Software Engineering Daily

A major challenge for almost every online service is reliably identifying users, and knowing whether a given user or agent can be trusted. Historically, web services leaned on cookies stored in the browser to remember a visitor and recognize them when they return. The problem is that cookies live in the user’s own browser and are easy to remove, block, or avoid entirely, so a bad actor can simply clear them to escape recognition. IP blocking and CAPTCHA puzzles are firmer approaches, but they can frustrate legitimate users while doing little to stop a determined attacker. That leaves developers stuck between being too lax and losing control, or too strict and driving real users away. FingerprintJS was started in 2012 as an open-source project. In 2019, Fingerprint was launched as a separate, full commercial platform, built on the original FingerprintJS GitHub library, to recognize devices and browsers without relying on cookies. It handles identification by reading over 100 signals, from fonts and screen resolution to how a device renders audio and graphics. Keshia Rose works in Developer Relations at Fingerprint. In this episode she joins Gregor Vand to talk about fingerprinting, how Fingerprint combines multiple signals to identify fraudulent actors, how to distinguish legitimate AI agent use from anonymous or malicious bots, and how Fingerprint’s research team uncovered and disclosed a privacy vulnerability in Firefox and Tor that could have been used to track people across the web. Full Disclosure: This episode is sponsored by Fingerprint Sponsorship inquiries: [email protected] The post Fraud Prevention in the Age of AI Agents appeared first on Software Engineering Daily.

AI coding agents can already reach well beyond the code in front of them. Through connections to tools like Slack, Jira, and Sentry, an agent can pull in issues, discussions, and production signals from across an organization. However, that context is scattered across many separate systems, with no shared map of how it all connects and no common controls over what an agent is allowed to touch. For a large enterprise, stitching that together while staying compliant, auditable, and sometimes fully cut off from the internet is a hard problem. GitLab runs one of the major platforms where software gets built, hosted, and shipped. That gives it a wide view of everything around the code, which shapes how it is approaching the agent era. The bet is that AI is most useful when it can draw on the full context of a project and stay under enterprise control, rather than acting as a point tool bolted onto a single repository. Getting there means wrestling with hard questions about governance, agent identity, and how much autonomy to hand over. Tim Zallmann is the VP of Engineering at GitLab. In this episode, he joins Gregor Vand to discuss bringing AI to the full software development lifecycle, why running agents under enterprise control matters for governance and auditing, how to track which human is behind an agent’s actions, the realities of shipping air-gapped software, and how the space is shifting as new players move into code hosting. Sponsorship inquiries: [email protected] The post GitLab and the Evolution of DevSecOps appeared first on Software Engineering Daily.

SED News is a monthly podcast from Software Engineering Daily where hosts Gregor Vand and Sean Falconer break down the biggest stories shaping software engineering, Silicon Valley, and the broader tech industry. In this episode, Gregor and Sean cover the PHP remote code execution flaw that hit an estimated 70 percent of the internet, the recording device an OpenAI employee hid in a conference room, and a busy run of deals including Chroma joining Replit, Cloudflare taking Deno, and Supabase acquiring Turso. The main topic tours the AI graveyard, sorting recent product failures into patterns: features swallowed by bigger platforms, runaway hits too costly or risky to sustain, interfaces made redundant by agents, and hardware that never materialized. As always, the episode wraps up with a few standout Hacker News threads, including why washing machines took 50 years to catch on, a location-aware local Wikipedia, and a Figma quirk that traces back to the Windows Numlock key. Sponsorship inquiries: [email protected] The post SED News: PHP’s Megabug, a Hidden Mic at OpenAI, and Dead AI Products appeared first on Software Engineering Daily.

Demis Hassabis founded DeepMind in 2010, before machines could reliably tell a cat from a dog. He believed that artificial general intelligence was achievable, and that it should be built safely and deliberately. Along the way, Hassabis shared the 2024 Nobel Prize in Chemistry for AlphaFold, the system that cracked the fifty-year problem of predicting protein structures. Fifteen years on, the LLM race has erupted across rival labs and countries, and AI has become one of the most consequential and contested technologies of the era. Sebastian Mallaby is a two-time Pulitzer Prize finalist and a longtime chronicler of the collision between innovation and capital, from hedge funds to central banking to Silicon Valley. His latest book, The Infinity Machine, is a portrait of Hassabis and DeepMind built on more than thirty hours of candid conversation, beginning just as ChatGPT set off the AI frenzy, and drawing as well on Hassabis’s estranged cofounder, his rivals, and academic pioneers who now fear for human survival. Mallaby is also the Paul A. Volcker Senior Fellow for International Economics at the Council on Foreign Relations. In this episode, Sebastian joins Kevin Ball to talk about Demis Hassabis and the founding of DeepMind, the pioneering breakthroughs that followed, and how the field arrived at the current moment in AI. Photo by Jeremy Sherlick The post Demis Hassabis and the Race to Build AI with Sebastian Mallaby appeared first on Software Engineering Daily.

The rapid rise of AI has set off a flurry of legal and regulatory activity. There is no single AI law to follow. Instead, there are overlapping circles of regulation, where privacy, cybersecurity, consumer protection, employment, and IP laws all continue to apply alongside newer AI-specific rules. Europe has its EU AI Act, but the U.S. has no federal equivalent yet. In its place is an emerging patchwork of more than 150 state AI laws, and the picture shifts every few months as new legislation and guidelines arrive. For engineers and tech companies, it can feel impossible to know what applies and where the real risks lie. Shannon Yavorsky is a data lawyer who co-leads the Cyber, Privacy and Data Innovation group and the AI practice at the international law firm Orrick. She advises companies across sectors from health technology to financial services on how to develop and deploy AI responsibly amid this evolving regulatory environment. In this episode, Shannon joins Kevin Ball to make sense of that landscape. They discuss how to map the concentric circles of regulation that actually apply to you, the risk spectrum separating a low-stakes manufacturing tool from a high-stakes system making loan or healthcare decisions, the problem of shadow AI and why recorded meetings can become a litigation liability, how to build an AI governance program, and more. Sponsorship inquiries: [email protected] The post AI Regulation and What Every Tech Company Should Know appeared first on Software Engineering Daily.