engineering Archives

Winsage

September 5, 2026

Microsoft engineer says “typing code is absolutely over,” and Windows 11 is already being built that way

David Fowler, an engineer with 18 years at Microsoft, claims that traditional software development methods are becoming obsolete, stating, “Typing code is absolutely over.” He has co-created technologies like SignalR and NuGet and currently leads Aspire, a toolchain for building distributed applications that emphasizes AI-driven development. CEO Satya Nadella noted that AI contributes to 20-30% of the code produced at Microsoft. While developers will still interact with code, manual typing is becoming less central, with a shift towards strategic software engineering tasks. Microsoft Research found that AI-generated suggestions in Visual Studio IntelliCode are often overlooked by developers. GitHub Copilot has evolved to autonomously perform tasks, including building Windows development environments as of February 2026. Linus Torvalds supports AI in Linux development, viewing it as a useful tool. A report from Veracode indicated that about 44% of AI-generated code contains known vulnerabilities, highlighting the need for oversight. Microsoft’s MDASH system uses AI for enhanced vulnerability assessments. Microsoft emphasizes native Windows development through the open-source WinUI 3 framework and provides resources for beginners using Copilot. Project Zenith aims to optimize Windows 11 for developers, supporting local AI-powered development. Fowler's statement signifies a transformation in developers' roles, focusing on strategic aspects rather than typing code, while the need for skilled software engineers remains essential.

Tech Optimizer

September 4, 2026

Object Storage + WAL: Lakebase Postgres for the agentic era

Agents interacting with traditional OLTP databases face bottlenecks at the storage layer due to data movement required for operations like deploying instances and managing replicas. Object storage solutions, such as Amazon S3, provide a more efficient and cost-effective alternative. The text discusses two OLTP models: data-centric and transaction-centric. The transaction-centric model emphasizes the importance of transaction history, which Postgres retains through its write-ahead log (WAL). The WAL records every modification before it is committed, allowing for the reconstruction of the database state as of a specific point in time. Lakebase Postgres introduces a two-layer architecture separating compute and storage. The compute layer handles SQL operations, while the storage layer ensures data durability and historical integrity. The WAL is streamed to safekeepers for replication, and the pageserver transforms WAL into materialized pages stored in object storage. This architecture allows for efficient read and write operations without direct interaction with object storage during queries. Key features of Lakebase Postgres include branching, which allows agents to create pointers to specific LSNs without copying data; instant restore capabilities that enable point-in-time recovery; time travel queries for accessing historical data; and read replicas that do not require data duplication. The system also supports scaling down idle compute nodes and eliminates the need for separate copies of data for transactional and analytical processing by storing a single durable copy in object storage. Overall, Lakebase Postgres enhances agent interactions with the database by leveraging object storage as a foundational element.

Winsage

September 4, 2026

Microsoft warns fake CAPTCHA is tricking Windows users into running malware

Microsoft has identified a new malware campaign called TerminalFix that uses fake CAPTCHA prompts to trick Windows users into executing malicious commands. This campaign is a variation of ClickFix attacks and employs deceptive pages that impersonate reputable services like Cloudflare. Instead of traditional CAPTCHA challenges, users are instructed to open PowerShell or Command Prompt and paste in commands, allowing attackers to execute complex scripts more easily. TerminalFix initiates a multi-stage intrusion, granting attackers persistent proxy access to the infected machine, which can lead to further exploitation of the company's network. The campaign relies on social engineering tactics, requiring user compliance with counterfeit verification instructions. Microsoft has released mitigation guidance, recommending restrictions on PowerShell access, monitoring for DLL sideloading, blocking outdated Flash plugins, and enabling cloud-delivered protection in Microsoft Defender Antivirus. The campaign poses significant risks to enterprise networks, but individual users should also be cautious about executing commands requested by websites.

AppWizard

August 29, 2026

Android 17 adds new protections against sneaky Wi-Fi tracking and web snooping

Google has introduced several network security enhancements in Android 17 to improve user privacy. One key feature is Encrypted Client Hello (ECH), which encrypts domain names to prevent external observers from monitoring user activities. ECH is integrated with private DNS and is enabled by default for apps using compatible networking libraries. Google claims to be the first major mobile operating system to implement widespread ECH support. Testing conducted by Jigsaw showed stable connection success rates and minimal interference across various networks. Additional security features in Android 17 include: - Local Network Protection, requiring apps to request permission before accessing devices on a user's home network. - Certificate Transparency, mandating public logging of certificates to detect forged ones. - A 2G Network Shutdown option for mobile operators to disable 2G services, reducing exposure to phishing messages.

AppWizard

August 28, 2026

Google warns Android app developers to reduce memory usage, with new thresholds set to begin in February 2027.

Google Play is implementing two key requirements to improve app quality and user experience. 1. Reducing App Memory Usage: Google Play is setting broader memory limits to prevent excessive memory consumption by apps. Developers must adhere to specific performance thresholds, including: - Dynamic Memory Usage: Monitoring memory used for an app's private data storage. - Bitmap Memory Usage: Ensuring bitmaps are not retained longer than necessary. - Optimized DEX Code: Achieving a minimum of 25% coverage with optimization tools like R8. To assist developers, Google Play has introduced tools for monitoring memory usage and tracking crashes due to insufficient memory. Warnings will be issued if apps exceed the new thresholds. 2. Ensuring a Seamless Device Migration Experience: Starting in April 2027, all apps supporting user sign-in must use the Android Restore Credentials API for automatic restoration of sign-in states when switching devices. Game apps are currently exempt, but guidance will be provided for handling authentication in gaming applications in 2027.

Tech Optimizer

August 27, 2026

Scammers Impersonate Microsoft to Push Fake Security Scans and Refund Fraud

A network of fraudulent websites, branded as SysScan, has been discovered, which falsely claims to evaluate antivirus software effectiveness through deceptive security scans. These sites manipulate users into uninstalling legitimate antivirus products and disclosing sensitive personal and banking information. Eleven distinct domains associated with SysScan have been identified, all hosted on a single server. The fraudulent scans generate misleading results based on static findings rather than actual system assessments, and users are coerced into believing their computers are at risk. The scams misrepresent normal browser behaviors as security threats and instruct victims to uninstall their antivirus software, compromising their defenses. The operation targets both individual and business users, collecting extensive personal information and utilizing remote-access tools. The data submitted is sent to Telegram via its bot API. Users are advised to disconnect from the internet and secure their devices if they suspect they have been compromised. Indicators of compromise include specific IP addresses and domains associated with the scam.

Tech Optimizer

August 25, 2026

EDB Brings Postgres-Proven Disaster Recovery to Petabyte-Scale WarehousePG Where Downtime Is Not Possible

On August 20, 2026, EnterpriseDB (EDB) announced the general availability of its Disaster Recovery feature for WarehousePG, enhancing EDB Postgres AI's analytical capabilities by enabling recovery of petabyte-scale data in minutes rather than days. This feature allows organizations to maintain a current recovery environment across on-premises, cloud, or hybrid setups, and provides flexibility in activating recovery. The implementation of Disaster Recovery for WarehousePG resulted in approximately 180 times faster recovery, with restore-point replay averaging 16 minutes, full backups decreasing from 44 hours to about 11 hours, and nearly 99% less query lock time. The recovery model was achieved without any modifications to the application architecture. WarehousePG leverages the Postgres framework for disaster recovery processes and includes built-in high availability to safeguard against component failures. The upcoming September version update will integrate Disaster Recovery configuration into WarehousePG Enterprise Manager, allowing operational teams to manage cluster health and resource utilization effectively.

Winsage

August 23, 2026

Microsoft explains why Pinball vanished from Windows: “We couldn’t afford to spend days studying the code”

3D Pinball was a space-themed game included in Windows XP since its debut in 1995. It was removed with the launch of Windows Vista due to a bug in the code that caused the game to be unplayable, not because of legal issues as commonly believed. The bug occurred during the transition of Windows XP to 64-bit architecture, where the ball would drop into the launcher and fall through the plunger. Microsoft engineer Raymond Chen, who worked on the project, noted that the original code was largely undocumented, making it difficult to fix. The game was licensed from Cinematronics and Maxis, which limited Microsoft's rights to bundling it within Windows and its Plus! packs, preventing a standalone release. Attempts to revive the game were hindered by these legal constraints. As of 2022, no official version of 3D Pinball has been included in Windows 11, and the licensing situation remains complicated due to the acquisition of Cinematronics and Maxis by Electronic Arts.

Winsage

August 22, 2026

Hackers abuse FTP server banners to deliver new Windows malware

Threat actors are exploiting FTP banners to conceal commands for deploying two undocumented remote access trojans (RATs), E4del and PINHOLE. This method was first observed by MalwareHunterTeam in July 2026, using shortcut files (.LNK) and FTP server banners as dead-drop resolvers to retrieve malicious commands. SOCRadar confirmed that this technique has been weaponized since early July 2026 and remains active, with new infrastructure identified as recently as August 2026. The attacks typically start with a ZIP archive leading to an LNK-based infection chain, likely initiated through phishing tactics. E4del is a Node.js-based RAT disguised within a digitally signed Electron application mimicking Discord, capable of executing commands, capturing screenshots, streaming desktops, and downloading additional payloads. It also includes a module for privilege escalation. PINHOLE retrieves its command and control configuration from Pinterest and SurveyMonkey, designed to leave a minimal footprint and employing shellcode fluctuation. It supports 14 commands, including file management and credential theft, but had only recorded 11 execution events at the time of analysis. SOCRadar notes that while using FTP banners is a novel approach, it is less stealthy than traditional web-based dead-drop resolvers. They provide indicators of compromise to help identify malicious infrastructure and infected machines.

Winsage

August 22, 2026

Researchers find way to weaponize Windows Defender’s own driver

Check Point Research revealed a technique that uses the boot-time remediation driver BTR.sys, part of Windows Defender, to execute kernel-level operations on Windows systems from Windows 7 to Windows 11 25H2. This method does not exploit software vulnerabilities but leverages BTR.sys, which is designed to remove locked malware components. Researchers reverse-engineered its undocumented protocol, leading to the creation of a proof-of-concept tool, BTR_CLI, that can install the driver as a service without standard management protocols. Once operational, BTR.sys can delete or move files, modify registry entries, and remove security binaries, including parts of Defender, during a specific period when the file system is writable. To exploit this technique, an attacker needs administrator privileges, specifically SeLoadDriverPrivilege. Although Microsoft does not consider this a critical issue due to the requirement of pre-existing administrative access, it highlights a significant potential vulnerability. There have been no documented real-world attacks using this technique.