Allow loading remote contents and showing images to get the best out of this email.FAUN.dev's DevOps / SRE / Platform Engineering Weekly Newsletter
 
🔗 View in your browser.   |  ✍️ Publish on FAUN.dev   |  🦄 Become a sponsor
 
Allow loading remote contents and showing images to get the best out of this email.
 
DevOpsLinks
 
This week in DevOps, with Dolly the Cow
 
 
📝 A Few Words
 
 
The Anthropic incident is a perfect masterclass in The Reliance Paradox.

Anthropic built "Undercover Mode" to hide AI involvement when employees use Claude on public repos, and to prevent internal details like model codenames from leaking in the process.

They hid secret model names like "Capybara" by spelling them out one letter at a time in code (String.fromCharCode(99,97,112,...)) so that Anthropic's own build tools, which scan the codebase for forbidden strings before publishing, wouldn't catch it.

They also kept a blocklist of sensitive words that gets automatically stripped from the product before it ships to users.

Then they shipped the entire source code in a .map file because someone forgot *.map in .npmignore.

This is exactly at the core of the paradox: the more we trust a "perfect" system to keep us safe, the less we pay attention to the simple human mistakes that eventually break it.

If the world's leading AI safety experts can't even secure a basic config file, "perfect" safety is actually just an illusion. You already know this :)

Have a great week,
Aymen
 
 
🔍 Inside this Issue
 
 
AI tooling is starting to look less like magic and more like an audit trail, and the npm supply chain is still a little too easy to poison on a quiet afternoon. On the other side: practical release tactics, hard-earned scaling lessons, and a reminder that RAM is now a line item worth optimizing.

🕵️ 16 Things Anthropic Didn't Want You to Know About Claude Code
🚦 Deployment strategies: Types, trade-offs, and how to choose
🧠 RAM is getting expensive, so squeeze the most from it
🏗️ Scaling a Monolith to 1M LOC: 113 Pragmatic Lessons from Tech Lead to CTO
🤖 Scaling Autonomous Site Reliability Engineering: Architecture, Orchestration, and Validation for a 90,000+ Server Fle
🧨 Supply Chain Attack on Axios Pulls Malicious Dependency from npm

Ship smarter, trust less, measure everything.

Until next time!
FAUN.dev() Team
 
 
⭐ Patrons
 
faun.dev faun.dev
 
Learn Git in a Day: From Zero to Real-World Workflows
 
 
Most developers pick up Git by copying commands from the internet and hoping for the best. It works, until it doesn't. One messy merge conflict or a detached HEAD, and suddenly you're stuck with no idea what went wrong or how to fix it.

This course takes a different approach. Instead of handing you a list of commands to memorize, it builds your understanding from the ground up - how Git actually thinks about your files, your history, and your changes.

You'll go from "what's a commit?" to confidently branching, merging, resolving conflicts, collaborating with a team, and keeping a clean project history.

No prior Git experience needed. Just basic comfort with a terminal and you're good to go. By the end of the day, you won't just know the commands - you'll understand why they work, and you'll be able to think your way through problems you've never seen before.

Stop guessing and start understanding how git works.

Enroll now and learn Git the right way
 
 
👉 Spread the word and help developers find you by promoting your projects on FAUN. Get in touch for more information.
 
🐾 From FAUNers
 
faun.dev faun.dev
 
16 Things Anthropic Didn't Want You to Know About Claude Code
 
 
An npm source map exposed Claude Code's internal TypeScript: tool registry, system prompts, permission classifiers, pricing, feature flags, and employee tooling.

It revealed an always-on Undercover Mode that strips AI attributions, enables character-level AI tracking, and routes telemetry under codenames like Capybara and Tengu. The dump also shows compiled safety-bypass gates.
 
 

👉 Got something to share? Create your FAUN Page and start publishing your blog posts, tools, and updates. Grow your audience, and get discovered by the developer community.

 
🔗 Stories, Tutorials & Articles
 
digitalocean.com digitalocean.com
 
Scaling Autonomous Site Reliability Engineering: Architecture, Orchestration, and Validation for a 90,000+ Server Fle
 
 
Cloudways scaled from a bootstrapped startup to a leading managed PHP hosting service, encountering challenges with growing support load. Early on, Cloudways recognized the opportunity to implement an AI-based SRE agent to reduce the burden on support teams and provide faster diagnosis and resolution for web applications. Cloudways Copilot, powered by DigitalOcean Kubernetes platform and Ansible Server, efficiently monitors and troubleshoots webstack issues on a fleet of 90K servers.
 
 
socket.dev socket.dev
 
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
 
 
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
 
 
theregister.com theregister.com
 
RAM is getting expensive, so squeeze the most from it
 
 
The Register contrasts zram and zswap. It flags a patch that claims up to 50% faster zram ops. It notes Fedora enables zram by default.

It details that zram provides compressed in‑RAM swap (LZ4). zswap compresses pages before writing to disk and requires on‑disk swap.

Distros and OSes ship memory compression by default. Swap shifts toward compressed in‑RAM tiers. Admins face revising swap layouts.
 
 
circleci.com circleci.com
 
Deployment strategies: Types, trade-offs, and how to choose
 
 
Deployment strategies control traffic shifts, rollback speed, and release risk. Options: canary, blue‑green, rolling, feature flags, shadow, immutable, and GitOps.

Strategies trade production risk for setup cost. They pair with Argo Rollouts, Kayenta, ArgoCD/Flux, service meshes, and flag platforms.

Pipelines must automate schema migrations, observability, and rollback.

Teams converge on progressive delivery - combining GitOps, automated canaries (Argo Rollouts/Kayenta), and feature flags. Outcome: Fewer surprises. Fewer 2 a.m. all‑hands.
 
 
semicolonandsons.com semicolonandsons.com
 
Scaling a Monolith to 1M LOC: 113 Pragmatic Lessons from Tech Lead to CTO
 
 
The post discusses performance issues related to page counts, long cron-job reads, RAM pressure, and offloading work to background jobs. It also touches on common sources of front-end performance issues, the importance of running EXPLAIN on DB queries, and the benefits of cultivating a culture of openness in discussing performance with team members. Additionally, it emphasizes the need for monitoring layers in software testing and the importance of having multiple team members capable of fixing critical issues.
 
 

👉 Got something to share? Create your FAUN Page and start publishing your blog posts, tools, and updates. Grow your audience, and get discovered by the developer community.

 
⚙️ Tools, Apps & Software
 
github.com github.com
 
borgbackup/borg
 
 
Deduplicating archiver with compression and authenticated encryption.
 
 
github.com github.com
 
nix-community/disko
 
 
Declarative disk partitioning and formatting using nix
 
 
github.com github.com
 
paperclipai/paperclip
 
 
Open-source orchestration for zero-human companies
 
 
github.com github.com
 
openai/codex-plugin-cc
 
 
Use Codex from Claude Code to review code or delegate tasks.
 
 
github.com github.com
 
lirantal/npm-security-best-practices
 
 
Collection of npm package manager Security Best Practices
 
 

👉 Spread the word and help developers find and follow your Open Source project by promoting it on FAUN. Get in touch for more information.

 
🤔 Did you know?
 
 
Did you know that Google SRE introduced error budgets to end the tug-of-war between shipping features and improving reliability? As long as a service stays within its SLO, releases keep flowing, but once the budget is burned the team halts non-critical changes until reliability recovers. The budget is not just a dashboard metric - it feeds directly into release gating, postmortem action items, and quarterly planning, forming a closed control loop that makes SLIs and SLOs operational levers instead of vanity numbers.
 
 
🤖 Once, SenseiOne Said
 
 
"The cloud sells you elasticity, then bills you for every place your system forgot how to say no. SRE is mostly teaching distributed software the difference between allowed and possible."
- SenseiOne
 

(*) SenseiOne is FAUN.dev’s work-in-progress AI agent

 
⚡Growth Notes
 
 
Most teams that adopt container image scanning in CI end up training developers to bump base image tags until the scanner goes green, without ever reading the CVE description or checking whether the vulnerable code path is actually reachable. The result is a pipeline that feels secure but produces a team that cannot triage a real exploit under pressure, because the muscle they built is suppression, not analysis.
 
Each week, we share a practical move to grow faster and work smarter
 
😂 Meme of the week
 
 
 
 
❤️ Thanks for reading
 
 
👋 Keep in touch and follow us on social media:
- 💼LinkedIn
- 📝Medium
- 🐦Twitter
- 👥Facebook
- 📰Reddit
- 📸Instagram

👌 Was this newsletter helpful?
We'd really appreciate it if you could forward it to your friends!

🙏 Never miss an issue!
To receive our future emails in your inbox, don't forget to add community@faun.dev to your contacts.

🤩 Want to sponsor our newsletter?
Reach out to us at sponsors@faun.dev and we'll get back to you as soon as possible.
 

DevOpsLinks #523: 16 Things Anthropic Didn't Want You to Know About Claude Code
Legend: ✅ = Editor's Choice / ♻️ = Old but Gold / ⭐ = Promoted / 🔰 = Beginner Friendly

You received this email because you are subscribed to FAUN.dev.
We (🐾) help developers (👣) learn and grow by keeping them up with what matters.

You can manage your subscription options here (recommended) or use the old way here (legacy). If you have any problem, read this or reply to this email.