---
title: "Practitioner's Corner"
canonical: "https://current.tinyfish.ai/issue/4/practitioners-corner"
publication: "TinyFish"
publisher: "TinyFish"
language: "en-US"
guide: "https://current.tinyfish.ai/llms.txt"
permalink: "https://current.tinyfish.ai/issue/4/practitioners-corner"
issue: 4
section: "practitioners-corner"
description: "Lessons from the field—what we see building at scale"
authors: ["Nora Kaplan","Rina Takahashi"]
published: 2025-11-20
updated: 2025-11-20
articles: 10
---

# TinyFish

> CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made.

[Read on the website](<https://current.tinyfish.ai/issue/4/practitioners-corner>)

## Issue 4 — Practitioner's Corner

Lessons from the field—what we see building at scale

### Dispatches from Production Scale

- [The API Exists. The Data Doesn't.](<https://current.tinyfish.ai/issue/4/practitioners-corner/article/4565/markdown>) — By [Nora Kaplan](<https://current.tinyfish.ai/team/26/markdown>) · Published 2025-11-20 · Format: Operations Field Notes

LinkedIn has a public API. Open any profile in your browser—work history, skills, recommendations, everything's there. Query the API for the same data? Name and current position. The rest requires partner status most companies will never get. The API exists. The data doesn't come through it. Every day, technical teams and business teams talk past each other about this gap, unable to explain why the "proper" solution doesn't work.

### Mapping the Invisible Web

- [The Web Has Amnesia](<https://current.tinyfish.ai/issue/4/practitioners-corner/article/4566/markdown>) — By [Rina Takahashi](<https://current.tinyfish.ai/team/25/markdown>) · Published 2025-11-20 · Format: Field Dispatch

You're one click from completing checkout. Payment details entered, shipping confirmed. Then the page refreshes and your cart is empty. You're logged out. Everything you were doing—gone.

### Theory Meets Production Reality

- [What Staging Actually Tests](<https://current.tinyfish.ai/issue/4/practitioners-corner/article/4567/markdown>) — By [Nora Kaplan](<https://current.tinyfish.ai/team/26/markdown>) · Published 2025-11-20 · Format: Parallax View

Every selector validated. Every error handler triggered correctly. The staging tests passed completely. Then production launched and 40% of the automation failed within an hour. The code worked perfectly—staging had confirmed it. What staging couldn't tell the team: whether their assumptions about how the web behaves matched reality. Turns out, testing your logic and testing your understanding are different problems entirely.

- [Production Teaches What Staging Cannot](<https://current.tinyfish.ai/issue/4/practitioners-corner/article/4568/markdown>) — By [Nora Kaplan](<https://current.tinyfish.ai/team/26/markdown>) · Published 2025-11-20 · Format: Parallax View

Staging confirmed your assumptions were internally consistent. Production revealed which ones were wrong. A website changed its authentication flow overnight. Bot detection evolved its logic between deployments. Rate limits activated at scale you'd never encountered in testing. Not because the code failed, but because the live web doesn't behave like controlled environments. Production doesn't just validate whether your automation works—it teaches you what you didn't know you needed to learn.

### The Number That Matters

- [78% of Data Collection Budgets Buy Human Judgment](<https://current.tinyfish.ai/issue/4/practitioners-corner/article/4569/markdown>) — Published 2025-11-20

Enterprises spend 78% of their data collection budgets on data specialists. Not for elegant code. For the grinding work of unblocking target sites and reformatting datasets into usable structures.

### Field Notes from the Ecosystem

November delivered a lesson in operational margins. One configuration change doubled a feature file size. A hardcoded limit that seemed reasonable suddenly wasn't. Three hours of global disruption followed.

The pattern keeps repeating. Feature files updating every few minutes because attackers evolve faster. Failover paths built in hours after 90-minute blackouts. Rate limiters moving into operating systems. These aren't theoretical concerns. They're production realities visible in incident reports and engineering blogs.

What we're documenting: the operational patterns that only surface when systems run at scale, under load, in public view.

- **Feature File Doubles, System Panics** — [Source](<https://blog.cloudflare.com/18-november-2025-outage/>) — Published 2025-11-20

Tag: Infrastructure Fragility

Cloudflare's November 18 outage: a database permissions change caused their bot management feature file to balloon from 60 to 400+ features. Hardcoded limit? 200 features. System panicked. Three hours down. 20% of web traffic affected, including X, ChatGPT, Discord. One configuration change, global disruption.

- **Building Escape Hatches in Real Time** — [Source](<https://resend.com/blog/incident-report-for-november-18-2025>) — Published 2025-11-20

Tag: Dependency Cascade

Resend lost Cloudflare connectivity for 90 minutes during the November outage. Their email API went dark. Engineers responded by building a CloudFront backup path deployable in 60 seconds via DNS failover. Didn't need it this time. But it's ready now. Infrastructure teams are preparing for the next cascade.

- **Every Request Gets Scored** — [Source](<https://developers.cloudflare.com/bots/get-started/bot-management/>) — Published 2025-11-20

Tag: Bot Detection

Cloudflare scores every request crossing their network: 1-99, with anything below 30 flagged as probable bot. The ML model's feature file updates every few minutes. Why? Bot attackers evolve constantly. Rapid deployment of detection rules isn't optional. It's survival at scale.

- **Windows Throttles Failed Logins by Default** — [Source](<https://learn.microsoft.com/en-us/windows-server/storage/file-server/configure-smb-authentication-rate-limiter>) — Published 2025-11-20

Tag: Authentication Defense

Windows Server 2025 and Windows 11 24H2 now enable SMB authentication rate limiting out of the box: 2-second delay between failed NTLM or PKU2U attempts. Addresses brute force attacks that hammer servers with multiple guesses per second. Defense migrates into the OS itself.

- **Edge Placement Sees Less, Responds Faster** — [Source](<https://medium.com/@lakshyachampion/rate-limiter-system-design-c678f166e94b>) — Published 2025-11-20

Tag: Rate Limiting

Rate limiting lives at the edge. API gateways, load balancers. Every request checked before routing downstream. Minimizes latency, shields backend systems from traffic spikes. The cost? Limited business context. Edge only sees HTTP request data: headers, IPs, tokens. Not user history, not purchase patterns.

## Other sections in Issue 4

- [Daily Brief](<https://current.tinyfish.ai/issue/4/daily-brief/markdown>)
- [Market Pulse](<https://current.tinyfish.ai/issue/4/market-pulse/markdown>)
- [Foundations](<https://current.tinyfish.ai/issue/4/foundations/markdown>)
- [Echoes](<https://current.tinyfish.ai/issue/4/echoes/markdown>)
- [Vision](<https://current.tinyfish.ai/issue/4/vision/markdown>)

## More

- [Publication guide](<https://current.tinyfish.ai/llms.txt>)
- [Issue archive](<https://current.tinyfish.ai/issues/markdown>)
