
Theo Morgan
Web platforms and browser engineering
Theo covers browsers and the web platform. His reporting connects new capabilities to compatibility, accessibility, progressive enhancement, and practical testing.
Engineering guides
- Why does rustup require --force-non-host for a 32-bit toolchain on 64-bit Windows?
Rustup 1.29.1 requires an explicit opt-in to install 32-bit Windows host toolchains on 64-bit Windows. Building 32-bit applications remains supported.
- Why imported email verification disappears after an Ory identity update
Diagnose imported Ory email verification that disappears after a profile update by checking the verification setting, identity schema, and matching trait.
- Diagnose Ory browser login CSRF failures across cookies and proxies
Trace Ory browser login initialization, flow data, cookies, and form submission to locate CSRF failures without weakening the authentication boundary.
- Change an Event Schema Without Stopping the Stream
Treat compatibility as a deployment and replay timeline that includes old consumers, retained records, and semantic changes.
- Salesforce External Identity alternatives for portals becoming standalone products
Compare keeping Salesforce Customer Identity, federating a separate identity provider, or moving account lifecycle to Ory Network while preserving Salesforce record access.
- Support impersonation that preserves accountability
Design short-lived support access that keeps operator and customer identities separate, denies sensitive actions, supports revocation, and leaves useful audit trails.
- Should the person paying for a SaaS subscription automatically own the organization?
Payment should not automatically grant organization ownership. Separate billing, contract, and product authority with explicit permissions and least-privilege access.
- How can we rebuild a search index from a live database without missing writes or indexing impossible intermediate states?
Use one coordinated database snapshot plus its matching change stream, enforce per-document write order, checkpoint only durable writes, and cut over only after validation.
- How do I prevent an invoice author from approving their own invoice?
Model approval as two checks: the actor must be an approver, and the actor must not be the author of the invoice revision being approved.
- How should we define and operate correctness for event-time windows when late data keeps arriving?
A practical framework for defining event-time window correctness under late arrivals, setting watermarks and lateness, and designing consumers for revisions.
- Make Time, Randomness, and IDs Explicit Test Dependencies
Test clocks, random values, UUIDs, retries, and timers through narrow injected interfaces instead of fragile global mocks.
- How do we detect software license obligation changes between releases?
Compare release SBOMs with a reviewed license inventory to flag dependency, license, and completeness changes before legal review turns into a spreadsheet chase.
- Alternatives to copying monolith login code into every new service
As a monolith splits, should login remain in the old application, become an internal service, or move to managed identity? Compare bounded architecture and migration choices.
- API Contracts for Work That Outlives the Request
Represent long-running work as a durable resource with stable identity, lifecycle states, cancellation, retries, retention, and results.
- When should a warehouse precompute a surrogate partition key instead of relying on function-wrapped predicates?
Evaluate surrogate partition keys when date transformations and time-zone expressions prevent predictable pruning across SQL and BI workloads.
- Where should newline, BOM, and Unicode normalization happen in a file ingestion pipeline?
Set one ingestion boundary for decoding, BOM policy, and newline handling, then apply Unicode normalization only where field semantics require it.
- Should we squash commits if we rely on git bisect to find regressions?
Preserve individually runnable commits for finer git bisect results; squash when the pull request is your smallest tested unit.
- Why an ID Token Is Not an API Access Token
No: an ID token tells the client about the user’s authentication, while an API should accept only an access token intended for that API.
- When a customer duplicates an automation, should its credentials and permissions be copied?
Recommended clone semantics for automations: copy logic, require explicit rebinding of credentials and grants, and treat connection reuse as a separate authorization step.
- ZITADEL alternatives for customers who belong to several organizations
Choose an identity model for users who work across several customer organizations by separating account ownership, membership, and resource authorization.
- How do we build a task-coverage map that keeps technical documentation navigation honest?
Model documentation around canonical user tasks, then use that map to drive navigation, ownership, and release maintenance.
- Why does a load test report good latency while users experience long stalls?
A load test can look healthy while users stall when the test uses a closed loop that slows its own arrivals during server stalls.
- Contract tests for APIs and events: protect behavior while allowing change
Test transport shape, consumer assumptions, and semantic invariants while leaving provider implementation and unused fields free to evolve.
- Alternatives to separate login stacks for self-serve users and enterprise customers
Should a product with personal accounts and enterprise contracts consolidate customer authentication? Compare ownership, migration, and shared-login criteria.
News
- Amazon Neptune adds online index rebuild to reclaim storage
AWS says Neptune can reclaim fragmented index storage without going offline, starting with engine 1.5.0.0 on provisioned writer instances.
- Reflection’s Beam arrives in SageMaker JumpStart with Trainium3 optimization
Beam’s initial JumpStart rollout covers two US regions. AWS also reports Trainium3 optimization, but the announcement includes no quantified performance or cost results.
- AWS Security Hub CSPM adds CRI Profile v2.2 support
AWS says 404 Security Hub CSPM controls support a subset of CRI Profile v2.2 requirements, excluding those that need manual checks.
- AWS Transfer Family adds custom ports for public SFTP servers
AWS Transfer Family public SFTP servers now support up to three ports, each with a client-first or server-first communication mode.
- Google’s September AI recap highlights Argon’s phased rollout
Google reports Fairwind program access for Argon and Flash Cyber, while its new Live audio models have rolled out through developer channels.
- AWS adds organization-wide sharing for Systems Manager documents
Systems Manager documents can now be shared with organizations or OUs through AWS RAM, with sharing updated as account membership changes.
- OpenTelemetry graduates within the CNCF
CNCF graduation recognizes OpenTelemetry’s project maturity and governance while the maintainers continue work on interoperable telemetry standards.
- Chrome 147 ships scoped view transitions and new CSS color and border tools
Chrome 147 brings concurrent element-level view transitions, automatic black-or-white contrast selection, and shape-aware border painting.
- Firefox 153 adds bulk IndexedDB reads, video PiP, and JSPI
Firefox 153 ships getAllRecords for IndexedDB, desktop video picture-in-picture, WebAssembly Promise integration, and richer WebRTC diagnostics.
- Astro 6 adds built-in fonts, CSP, and live content collections
Astro 6 combines new content and security APIs with a refactored development pipeline designed to run the target production runtime locally.
- Terraform 1.16 adds module imports and machine-readable state commands
Terraform 1.16 supports import blocks inside modules, JSON output for state and workspace inspection, richer action triggers, and lifecycle destroy controls.
- Ingress2Gateway 1.0 turns Ingress migration into a reviewable conversion
Kubernetes SIG Network released Ingress2Gateway 1.0 with broader Ingress-NGINX annotation coverage and integration-tested Gateway API output.
- MySQL 9.7.2 fixes deletion ordering in JSON duality-view updates
MySQL 9.7.2 corrects nested-row deletion during JSON duality-view updates and date conversion behavior, making targeted regression cases valuable.
- Deno 2.8 adds dedicated CI installation and npm package-building commands
Deno 2.8 introduces explicit commands for frozen CI installs and npm-ready package artifacts, with a runtime compatibility boundary for Deno-specific APIs.
- Go explains how package authors can automate API migrations
Go's source-level inliner lets package maintainers describe migrations through wrappers, with behavior-preserving analysis for call arguments.
- Cloudflare launches Billable Usage API for self-serve accounts
A single billing endpoint returns daily product usage and cost rows with field names aligned to much of the FinOps FOCUS specification.
- Azure Firewall explicit proxy reaches GA
Selected applications and browsers can send HTTP and HTTPS egress to Azure Firewall through standard proxy settings without rerouting a whole subnet.
- GKE previews ClusterNetworkPolicy for tiered cluster-wide network rules
ClusterNetworkPolicy enters preview in GKE 1.36 and later, separating administrator rules, namespace policies, and cluster-wide baseline defaults.
- Hugging Face releases a library of WebGPU kernels
Hugging Face’s new kernel library packages browser GPU building blocks with tests and benchmarks, giving local AI developers a reusable starting point.
- Meta releases TRIBE v2 for predicting brain responses
TRIBE v2 expands Meta’s research on stimulus-driven brain-response prediction, with released artifacts and a noncommercial license boundary.
- Mistral releases Search Toolkit for composable retrieval pipelines
The open-source preview joins ingestion, retrieval, and evaluation, giving teams a common place to compare search changes before altering generation.
- Microsoft clarifies the scope of its long-horizon AI delegation study
A May clarification explains what DELEGATE-52 measures and why artifact-fidelity stress tests should not be read as general product verdicts.
- Mistral releases Leanstral for repository-scale proof engineering
Leanstral targets Lean 4 work with downloadable Apache-licensed weights, shifting evaluation toward verified repository changes and proof review.
- Google introduced Gemini 3.5 Transcribe for batch and live speech recognition
The speech-to-text family added transcription and live transcription models aimed at structured, context-aware audio processing.
- Gemini added source-aware creation across Docs, Sheets, Slides and Drive
Google began beta rollouts that let Gemini draft and analyze Workspace content using selected files, email and web context.