Digest #229: AWS acquires DuckDB, Cloudflare frees 100TB of RAM, your executable as a SQLite database and on-call as theatre

Also inside: a $500-a-month AI security analyst built on AWS, Databricks running 2,000 AI incident investigations a day, and proof that plan mode doesn't make AI-written code any safer.

AWS signed a deal this week to acquire DuckLabs, the ~30-person Amsterdam team behind DuckDB, and the timing is the part worth staring at: it landed nine days after DuckDB previewed v2.0 with a client/server protocol.
Also, Cloudflare shaved 533 bytes off every DNS cache entry and got 100 terabytes of RAM back across its fleet, and I shared a good case for shipping your executables as SQLite databases.

If you’re interested in sponsoring this newsletter, feel free to reach out via LinkedIn or simply reply to this email.

My take: what AWS actually bought when it bought DuckDB

If you haven’t used it, DuckDB is SQLite for analytics. pip install duckdb, point it at a Parquet file in S3, run SQL. No cluster, no Spark job, no ticket to the data platform team. It won because most data is small. AWS’s own post says DuckDB covers the “90%+ of data queries in the world today” that run on data smaller than 1 terabyte.

Four things I’d take from it:

• This is an S3 play, not a Redshift one. The announcement was signed by Andy Warfield, who runs S3.

• The deal landed nine days after DuckDB previewed v2.0 with the Quack protocol, which allows any DuckDB process to serve its databases over the network. Embedded DuckDB is a developer tool. DuckDB that speaks a wire protocol is a query engine you can rent by the second.

• The product writes itself. Quack on top of S3 Tables and Iceberg gives you serverless SQL straight against object storage, no warehouse in the middle. That’s aimed at Databricks and Snowflake, not Redshift.

• AWS didn’t buy the project; it hired everyone who commits to it. No license fight, no fork, no OpenSearch-style backlash. The Foundation keeps the IP, AWS keeps the roadmap.

Newsworthy stories

• How we saved 100 terabytes of memory by optimizing 1.1.1.1’s DNS cache

• On-call is now theatre

• Your executable is a SQLite database

• How Databricks uses AI to accelerate incident investigation

• Stop trying to learn all of Kubernetes at once

Tutorials of the week

• From clickops to governed IaC: CloudFormation drift detection in practice

• Optimizing Kubernetes pod deployments for reliability with topology spread constraints

• How to evaluate LLMs before production

• How we built an AI security analyst on AWS for under $500/month

• Putting models to the secure coding test: plan vs default mode

• Federating clusters for zero-downtime Kubernetes

• How to achieve resource-level isolation in Kubernetes using a multi-environment node pool strategy

• HashiCorp’s tfpolicy made module source a policy decision

• Building safe MCP servers for your PostgreSQL database

• Automating filtered cost and usage report exports with AWS Data Exports

Videos of the week

Projects of the week

• Khaos injects the Kafka failures you normally wait for into a cluster on demand, from consumer lag and hot partitions to rebalances and broker outages.

• Proval reviews your pull requests with an LLM that runs entirely inside your own network, on GitLab, Forgejo, and GitHub alike.

• restoredrill restores your latest Postgres backup into a throwaway container, runs your validation checks against it, and writes the JSON report an auditor actually asks for.

• AWSHound turns your AWS IAM data into a BloodHound graph, so the privilege escalation paths in your account become something you can see.

• cloudflare-github-actions-runner runs your GitHub Actions jobs on ephemeral Cloudflare Containers you size yourself, instead of on GitHub’s runners.

Meme of the week

Want to reach out to sponsor the newsletter? Book a slot - Q4 dates are open.