and I think some pe like to me, it’s the cheapest channel in the world. Yeah. Like with committed budget and people to support you winning. Like the, that formula, the math is so simple. [00:35:57] Shawn Toldo: Yeah. For, for a company of our size to go to like the classic resell ecosystem, I gotta walk in with 30 points. [00:36:02] John Janke: Yeah. [00:36:03] Vince Menzione: Yeah. [00:36:03] Shawn Toldo: It, it’s an illogical conversation. Outside of public sector and growth, you know, geos around the world. And so I, I’ve been lucky to have a CFO that I haven’t had that challenge with, at least at DBTI should say. [00:36:19] Vince Menzione: Really great insights. I think we have, we have another hand up here. [00:36:28] Audience Guest: Yeah. Thanks Susan. The question is for Dai. Uh, my name is Latif Hamani. I’m the founder of Partner System ai. Um, so what we’ve done is we’ve built a, a co-sell AI agent mm-hmm. That your partners can use to Yeah. Reduce all the friction in the co-sell with you. Uh, the questions that I have is, I guess I should back up, so XAWS Madison with a very large alliances, and then I worked, went on the other side. [00:36:55] Audience Guest: For software companies, and even though I had an operational team, I was spending two to three hours on on the keyboard, right? Mm-hmm. Deal registration, emails that can’t be automated, et cetera. So the question that I have for you is, I’d love for you to validate that. You know, unless you are one of the big companies, one of the big enterprises, if you go to the lower end of the enterprise or the mid market, uh, would you validate that there is a challenge? [00:37:20] Audience Guest: There’s a lot of friction for a smaller company. Mm-hmm. Uh, ’cause these marketplaces are complex. Yeah. The cosell is complex. Uh, that there’s an opportunity to really break down that friction with some automation and ai. [00:37:33] Dai Vu: Yeah, absolutely. So, um, we have already been, uh, part of the journey to remove some of the, uh, the friction as part of that selling and purchasing journey. [00:37:43] Dai Vu: Uh. We’re not quite there yet. But, uh, we’ve done things like we have, uh, you know, private offer APIs. We, uh, we have co-sell, uh, registration automation. Um, you know, we have tools like, uh, propensity to buy, tooling to help, uh, partners do, uh, more targeted efforts. Um, but the a i piece is still coming. Um, so I think, uh, the idea here is that we have launched a number of agents as part of our, um. [00:38:08] Dai Vu: Uh, part of our, uh, Google Cloud Partner network, partner hub. Uh, so these are, uh, agents that are gonna do a bunch of things to help partners as part of their workflow, but we’re gonna extend this to the marketplace and ISV area as well. Uh, so I think there’s a lot of opportunity. So, uh, I know there’s probably a lot of feedback in friction, uh, in, in certain parts. [00:38:29] Dai Vu: So we can, we can go tackle together. [00:38:32] Vince Menzione: Hey. There you go. There was a little [00:38:34] Dai Vu: plug [00:38:34] Shawn Toldo: there for tackle. Exactly. [00:38:37] Dai Vu: Uh, and I wanted, and just to be clear, I want to take a look at it from the end to end, uh, uh, flow, right? It shouldn’t just be just marketplace. It should be all the way from like, you know, top of the funnel, demand generation, all the way to like post transaction follow up. [00:38:51] Dai Vu: So we really need to take a look at, at the, the end, end flows and figure out a way we can remove some of that friction [00:38:56] Vince Menzione: three sense. [00:38:57] Dai Vu: Yeah. [00:38:59] Vince Menzione: Any more questions [00:39:00] Audience Guest: back here? Hey. Hey guys. This, this is a really good discussion. Uh, di this question’s primarily, uh, from, I’m interested in the hyperscaler response. [00:39:09] Audience Guest: Yep. Uh, but all of you, uh, can you talk about the patterns or say more about the patterns between. Um, the consumption of just platform capabilities versus industry workflows. Mm-hmm. And how industry where I, I mean, I, I, my sense is that industry workflows are becoming more [00:39:27] Dai Vu: Yeah. [00:39:28] Audience Guest: Uh, the easier thing for enterprises and SMBs to buy. [00:39:33] Audience Guest: Yeah. Especially SMBs, I think. Um, but say more about those patterns that you’re seeing develop and kind of what is. Uh, who are, where, where are those kind of, where is the demand being driven? Is it, is it, yeah. The search and discover in the marketplace, or is it being led by field sales of mm-hmm. Either GCP or partners? [00:39:55] Dai Vu: Yeah, so let me, I’ll mention a couple, a couple areas where, where it’s growing. So I think number one I mentioned before about some of these large horizontal business apps that we’re partnering with, right? Um, and, uh, and of course the fact that we’re, we’re, we’re transacting them through marketplace is, is a huge. [00:40:14] Dai Vu: Evolution from a few years ago. So who would’ve thought you would be buying like, you know, a hundred million dollars a CB deals, uh, through, through marketplace with like a Salesforce or a ServiceNow workday. But it’s happening now. And to be clear, all these. Horizontal business app. They’re not doing this in a very, you know, opportunistic, transactional way. [00:40:32] Dai Vu: They basically see marketplace and cloud go to market as a strategic growth lever for them. So that’s one big area. So from just a pure large deal perspective. Okay. Then you mentioned before around sort of corporate and SMB. Well, we find that a lot of the big opportunities are mostly around as they scale their business, uh, they’re not necessarily looking for things in the traditional sort of infrastructure space, but they’re looking for, you know, full SaaS applications to help scale their business, right? [00:40:58] Dai Vu: So it would be CRM, finance, hr, these types of solutions to become very attractive for some of this, uh, downstream market. And then lastly, as I mentioned before, which is, uh, when we think about this gentrification and owning, um. Uh, driving, uh, this business process and vertical, the ISVs become very important along with the services partners who bring that domain expertise to drive the end to end workflow. [00:41:25] Dai Vu: So I think that’s gonna be increasingly important. So those are three areas I think we need to watch out for. We. Okay. [00:41:30] John Janke: Maybe one thing, like as the cloud commit grows inside of companies, it’s shifted from being an engineering department, IT department budget line item to a corporate finance budget line item. [00:41:40] John Janke: Typically one of the top five to 10 expenses in a company. So that has shifted. Who is thinking about optimizing? The cloud commit with marketplace contracts. And that opens, that’s really opened up the avenue in addition to like these biz apps, vertical apps players. Yeah. Like having success. So I, I do think even inside your own company, evaluating where your cloud commits are, who owns them and are they thinking about the intersection of marketplace? [00:42:06] John Janke: ’cause I, I think it’s smaller companies, they’re still figuring it out. I run into engineering leaders who still own the commits, uh, but in medium to large companies. Very different. [00:42:16] Vince Menzione: Really good point. Because it, you know this, the optics change dramatically, right? This large commitment is now at the board level, [00:42:23] John Janke: right? [00:42:23] John Janke: And then you do have to teach your sellers as a vertical or business application player how to ask that question. ’cause the first resistance everybody says is, oh my, my person, my stakeholder, we. Manufacturing vertical application provider talking at an event last week, and they’re like, the shop floor manufacturing owner doesn’t know anything about the cloud commit. [00:42:43] John Janke: But if they ask the question, be like, Hey, do you guys have a strategic relationship with Google? Would it be easier to buy our product on the bill? Eight out of 10 times they get a yes. So [00:42:52] Vince Menzione: which is why the 5% comes in And that really accelerates the conversation happening. Yeah. We’ve got three more minutes. [00:43:01] Vince Menzione: Um, if we don’t have any other questions, I ha I have one for each of you really about the maturity model and partners are in the room that are not committed yet, right? We’ve talked about some very significant DBTs doing some incredible things, right? So we, there’s maybe a sense that like we, you, you are working with the be the biggest and the best out there, but what about everyone else that’s in the room that maybe isn’t committed yet? [00:43:23] Vince Menzione: And maybe they’re in motion, but they need some help and advice on what to go do next. What? What would you say die first? [00:43:30] Dai Vu: So they’re early stage, [00:43:31] Vince Menzione: early, early stage or not, they’re not on board yet. They’re not, yeah. They’re not with you yet. [00:43:35] Dai Vu: Yeah. So I’ll, I’ll go back to my earlier comment, which is that as you go into the journey, just be very intentional about what you need to do from an operational, investment people, uh, technology perspective. [00:43:47] Dai Vu: Uh, because it could be, it could be a multi-year journey. Um, uh, so I’d say go into it with the right expectations as opposed to thinking it’s going to be some accelerated six month thing that Sean has been driving here. It’s, he’s the outlier. [00:43:59] Shawn Toldo: But, but the reason for the outlier, [00:44:00] Dai Vu: yeah. [00:44:01] Shawn Toldo: And just to add to the intentional point Yeah. [00:44:02] Shawn Toldo: Is, you know, hire the right people. Right. So, somebody told me a long time ago, uh, hire slow, fire fast. That’s a really, really, really good principle that I take. Mm-hmm. I don’t like the fire part, obviously, but just for context, I, I am very lucky to have a great set of leaders that we were able to add people in. [00:44:24] Shawn Toldo: When I walked in the door, we had a person that was leading the Snowflake and AWS partnership. I had nobody on GCPI had nobody on Microsoft. I had nobody on Databricks. And then we made prioritization decisions on where we’re gonna go next. And so we hired people that had the experience and could drive the outcome in the right way. [00:44:43] Shawn Toldo: But we were very thoughtful about when we made those decisions on a quarterly basis, not a daily basis. So who you’re gonna bet on and then who you’re gonna put in the seat to make that bet come to life, I think is a really important thing as well. [00:44:58] John Janke: Yeah. [00:44:58] Vince Menzione: John, you worked with the be biggest and the best out there, so Yeah, sorry. [00:45:01] John Janke: Well, I think there’s the, like there’s the bottoms up and the tops down. Like seven years ago, this was all bottoms up. It was a partner leader who thought launching a marketplace would be good and they would go figure out how to do some deals and then sell their way up. Today there’s a lot more top down where people get it. [00:45:17] John Janke: But you can evaluate top down pretty fast. ’cause if you go talk to your CEO, you talk to your head of product, you talk to your CFO, and they have an allergic reaction to these concepts. You know, you have to go bottoms up. But there also are success story examples in every single ISV category that exists. [00:45:33] John Janke: Like this is not just security and data and DevOp like the, I think the ServiceNow. Salesforce workday. Examples are really great, like the marketing tech examples, more and more business of vertical apps every day. So I do think you can look at those people who’ve been successful. Maybe they’re your competitors, maybe they’re people you aspire to be and reference them as you’re trying to figure out how to do top down. [00:45:55] John Janke: But like you need both. You can’t win long term unless you get top down and bottom up aligned. [00:46:01] Shawn Toldo: And, and when I, when I would go ask for resourcing, I would always get the question, do, could you go faster with more? And I’d say, no. Gimme the one or two humans here, let me go prove it out and I’ll come back. [00:46:13] Shawn Toldo: So there’s a little bit of a strategy in doing that, that you’re gonna get more over time when you’re, you know, very measured in how you go ask for investment and resource. And so I would just add that point also. [00:46:27] Vince Menzione: Was, was hiring a significant component of your executive commitment, Sean? I mean, [00:46:33] Shawn Toldo: yes. So when I walked in the door at DBT, we had eight people in the partner organization. [00:46:38] Shawn Toldo: Today we have 25, and that was 18 months ago. But that did not happen. I didn’t go in and ask for, you know, that 16 people. Right. I asked over time in a very measured way with, you know, the programs and strategy team, like, what can we also support? You don’t want to bring somebody in to go do something and you don’t have the programs and operations side to support it ’cause they’ll fail. [00:47:01] Shawn Toldo: So we’ve been very thoughtful about how we’ve done that as well. [00:47:04] Vince Menzione: Die from you. I know you had something. [00:47:06] Dai Vu: No, no, no. I, I was good. [00:47:08] Vince Menzione: What is the one thing that people in this room need to go better and differently? Is there one, is there one specific thing other than what we’ve already discussed, did we miss anything? [00:47:16] Dai Vu: No, I would just, the whole identification. So obviously, uh, identifying this is not just like slapping a chat bot, but more around thinking all the things we talked about, product commercials, but also go to market where it’s agent first, where you can surface your agent in a workflow like Gemini Enterprise app. [00:47:34] Dai Vu: That’s gonna drive high alignment with how we work and go to market with Google. [00:47:38] Vince Menzione: Awesome. [00:47:38] Dai Vu: Yeah. [00:47:40] Vince Menzione: Wow. Good stuff. Yeah. Very good session. [00:47:44] Dai Vu: Thank [00:47:44] Vince Menzione: you guys. What do you think? Everyone? Thank you very much. [00:47:47] Shawn Toldo: Thanks for listening to the Ultimate Partner Podcast. [00:47:50] Vince Menzione: If today’s conversation resonated, share it with a partner leader in your network. [00:47:55] Vince Menzione: Subscribe where you listen, and head over to the ultimate partner.com. For show notes related content and the resources for this episode. And if you haven’t already, now’s the time to register for the Ultimate Partner Live Event in Reston, Virginia, [00:48:11] John Janke: October 26th through October 28th. [00:48:14] Vince Menzione: Until next time, keep showing up in the rooms that matter because being in the room changes everything [00:48:22] I.

Nik and Michael are joined by David Steele to talk all things pgBackRest. Here are some links to things they mentioned: David Steele https://postgres.fm/people/david-steelepgBackRest https://pgbackrest.orgpg_basebackup https://www.postgresql.org/docs/current/app-pgbasebackup.htmlBarman https://pgbarman.orgpgmoneta https://github.com/pgmoneta/pgmonetaWAL-G https://github.com/wal-g/wal-gReturn pg_control from pg_backup_stop (patch proposal) https://www.postgresql.org/message-id/flat/86436ff9-eb98-4c8a-825e-3bcae022107b%40pgbackrest.org#e36e2ad2f410d1a9a1152e36aa66bb48Add StorageReadMulti for prefetched multi-file/range reads from object stores (pgBackRest change that needs review) https://github.com/pgbackrest/pgbackrest/pull/2783pg_hardstorage https://github.com/cybertec-postgresql/pg_hardstorageWhy the cycle of open-source sustainability needs to be virtuous (blog post by Gabriele Bartolini) https://www.gabrielebartolini.it/articles/2026/04/why-the-cycle-of-open-source-sustainability-needs-to-be-virtuousARIN https://www.arin.netStefan Fercot https://pgstef.github.io/aboutpgBackRest sponsors at the time of recording: AWS, Supabase, pgEdge, Tiger Data, Percona, Eon, Xata, Dalibo, Data Egret~~~00:00 – Intro & pgBackRest origin story03:07 – Could pgBackRest live in Postgres core? Why it hasn't happened11:37 – Primary vs. standby backups & corruption safety20:36 – Measuring RPO & RTO in practice26:20 – Checksum performance & S3 storage class tips30:02 – Standby replay bottleneck35:12 – Log shipping, streaming replication, and sharding44:56 – Maintenance reality & the sponsorship crisis47:41 – What's next: repo-to-repo backup & RPO-zero streaming56:00 – Incremental backup1:05:01 – Reliability philosophy1:10:05 – Second maintainer, community growth & wrap-up~~~What did you like or not like? What should we discuss next time? Let us know via a YouTube comment, on social media, or by commenting on our Google doc!~~~Postgres FM is produced by:Michael Christofides, founder of pgMustardNikolay Samokhvalov, founder of Postgres.aiWith credit to:Jessie Draws for the elephant artwork

Jeroen Janssens, a senior developer relations engineer at Posit, and Thijs Nieuwdorp, a developer relations engineer at Polars, speak with host Gregory M. Kapfhammer about Polars, a Python package for transforming, analyzing, and visualizing data. After discussing the key features, they explore the implementation and use of the expressions data type provided by Polars. Along with comparing Polars to other data-manipulation packages like Pandas, they also share best practices for performing data analysis in Python with Polars. Jeroen, Thijs, and Gregory also discuss topics such as how to interface Polars with a SQL database.

SQL is one of the most valuable technical skills for finance professionals, business intelligence analysts, and data analysts. But once you've mastered the basics, how do you write cleaner, more scalable queries that support real business decisions?In this episode of What's New at CFI, Meeyeon sits down with CFI instructor Joseph Yeates to discuss CFI's new Advanced SQL for Analysts course. They explore how advanced SQL helps analysts move beyond answering individual questions to building flexible, reusable data models that support reporting, dashboards, and business intelligence workflows.Whether you're working in Excel, Power BI, Python, or directly with SQL databases, this course is designed to help you collaborate more effectively with data engineering teams, organize complex SQL queries, and build stronger data analysis skills.

Is it worth continuing to run SQL Server when PostgreSQL licensing is zero? Rebecca Lewis has a well written post on why that looks at some of the pros and cons of paying for SQL Server instead of moving to PostgreSQL. She starts with some of the things PostgreSQL does well, of which I think the Extensibility is really cool. SQL Server has some of this in CLR and the non-SQL language support, but those seem kludgy and complex to me. They aren't really integrated into the SQL Server platform. They're good, but I do wish vendors or the community could add some extensions in a way PostgreSQL does. Of course, I also worry about stability, so maybe this is a wish that isn't really a great idea. Read the rest of SQL Server Still Wins

Amazon just made its premium first-party (1P) data including Flexible Shopping Insights (FSI) and Audience Segment Membership completely FREE to query in Amazon Marketing Cloud (AMC) through the end of the year! But before you get blinded by the shiny new data, we need to talk about reality.In this episode, I break down what FSI actually uncovers (like the massive 14+ day attribution gap and organic vs. ad-exposed behaviors) and look at a real-world account to see if this data actually changes how you manage your PPC.Is it a total game-changer for proving ad viability, or is it just an Amazon-engineered tool to get you to spend more money? We dive into why AMC data still misses the mark on true net profitability, and why you shouldn't treat this data as a silver bullet if you have bottom-line ROI issues.We'll see you in The PPC Den!

We're excited to have Databricks join us at AIEWF, among hundreds of the top companies in the AI Engineer ecosystem. LS subscribers can use their discount to get past the late bird pricing and access over $50k in sponsor offers! Everyone is still talking about Satya's Frontier Ecosystems post, but few have actually built a (now $175 billion) frontier ecosystem and cloud like our guests today.From open-sourcing the layer above coding agents to rethinking databases for the agent era, Databricks cofounders Matei Zaharia and Reynold Xin are pushing the company beyond the lakehouse into a full data-and-AI operating system. In this episode, Matei and Reynold join swyx at the 2026 Data + AI Summit to unpack Omnigent, LTAP, Lakebase, agent security, open formats, Mosaic, and why databases may matter more than ever once AI agents start doing real work.We go deep on Omnigent: Databricks' open-source meta-harness for combining, controlling, and sharing agents across Claude Code, Codex, Cursor, Pi, custom agents, and internal tools. Matei explains why coding agents and enterprise agents run into the same problems: portability, collaboration, session history, security, spend controls, and the need for a common API above every harness.Then Reynold walks through Databricks' database dream: why CDC is brittle enough to joke that it means “continuous data corruption,” why HTAP has been the holy grail of database engineering, and why Databricks thinks LTAP gets most of the benefits by unifying the storage layer instead of collapsing every query engine. We also cover Databricks' infrastructure scale, the culture behind rapid prototyping, the difference between tech and enterprise customers, Databricks vs Snowflake, whether vector databases should have ever existed, the Mosaic model strategy, Genie, AI Runtime, RL fine-tuning, and the thesis that traditional software gets rewritten once the data is in the right place and agents sit on top.Databricks began as a company for the big data era. The origination of Spark from the Berkeley AMPLab which eventually turned into the product Lakehouse convinced enterprises that they didn't need a separate data lake, warehouse, ML platform, and governance layer. They just needed one open foundation where all of their data could live and be reasoned over.Since then a lot has changed, but data has only become more important. Data is no longer something you keep track of and analyze ad hoc, it's the necessary context agents need in order to act. So the framing has shifted from “where do we put all of our data?” to “how do we expose the right slice of state, history, permissions, and business logic to an AI system at the exact moment it's doing work?”If frontier model performance becomes commoditized, the durable advantage then becomes the company-specific context around them: proprietary data, governed access, operational state, transaction logs, workflows, and feedback loops. Which makes Databricks positioned perfectly.Now coming fresh off the Data + AI Summit 2026, the company is moving just as fast to keep up, announcing Genie One, Omnigent, LTAP, and many more, indicating a central mission in its newer work: Databricks is trying to become the operating system for enterprise agents.Models are getting good enough, but agents are only useful if they have the right context, permissions, memory, state, cost controls, and access to live business data. Fundamentally it appears that significantly better model performance in production is a systems problem, one that data guys like us are remarkably well prepared to solve!We discuss:* Why Databricks built Omnigent as a meta-harness above existing AI agents* Why coding agents and custom enterprise agents need the same infrastructure* The common API for agent sessions, files, streams, tool calls, and cancellation* Why persistent sessions, cloud sandboxes, sharing, search, and collaboration matter* Why Databricks open-sourced Omnigent instead of keeping it proprietary* Databricks' internal agent usage, cloud sandboxes, and coding workflows* The scale of Databricks: 50–60 million virtual machines a day and exabytes before breakfast* Why agent security needs contextual and stateful policies* How an agent could read confidential docs, install a compromised npm package, and leak data* Why spend control matters when an agent can burn $500 reading logs* Startup opportunities around coding-agent analytics, quality, skills, and spend* LTAP, Lakebase, and why Databricks wants to rethink the database stack* OLTP vs OLAP, CDC, and why data pipelines break at 3 a.m.* Why HTAP has historically been the holy grail of database engineering* Why Databricks thinks LTAP is “HTAP done right”* How writing transactional data into column-oriented formats changes analytics* Why agents need live operational context from databases, not just telemetry* How Databricks prototypes strategic systems without endless process* Enterprise vs tech customers, governance, procurement, and DIY culture* The “second system syndrome” risk of rewriting a database engine* Building a database engine from a decade of traces and quadrillions of data points* Why vector databases should never have been a separate category* Why open formats and AI changed the race with Snowflake* The Mosaic story, DBRX, Genie, document parsing models, and specialized model training* Why model customization and RL fine-tuning may become mainstream* Why “get the data there, slap some agent on top” may rewrite traditional softwareMatei Zaharia* LinkedIn: https://www.linkedin.com/in/mateizaharia* X: https://x.com/matei_zahariaReynold Xin* LinkedIn: https://www.linkedin.com/in/rxin* X: https://x.com/rxinDatabricks* Website: https://www.databricks.com* X: https://x.com/databricksTimestamps00:00:00 Introduction00:02:22 Omnigent and the Agent Infrastructure Layer00:08:39 Agent Clouds, Common APIs, and Open Source00:16:52 Databricks Scale and Internal AI Workflows00:18:03 Agent Security, Governance, and Spend Controls00:27:34 LTAP and the Database Dream00:30:30 CDC, HTAP, and Why Data Pipelines Break00:34:05 Lakebase, Parquet, and Live Data for Agents00:36:47 Databricks' Culture of Fast Prototyping00:43:40 The Dream Engine and Rewriting the Database Stack00:51:02 Vector Databases, Query Engines, and LTAP00:52:36 Databricks vs Snowflake00:57:48 Mosaic, DBRX, Genie, and Specialized Models01:03:11 Context, AI Runtime, and RL Fine-Tuning01:06:15 Why Data + Agents May Rewrite Software01:07:09 Closing ThoughtsTranscriptIntroduction: Databricks, Data + AI Summit, and Founder DynamicsSwyx [00:00:00]: Matei and Reynold from Databricks, welcome to Latent Space.Reynold Xin [00:00:06]: Hey, thanks for having us.Swyx [00:00:07]: Yeah.Matei Zaharia [00:00:08]: Yeah, thanks so much.Swyx [00:00:09]: thanks for taking time out. You have your Databricks, Data AI Summit going on. You were just telling me how the first summit that you guys ran was just 50 peopleReynold Xin [00:00:17]: Yeah, it wasSwyx [00:00:17]: in BerkeleyReynold Xin [00:00:18]: little meetup at Berkeley, I thinkMatei Zaharia [00:00:19]: YeahReynold Xin [00:00:19]: put togetherMatei Zaharia [00:00:20]: We were doing these tutorials and, yeah, just teach people Spark.Swyx [00:00:23]: Yeah. obviously now it's like, I think like the headline number's like 100,000 people around the world, 30,000 in person.Swyx [00:00:30]: it's a crazyMatei Zaharia [00:00:31]: AmazingSwyx [00:00:31]: community. Well, I just saw the keynote.Swyx [00:00:35]: Ali's just. Did was it obvious or that back when that Ali would be, like, such a great, like, CEO? LikeReynold Xin [00:00:42]: OhSwyx [00:00:42]: such a great presenter?Reynold Xin [00:00:43]: What do you think?Matei Zaharia [00:00:44]: I think among our group of founders it was clear that, I think he'd be the best at this.Swyx [00:00:50]: Yeah.Matei Zaharia [00:00:50]: And yeah, it turned out great. And he's, he's ramped up on so many topics growing a company. He would just go in and, like, study it and, be talk to all the experts. Like, even if he can't hire the person, learn enough about, like, finance and sales and whatever it was, and, and go from there. Yeah.Swyx [00:01:09]: Yeah.Reynold Xin [00:01:10]: he's obviously very high IQ and a very high EQ, but it wasn't. Like, Ali today is quite different from Ali from, like 10 years ago. I think there's a lot of work that he put in to, get to this point.Swyx [00:01:20]: Yeah. no, to me the most appealing thing about him is that he's funny. And like, it, it's, it'Matei Zaharia [00:01:26]: It's true, yeahSwyx [00:01:26]: it's hard to make jokes about, data warehousesReynold Xin [00:01:30]: About serious topicsSwyx [00:01:31]: securityMatei Zaharia [00:01:32]: YeahSwyx [00:01:32]: what have you.Matei Zaharia [00:01:33]: Oh, yeah. That's for sure.Swyx [00:01:34]: Yeah. So you guys launched a whole bunch of things. I'll, I'll just name check briefly, the stuff because we're not gonna cover everything. Omnigentt, your baby. LTAP, your baby, your dream engine.Swyx [00:01:47]: we're also gonna cover Genie, cover CustomerLake, you acquired PantherMatei Zaharia [00:01:52]: YeahSwyx [00:01:52]: Open Sharing, and there's Unity AI Gateway. A lot of these, I think, like, are things that you would expect a Databricks to do. It's, it's like part of the roadmap. Everyone in your category has similar things. But I think, probably the two of you are leading the two most unique and differentiated initiativesOmnigent and the Agent Infrastructure LayerSwyx [00:02:09]: on, in the landscape. Maybe we'll start with, Omnigentt we'll, we'll, we'll, we'll go into it. I do think that a lot of people are exploring this meta harness concept.Matei Zaharia [00:02:21]: Yeah, totally.Swyx [00:02:21]: What led you to it?Matei Zaharia [00:02:22]: Yeah. There were a couple of, like, converging lines, which I think is a good sign that you need something new. So on the one hand, there's all the coding agent info internally. We have really great, dev infra team. they built something called Isaac, that's like a wrapper on Claude Code and Codex, and, lets you use them either on the web in, like, sandboxes or, just on your dev machine or on your laptop or whatever. And then, they were adding all kinds of stuff there. And we saw all the more advanced engineers like, were building their own workflows with tons of agents, and they were building their own UIs and stuff on top or even on top of that. And then the other one was, like, us building agents. We ship this, like, data science agent called Genie on the research team, which I lead. We also build a lot of internal ones for various things, and then we have all the customer ones. And all of them running into this thing of like, “Oh, I need to switch model and harness and so on,” every few months. Plus the agent is, like, completely useless if you can't share sessions with someone and have history and have search and all this, like, layer on top of it for collaboration. I thought a bit about it from both contexts and, at first people thought it was weird. They're like, “Why are you doing coding agents and custom agents in the same thing?” But I said it's, it's the same problems and, you just wanna build the stuff that lets you deliver the agent, maybe control it if you care about security, and, make it portable across things. And then we prototyped some things as experiments. We saw, yeah, we can make it work, and then we built that for real.Swyx [00:04:06]: I'm wondering if this let's call it architectureMatei Zaharia [00:04:11]: YeahSwyx [00:04:11]: maps to anything in your careers in the past. like I always think about how a lot of things just tie back to operating systems.Swyx [00:04:18]: A lot of operatingMatei Zaharia [00:04:19]: YeahSwyx [00:04:20]: systems tie back to databases,Matei Zaharia [00:04:21]: SoSwyx [00:04:21]: or the other way aroundMatei Zaharia [00:04:22]: so the thing, I do think it ties a lot to, like, network protocols, internet protocol. we alsoSwyx [00:04:29]: Communication between entities.Matei Zaharia [00:04:30]: Yeah. We did stuff with, like, data sharing also, which is probably, most viewers probably won't know unless they'Swyx [00:04:36]: Yeah, open protocol is the term.Matei Zaharia [00:04:37]: Yeah.Swyx [00:04:38]: Open sharing. Open sharing.Matei Zaharia [00:04:38]: Open sharing.Swyx [00:04:39]: Yes.Matei Zaharia [00:04:39]: Yeah. So it's like you have a company, you maintain some table, like let's say like a Walmart or something. They have like the, inventory and what's been sold in each store. And then you also have suppliers, and they would love to produce more things and ship them, like, exactly the moment you need them. So they would love, like, real-time access to your table. So instead of like sending emails around or Excel sheets or phone calls, why can't you share like a view of that table in real time with them? Then they query, they, join it with their data, and they decide what to send. So it's one of these things where you, like you might ask like today since we can vibe code anything so fast, why do we even need to design like protocols or APIs or software? Why can't you just vibe code things on demand? But for this type of interoperability where multiple parties that are moving at different speeds are building stuff and you still want some layer on top to coordinate, you do wanna design it and build it. So it reminds me of that, like agents talking to each other and, users talking to agents and tools.Agent Clouds, Cloud Sandboxes, and Keeping Sessions AliveSwyx [00:05:42]: Reynold, any other comments alternative viewpoints?Reynold Xin [00:05:46]: I think, by the way, we had a debate on exactly which set of benefits would, matter a lot, and I think around the time we decided to do this thing I was telling Matei, “Hey,” it just happened to be there's a particular week that I was coding nonstopSwyx [00:06:00]: from the moment I woke up to, like, the moment I went to bed, I was, like, looking at my Claude sessions, my Codex sessions. And one of the things that was particularly annoying was having to keep my laptop open.Swyx [00:06:12]: I was driving to a doctor's appointment, and I remember because I wanted to make sure the whole thing continues working.Matei Zaharia [00:06:18]: But by the way, it's so comforting to hear you say that because I'm like, “I don't know if I'm a clown and I'm doing this or like.”Swyx [00:06:25]: Yeah. Like honestly, I was driving and I was tethering my laptop to my phone.Matei Zaharia [00:06:29]: huh.Swyx [00:06:29]: Keeping it on the side. Whenever I hit a red light, I started looking at what's going on my laptop.Matei Zaharia [00:06:35]: Yeah.Swyx [00:06:35]: And I just felt that was ridiculous.Matei Zaharia [00:06:37]: Yeah.Swyx [00:06:37]: It felt like we went back to the dark agesMatei Zaharia [00:06:39]: YeahSwyx [00:06:40]: programming. the productivity you gain from all this coding age is amazing, but, yeah.Matei Zaharia [00:06:45]: Have you heard of cloud?Swyx [00:06:47]: Yeah.Swyx [00:06:48]: It was crazy to me.Matei Zaharia [00:06:49]: Oh, the thing you were working on was the sandboxes or was this before that?Swyx [00:06:52]: It was a sandbox.Matei Zaharia [00:06:53]: Okay.Swyx [00:06:54]: I was workMatei Zaharia [00:06:54]: So you were inSwyx [00:06:55]: So I was approaching from a very different angle. I wanted to, “Hey, we're gonna have cloud sandboxes that doesn't shut down. You can get one very quickly,” but not just for running agentic sessions.Matei Zaharia [00:07:06]: Yeah.Swyx [00:07:06]: It's also for running development. So I was personally building that week, and through building that, I ran into all these issues, and then I wroteMatei Zaharia [00:07:15]: YeahSwyx [00:07:15]: a document for Matei, it's like, “Here's my wish list of what the actual environment should do.” And I think he ended up almost implementingMatei Zaharia [00:07:22]: YeahSwyx [00:07:22]: every single one of them.Matei Zaharia [00:07:23]: Yeah, I remember Reynolds saying, ‘cause my first prototype of this had just chats with your agent and he said, “I have to be able to open a shell, like my own shell and like list files and like tail them and stuff.” SoSwyx [00:07:36]: So SSH into a mainframe.Matei Zaharia [00:07:37]: Yeah. it has that now.Swyx [00:07:39]: Tailing my log.Matei Zaharia [00:07:40]: Yeah.Matei Zaharia [00:07:41]: Yeah.Swyx [00:07:41]: And also another thing I think I asked was, I had. I still use cursor for the sole purpose of rendering markdown files.Matei Zaharia [00:07:48]: huh. Yes.Swyx [00:07:49]: So I said, “If you just give me a way to see my markdown files and renderMatei Zaharia [00:07:53]: YeahSwyx [00:07:53]: them properly, I don't need a separate tool anymore.”Matei Zaharia [00:07:55]: Yeah.Swyx [00:07:56]: And I think you also built that in.Matei Zaharia [00:07:57]: Yeah, we, yeah, we did that, yeah. Yeah, we had a lot of engineers building, their own vibe coding setup. But then the other thing they all said is like, “Hey, I built something that's amazing for me, but, like, no one else on the team can use it ‘cause I don't have a server to collaborate.” And this is why we tried to set up, Omnigent, so you can have a server and have the security, set up in there. So, like log in with Google or whatever and, like securely share stuff. which. And that's where we've seen a lot of other agents like hit things. Like people think they prototyped an awesome agent, but it's not allowed to connect to like some really important data or whatever because of the security team.Omnigent Architecture, Open Source, and Common APIsSwyx [00:08:38]: Yeah.Matei Zaharia [00:08:38]: So yeah.Swyx [00:08:39]: Yeah. At this point, so for those watching along on YouTube, we're gonna putting up a image of the structure here, and we can talk a little bit of the architecture. I think I just want to have people understand, ‘cause like when we're talking about software, it can be very abstract and like here is what we're talking about. You've worked out in open source this entire platform and there's a runner component and server component with a uniform API that you've, you've figured out. any other element and obviously you can plug in all this, persistence layers and compute layers. This is a whole cloud. It's an agent cloud.Matei Zaharia [00:09:12]: Yeah. It's, it's got these components to work with it. The, a lot of the action happens like on the machine where you deploy your agent too. So whatever you've got on there, you can run. But yeah, it's, I think it's the minimal thing you want to have hosted, like collaborative agents and to have that server. And one of the reasons we open sourced it is, anyone building agents, this gives them an app they can start with and customize, which we were seeing in Databricks too. Like someone would make a nice, agent app and then other teams would ask, “Oh, can I just use yours for my agent?”Swyx [00:09:45]: Yeah, I think we had like five or six different agentic frameworksMatei Zaharia [00:09:48]: YeahSwyx [00:09:48]: built by every different team. They do all do more or less the same thing. Yeah, you need to. people wanna take something that works in Forkit, and you might as well have something open source. Yeah, which also was another question, which is interesting for Databricks. Like what do you choose to open source? What do you choose to make it proprietary? It's in. this goes back to Spark, right?Matei Zaharia [00:10:05]: Yeah.Matei Zaharia [00:10:06]: One, so one of the reasons to open source something is if you think it's a layer that will there'll be some network effect, it'll benefit from many, people collaborating, on it. So, for example, with Spark, I don't know if when Spark came out, we also focused a lot on letting you have libraries on top. So like there used to be differentSwyx [00:10:28]: EcosystemMatei Zaharia [00:10:28]: distributed computing engines for like machine learning and graph computation. We said they should all be libraries that you can compose. And we made it super easy to add connectors to data sources too. And then we benefit because, we don't have the time to write like connectors to like, 1,000 like different databases and file formats, but we can just use the ones people make, and of course they benefit from joining, this thing. So that's like one of these as it. Another way to think about it is like imagine, we our thing wasn't open. We had some agent hosting thing, but it's not open and then there is an open one. if you're. Which one's gonna win in the long run? So like here, because there is this benefit from like people writing integrations, it'll be, it'll be that. And then there are other things that like you just can't, even deliver as open source that are things the company does. Like for example, how do you make sure you're like streaming, jobs or your Lakebase database doesn't like, lose all your data at night? Well, that requires an operational team that's gonna sit there. There's no way it has to be a service. So like we wanna make sure as a company we're really good at those infra services and then we're as open as we can in terms of like what you build on top.Swyx [00:11:42]: speaking from a benefits, I think we are already seeing pull requestsMatei Zaharia [00:11:45]: YeahSwyx [00:11:45]: of all kinds of ecosystem integration, even though it was only released on Saturday.Matei Zaharia [00:11:50]: Yeah, Saturday. Yeah. So someoneSwyx [00:11:51]: Let's see, let's see what's going on. Yeah, you can look at the merge ones. I asked Sam Nigon this morning aboutMatei Zaharia [00:11:59]: 400 merge already?Matei Zaharia [00:12:00]: Yeah. I think Recent quite, I would guess around half are not from our team. but for example, someone added support for running it on Kubernetesrnetes. people added, many cloud sandboxes, so this can launch a cloud sandbox and run your agent in there, which is great for sharing too, ‘cause it's not, like, on your laptop and someone's, like, running scary code on there. so yeah, many startups have put those in, and, we expect to see more of them. We also have more agent harnesses already. Cursor, CLI, and Antigravity also.The Modern Data Stack and the Emerging AI StackMatei Zaharia [00:12:34]: Yeah. That's all, beautiful. And I, I feel like the last time this happens, there was the rise of the modern data stack.Matei Zaharia [00:12:42]: I don't know if it's that useful. I'm, I'm curious in your postmortem.Matei Zaharia [00:12:46]: I think most peopleSwyx [00:12:47]: AgreeMatei Zaharia [00:12:47]: will agree that it is finally dead. but maybe this arises to a new modern AI stack that, like, does the same thing.Matei Zaharia [00:12:52]: I don't know.Reynold Xin [00:12:54]: I think the modern data stack was a pretty useful thing, probably even up until this day. I think what, maybe for the audience who don't understand the history, I think the modern data stack is effectively decomposed into you need a layer to ingest the data in, you need a layer to transform your data, and then all of this are run, and then you need a layer to maybe visualize your data. And all of this runs on some data warehouse, or later on, as we're doing data warehouse or lakehouse.Reynold Xin [00:13:21]: I think that concepts are all very powerful and very useful. They enable a lot of workloads. What people eventually run into is a question of unification and consolidation is, hey, do you really need to chop all this into different pieces and work with so many different vendors and platforms in order to get, like, a very simple visualization done, right? So I think, like, over time, everybody started realizing that customers are pushing us. We started, we can realize that, so we started building more and more capabilities and trying to consolidate. And at the end of the day now, customers don't have to worry about having me hook up five different systems in orderMatei Zaharia [00:13:55]: YeahReynold Xin [00:13:55]: produce a chart. But the. I think, honestly, something like this is probably happening, in how many different frameworks do you want to hook up together in order to produce, like do a very simple agent.Matei Zaharia [00:14:06]: Just to be clear, I would say the core of this is this common API on top of all the harnesses. So the API is like, you've got an agent session, and you can send in a message or, like, a file. That's what you can send in, and then you get out, these streams as it's streaming text or as it's doing tool calls. And, or the other thing you can send in is you can, like, tell it to cancel a turn. So that's the API. Now, the thing we did is we could get you that on top of, like, cloud code running in a terminal, Codex, Py, OpenAI SDK, all that stuff. We map them all to that same interface. So that is something that you'd have to maintain yourself if you built your own, like, agent orchestrator, and then whenever cloud changes its API, you gotta, tweak your thing or it's gonna lose some messages. So that's the thing that's valuable to maintain. Then on top of that, like, we built a few apps. I think we built a pretty cool UI and stuff, but that's, And we built a security and control piece, which I'm excited about. But it's that common interface, so we don't. We. That doesn't try to be a stack. And in fact, you could plug in your own UI on top of this, server. That, and that's one of the use cases we care a lot about, ‘cause we want to use this in our own products.Compute, Sandboxes, and Databricks ScaleSwyx [00:15:20]: Yeah. It should be everywhere.Matei Zaharia [00:15:22]: Yeah.Swyx [00:15:22]: I think one of those things that is really interesting to me is, like, well, first of all, I'll, I'll endeavor to do everything and not call it the modern AI stack because like it needs a different name.Matei Zaharia [00:15:32]: Yeah.Swyx [00:15:32]: But like, yes, like, so one of the first people that told me about compute, sandboxing was Nikita from Neon.Swyx [00:15:39]: Because a lot of people think about Neon as like, well, it's serverless Postgres with, like, the separation of compute and storage and, instant branching and all those things. But every database company is also a compute company.Matei Zaharia [00:15:51]: Yeah. Yeah.Swyx [00:15:52]: And so he was showing to me his whole, his sandboxing solution. I don't think he have ever launched it.Matei Zaharia [00:15:57]: So our sandbox solution, the reason we could build it so quickly was because we realized if you just take the actual Lakebase architectureSwyx [00:16:05]: YeahMatei Zaharia [00:16:05]: and remove the database from it, by the coming from NeonSwyx [00:16:08]: Exactly, rightMatei Zaharia [00:16:09]: you have this sandboxSwyx [00:16:09]: Every database company has it already, yeah.Matei Zaharia [00:16:11]: Now, there are some differences. For example, in the one to support this particular workflow, it's important to have local persistence,Swyx [00:16:19]: YeahMatei Zaharia [00:16:19]: because you want your state to persist. Your libraries, you don't have to install your library every time, right?Matei Zaharia [00:16:24]: whereas the Neon architecture, because of the separation of storage from compute, you don't need persistent local disk.Swyx [00:16:30]: Yeah.Matei Zaharia [00:16:30]: So there's some differences.Swyx [00:16:32]: Yeah.Matei Zaharia [00:16:32]: But the, at the end of the day, yeah, it's, Yeah, so this is when you run, like, a coding sandbox. Like, if I use it, yeah, we have the dev env internally at Databricks. There's, like, many, like, tens of gigabytes of data just for, like, all the source code and, like, artifacts and stuff that I built, and I want that to come back next time, so.Matei Zaharia [00:16:51]: Yeah.Matei Zaharia [00:16:51]: But yeah.Matei Zaharia [00:16:52]: Before the show, we was talking about some statistics that might be surprising at the adoption.Matei Zaharia [00:16:56]: It could be internal, it could be external, whatever comes to mind, just to impress people the scale this is happening.Swyx [00:17:02]: So we, on the analytics side, I think we launchedReynold Xin [00:17:06]: Maybe 50 or 60 million virtual machines a day across all three clouds, so we're one of the biggest compute orchestrators out there.Reynold Xin [00:17:13]: Stuff for sure for CPU compute.Swyx [00:17:14]: Yeah.Matei Zaharia [00:17:14]: Yeah.Reynold Xin [00:17:15]: the. And all of this process, I think exabytes of data, I joked about depending on which time zone you are, typically before you have breakfast, Databricks would have processed exabytes of data already on that day. and on Neon, it's pretty interesting, too. It's launching, I think, 13 million databasesSwyx [00:17:34]: YeahReynold Xin [00:17:34]: a day now.Swyx [00:17:35]: Yeah, to me that was, like, aReynold Xin [00:17:36]: And that's just likeSwyx [00:17:37]: Like, what do you mean?Matei Zaharia [00:17:38]: Yeah. And that's the point.Reynold Xin [00:17:40]: And a lot of those were thanks to agent- agents and branching experimentationSwyx [00:17:44]: YeahReynold Xin [00:17:44]: because we made it so easy and so quickly, and thanks a lot to Nikita's team, to launch databases. It's, the. So it's changing the way people use databases.Swyx [00:17:54]: Yeah. Okay, we're gonna go into more database talk in a bit, but I wanna make sure we close up anything on Omnigentt. you mentioned, you were excited about the securityOmnigent Security, Contextual Policies, and Spend ControlsSwyx [00:18:03]: control side.Matei Zaharia [00:18:04]: Yeah.Swyx [00:18:04]: a lot of companies are figuring that out right now, as well as the spend side.Matei Zaharia [00:18:08]: Yep.Swyx [00:18:09]: what have you found there?Matei Zaharia [00:18:11]: Yeah, so I spent quite a bit of time talking to internal users, developers, security team, managers, and also lots of customers, and there's a few things. Like, first of all, one thing, that immediately was. became obvious is for security, there's this tension between, like, usability and security. And, the way people do. Like, a lot of coding agents today have very basic things like you can tell me which tool patterns I'll allow or disallow or whatever. It's like yes or no. But that puts you in a very tough spot. So just as an example, like, should my agent be able to read, some confidential documents, or let's say, should it be able to install new packages from npm, which, maybe it's compromised. Yes or no? Like, maybe I wanna allow it. Should my agent be able to publish stuff to the company website? Well, if I'm using it to code on the website, yes. But should it be able to do both, so it can, like grab a confidential document and be prompt injected and leak it? Probably not. So the thing we decided we need is stateful or what we call contextual policies where you keep track of the state of that session. It's not like is it allowed to push to the marketing site or not, but, like, hey, if it did a risky thing, like it installed, a old package from npm, or it read, like, 1,000 confidential docs, then no. Then don't, don't do it. Otherwise, maybe it's okay. That's one example of, like, moving that trade-off so it's both more secure and more useful by having a more powerful engine, essentially. This requires tracking sessions. The other piece that was interesting there is, like, there are these very level events it's doing, and you want some libraries on top that parse them. Like, for example, we have a, MCP server on Google Drive internally. It's got 60 API calls. like, how do I know which of those, like, will share a document with stuff on the internet and which ones won't? It's, it's annoying. So we designed in Omnigentt the policy layer so that it's functions and you can have libraries. Like, someone can make something that maps the level events to high-level ones, and then you write a policy about the high-level things that came out. so and thatSwyx [00:20:25]: This is related to the Panther,Matei Zaharia [00:20:27]: Yeah, Panther is. will help with that. PantherSwyx [00:20:30]: YeahMatei Zaharia [00:20:30]: a similar idea on the event processing side, and it's Python-based versus a weird custom language. this is more, as in realSwyx [00:20:39]: I didn't even know we were good yeah.Matei Zaharia [00:20:41]: Those things are happening, yeah.Swyx [00:20:42]: Yeah.Matei Zaharia [00:20:42]: So yeah, but these are the cool things. I think the contextual or stateful part, and then the way it can be libraries, and that was another reason to make it open source because others will write libraries and, like, we and our customers can use them. And the final thing, because it's stateful, one of the states we track is how much you spent in that session. So I can. I've had, like, I ask an agent to debug something, and it spent $500 because it decided to read a lot of log files and burn a lot of tokens. but I can literally say, “Okay, launch a agent to do this and cap it to spending $5.” Like, ask me for permission if it needs more. And because we're counting that within that session, it'll pop up and tell me, “Okay, you spent five, $5. Do you wanna go on?”Reynold Xin [00:21:27]: So important context here. Matei spent the last five years, a lot of his time was architecting Unity Catalog at DatabricksMatei Zaharia [00:21:34]: YeahReynold Xin [00:21:34]: which is the governance layer for data.Matei Zaharia [00:21:35]: That's right, yeah.Reynold Xin [00:21:36]: And he's combining expertise at that layer together with all the AI governance he knows.Matei Zaharia [00:21:41]: Yeah.Swyx [00:21:41]: DoMatei Zaharia [00:21:41]: But I also spent a lot of time being annoyed by coding agents and getting prompts.Matei Zaharia [00:21:46]: And also as theReynold Xin [00:21:48]: All the aboveMatei Zaharia [00:21:48]: I don't want to end up on the front page as, like, I installed some weird npm package and leakedSwyx [00:21:53]: YeahMatei Zaharia [00:21:53]: all the code, so I'm especially paranoid. But also I have very little time, so I don't want to sit there approving, like, do you want to run a 20-line, bash script, yes or no? so that's why I spend a lot of time figuring out, like, how can I make it as safe as possible and not annoying?Swyx [00:22:10]: Yeah. Is safety and mmm, let's call it security a bigger concern than token maxing or token budgets? which one is, likeMatei Zaharia [00:22:19]: Oh, yeah, they're both there. I don't know. I guess it depends on the type of company you are. So I think, some companies, like, the budget is, limited and, they really care about thatSwyx [00:22:34]: you can be Uber and still be concerned?Matei Zaharia [00:22:36]: Yeah. Oh, yeah, totally. Yeah. If you haveReynold Xin [00:22:38]: for us, securityMatei Zaharia [00:22:39]: YeahReynold Xin [00:22:40]: super paramount.Matei Zaharia [00:22:40]: For us, security is absolutely critical as a, cloud provider. It's, it's the most important thing, and, token maxing, we're not so worried about it yet, but I've seen the Like, for example, I talked to some consulting companies. They have, like, 100,000 employees who are all coding for customers. If those each spend, like, an extra $1,000 a month, that's, that's not fun.Swyx [00:23:04]: YeahMatei Zaharia [00:23:04]: we have, like, only a few thousand engineers.Swyx [00:23:06]: What's the policy in Databricks? Is it just unlimited or what'Matei Zaharia [00:23:08]: It's, it's unlimited, but we do. we use our own product to, like, analyze the traces and stuff, and we have a team that'looking to optimize and to see if anyone's doing something weird. And, we had some really cool insights just from analyzing current traces, like whichSwyx [00:23:24]: YeahMatei Zaharia [00:23:25]: models are better at, say, Rust versus like TypeScript or whatever. So yeah, at least in our code base.Swyx [00:23:31]: Yeah. Amazing. Obviously, I have to ask the token question, obviously.Matei Zaharia [00:23:34]: Yeah.Swyx [00:23:34]: I think it'sReynold Xin [00:23:34]: YeahSwyx [00:23:34]: it's a key thing. But yes, security and control above that, and figuring out a sane layer there you can have some autonomy, but, not too much.Matei Zaharia [00:23:43]: Yeah. Yeah, and we wanna make it super easy. As a engineer, you should set a thing. So in Omnigentt, you can ask your agent, “Set a policy on yourself to do this.” So it can likeSwyx [00:23:52]: But if there's something I should be showingMatei Zaharia [00:23:53]: YeahSwyx [00:23:53]: I don't, I don't see it on the GitHub, but,Matei Zaharia [00:23:55]: Oh, yeahSwyx [00:23:56]: there's justMatei Zaharia [00:23:56]: Well, in the docs there's something.Swyx [00:23:57]: Yeah, this is it.Matei Zaharia [00:23:58]: You can look at it later.Swyx [00:23:59]: Okay. Yeah.Matei Zaharia [00:23:59]: Just look in the docsSwyx [00:24:00]: YeahMatei Zaharia [00:24:00]: contextual policies if you wanna see.Swyx [00:24:04]: I just like to point peopleMatei Zaharia [00:24:05]: look at the built-in policies.Swyx [00:24:06]: Yeah.Reynold Xin [00:24:06]: Yeah.Swyx [00:24:06]: If you want to, follow up on this is exactly where to look, right?Reynold Xin [00:24:10]: Yeah.Matei Zaharia [00:24:10]: Yeah. yeah, and the story of these is, like, I just wrote, like, I wrote a doc with like 10 ideas for things before as you were working on them. Well, that was, like, my wish list of things people asked, and I told the team, like, “Hey, can you do like at least five of these for the launch?” And then they just got back with all of them, so.Swyx [00:24:29]: Oh, wow.Matei Zaharia [00:24:29]: so you can come up with more, but them- some of them are just meant to be examples. really you can intercept, like, any event the agent is making, and you can then either block or force it to ask the user or, like, allow, and you can update state to keepSwyx [00:24:45]: YeahMatei Zaharia [00:24:45]: track stuff.Swyx [00:24:46]: Yeah, ‘cause ultimately you're, I think of you as, like, a systems designer.Swyx [00:24:50]: You let people plug in, right? That's the wholeMatei Zaharia [00:24:51]: YeahSwyx [00:24:52]: modus operandi of what you do.Matei Zaharia [00:24:53]: Yeah.Swyx [00:24:54]: It's likeMatei Zaharia [00:24:54]: And we care a lot about also composab- like, can someone else write a library that others use, whichSwyx [00:24:59]: YeahMatei Zaharia [00:24:59]: this is meant to.Reynold Xin [00:25:00]: There's also a batteries included philosophy hereMatei Zaharia [00:25:03]: YesReynold Xin [00:25:03]: probably very similar to how you did Spark, which is you could just start using.Swyx [00:25:06]: Yeah.Matei Zaharia [00:25:06]: Yeah, that's right. It has to be good out of the box at certain things, and then you can build your own things on top that, like, we don't wanna do. But in Spark, if you just wanna like, I don't know, like read a table or do, like, a aggregation, it should be awesome at that out of the box.Building on Omnigent: Contributions, Startups, and AnalyticsSwyx [00:25:23]: Yeah. People wanna catch up on Omnigentt, they should watch your keynote.Swyx [00:25:26]: they should go through the GitHub and the docs. If they wanted to contribute, or they want to build on this ecosystem what would you call out as the most high-leverage places get involved?Matei Zaharia [00:25:36]: Yeah, do get involved in the Discord and in GitHub. Our team is there, is monitoring, and, some of the things people ask for we just built ourselves. Some of them, we're, we're collaborating with them to build it. and also tell us, likeSwyx [00:25:49]: Yeah, they're gonna be veryMatei Zaharia [00:25:49]: how you would like to use it because I think especially for developers, like, everyone wants it to work their own way, and a really good developer tool, like you have to hear the feedback on all the ways and figure out the abstractions and how to let people customize. So we'd love to hear, like, if you think, “Hey, I, I don't want it to work this way,” tell us. We really just wanna get that compatibility layer across agents and then let you do stuff on top.Swyx [00:26:14]: Yeah. is there any, in terms of like the startup side, I'm, I'm a founder.Swyx [00:26:18]: I wantMatei Zaharia [00:26:18]: YeahSwyx [00:26:18]: I see an opportunity, I wanna get in front of you. What's your request for, like, a startup that, like, I wish someoneMatei Zaharia [00:26:23]: Oh, like you wanna integrate with us?Swyx [00:26:24]: someone was working on this.Matei Zaharia [00:26:26]: Oh, for a startup?Swyx [00:26:27]: Yeah.Swyx [00:26:28]: Like, your, you got your own startup. It's doing well.Matei Zaharia [00:26:30]: Yeah.Swyx [00:26:30]: But like, if you weren't working on your own startup, what is, like, obvious that you should You advise many startups too, obviously.Matei Zaharia [00:26:37]: I do think, just as a company with a lot of engineers, like anything that helps me make sense of how people are usingSwyx [00:26:46]: SpendMatei Zaharia [00:26:46]: coding agents and,Swyx [00:26:48]: Yeah. AnalyticsMatei Zaharia [00:26:48]: spend, but also quality or like you should write, you should add this skill, or you should write this thing, or your agents are really horrible at tasks involving this service, so I go spend time. That would be nice. yeah.Swyx [00:27:00]: Yeah. The closest I've found is, this team, GitAI.Matei Zaharia [00:27:03]: Oh, cool. Yeah.Swyx [00:27:04]: They started with, like, we will just do, code and human attribution, but they're building the analytics layer on top of that.Matei Zaharia [00:27:12]: Yeah.Swyx [00:27:12]: I do think, like, there are a bunch of, like, artificial analysis is obviously,Matei Zaharia [00:27:18]: Yeah, they have their benchmarksSwyx [00:27:18]: doing super wellMatei Zaharia [00:27:19]: YeahSwyx [00:27:19]: with their stuff. so there's, there will be people. I think this is like the domain of consultants first, but then peopleMatei Zaharia [00:27:26]: YeahSwyx [00:27:26]: will build software that, let's say, it's kinda like the management planeMatei Zaharia [00:27:29]: YeahSwyx [00:27:30]: for coding agents.Matei Zaharia [00:27:30]: Yeah, I think there'll be a lot of insights there. You have it in other areas.Swyx [00:27:34]: Okay. Well, and then the other, big thing is your dream engine.LTAP: Lake Transactional/Analytical ProcessingSwyx [00:27:39]: maybe you wanna tell the story of, LTAP.Reynold Xin [00:27:45]: So, and background with. I'm, I'm gonna make people listen to our Ankur Goyal episode where we talked about SingleStore, HTAPMatei Zaharia [00:27:52]: YeahReynold Xin [00:27:52]: and all that history.Matei Zaharia [00:27:52]: Yeah. The LTAP idea is pretty simple. so if people have heard of the, Ankur's, talk about HTAP, it's effectively the world of databases. Sorry, there's like maybe a lot of context needs to be injected here. The world of databasesSwyx [00:28:06]: I am happy to be the database podcast that I'm forcing people to, like, learn your databases, guys.Swyx [00:28:11]: You cannot vibe code with just markdown files.Reynold Xin [00:28:13]: Yeah.Swyx [00:28:13]: Like,Reynold Xin [00:28:14]: It's one of the most important fundamental systems technologies out there. But the world of database effectively split into roughly two halves. There's what we call OLTP databases, which are transactional, and think of your Postgres, your MySQL, your Oracle databases, and the other side is what we call analytics, and sometime might refer to term OLAP. And the difference is on OLTP, you typically have maybe run some transaction on some event that looks up at one specific row. We update that row, right? It's a very oriented data structure. And on analytics, you're trying to reason on the data. You're trying to compute, “Hey, what's my revenue per store? What's my. How's my website doing every day?” And then you, eventually want to probably end up running anal- machine learning on it to predict, “Hey, how will my maybe sales be going in the future?” they are so very different architecture, and everybody start with OLTP databases. Every app, when you become serious enough, that needs more than markdown files, you need to have a database. You want to lose your data, you want to have some transactional consistency. But once you want to reason on the data, if you only have like- A hundred rows, it's probably okay to run it on your Postgres or your own, your MySQL database. But once you have more data and want to run more complicated analysis, the very analysis might crush your Postgres database. So you start doing, getting data out of the OLTP databaseSwyx [00:29:35]: Replication.Reynold Xin [00:29:36]: Replicate them into the analytic systems and just startSwyx [00:29:39]: Yeah, which for people, Elasticsearch is, like, aReynold Xin [00:29:42]: Yeah. So some of them get into Elasticsearch for, like, blocked analysis. A lot of our customers obviously get into Databricks to run more sophisticated things.Swyx [00:29:51]: Yeah.Reynold Xin [00:29:51]: And there's this term called CDC, whichMatei Zaharia [00:29:54]: Change data captureReynold Xin [00:29:55]: change data capture. and what it does, it reads the binlog of the database, and if you don't understand what binlog is, it's fine. The, but it's a little delta of the data, and it reconstructs based on the delta, the state of the database, on the analytics side. But CDC is, like, a very painful thing. It's how standard in the industry, everybody uses it, but, it ends up being. I think many data engineers ends up being waken up at, like, 3:00 a.m, because there's some pipeline thing.Swyx [00:30:22]: my explanation is, like, Airbyte is like a, became a $5 billion company just doing CDC.Reynold Xin [00:30:27]: Yeah, exactly.Reynold Xin [00:30:28]: CDC is, like, a veryMatei Zaharia [00:30:30]: It's hard.Reynold Xin [00:30:30]: It's one of the most boring but one of the most fundamental operations, like, powering modern society.Matei Zaharia [00:30:37]: huh.Reynold Xin [00:30:37]: But it's so brittle that, we joke that it's, should be called continuous data corruption, because you might change your schema on your OLTP database, and then the CDC pipeline fails to handleSwyx [00:30:48]: YeahReynold Xin [00:30:48]: the schema change.Swyx [00:30:49]: Yeah.Reynold Xin [00:30:49]: And then everything goes out.Swyx [00:30:51]: And there's all sorts of tricks that you can do, like, you add in, like, some versioning or whatever, but yeah.Reynold Xin [00:30:55]: Yeah, but it's a very, in general, very complicated. Like, I think at my keynote, I asked the audience put up their hand if they love their CDC pipeline. Only, like, maybe two people put it up. So if single store, like, about maybe a decade ago, I think the industry had this idea, hey, what if I built a single database that can handle both workloads? Now I don't.Swyx [00:31:12]: Which, like, by the way, every database person ever has ever always dreamed about this.Reynold Xin [00:31:15]: Yes. Yes.Reynold Xin [00:31:16]: This is the holy grail of database engineering is why not build a single system that can do both of this? But it ends up just being a lot of compromises. one, I think one of the first issue is that, hey, each. they say Postgres has a massive ecosystem, right? You want to be using the tools that's built for Postgres. And Spark, for example, had a massive ecosystem. There's a lot of libraries you want to use. If you were to create now a new thing, you don't have a ecosystem. You tend to create a new, smaller proprietary API, and you're lacking both, and it's also very difficult to make it performance-wise to be, comparable on either side. So it ends up being sucking on both. And our whole idea of LTAP, it's obviously a wordplay on the term HTAP, is that we think this is HTAP done right. HTAP wants to build a single engine for both. We think you can get 99% of what you need by unifying the storage, and just have a single storage layer. And once you have the single storage layer, if your Postgres databases are writing data in a column-oriented format, everything analytics can just go read that data directly without any delay, right? There's no pipeline in between, so all the data will immediately be available for reasoning analytics. I think I was telling some customers earlier, hey, when we talked about this is gonna be super useful for agents, I at first didn't really believe in it myself, even though we wrote that positioning.Lakebase, Agents, and Live Operational DataMatei Zaharia [00:32:39]: Yeah.Reynold Xin [00:32:40]: But then last night I was having dinner with a Australian customer, and they told me, “Oh, hey, one of the big issue we have is we have all these logs from our services, and we see SLA dips and want to investigate. But then there's no way for those agents to even understand what's going on in the actual databases themselves. All we see is just, like, product telemetry of the database and the services.” It would make those agents 10 times more powerful if understand, for example, who's placing those orders, what is happening, what exactly are they doing. So now I'm sold on our own message.Swyx [00:33:13]: Yeah.Reynold Xin [00:33:14]: I think it's really. It gets you the almost all of the benefits of the HTAP holy grail, which is, hey, make the data available immediately for reasoning analyticsSwyx [00:33:26]: Yeah, I think,Reynold Xin [00:33:27]: without compromiseSwyx [00:33:28]: in the way that humans are generally intelligent and want to have the ability and access to query anythingReynold Xin [00:33:34]: YeahSwyx [00:33:35]: while they do the work, they also need history and need context.Swyx [00:33:38]: And, like, where else does they get context? That's it's an analytical workload.Reynold Xin [00:33:41]: Exactly.Matei Zaharia [00:33:42]: Yeah. Yeah. And I remember when we had incidents with our databases and engineers said, “Well, I can't just run a giant query on it to see what's going on because that's gonna bring down the database and hoard it even more.” Like, that's the stuff that this gets rid of, because you spin up a whole separate fleet of machines that's doing the analytics. You're not overloading, like, the main databaseReynold Xin [00:34:02]: RightMatei Zaharia [00:34:02]: that's still trying to serve stuff.Reynold Xin [00:34:04]: Yeah.Matei Zaharia [00:34:04]: Yeah.Why LTAP Works Now: Parquet, Postgres, and LakebaseSwyx [00:34:05]: So this has been a dream for a while. what had to get done in order to get to today? Like,Reynold Xin [00:34:11]: Yeah.Swyx [00:34:11]: I feel like, you have announced variants of this several times, but it wasn't as clear as LTAP.Reynold Xin [00:34:18]: Yeah.Swyx [00:34:18]: I think LTAP is like Like, okay, we've got it, guys.Matei Zaharia [00:34:21]: This thing, yeah.Reynold Xin [00:34:21]: I was talking to somebody at Meta, and then he was asking me, “Hey, what's the catch? Why is it possible now?” And I think the reality is we took a lot of time to work on the Lakebase architecture. obviously a lot of it came from the Neon team, which is a separation of storage from compute. And it turned out it was just a tiny little step away going from that to this LTAP idea, which is, hey, we just. in the Neon architecture and in Lakebase architecture, we're writing data in oriented format to the open data lake, but in there we're writing in Postgres pages. Ali and I were spending a lot of time debating, hey, can we just change that to write in column-oriented format? And we're just debating, and one day, one of our engineers who's, like, super smart came in, he's like, “Hey, I just prototyped it. It works.”Swyx [00:35:07]: Wait, it's, prototype what?Reynold Xin [00:35:09]: Prototype, instead of storing the data in the data lake in the oriented formatSwyx [00:35:15]: ColumnReynold Xin [00:35:15]: like Postgres pagesSwyx [00:35:15]: YeahReynold Xin [00:35:16]: write them in Parquet.Swyx [00:35:17]: Yeah.Reynold Xin [00:35:18]: and he just made the observation that, hey, our storage fleet has a lot of extra idle CPUs And we could use those CPUs to do the transcoding from row to column, where row is good for OLTP, but column is good for analytics. so let's do that transcoding at that time. And as a matter of fact, once you transcode the data compresses better. So from those services writing to, for example, S3 or other data lake, like object stores, you can write them faster ‘cause now they are now smaller.Matei Zaharia [00:35:49]: Yeah.Reynold Xin [00:35:49]: So there's no overhead, it's no compromise in performanceMatei Zaharia [00:35:52]: Some CPU overhead.Swyx [00:35:54]: Yeah, because,Matei Zaharia [00:35:55]: YeahSwyx [00:35:55]: we had extra CPUs anyway.Matei Zaharia [00:35:56]: We had that fleet anyway, yeah.Swyx [00:35:57]: so the debate ended. it's one of the classics of, tech, issue of a lot of debate, but then somebody went ahead and just tried to prototype it and it worked.Matei Zaharia [00:36:06]: But, like, something this strategicSwyx [00:36:07]: That's rightMatei Zaharia [00:36:07]: and important to the company, I expect there to be, like, a kickoff thing, like a design doc. Nothing like that.Swyx [00:36:13]: Nothing like that.Swyx [00:36:14]: He just. We were debating in many meetingsMatei Zaharia [00:36:17]: Yeah.Swyx [00:36:17]: and then we're just debating whether it's possible or not from first principle.Matei Zaharia [00:36:20]: YeahSwyx [00:36:20]: and then, somebody just did it.Matei Zaharia [00:36:23]: Yeah, if you set yourself up so people do that'll be great. And that happened a bit with Omnigentt too. I think if I just had a doc on, like, we can make these together, everyone would, would think, “Oh, what about this? What about this?” But then you. if you try it out, it helps. And then if you have real users and they bash it and, like, it's still working, or in this case, if you have the workload, what the workload looks like, you can just test the same pattern then.Databricks' Culture of Fast PrototypingSwyx [00:36:47]: Yeah.Matei Zaharia [00:36:47]: Yeah.Swyx [00:36:47]: Tech aside, which is very cool, this is, like, the most important thing, the culture of innovation, and you don't have to ask my permission, you don't have like, do a whole form- formal process, just do it?Matei Zaharia [00:36:59]: Well, especially these days, I think withSwyx [00:37:01]: YeahMatei Zaharia [00:37:01]: AI, it's easier to buildSwyx [00:37:02]: But so, likeMatei Zaharia [00:37:03]: a prototypeSwyx [00:37:03]: I think you are very I made a lot of suite of, like, large companies and, like, I think that at scale, things slow down, and I'm sure you felt it already, but somehow you have this core of people that, like, are exempt. How? I think we hire and we work with really good people, and that's a very important part of it, and empowering them, but also spending a lot of time, maybe us in the trenches matter a lot also.Matei Zaharia [00:37:28]: Yeah, I think, I think first, people can adapt to being in the larger company, so that helps. And we wanna make sure they know that they can try stuff and settle debates and have a lot of examples of how it was done before, or launch a thing in beta or whatever. and then the other thing I do think as a company, like despite the size, we don't launch that many, like, products. We try to keep it pretty coherent. That's, that was the whole, like, theory of the company, was like instead of having, like, 20 Amazon services you need to set up, like a analytics and machine learning stack, you just have one, and it's, like, the same API, the same semantics across all of them, the same copy of the data. So that requires, like, unification. And then we added one more thing at a time. Like, we added storage with Delta Lake. We didn't used to do any storage. Then we added SQL, we added, machine learning platform stuff. So, but yeah, don't, don't do too many, but do those things well and, that also helps, it helps keep it manageable.Reynold Xin [00:38:33]: Yeah. The other thing we encourage a lot is instead of building, boil the ocean for everything, let's figure out how do we do it incrementally, how do we do it very quickly. Like, many of our productsMatei Zaharia [00:38:43]: YeahReynold Xin [00:38:43]: they're built in the span of weeks, and then we go to, hey. Like, usually my first question to whoever team is building is who's the target customer? Who are you working with? Are you on a first-name basis with them? Are you texting with them? I think having that very tight loop,Matei Zaharia [00:38:59]: Can you bring up another launch that comes to mind when, in this thing? I just want to give examples.Reynold Xin [00:39:04]: Omnigentt itself happened that way.Reynold Xin [00:39:05]: Yeah.Matei Zaharia [00:39:06]: Who's the customer? That's a good oneReynold Xin [00:39:34]: storage layer we did. we had, our largest customer at the time said like, “Okay, I need some. I want something in the cloud ‘cause, I. if the rest of our network is compromised, like this thing needs to be separate to store and query the events.” And then, talked to us, he said, “Okay, this is the rate of events per second. This is, like, the freshness I want. Can you do it?” So that was, like, way larger than any workload we had, and we had our, engineer, working on that, Michael Armbrust, and he worked just to make this work. And once it worked for them, it worked for everyone else. Yeah. This was early in the company, probably like four years in or something.Matei Zaharia [00:40:24]: 20- 2018?Swyx [00:40:26]: Yeah, ‘17, ‘18.Matei Zaharia [00:40:28]: Few companiesSwyx [00:40:28]: Do you have other examples?Matei Zaharia [00:40:30]: there'Swyx [00:40:31]: Maybe you have othersMatei Zaharia [00:40:31]: yeah, Clean Room, which is how you share data in a way without sharingSwyx [00:40:35]: YeahMatei Zaharia [00:40:35]: underlying data, but you allow specific operations. Those were done effectively initially just for two customers. I think the industry has a sense of, hey, maybe if you overfit to, like, one or two customers, it's gonna be really bad for you. But I think the, downside of overfitting is much smaller than the upside itself. And if you try to be too ambitious and boil the ocean, it's a much bigger problem.Swyx [00:40:58]: Yeah. Yeah.Matei Zaharia [00:40:58]: ‘Cause you might end up having no customer.Swyx [00:41:00]: Yeah, that's more, that's the more likely outcome.Matei Zaharia [00:41:02]: Yeah.Tech Companies vs. EnterprisesSwyx [00:41:03]: than you can pivot from there. I do think there is such a thing as a bad customer that sometimes you should fire. Yeah.Matei Zaharia [00:41:08]: They could exist sometimes if you drive. well, one of the challenge I think we probably see, and maybe many AI, so newer generation companies are seeing is, so tech companies are very different from tech companies or traditional enterprises.Swyx [00:41:22]: Yeah.Matei Zaharia [00:41:22]: And, if you optimize everything just for tech companies, you might have various challengesSwyx [00:41:27]: OhMatei Zaharia [00:41:27]: scaling them outside of tech companies.Swyx [00:41:28]: Okay, what likeMatei Zaharia [00:41:30]: YeahSwyx [00:41:30]: what like top three differences that you always think about?Reynold Xin [00:41:33]: Governance is a big oneMatei Zaharia [00:41:34]: I think, yeah, a big one is like, yeah, security, data privacy, governance, all that stuff. So usually if you're building some kinda like B2B or developer tool, like your biggest market is gonna be enterprises, but it's just very different. A company that's existed for like, it's had some form of IT for like 30 years, they have so many legacy systems or they operate in a regulated space. whereas a startup or, even like a, like sorta more recent tech company, all the. everything is new and pristine. So yeah, it's just different, and if you've never worked with enterprises or been in one, you just won't know about it.Reynold Xin [00:42:13]: Yeah.Matei Zaharia [00:42:13]: Yeah.Reynold Xin [00:42:13]: And the procurement process is probably quite different. There's far more stakeholders.Matei Zaharia [00:42:17]: Yeah, that is one. Yeah.Matei Zaharia [00:42:18]: Another piece that's interesting is I think some tech companies, people, will say, “Oh, I can build that myself,” right? I'll just build that myself.Matei Zaharia [00:42:27]: So then you go,Reynold Xin [00:42:28]: I don't think people say that about Databricks, butMatei Zaharia [00:42:31]: yeah, it dependsReynold Xin [00:42:32]: They do.Matei Zaharia [00:42:32]: They do?Matei Zaharia [00:42:32]: Yeah, the. Yeah, and it depends on the teams and things. So, but, on the other hand, like many of the enterprises say, “I don't, I never wanna be in the business of building that.” Like, I don't want my, whatever, I'm a retailer or something, I never wannaReynold Xin [00:42:45]: Yeah, sell clothes,Matei Zaharia [00:42:46]: be down because like some weird like nerd like couldn't get streaming pipelines working.Matei Zaharia [00:42:51]: That is not what I'm doing.Reynold Xin [00:42:53]: Yeah.Reynold Xin [00:42:53]: Yeah. This makes them great customers, to be honest, right?Matei Zaharia [00:42:55]: Yeah. But you have to understand that it's hard without having worked there and stuff, like you may not appreciate.Reynold Xin [00:43:01]: Look, I think they're all great. don't get me wrong, they have different challenges. But the, many of the tech companies, for sure there's a lot, far more DIY.Matei Zaharia [00:43:10]: On the flip side, you have people who are. they're very much experts in their domain, like they're building airplanes, they're, designing medicines, whatever, and they just want to bridge the technology, where like they don't wanna learn, databases or whatever. As cool as we think it is, even as interesting as the average software engineer might think it is to read a little bit, like they just never wanna know. They just say, “I have a, giant like, matrix or whatever with my, clinical data, like how do I, how do I like cluster it or whatever?” So yeah.The Dream Engine and Rewriting the Database StackReynold Xin [00:43:40]: Yeah. That's true. Okay, so and then I wanted to build out the dream engine, vision. where does this all lead? So one of the thing we, realized maybe a couple years back is that every single database engine out there, especially on the analytics side, are a decade old. pretty much everything that have reasonable traction are about a decade old. And they all started targeting some very specific narrow use cases, and then over time it's become more and more successful. They have grown in their ambition, and then they try to support more and more use cases. But the fastest way to support those use cases tend to be hacked around the abstractions that were initially created, that were not for those use cases.Matei Zaharia [00:44:23]: Yeah.Reynold Xin [00:44:23]: And then, but you can support them more or less okay. And before it, after 10 years of organic evolution that way, it becomes a gigantic pile of s**t.Reynold Xin [00:44:31]: the. And, but that includes Databricks. And very few company or very few systems, I think, have the gut to say, let's go start from scratch. Let's go back to the drawing board and design, knowing everything we know today after a decade of workloads and probably billions in revenue, let's attempt to rewrite it from scratch and make sure it will work and it can support all of these use cases. So we started doing that, but it's a very ambitious project. by the way, you can search on Wikipedia, there's this thing called second system syndrome.Matei Zaharia [00:45:08]: Yeah, I know that. Yes.Reynold Xin [00:45:09]: Or second system effect.Matei Zaharia [00:45:11]: Every developer must know what a second syndrome is.Reynold Xin [00:45:12]: It's you built your first thing and it works out great, and the second one's bound to fail because you become too ambitious.Reynold Xin [00:45:19]: And then you ask so many requirements.Matei Zaharia [00:45:20]: Or like you think everythingReynold Xin [00:45:21]: YeahMatei Zaharia [00:45:21]: and then you're likeReynold Xin [00:45:22]: You justMatei Zaharia [00:45:22]: you're, “I'm gonna design the perfect system this time.”Reynold Xin [00:45:24]: Yeah. And it turned out it's not perfect, and then it start failing and you're too ambitious, never launch, and you get killed. The, and the engineering team that started this, they were brilliant. I think we hired some of the best database engineers, on the planet into Databricks, and they were brilliant. Thank God it's not their second system. Many of them have built more than two in the past.Matei Zaharia [00:45:44]: Ah, nice.Reynold Xin [00:45:45]: But they were still worried about this, hey, building a database engine from scratch, I think the conventional wisdom is gonna take like five years to mature. This would be a very long-term project. It could fail. I think one of the engineers jokingly said, “Hey, maybe we just call it Reynolds Stream Engine.” If we name after a founder, maybe we then may get canceled or killed. But I think they built something pretty remarkable. they went back to. They changed the way the database engines were built from a paradigm point of view. Usually when y

If you've ever poured months into building a semantic layer only to watch it become shelfware the moment the business pivoted, Jacob Matson has some thoughts. And a metaphor. Your data is a jungle—and a semantic layer is a highway. Great if you need to get somewhere fast and reliably (monthly active users: highway, please). But the interesting business questions? The slicing, the dicing, the nuanced dimensions that actually differentiate your company from its competitors? There's no highway for that. There never will be. Jacob, a developer advocate at MotherDuck with deep roots in accounting and ERP systems, joined Michael, Moe, and Julie to talk through what comes after the semantic layer—or at least alongside it. The conversation covered why the most important parts of any business are precisely the parts that resist being modeled in someone else's framework, why AI is actually pretty good at writing SQL but not so great at remembering what it figured out yesterday, and whether the real job to be done here is less about modeling and more about search. Oh, and the uncomfortable truth that at episode 300, we still don't have a great answer for metric drift. But we've got some really good questions. For complete show notes, including links to items mentioned in this episode and a transcript of the show, visit the show page.

AI isn't necessarily creating impossible new attacks, but it is drastically lowering the technical barrier to entry for cybercriminals. In this episode, Ashish Rajan speaks with Simon Biggs, Cyber Incident Response Specialist at Varonis, about how AI is accelerating the attack lifecycle. Simon explains how attackers are using AI kits to instantly set up ephemeral phishing portals, query SQL databases in minutes, and bypass AI guardrails to compile Remote Access Trojans (RATs). We also discuss the shift in ransomware tactics from "encryption-first" to "data-theft-first," and how AI empowers attackers to post-process terabytes of stolen data to monetize it in novel ways. For defenders, the message is clear: if your S3 access logs and SQL transaction logs aren't turned on before a breach, your forensics team won't be able to tell lawyers or regulators what data was actually lost. Discover why data classification and proactive logging are the ultimate lifelines for IR teams in the AI age. Guest Socials -⁠⁠ ⁠⁠⁠⁠Simon's Linkedin Podcast Twitter - ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@CloudSecPod⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:-⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cloud Security Podcast- Youtube⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠- ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cloud Security Newsletter ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠If you are interested in AI Security, you can check out our sister podcast -⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ AI Security Podcast⁠Questions asked:(00:00) Introduction(02:00) Simon Biggs' Background in Law Enforcement and Varonis(03:10) Is There a Huge Volume of Sophisticated AI Attacks?(04:10) How AI Accelerates SQL Queries and Business Email Compromise (BEC)(05:15) Why AI Kits Are the New Metasploit and BloodHound(08:15) Varonis Threat Labs: Copilot Prompt Injection Vulnerability(09:20) The Forensic Challenge: Auditing Prompts vs. Understanding AI Output(10:30) Tricking AI Guardrails to Compile Malware(12:15) Defensive Strategies: Shadow AI, Permissions, and Logging(15:30) Using Defensive AI and BloodHound for Threat Hunting(17:30) Why Ransomware is Now "Data First, No Encryption"(20:50) The Legal Nightmare of Unclassified Stolen Data(23:20) Why Windows Forensics Can't Tell You What Data Was Stolen(31:20) The Crucial Importance of Enabling S3 and Cloud Audit Logs(35:10) How AI Allows Attackers to Post-Process Terabytes of Stolen DataResources spoken about during the episode:Simon's Research at VaronisArticle about SearchLeak Article about RepromptVaronis Threat LabsThank you to Varonis for sponsoring this episode of Cloud Security Podcast