TinyFish | Practitioner's Corner

Field Dispatch

What Got Normalized Away

By Nora Kaplan— February 11, 2026

Feature image for article: What Got Normalized Away

The competitor tracking dashboard showed stable availability for three months, then a 12% price jump overnight. The data quality engineer pulled last quarter's manual collection logs to compare. Same product, same retailer, two weeks before the spike: "Limited stock—2-3 units available." This quarter's agent-collected entry for the same listing: "In stock." Three months of records told the same story. Something in the automation was smoothing away signals that preceded price changes. The data had gotten cleaner.

Field Dispatch

What Got Normalized Away

By Nora Kaplan— February 11, 2026

The competitor tracking dashboard showed stable availability for three months, then a 12% price jump overnight. The data quality engineer pulled last quarter's manual collection logs to compare. Same product, same retailer, two weeks before the spike: "Limited stock—2-3 units available." This quarter's agent-collected entry for the same listing: "In stock." Three months of records told the same story. Something in the automation was smoothing away signals that preceded price changes. The data had gotten cleaner.

Builder Profiles

What You Lose When You Remove the Screenshots

By Rina Takahashi— February 12, 2026

Feature image for article: What You Lose When You Remove the Screenshots

A login button moves from top-right to bottom-left during a site redesign. The HTML is identical—same element, same attributes—but your agent can't find it anymore. The spatial cues that signaled "this matters" or "wait here" vanish with the visual information when you strip the page down to text.

Satya Nitta is betting $97 million that removing screenshots entirely can solve the cost problem plaguing vision-based agents. Agent-E works with text-only DOM, claims benchmark results that beat multimodal approaches, and acknowledges it's "not designed for dynamically changing environments." Every production website is a dynamically changing environment.

Builder Profiles

What You Lose When You Remove the Screenshots

By Rina Takahashi— February 12, 2026

A login button moves from top-right to bottom-left during a site redesign. The HTML is identical—same element, same attributes—but your agent can't find it anymore. The spatial cues that signaled "this matters" or "wait here" vanish with the visual information when you strip the page down to text.

Satya Nitta is betting $97 million that removing screenshots entirely can solve the cost problem plaguing vision-based agents. Agent-E works with text-only DOM, claims benchmark results that beat multimodal approaches, and acknowledges it's "not designed for dynamically changing environments." Every production website is a dynamically changing environment.

The Number That Matters

TLS Fingerprinting Creates 47x Success Rate Gap

Standard Python requests library achieves roughly 2% success rate against Amazon's 2026 anti-bot system. Switch to curl_cffi, which mimics browser TLS fingerprints, and success climbs to 94%. That's a 47-fold improvement from addressing a single technical layer most developers never see.

The gap exists because modern systems compare what clients claim to be against what their TLS handshake reveals. Claim to be Chrome 120 while sending Python's TLS signature? Instant block. The Client Hello message, sent unencrypted during TLS negotiation, exposes version, cipher suites, extensions, and elliptic curves that uniquely identify each HTTP library.

Detection happens at the protocol level, before application logic even runs.

The Number That Matters

TLS Fingerprinting Creates 47x Success Rate Gap

Standard Python requests library achieves roughly 2% success rate against Amazon's 2026 anti-bot system. Switch to curl_cffi, which mimics browser TLS fingerprints, and success climbs to 94%. That's a 47-fold improvement from addressing a single technical layer most developers never see.

The gap exists because modern systems compare what clients claim to be against what their TLS handshake reveals. Claim to be Chrome 120 while sending Python's TLS signature? Instant block. The Client Hello message, sent unencrypted during TLS negotiation, exposes version, cipher suites, extensions, and elliptic curves that uniquely identify each HTTP library.

Detection happens at the protocol level, before application logic even runs.

TAKE NOTE

Detection sophistication: Amazon's six-layer system calculates a "human likelihood score" for every request using real-time machine learning models, not simple rule-based blocking.

Library signatures: Python requests, Go http, and browsers each send distinct TLS fingerprints based on their underlying SSL implementation, making them instantly distinguishable at handshake.

Behavioral layer: Perfect TLS fingerprints fail without human-like mouse trajectories, variable scrolling speeds, and realistic page interaction sequences that match biological patterns observed in real users.

Production reality: One practitioner reported 94% success across 50+ million requests by addressing all detection layers simultaneously: TLS, JavaScript challenges, behavioral analysis, and IP reputation.

Industry shift: Cloudflare, Akamai, and AWS Shield now deploy TLS fingerprinting as standard defense, making traditional automation tools obsolete without specialized clients that mimic browsers.

Field Notes from the Ecosystem

February brought infrastructure surprises. Automation systems designed to protect platforms turned on their own users. APIs that once felt generous suddenly imposed constraints that reshape how teams architect for scale. Power grids failed and reminded us that cloud infrastructure still runs on physical things.

Railway's abuse detection took down legitimate databases. USPS capped their new APIs at 60 requests hourly without publishing how to get more. Azure West US spent 20 hours recovering from a power interruption because storage and compute wouldn't stabilize even after power returned. The usual operational chaos, now with better documentation.

Field Notes from the Ecosystem

February brought infrastructure surprises. Automation systems designed to protect platforms turned on their own users. APIs that once felt generous suddenly imposed constraints that reshape how teams architect for scale. Power grids failed and reminded us that cloud infrastructure still runs on physical things.

Railway's abuse detection took down legitimate databases. USPS capped their new APIs at 60 requests hourly without publishing how to get more. Azure West US spent 20 hours recovering from a power interruption because storage and compute wouldn't stabilize even after power returned. The usual operational chaos, now with better documentation.

Abuse Detection

False Positives Terminated 3% of Railway

Railway's automated abuse detection incorrectly terminated legitimate workloads February 11, sending unexpected SIGTERM signals to active databases. New anti-fraud ruleset delivered false positives. Postgres and MySQL instances went offline across roughly 3% of platform services.

Rate Limiting

USPS Caps New APIs at 60 Hourly

Legacy Web Tools retired January 25, 2026. Replacement APIs enforce default rate limits of 60 requests per hour. Higher thresholds exist but USPS doesn't publish available tiers or approval criteria. High-volume shipping operations now operate blind.

Rate Limiting

Atlassian Switches to Points-Based API Quotas

Starting March 2, 2026, Jira and Confluence REST and GraphQL requests consume points based on work performed: data returned, operations triggered. Hourly quotas allocated per-tenant, per-app. No more simple request-per-second caps.

Security Patching

Microsoft Patched 6 Actively Exploited Zero-Days

February 2026 Patch Tuesday addressed 58 vulnerabilities including 6 actively exploited in the wild. CVE-2026-21533 allows attackers to gain SYSTEM privileges through Remote Desktop Services. CVE-2026-21525 denial-of-service exploit found in public malware repository.