标签：#Metrics

Andrew Swerdlow shares how Roblox scales autonomous software development from prompt to production. He discusses building robust security sandboxes, extracting institutional knowledge via code review exemplars, updating engineering infrastructure, and redefining productivity metrics around feature velocity and long-running AI turns to achieve trusted, automated deployment at scale. By Andrew Swerdlow

One of the most common assumptions in engineering leadership is that a rising number of reported incidents signals declining system reliability. However, a recent article from Great Circle argues that the opposite is often true: an increase in incident counts may actually indicate that an organization's incident management culture is improving. By Craig Risi

TL;DR If you're a five-person startup shipping a Node.js API and you want a metrics dashboard by Friday, send your telemetry to a managed backend and keep only the instrumentation layer inside your own repo. The alternative — standing up a time-series database, an object store for long-term blocks, and a dashboard service — puts three more components on an on-call rotation that hasn't earned its first SLO yet. Settle the wire format now and treat the backend as a config line you can change later. I own the platform team's roadmap, which in practice means I'm the person who defends the monitoring bill in a budget review and also the person who gets paged when a disk fills at 03:00. Those two jobs pull in opposite directions, and most of the advice online is written by people who only hold one of them. Usually the pager wins the argument. Should a startup run its own metrics stack, or pay for a managed dashboard? Start with capacity, because that's the step everyone skips before signing anything. A moderately instrumented Node.js API — say 40 HTTP routes, two queue workers, default runtime and event-loop metrics, one latency histogram with ten buckets — sits somewhere around 3,000 to 8,000 active series per process. Multiply by replicas. Multiply again by every environment you keep alive, including the staging cluster nobody admits to. You are at 50k active series before a single engineer has written a custom counter, and a self-hosted scraper will chew through that on a 2 GB VM without noticing. It will still be fine at 500k. Past a few million active series you're into sharding, remote storage, and a retention argument with whoever pays for object storage — that's the point where the self-hosted route stops being free and turns into a project with a headcount attached. None of that work is hard. It's just never zero. Dimension Self-hosted stack Managed metrics backend Time to first dashboard 1–3 days under an hour Who owns retention you, plus the storage bill vendor

Quotient CEO Lizzie Matusov explains why soaring AI spend often fails to improve software delivery. She presents a research-backed AI maturity framework designed to help engineering leaders move beyond vanity metrics like token usage, align organizational AI adoption, and address critical bottlenecks across the software development life cycle to deliver measurable business outcomes. By Lizzie Matusov

A portfolio can look good on the usual scorecard and still answer the wrong question. One line says return was high. Another says risk-adjusted performance was acceptable. A third says drawdown stayed inside a tolerable range. Then the market turns, the benchmark starts recovering, and the thing I actually care about is different: how efficiently did the portfolio catch up? That is where a new metric can fool its own author. If I build a recovery measure and it moves almost exactly like an existing ratio, I have created a longer name for the same signal. The right acceptance test is geometric: a useful metric should cast a different shadow. This is the rule I used while validating Hyperlogarithmic Benchmark Catch-Up Ratio (HBCR): orthogonality to existing measures is a first-class test, not a chart for the appendix. 1. A new metric has to earn its axis HBCR was built to measure benchmark-relative recovery dynamics. The research page states the motivation plainly: traditional benchmark-relative metrics often fail to capture the true dynamics of investment performance, especially during market recoveries [ A New Metric for Private Equity Risk Adjusted Returns , Calibration of Risk and Correlation in Private Equity ]. That framing matters because the obvious validation path is tempting and weak. You compare the new number with familiar performance measures, find a comforting relationship, and declare victory. But a high correlation with a well-known score can be a warning. If HBCR strongly tracked Sharpe Ratio, it would probably be an expensive synonym for risk-adjusted return. The acceptance test I wanted was sharper. HBCR should have some relationship with performance, because recovery has economic content. It should also avoid collapsing into the same direction as Sharpe Ratio, Beta, Volatility, Alpha, Total Return, or Max Drawdown. Written as a predicate, the test has two sides. Let $\mathcal{T}$ be the set of metrics already on the scorecard, $\rho_{n,m}$ the corr

Use metrics APIs for cron-job, API-failure, and business-event charts, then add a separate heartbeat monitor for jobs that never start. That is the smallest stack I would put on call for a small SaaS. A metrics dashboard can show success and failure counts, duration, backlog size, and error-rate trends; it cannot prove that a scheduler actually invoked a job. Healthchecks-style monitoring closes that specific gap. It still isn't full monitoring coverage, and I wouldn't describe it that way in an SLO review. The distinction matters because a failed run and a missing run leave different evidence. An API error usually increments something. A business event can be counted. A cron job that never fires may produce nothing at all — no duration, no failure, no final log line. No signal. How should a backend metrics dashboard combine cron jobs, API failures, and healthchecks? Start with the questions an operator must answer, not with a vendor menu. For cron jobs, I want a success count, a failure count, duration, and any queue backlog that can delay completion. For API failures, I want error counts and an error-rate trend beside request volume, because a raw count without a denominator can make ordinary traffic growth look like a regression. For business events, I want domain verbs: invoices issued, imports completed, or messages accepted. Those widgets belong on one dashboard because they describe the same service from different angles. Heartbeat monitoring is a separate control. A job reports a start or completion ping to Healthchecks, Cronitor, or an equivalent tool; if the expected ping doesn't arrive within its schedule and grace period, that system owns the missing-run signal. Keep that alert outside the metrics query path. Otherwise the component that failed to emit data is also the component being asked to notice its own silence. Silence counts. I've learned to write the failure matrix before drawing the dashboard. In one incident, a call returned 200, but the side e

A lot of platform teams face a problem: they build a lot of really cool stuff, and then their developers don't use it. Be visible to management, talk to stakeholders and listen to their problems, make your value measurable with metrics like DORA, create narratives, and show the hidden pain to make it personal: these are lessons that Lucas Hornung and Christian Matthaei presented. By Ben Linders

In today's mobile-first world, users expect authentication to be both secure and effortless. Typing passwords every time an app is opened not only impacts the user experience but also introduces security risks if passwords are weak or reused. Biometric authentication solves this problem by allowing users to verify their identity using Fingerprint , Face ID , Touch ID , Iris Scanner , or even their device's PIN/Password . If you're building a React Native application, @sbaiahmed1/react-native-biometrics is one of the most comprehensive biometric libraries available. Beyond simple authentication prompts, it offers hardware-backed cryptographic key management, biometric enrollment detection, device integrity checks, StrongBox support, and compatibility with both the React Native New Architecture and Expo. In this article, we'll explore everything this library offers and learn how to integrate biometric authentication into a React Native application. Why Biometric Authentication? Traditional authentication methods come with several drawbacks: Passwords are easy to forget. Weak passwords are vulnerable to attacks. OTP-based logins can be slow and frustrating. Users often abandon apps with poor login experiences. Biometric authentication addresses these challenges by providing: 🔒 Enhanced security ⚡ Faster authentication 😊 Better user experience 📱 Native platform support 🔑 Secure fallback using device credentials Whether you're building a banking app, healthcare platform, enterprise application, or e-commerce app, biometric authentication has become an expected feature. Installation Install the package using npm: npm install @ sbaiahmed1 /react-native-biometric s or with Yarn: yarn add @ sbaiahmed1 /react-native-biometric s For iOS: cd ios pod install Platform Configuration Before using biometric authentication, configure the required permissions for both Android and iOS. Android Open your android/app/src/main/AndroidManifest.xml file and add the following permissions: <

OrbitLens Ace → ace.orbitlens.io A busy quarter is easy to stage. Code that's still there in two years isn't. Pick any metric a team has ever used to judge people, and someone has quietly figured out how to move it without doing the underlying thing. Lines of code rewarded typing, so people typed. Commit counts rewarded committing, so commits got smaller and more frequent. Velocity rewarded closed points, and points drifted upward until a "3" meant nothing. DORA measured how often you deploy, so teams shipped trivial changes just to move it. Even churn — the number the "code health" tools lean on — is something you can lower on purpose, which means you can manage the number instead of the mess underneath it. None of that requires dishonest engineers. It's Goodhart's law doing what it always does. Every one of those numbers is a measure of activity , and activity is cheap to produce. Once you're paid for activity, the fastest way to get paid more is to produce more of it — not more of whatever the activity was supposed to be a sign of. So the question worth asking isn't which activity metric is least bad. It's whether a git history contains anything at all that you can't move just by being busier. It turns out there's one. And it's not because we were clever — it's because of what the thing is actually made of. What lasts isn't something you do Take everything a person wrote, wait a while, and ask a smaller question than "did they work hard." Ask whether the specific lines are still there. Not reverted, not rewritten, not quietly swallowed by someone else's refactor. Still holding weight at HEAD. That's survival. We read it with time-decayed git blame : a line's weight fades month by month unless the line keeps existing, and it counts for more once other people have built on top of it instead of leaving it as a private island. Survival that others have built on is what we call gravity — the structural pull that outlives the person who created it. Try to game it and w

Introduction: The Illusion of Productivity Metrics Traditional software development metrics—velocity charts, commit counts, bundle size—are the comfort objects of the coding world. They sit on dashboards, glowing with the promise of insight, but in reality, they’re often lagging vanity numbers . They don’t capture the narrative of a week’s work; they don’t reveal the decisions , the reversals , or the patterns that define progress. Instead, they deform the truth by oversimplifying it, much like a rubber band stretched too thin—it snaps under pressure, failing to hold the complexity of real work. Consider the mechanical process of a commit. A commit is a snapshot , a frozen moment in time. But software development isn’t a series of snapshots; it’s a sequence . When you string commits together without context, you miss the heat of decision-making—the back-and-forth, the undoing, the redoing. This is where traditional metrics fail. They don’t account for the thermal expansion of ideas, the way a decision made on Monday might cool by Friday, only to be reheated and reshaped. Without a narrative, these metrics are like a machine running without lubrication: they friction against reality, wearing down under the weight of their own inadequacy. The Mechanism of Metric Failure Let’s break down the causal chain: Impact: Developers rely on metrics like commit counts to gauge productivity. Internal Process: These metrics are lagging indicators , reflecting past actions without context. They don’t capture the why behind the numbers—the decisions, the reversals, the thought process. Observable Effect: Developers miss critical patterns, such as repeated decision reversals, leading to inefficiencies and missed opportunities for improvement. It’s like trying to diagnose a car’s engine by looking only at the speedometer—you’ll never catch the misalignment in the gears. Narrative-Driven Insights: The Optimal Solution Contrast this with a narrative-driven approach . When you narrate a

GitHub added a tiny field to the Copilot usage metrics API this week that is going to create a lot of very confident spreadsheets. Enterprise and organization admins can now see ai_credits_used in the user-level Copilot usage reports. One field. Per user. Available for single-day and 28-day reports. It is not the invoice, and GitHub is careful to say it is a consumption signal rather than a billed total. Still, the shape is obvious. Now AI usage can sit next to adoption, activity, team, department, cost center, and whatever else the company already exports into a dashboard. That is useful. It is also exactly how a tool metric becomes a management metric. And once that happens, the question is no longer "can we measure AI usage?" The question is "what weird behavior will this metric create?" every useful metric becomes a temptation I understand why this field exists. If a company is paying for Copilot, especially with usage-based pieces attached to more expensive models and premium features, it needs some way to understand consumption. Platform teams need budget signals. Engineering leaders need adoption signals. Procurement needs something more concrete than "people seem to like it." Finance will eventually ask why one org burns through credits much faster than another. That is normal. The problem starts when a consumption signal is treated as a productivity signal. High AI credit usage might mean a developer is doing valuable work with agent mode, code review, test generation, refactoring, or research. It might also mean the developer is stuck, repeatedly asking the model to solve the wrong problem, generating code that gets deleted, or using a heavyweight model where a small one would have been fine. Low AI credit usage might mean a developer does not need much help. It might mean the work is mostly design, review, debugging, incident response, mentoring, or architecture. It might mean the codebase is small and well understood. It might mean the developer is skept

Observability isn't just a buzzword; it's a necessity, especially when diving into distributed systems. If you're using NestJS, you might want to take a look at RedisX. It's a modular toolkit that can boost the observability of your applications. A standout feature? The Metrics Plugin. It meshes well with Prometheus, delivering insights into Redis operations in your NestJS setup. Getting RedisX Metrics Rolling in NestJS So, first things first. To harness the power of RedisX Metrics, you need to set up your NestJS app with RedisX. This means installing some packages and configuring the RedisModule with the MetricsPlugin. Hit your terminal and run: npm install @nestjs-redisx/core @nestjs-redisx/metrics Now, let's tweak your AppModule . You want it to use RedisModule with MetricsPlugin: import { Module } from ' @nestjs/common ' ; import { ConfigModule , ConfigService } from ' @nestjs/config ' ; import { RedisModule } from ' @nestjs-redisx/core ' ; import { MetricsPlugin } from ' @nestjs-redisx/metrics ' ; @ Module ({ imports : [ ConfigModule . forRoot ({ isGlobal : true }), RedisModule . forRootAsync ({ imports : [ ConfigModule ], inject : [ ConfigService ], plugins : [ new MetricsPlugin ({ prefix : ' redisx_ ' , endpoint : ' /metrics ' , defaultLabels : { service : ' my-service ' } }) ], useFactory : ( config : ConfigService ) => ({ clients : { host : config . get ( ' REDIS_HOST ' , ' localhost ' ), port : config . get ( ' REDIS_PORT ' , 6379 ), }, }), }), ], }) export class AppModule {} Prometheus Metrics: What You Get With MetricsPlugin set up, your app now exposes a /metrics endpoint. Prometheus can scrape this endpoint, dishing out detailed metrics about your Redis operations. Here's a snapshot of what you get: redisx_cache_hits_total : Tracks total cache hits. redisx_lock_acquired_total : Total locks acquired. redisx_redis_commands_total : Total Redis commands run. Making Prometheus Work for You To get those insights, set up Prometheus to scrape your /metrics end

From anti-drone tech to face recognition, 2026 World Cup stadiums in the US, Canada, and Mexico are subjecting fans to an array of surveillance tech. Here’s what you need to know.

To provide SRE as a service, a team built a center of excellence, introducing Federated SREs and roles like production manager and technical tribe lead. They created a culture of data-driven conversations where SLOs and SLAs were democratised. Surviving growing cognitive load meant continuously simplifying architecture and embedding sovereignty and resilience into platform design decisions. By Ben Linders

Why your age-gating algorithm is probably doomed to fail in the wild For developers building in the computer vision and biometrics space, there is a massive gap between a model that passes a NIST benchmark and a system that survives the "child-with-a-VPN" test. Recent data indicates that roughly 32% of children are successfully bypassing age-gating tech. As engineers, our first instinct is often to blame the model—to tweak the weights, gather more training data, or tighten the threshold. But the technical reality is more sobering: the failure isn't in the algorithm; it's in the deployment architecture. The Problem with Probabilistic Logic in Binary Workflows Most age estimation models rely on analyzing biometric markers—skin texture, bone structure ratios, and periocular geometry. They produce a probabilistic age range. However, according to NIST's evaluation of age estimation software, to maintain a low false-positive rate, systems often need to set a "challenge age" between 29 and 33 years. If you are a dev tasked with keeping 17-year-olds off a platform, you are essentially forced to build a "buffer zone" of over a decade. If the system flags anyone who might be under 30, the UX becomes a nightmare. If you lower the threshold to 18, the false-negative rate skyrockets. This is the fundamental trade-off of probabilistic facial analysis: precision and recall are at constant war, and in a high-traffic production environment, the "noise" of real-world variables (poor lighting, low-res sensors, off-axis angles) makes consistency nearly impossible. The Breakdown of the Identity Handoff Beyond the model, there are three technical failure points that no amount of Euclidean distance analysis can fix if the pipeline is broken: The Signal-to-Noise Ratio at Source: Evaluation datasets are clean. Production images are taken on scratched lenses in low-light bedrooms. The delta between training distribution and inference-time reality is where the first 10% of accuracy vanishes.

Some AI-based video age-verification checks can be fooled with a fake mustache .