SE Radio 742: Tim Varelmann on Mathematical Optimization for Software Engineers

Tim Varelmann, the founder of Bluebird Optimization, which helps companies automate complex decision-making, speaks with host Sriram Panyam about mathematical optimization. The episode begins by differentiating optimization from what software engineers usually mean by the word. Making something faster or smaller is improvement, whereas optimization means finding the provably best solution after which no further improvement is possible unless the problem's parameters change. The conversation examines the difference between simulation and optimization, where optimization is already running, optimization and AI, key software engineering principles, and how you can get started with mathematical optimization.

Sahil Walia, a senior technical architect at Snowflake, joins host Robert Blumen for a conversation about schema migration and data migration. Together, they discuss the basics of schema: do all data sets have schema?; what drives schema change?; are data migration and schema migration the same thing? Must they happen at the same time? They then talk about the challenges and failure modes of schema migration, including challenges at scale, migrating without downtime, the concept of "safety" in data migrations, and safety patterns for data migration - double writes, read repair, replication, ending on the Apache Iceberg case study.

Raju Dandigam speaks with host Amey Ambade about building robust AI agents for production. Raju recommends treating an agent as a software subsystem rather than a standalone model call. That means designing decision contracts and tool boundaries, choosing between predictable workflows and multi-agent orchestration, and managing the runtime, state, and streaming that make agents durable. A recurring theme is that the model should not own the system: the right architecture is usually the simplest one that meets the product need while preserving reliability and control, with the language model placed inside a controlled runtime that settles authentication, policy, data freshness, and idempotency before it is ever asked to reason. They focus largely on how teams can be sure that an agent works and how to debug it when it does not. The episode covers behavioral testing against contracts, golden scenarios, and observability that captures the full execution path rather than flat logs, which is the gap behind agent-inspect and its readable execution trees. Raju and Amey close on operating agents in production: measuring cost and latency per run, knowing when a simpler model or no AI path is the right call, and treating prompts, schemas, tools, and evaluation sets as owned, versioned artifacts. Brought to you by IEEE Computer Society and IEEE Software magazine.

Erin Catto of Kintsugiyama, veteran video game developer who worked on the Tomb Raider series at Crystal Dynamics and later contributed to Diablo III, Overwatch, and other franchises at Blizzard, discusses video game physics engines with host Jason Davey. Erin created the popular open-source Box2D library used in titles including Angry Birds and Noita, and he released Box3D in 2026, bringing the much-loved physics engine to the third dimension. Underpinning everything from platformers and racing games to industrial robotics simulations, modern physics engines present a host of interesting engineering challenges, including the need to balance accuracy, stability, determinism, and performance. Catto describes the core concepts, the various trade-offs and factors that influence the design of these systems, and how they fit into the broader software architecture of a video game.

Milan Milanovic, Microsoft MVP for Developer Technologies and author of the book, Laws of Software Engineering, joins host Giovanni Asproni for a conversation based on the content of his book—a collection of 53 empirical and mathematical laws governing modern software engineering. The book includes some well-known laws, such as Conway's and Brooks's laws, as well as other lesser-known but just as important, including Gilb's and Tesler's laws. The episode starts with an introduction to the laws and the criteria that Milan used to choose them. The episode continues with some practical hints on how to apply the laws and concludes with thoughts on the importance of the laws for teams using artificial intelligence tools in their day-to-day work.

Owen McGirr, creator of SayIt!, Switchify, and an entrepreneur who builds inclusive technology, speaks with SE Radio host Gavin Henry about software accessibility. For this episode, Gavin emailed the questions to Owen, who prepared his answers and generated the audio programmatically using text-to-speech. Owen discusses what accessibility is, different ways a user might interact with software, how accessibility is currently handled between various operating systems, the technical challenges of creating SayIt! and Switchify, plus what developers can do to improve accessibility. This episode explores access methods, what good accessibility means, eye gaze, touch, voice, keyboards, scanning, switches, radaring, screen overlays, iOS accessibility, Android accessibility, which OSes have better support, AI testing, what vendors can do to improve, what developers can do to improve and what two things a developer can do immediately to test their software accessibility.

Sahil Walia, Senior Technical Architect at Snowflake, joins host Robert Blumen for a deep dive into Apache Iceberg.  The conversation covers OLAP, data formats, data lakes and lake houses, Iceberg as a data format, columnar storage, use cases, reference implementation, read/write, how Iceberg structures metadata, indexing, query planning and performance issues.

Vivek Yadav, an engineering manager at the payment company Stripe, speaks with host Adi Narayan about building regression testing for microservices. Drawing on his work estimating network costs for card payments, Vivek explains why unit and integration tests fall short when a single transaction's cost can depend on 100+ parameters across card networks, countries, and merchant types. He describes Stripe's approach: structuring services so that core logic is stateless and separated from I/O, then wrapping that logic in an Apache Spark job that replays historical transactions from cold storage to compare old versus new outputs at a granular, per-transaction level. This allows Stripe to validate major migrations with far more confidence and speed than a traditional shadow-rollout, and it now doubles as a tool for assessing network rule changes, debugging incidents, and even showing customers how a pricing change will affect their costs. The episode closes by noting the same pattern applies wherever AI-driven code changes need fast, reliable evals.

Sathiesh Veera, a GenAI Solutions Architect at At&T, speaks with host Brijesh Ammanath about the data-protection guardrails required when using LLMs. The core issue is that LLMs sit outside the cloud tenant in most enterprise AI deployments, which means that data leaves the company's perimeter with every prompt, RAG retrieval, and tool call. Contractual agreements can restrict the data that LLM vendors are allowed to use for training and audits, but they don't stop prompt injection or unintended exposure as company data is often shared to LLMs via natural language queries, APIs, tool and function calls, and MCPs. Sathiesh discusses ways to employ security measures and data filtering at each layer to conform to data security policies and protect the data. 

Max Corbridge, an ethical hacker and red teamer who is co-founder and CEO of Secure Agentics, speaks with SE Radio host Amey Ambade about how AI agents get attacked and what engineers can actually do to defend them. Drawing on years of offensive security work, Corbridge frames agents as a new and largely undefended attack surface: the industry has handed AI systems autonomy and the ability to act in the real world while carrying forward prompt injection, a flaw the frontier labs themselves describe as effectively unsolvable. He likens the moment to the early, lawless days of the web, when SQL injection was everywhere and adoption ran far ahead of security. The conversation builds from first principles as Corbridge explains what separates an agent from ordinary software and why three properties make them hard to secure: they are non-deterministic, their language-model core can be coerced, and they are increasingly interconnected through MCP servers, other agents, databases, and email. Turning to the attack surface, Corbridge lays out his "lethal trifecta" (a vulnerable core, dense interconnection, and security tooling that has not caught up) and contrasts the decades of layered defenses protecting an ordinary email inbox with the thin protection around agents that take autonomous actions on critical systems. The heart of the episode is defense. Corbridge orders practices by leverage: least-privilege access and privilege separation, sandboxing where feasible, imperfect-but-useful guardrails as one layer of defense in depth, and human-in-the-loop for irreversible actions (which he notes is contentious and does not scale). The discussion closes on detecting a compromised or drifting agent, the value of watching an agent's chain-of-thought reasoning alongside its actions, the open-source tooling landscape (including Corbridge's own project, Adrian), and his central advice: build security in proactively, define what good agent behavior looks like up front, and avoid bolting it on after agents have already spread across the business.