Two of twenty-five package managers check the download
A researcher put 25 package managers behind a proxy that could rewrite whatever the repository sent, and found that two verify package contents by default and one verifies signatures. Replit charged 25 cents for an agent checkpoint while some of those jobs were costing it several dollars, and Cloudflare bought a year of traffic growth by splitting one schema before it tried anything clever.
How we Organise
The price held at twenty-five cents while the job ran into dollars
Stripe published notes from the second Monetize conference. More than 300 people came to argue about how to price it. Replit charged 25 cents for an agent checkpoint back when its agents ran for a few minutes. Runtimes grew. Some jobs went on to cost Replit several dollars. The price stayed where it was. The company moved to usage-based billing to close the gap. Two-thirds of the companies on the Forbes AI 50 list now price by usage.
We tell a finance team that the money leaves before anything comes back, and that a price set against an early guess will not survive the work getting slower.
Spend precedes benefit.
Clay’s head of finance runs the same discipline from the other end. Model tokens and third-party data are passed through at cost. Clay accepts its own AI spending outgrowing revenue only where that spending buys something the company could not otherwise have. These are conference notes written by the host. Every figure is a speaker describing their own company. There is no sample behind it and nobody checking.
How we Build
One schema split bought a year of traffic growth
Cloudflare’s data team has spent five years holding hardware flat while traffic compounds. The pipeline carries roughly two billion events a second. The first of the moves was the cheapest of them. In 2022 they took a single schema that forced every consumer to ingest every product’s fields. They replaced it with product-specific schemas. The bandwidth on the backbone fell by 35 to 40 per cent. Compression, late replication, producer-side sampling and staged aggregation came afterwards, and shed about 70 GB/s more.
Our position is that a data product is built at the size of the capability it serves, and that one stream everybody has to filter is a design fault rather than a saving.
The data products inside a domain are sized to the capabilities they serve, an answer is assembled inside one domain rather than across the enterprise, and each new product is reviewed by a machine against the written design principles for data products.
A design review can use the ordering. The split came before any of the clever work, and on its own it bought about a year of growth. It is one company’s own telemetry, written up by the team that built it. Cloudflare states the limit itself. Half of one dataset’s reduction was erased by organic growth inside two months.
How we Assure
Two of twenty-five package managers check the download
A Trail of Bits researcher put 25 package managers behind a proxy that could rewrite whatever the repository sent. The proxy’s certificate was installed in the image, so that the simulation would be exact. Run with default flags, two of them verified the contents of a package and only one of them verified signatures. Nine do not check against a lockfile at all. Pub computes the hash, finds the mismatch, reports it, installs the package anyway and rewrites the lockfile. GitHub shipped workflow lockfiles for Actions a day earlier. Its own note says locking tells you nothing about whether the dependency is safe.
We ask a client to show us a policy’s check and the day it stopped something going out of the door.
Every codified policy states where its test runs, and one of them has stopped a release.
The second of those clauses is the one that firms skip. Pub is what skipping it looks like inside a tool that millions of people run. One researcher tested one package per manager on one operating system. He says plainly that this shows a developer following ordinary conventions is exposed, and not that everyone is. Several of the behaviours are documented choices their maintainers defend.