Daily Engineering Intelligence

Technology Newspaper

← Back to Home

Engineering Intelligence β€” Monday

October 5, 2026

πŸ”₯ What Changed

Quiet Monday β€” Go EMPTY; DistSys: Spanner queues; Auth/IAM: SAML teardown as Worth Your Time; AI/OCR held.

Spanner queues: native transactional messaging

Google Cloud (Oct 2) β€” Native transactional messaging inside Spanner: enqueue is just another write in the same ACID transaction as the state change β€” the transactional-outbox pattern built into the database. Under the hood: queue tables interleaved with parent rows; DeliverTime for scheduled delivery + atomic cancel via DELETE in the same txn; workers pull via the RECEIVE_ TVF with a SpannerLeaseToken + RENEWLEASE_; ACK = DELETE with ASSERT_ROWS_MODIFIED 1, so a stalled worker cannot overwrite newer state after its lease expires. At-least-once delivery + at-most-once ACK β†’ exactly-once processing when TaskId doubles as the external idempotency key.

Why you care: Board DistSys 48 β€” real event-driven mechanics (outbox / leases / scheduled cancel / lease-race ACK), not Kafka-cap burn. Read it as transactional outbox-in-DB messaging craft, not the agent-marketing wrapper. Caveat: ASSERT_ROWS_MODIFIED protects the DB write only β€” external side effects still need TaskId as an idempotency key.
Read on Google Cloud Blog β†’

πŸ“š Worth Your Time

SAML: A fractal of bad design

Trail of Bits / Matt Schwager (Sep 21) β€” Protocol-design teardown of SAML: XML foundation + C14N / parser-differential bugs, enveloped vs detached signatures, kitchen-sink ossification. Walks the attack history from Go encoding/xml round-trip CVEs (2020) through the 2025 GitHub Enterprise / β€œSign in as anyone” bypasses, and ends with OIDC migration advice (SP: hold the line; IdP: build a sunset path).

Why you care: Board Auth/IAM rising (SAML/OIDC named); Go encoding/xml adjacent. Two weeks old β†’ Worth Your Time, not news.
Read on Trail of Bits β†’