Cloudflare reclaims 100 TB of RAM

Hi there, this is your daily ☕️ Devshot.

Cloudflare reclaims 100 TB of RAM LINK

• Cloudflare freed more than 100 TB of RAM across its internal load balancer by optimizing the Rust consistent-hashing implementation in pingora-ketama, which the Pingora Backend Router uses to spread cacheable requests across backend servers.
• Applying probability theory to find the minimum hash points needed, the team cut hashes per backend by about 90% without losing distribution accuracy, and shrank each stored entry from 8 bytes to 6 since the hash and server index fit in that space.
• Because swapping the hash ring reroutes cached requests and could flood origins with traffic, Cloudflare rolled the new ring out gradually alongside the old one to limit cache churn.

Moonshot curbs Kimi hacking as cyberattack fears grow LINK

• Moonshot deliberately stripped offensive-cyber data from Kimi K3.1 Pro, an open-weight model unveiled on October 24, to limit its hacking abilities while keeping general coding intact, as fears grow that capable AI makes cyberattacks cheaper to automate.
• The curbed model scored 81% on Moonshot's internal benchmark for finding and exploiting vulnerabilities, versus 90.5% for an unrestricted version, a drop the company hasn't had independently verified, though it still reportedly beats its predecessor.
• Weights ship on November 4 for the roughly 3-trillion-parameter model, which carries a one-million-token context window and a Highspeed variant running two to three times faster; once distributed, Moonshot loses control over whether its safeguards hold.

GitHub Actions previews workflow lockfiles LINK

• GitHub Actions now offers workflow dependency lockfiles in public preview, letting you pin actions and reusable workflows to exact commits while keeping readable tag or branch references in your workflow files.
• A GitHub CLI extension generates and maintains lockfiles covering actions, their transitive dependencies, and reusable workflows; once a workflow is onboarded, Actions runs the recorded commits even if a tag or branch moves afterward.
• This protects against moved tags or branches injecting malicious code, but locking doesn't vet whether a dependency is safe, so review before locking; Dependabot regenerates matching lockfile entries in its update pull requests.

MCP C# SDK 2.0 defaults to stateless LINK

• Microsoft shipped the stable 2.0 release of the official MCP C# SDK, implementing the latest Model Context Protocol spec and making Streamable HTTP servers stateless by default so any instance can handle any request.
• Protocol version and capabilities now ride with every request, dropping the handshake and session stickiness, while standardised headers let load balancers route MCP traffic without reading the body, which stays authoritative on mismatch.
• Stateful-only paths and legacy SSE endpoints now raise warnings, mid-call input moves to Multi Round-Trip Requests, and stable 1.x APIs keep working except Tasks, which moved to an opt-in package incompatible with the earlier experimental version.

Tamagui 3 adds a native runtime LINK

• Tamagui 3 shipped with a C++ native style runtime that pushes theme and style updates straight to eligible Fabric views without re-rendering the React components that use them.
• The runtime is an opt-in beta requiring React Native 0.82 or newer on the New Architecture, and an improved compiler now handles conditionals, nested ternaries, static spreads, and build-time variants to flatten more components to plain views.
• Flat style props merge each property's base value and conditions into one Tailwind-style clause, but their full type space exceeds a million union members, so completions, diagnostics, and hover moved to a Rust LSP binary serving Neovim, Zed, JetBrains, and VS Code.

Tutorials & Advice

> Compiling a Workflow into a 3B Model: Training a procedure's steps directly into a small model's weights matches a frontier model's accuracy while cutting input tokens 91% and cost 8-fold.

> Shipping 103,802 Dots in 82 KB. How we packed our hand plotted dot art…: Shrink hand-drawn dot art 93% by arranging the data in the artist's own row pattern so standard browser decompression handles it.

> Shard design doesn't start from your tables: Design database shard groups around the key shared by your most important queries, not around individual tables, so related rows stay on one server and joins stay fast.

> Why Kubernetes autoscalers keep fighting each other (and why the solution must be autonomous): Kubernetes autoscalers destabilize clusters because each adjusts sizing in isolation, so one unified decision layer should coordinate them to balance performance and cost.

> How we cut GitLab Duo Code Review's cost by 98%: Cut an AI code-review tool's cost 98% by switching to a cheaper open-weight model and trimming each stage's input so reviews still fit.

Other news you might like

• Origin Range Requests: Serving large files without range-request tuning LINK

• PHP Foundation 'under-funded' with one full-time staff member, director says LINK

• ‘Tokens Are Cheap’: Open Source Subreddit Bans AI LINK

• stencil-hq/dquickts: QuickJS with durable execution: suspend running JS, snapshot the whole heap, resume it in another process. Native TypeScript, a REPL that survives restarts, Rust bindings. LINK

• Google's C Binder Driver Removed With Rust Binder Ready For "Few Billion Devices" LINK

• Modder turns NES into a Windows-like desktop with original hardware LINK

• Nvidia RTX 20, 30, and 40-series GPUs hacked to remove a half-speed AI throttle LINK

Trending tools

tiun: an AI-native backend bundling authentication, payments, customer data, and analytics into one platform, so teams skip stitching separate services together. LINK

Jev: adds structured AI-driven decision-making to automation workflows, letting developers build reliable branching logic without hand-coding every rule LINK

Switch: open-source workspace connecting people and AI agents across Slack, Teams, Discord, and Mattermost, preserving context during handoffs without vendor lock-in. LINK

Steal My Bitcoin: a security challenge inviting others to exploit a PHP remote code execution vulnerability to access the author's Bitcoin. LINK

Floot MCP: links Claude and ChatGPT to your workflow, building full-stack apps from chat while handling databases, logins, hosting, emails, and publishing automatically. LINK

OpenSwarm: an AI-first operating system where agent swarms run the machine, letting you orchestrate dozens of parallel tasks instead of working sequentially. LINK

Trending papers & reports

AI agents operating apps frequently misread what's actually on screen, with ~87% of 335 cataloged failures silently producing wrong actions, and a new checker catches most of them before launch. LINK

AI-written software verification often rubber-stamps buggy code as correct by writing checks that match the flawed program instead of what it should do, and better prompting does not fully fix this. LINK

The 2024 CrowdStrike outage traces the crash of roughly 8.5 million Windows devices to a single mismatched input in a security update, arguing that configuration files deserve the same rigorous testing and staged rollout as code. LINK

Novice coder oversight of AI mostly judges whether plausible AI output fits the task, with ~74% of student interventions targeting suitability versus ~17% catching outright errors, showing supervision is more about fit than bug-spotting. LINK

Coding agent pairings show that the same open-source model solves up to 44 percentage points more bugs depending on which agent wrapper you pair it with, and cost per fix varies more than 20-fold. LINK

See you tomorrow for a new dose of ☕️ Devshot!