Hi there, this is your daily ☕️ Devshot.
In today's Devshot:
🎧 Spotify opens its tech tools to all
💻 Torvalds calls AI coding a gateway drug
🤖 GitHub Copilot adds on-device AI models
🔒 Let's Encrypt shortens certificate lifetimes
⚙️ PostHog builds its own cloud agent runtime
Plus: 🎁 6 more stories you might like, 🧰 6 tools, and 📚 5 papers.
🎧 Spotify opens its tech tools to all LINK
- Spotify has grouped its in-house R&D software under a single brand, Spotify Technology, bundling the Portal context layer, Xirp agentic-development tool, Confidence experimentation platform, and the open-source Backstage for teams outside the company to adopt.
- The four products share one context layer and one agent runtime, so Portal encodes an organization's architecture and standards, Xirp carries that into coding agents without losing state, and Confidence feeds experiment results back into what gets built next.
- You can start with any single piece as one engineer or scale to a whole organization, with each tool already run on Spotify's own production workloads serving 777 million monthly users before being sold.
💻 Torvalds calls AI coding a gateway drug LINK
- Linus Torvalds told the Open Source Summit in Prague that he sees AI coding as a useful "gateway drug" that lowers the barrier for junior and teenage programmers, while warning against leaning on it for serious work.
- His reasoning is that beginners today feel ashamed comparing their efforts to polished professional code, whereas AI makes those first steps enjoyable enough to keep learning, though users must know exactly what outcome they want to avoid grave consequences.
- Torvalds also said AI-generated vulnerability reports have left the Linux security mailing list nearly unmanageable, with maintainers now countering the patch flood using their own AI review tools, raising stress he says dominated roughly three-quarters of maintainer-summit discussions.
🤖 GitHub Copilot adds on-device AI models LINK
- GitHub Copilot will soon route coding tasks automatically between on-device and cloud models, with Microsoft expanding Project HydraFusion to pick where inference runs and shipping the Auto routing feature by the end of October.
- Developers can select local models themselves in Copilot CLI, the Copilot app, and VS Code, including MAI Code 1.1 Flash, a 137-billion-parameter mixture-of-experts model quantized to roughly 3.3 bits per weight, shrinking it 80% to 53GB.
- Microsoft hasn't said how much repository context Auto sends to the cloud or whether sessions can be forced local, and the quantized model's 75.5GB peak memory at 256K-token context rules out most 16GB and 32GB laptops.
🔒 Let's Encrypt shortens certificate lifetimes LINK
- Let's Encrypt will cut its free SSL/TLS certificate lifetimes from 90 days to 64 days starting February 10, 2027, with opt-in testing of the shorter certs beginning on October 14 ahead of the production rollout.
- Deployments running modern ACME clients that support ARI, which lets the certificate authority signal when to renew, should transition seamlessly, while setups using hardcoded schedules or manual renewals face expiring certs unless updated by February.
- The shorter window continues Let's Encrypt's push to limit damage from compromised or misissued certs and force full ACME automation, with 45-day defaults planned to follow in 2028.
⚙️ PostHog builds its own cloud agent runtime LINK
- PostHog built a unified cloud agent runtime that provisions a sandboxed VM per task, clones your repos, boots the agent, and stays with the run until it opens a PR, surviving laptop closes and worker deploys.
- State lives outside the sandbox in a durable Temporal workflow, runs in Postgres, conversation in a log, working tree in a snapshot, tokens minted fresh, so when a VM dies the worker rebuilds one, restores the tree, replays the log, and continues.
- Now in closed alpha via PostHog AI's web coding features, you configure a per-project network allowlist enforced at Modal's network layer and custom images written as short YAML specs by a builder agent, with a scan judge treating each spec as untrusted input.
Other news you might like
- Harness acquires Augment Code to bridge software engineering from idea to deployment LINK
- Boro: NVIDIA's Open-Source Effort For AI-Assisted Linux Kernel Development LINK
- R.I.P. Margaret Hamilton, whose code saved the Apollo 11 Moon landing LINK
- prevents me from logging into Vanguard LINK
- Introducing Railway Authentication via identity-aware proxy LINK
- Rust upstart reveals 'reimplementation' of Microsoft Office – with Claude on coding duty LINK
🧰 Trending tools
Die With Me: a Mac app that tracks Claude and Codex usage, compares it with friends, and opens a chatroom when your allowance runs out. LINK
Kilo Code for JetBrains: an open-source AI coding agent for JetBrains IDEs, letting you build and iterate with flexible model choices across projects. LINK
Mastra Factory: a TypeScript framework for building AI agents with staged workflows, memory, streaming, evals, tracing, and a Studio UI for testing. LINK
Monospace from Directus: turns any SQL database into instant REST and GraphQL endpoints with a no-code app for collaborative data management. LINK
Meridian: open-source, locally-run activity tracker that logs work with context, showing where your time goes and which blockers stall projects. LINK
Kane CLI: controls Chrome with plain-English commands to test web apps and scrape data, auto-fixing broken selectors so checks keep passing without manual edits. LINK
📚 Trending papers & reports
Coding assistant testing shows today's AI programmers pass over 75% of tasks when guided by expert architects but fewer than 25% when working with non-coders, proving they can't yet reliably build software for beginners. LINK
AI software labels turn out to map to seven real architectures, so terms like copilot and agent signal genuine design differences, copilots act step by step with user approval while agents plan and execute on their own. LINK
3D world grading fixes unreliable automatic scoring of AI-built interactive worlds by both watching them run and reading the code, catching dead features that code-only judges wrongly credit on four of five removed items. LINK
Code-fixing AI agents get smarter by mining a project's past pull requests for design decisions, lifting the share of software bugs resolved automatically from about 69% to 73%, and up to 80% with the best model. LINK
System prompt wording turns out to behave differently across languages, with commanding instructions like "NEVER do X" clashing in Spanish but cooperating in English, while neutral phrasing like "X: disabled" cuts cross-language inconsistency by ~81%. LINK
See you tomorrow for a new dose of ☕️ Devshot!