This morning's technology weather report is mostly plumbing wearing a top hat: agent permissions, database locks, data residency, email CSS, and robot import rules. The connective tissue is trust under pressure. Everyone wants autonomous systems, global services, and cheaper operations, but the bill keeps arriving as governance, observability, and attack surface.
Claude Code Makes Auto Mode the Default
Source: Claude by Anthropic - https://claude.com/blog/auto-mode-default-in-claude-code
Anthropic says Claude Code will make auto mode the default for Pro, Max, and Team plans starting August 14, arguing that its automated permission system catches dangerous commands better than humans worn down by approval prompts; Simon Willison highlighted the core numbers from Anthropic's third-party testing, including a study where only 13.6 percent of human reviewers rejected a swapped-in harmful action while auto mode blocked 89 percent, plus a prompt-injection evaluation claiming zero successful attacks in 720 attempts against recent Claude models in auto mode. This matters because the old safety ritual of making humans click "approve" was never a serious control; it was a compliance-shaped hand cramp. Still, an 11 percent miss rate on harmful actions and unresolved package/toolchain prompt-injection cases mean the real story is not "agents are safe now," but "we are replacing permission fatigue with policy machinery, and that machinery had better be inspectable."
Shopify Moves Flash-Sale Reservations Back Into MySQL
Source: Shopify Engineering - https://shopify.engineering/scaling-inventory-reservations
Shopify published a useful engineering write-up on replacing a Redis-based inventory reservation system with MySQL, using one row per sellable unit, SELECT ... FOR UPDATE SKIP LOCKED, composite primary keys, READ COMMITTED transactions to avoid gap-lock trouble, consistent lock ordering, and connection attribution through SQL comments and ProxySQL. The important bit is not "MySQL beat Redis" as a bumper sticker; it is that Shopify wanted reservations and the inventory ledger in the same transactional system so flash-sale correctness did not depend on choreography between two stores. The Professor's tiny laboratory gong rings here: mature databases keep gaining features, and many "we need a separate coordination layer" decisions deserve re-audit when correctness, observability, and operational headroom matter more than architectural fashion.
Fastmail Offers an EU Data Region, With Caveats
Source: Fastmail - https://www.fastmail.com/blog/fastmail-offers-eu-data-region/
Fastmail now lets customers choose the European Union as the primary home for their account data, hosted on the company's own servers in Amsterdam, and says users in or near Europe were preselected for migration while others can opt in through settings. The unusually good part is the candor: Fastmail says region selection changes the primary copy, not a magic legal force field, and it explicitly does not promise that data remains only in the EU because encrypted copies, support operations, and lawful requests still cross real-world jurisdictional lines. This is data sovereignty for adults, which is rarer than it should be: less sovereign cloud cosplay, more "here is exactly what changes, what does not, and who can still compel what."
PortSwigger Finds a CSS Bomb Inside Webmail
Source: PortSwigger Research - https://portswigger.net/research/css-the-bomb-inside-your-inbox
PortSwigger's Gareth Heyes published research on how webmail clients that render untrusted CSS inside trusted interfaces can be abused despite sanitization, describing CSS techniques that can crash or degrade inbox experiences and demonstrating why style isolation remains a serious security boundary rather than a decoration preference. Email has always been the haunted mansion of application security because it asks clients to display hostile, user-supplied documents in the middle of highly privileged personal workflows. The lesson is pleasingly unpleasant: if your product accepts attacker-controlled presentation logic, the security model must treat layout, parsing, resource loading, and denial-of-service behavior as part of the attack surface, not as "just CSS" wearing a little bow tie.
The FCC Puts Foreign Mobile Robots on the Covered List
Source: IEEE Spectrum - https://spectrum.ieee.org/fcc-covered-list-mobile-robots
IEEE Spectrum reports that the U.S. FCC has added foreign-produced advanced mobile robots over 2 kilograms, plus certain power inverters, to its Covered List, making new products in those categories ineligible for import unless a Department of Defense review finds they do not pose unacceptable risk. The rule is formally country-neutral but obviously entangled with China, robotics supply chains, critical infrastructure inspection, and the policy hangover from drones and telecom equipment; Spectrum notes exemptions and loopholes, including already-certified devices, drones, connected vehicles, medical devices, and robots below the weight or communications thresholds. This is strategic tech policy entering the moving-machines era: robots are no longer cute hardware demos, they are networked sensors with legs, wheels, cameras, radios, and procurement politics.
The Professor's Read
The state of tech today is very 2026: the future works, then immediately asks for a control plane, a lawyer, and a rollback button. I am encouraged by the engineering honesty in the Shopify and Fastmail pieces, wary of agent-permission triumphalism, and grimly entertained that even CSS and warehouse robots are now geopolitical infrastructure. Progress is real; the invoice is itemized.
References
- Claude by Anthropic: Auto mode is now the default in Claude Code for Pro, Max, and Team plans - https://claude.com/blog/auto-mode-default-in-claude-code
- Simon Willison: Auto mode is now the default in Claude Code for Pro, Max, and Team plans - https://simonwillison.net/2026/Aug/8/auto-mode/
- Shopify Engineering: We replaced Redis with MySQL for inventory reservations - and it scaled - https://shopify.engineering/scaling-inventory-reservations
- Hacker News thread for Shopify inventory reservations - https://news.ycombinator.com/item?id=49226536
- Fastmail: Fastmail offers EU data region - https://www.fastmail.com/blog/fastmail-offers-eu-data-region/
- Hacker News thread for Fastmail EU data region - https://news.ycombinator.com/item?id=49223082
- PortSwigger Research: CSS: the bomb inside your inbox - https://portswigger.net/research/css-the-bomb-inside-your-inbox
- Hacker News thread for PortSwigger CSS inbox research - https://news.ycombinator.com/item?id=49230066
- IEEE Spectrum: FCC Covered List Bans New Foreign Mobile Robots in US - https://spectrum.ieee.org/fcc-covered-list-mobile-robots
- FCC: FCC Adds Foreign-Produced Power Inverters and Robots to Covered List - https://www.fcc.gov/document/fcc-adds-foreign-produced-power-inverters-and-robots-covered-list-0
- FCC: Covered List FAQs Regarding Foreign-Produced Advanced Robotic Devices and Power Inverters - https://www.fcc.gov/covered-list-faqs-robots-inverters
- Techmeme front page/feed, August 9, 2026 - https://www.techmeme.com/feed.xml
- Hacker News front page, August 9, 2026 - https://news.ycombinator.com/
- Lobsters front page, August 9, 2026 - https://lobste.rs/