RSS Feeds

Sauces, reductions, deglazing: our expert panel has plenty of options for making the most of undrunk vino – whether you’ve got just a capful or a whole carafe to get through

What can I do with wine left over from a party?
Rob, by email
This is a novel concept, perhaps, but the answer essentially comes down to the quantity: “If we’re talking dribbles of red or white, that’s simple,” says Jon Atashroo, head chef/owner of Where There’s Smoke in North Yorkshire. “They go into sauces, whether that’s for pasta or to deglaze a pan before making a gravy.” Joe Otway, chef/co-owner of Higher Ground in Manchester, couldn’t agree more: “Reducing wine, be it white or red, in the base of anything is generally a good idea.” Take something tomato-based, such as ragu or chilli, as an example: “Once you’ve sweated the vegetables and there’s caramelisation on the bottom of the pan, a glass of red wine will add acidity, depth and sweetness.” And remember, you can always freeze wine dregs for later use: simply pour into ice-cube trays and stash.

Moving on to medium amounts, we’re talking “stewy, fish-type things”, Atashroo says, perhaps moules marinière. Another good option is pickling: “A basic recipe is one part caster sugar, one part white-wine vinegar and one part white wine. And if you’re pickling something like beetroot, cook it in that mix, while if you’re using cucumbers, say, they go in cold.” That said, a current Atashroo go-to is altogether sweeter: “Weigh some red wine, though I don’t see why it wouldn’t work with white wine, too, add 20% of its weight in sugar, and reduce to a syrup – you’re looking for the consistency of strawberry sauce.” The result is complex and acidic, “almost like reduced port”, and great for drizzling over vanilla ice-cream. While we’re talking desserts, few things are better than fruit (peaches, figs, pears) poached in wine, either.

Got a culinary dilemma? Email feast@theguardian.com

Mathematicians are raising concerns that the technology could kill their profession. But they still have abilities AI doesn’t

Earlier this month, about 40 top mathematicians gathered at OpenAI’s offices to discuss the future of their profession. The meeting was off-the-record, but if recent articles by mathematicians are any guide, it was mostly pretty glum. People fear for their jobs, their careers and the work they love.

We think the contrary view is more likely, at least in the short-term. AI models are nowhere near as capable as experienced academic mathematicians.

После публикации первоначального отчета OpenAI об инциденте появились новые подробности, представленные исследователями на конференции Black Hat. Теперь можно восстановить практически полную цепочку действий автономного ИИ-агента: от выхода за пределы изолированной среды до попыток закрепления во внешней инфраструктуре. Разбираем, какие технические механизмы использовал агент и почему этот случай меняет подход к защите агентных ИИ-систем.

21 июля OpenAI сообщили об инциденте, который произошел во время внутренней оценки возможностей ИИ-агентов в области кибербезопасности. Во время прохождения бенчмарка ExploitGym агент на базе GPT-5.6 Sol смог выйти за пределы изолированной среды выполнения и получить доступ к внешней инфраструктуре.

В отдельном материале мы уже разбирали назначение ExploitGym, а теперь сосредоточимся на технической стороне инцидента: какие границы доверия были пересечены, как агент строил цепочку атаки и какие уроки из этого стоит вынести командам, которые внедряют автономные системы.

Провожу тренировочные онлайн-кодинг интервью на английском и понимаю, насколько эта тема больнючая.

Надо умудряться делать 5 вещей одновременно: понимать, что от тебя хотят, задавать уточняющие вопросы, думать и кодить, а еще и комментировать всё это на английском! Искренне восхищаюсь теми, кто пробует или уже так умеет.

В июле проводила открытую тренировку по live coding собеседованию на английском — было 300 регистраций и 90 человек онлайн. Тема очень актуальна, поэтому решила поделиться шпаргалкой с теми, кто не был, но кому тоже надо.

Gao Zhen sentenced to three years in prison after already spending two years in detention

Gao Zhen, a prominent Chinese artist known for provocative sculptures of the former leader Mao Zedong, has been sentenced to three years in prison after being found guilty of slandering China’s “heroes and martyrs”. The sentencing came two years after he was detained while visiting the country with his family, according to his wife and human rights groups.

The case has attracted international condemnation, largely because the artworks at the centre of the case were created more than 10 years before China created the law under which Gao was charged.

Welcome to The Midterms, Actually. Every week I’ll be writing about two things: one big idea or trend I see forming across the 2026 primaries, and one thing I’m hearing from a voice on the ground. You can sign up here to get it in your inbox every week. Let’s get into it.

One big idea: The data center backlash is a democracy story

This week, OpenAI CEO Sam Altman acknowledged a small hurdle in his quest to integrate artificial intelligence into all parts of human life and the economy: the rest of us. 

In an episode of the Founders podcast with David Senra, Altman confronted the growing public backlash against tech leaders and their AI tools, conceding that he’d overrated the speed at which they’d be adopted across the economy and that the industry hasn’t made its case to the public.

“We have not, as a field, done a very good job of explaining to people what the benefits are and how the downsides can be mitigated,” Altman said. He added that “it’s probably a good feature of human society that we have some built-in inertia, some skepticism of rapid change.”

You think?

Survey after survey shows how deep — and how bipartisan — the backlash against AI, and specifically data centers, already runs. The pressure has been building all year: A Gallup poll in March) found that 71 percent of Americans said they oppose building AI data centers in their area — 48 percent of them strongly. That opposition runs across the aisle: 75 percent of Democrats, 74 percent of independents, and 63 percent of Republicans. For perspective, Americans are more opposed to a data center going up near them than a nuclear power plant (53 percent). This is not some fringe opposition. It is a consensus. 

The shift is already scrambling candidates’ positions ahead of the midterms, where data centers, artificial intelligence, and the future of work will be front and center. Michigan Democrat Abdul El-Sayed’s refusal to back a data center moratorium (which he reiterated on America, Actually) has given Republicans an opportunity. His opponent in Michigan, GOP Senate candidate Mike Rogers, recently came out for a one-year moratorium — an attempt to get to the left of El-Sayed (!). The shift reflects our new political reality. At this point, being pro-data center isn’t just a minority position overrepresented among C-suite executives — it’s become a moral and cultural signal. An us-vs.-them litmus test in an age of elite distrust.

The political world did not see this coming. A year ago — before Zohran Mamdani’s win in New York, before DSA congressional wins in New York and Colorado, before El-Sayed in Michigan and Angie Nixon in Florida — the Democratic establishment was all about Abundance, the 2025 Ezra Klein–Derek Thompson book that had become something like an electoral manual for Washington Democrats and the press that covers them. But Abundance was (and is) powered by advanced technology and its mass adoption — the book says so on its first pages — and, like Altman, its proponents may have underestimated how unwilling neighbors would be to hand still more of their lives over to our Silicon Valley overlords. In a recent piece, my colleague Andrew Prokop wrote that Abundance flopped among voters because leftists adopted their best ideas, and issues like Israel became more of a motivating force among primary voters. But I’d also add that it replicated the same mistake tech leaders made: reveling in the benefits of a transformed economy before building consensus among the people who must live with it. 

We’ve been covering this issue throughout the year, including attending an early-summer town hall in New Jersey over a proposed data-center expansion in the state’s poorest county. But even I have been surprised at how much we hear about AI and data centers from voters on America, Actually — and how tied those fears are to a larger anxiety about the future of work and a growing resentment of tech CEOs like Altman and Elon Musk. If the 2020 election was defined by both parties’ silence on AI, the years since have been defined by elites telling the underclass that they have no agency in the disruption to come.

Based on our reporting this year, here are four things that I think explain the shift in sentiment — and forecast where this goes in the midterms and the presidential race to come.

1. It’s about agency, not “the environment” 

The thing that comes through loudest on the ground isn’t a technical objection to server farms, or even a concern with their potential impact on the environment. It’s the feeling that this change was done to communities — not in consultation with them. At the New Jersey town hall, one resident put it this way: “Folks feel unheard. And we don’t feel that way — we are unheard.” Another related it to a broader anxiety about artificial intelligence, which she said felt imposed on society from the upper class: “Everything relates from the top down, and what we’re getting from the top has spread all the way to the local level. And it isn’t good.” 

Sen. Ruben Gallego — no AI opponent himself — suggested the resentment often came from how the industry picks its targets. “They’re gonna put a data center all because it’s cheap land, and also because they think it’s a Black and brown area, so they’re gonna have less pushback,” he said. And that feeling of powerlessness is not only amplified in the absence of federal regulation, but by the knowledge that most elected officials don’t even understand the technology themselves. 

In New Jersey, residents suspected the game was rigged against the people with the least power to say no, and it often is. One word in particular, from a data center developer, had enraged them. The developer had called the project an “experiment.” That means  “we’re the guinea pigs,” the resident said. 

2. These are not all Luddites

Recently, I’ve seen the data center backlash dismissed as a “psyop” — a foreign plot to undermine the US economy — or a symptom of technophobia. Simpletons who can’t understand what’s to come. 

But that’s a convenient and self-serving misread. In New Jersey, one of the most striking voices at the town hall was a man who runs a civic-tech project: “I use AI all the time — for project management. If you use it responsibly, you can leverage it to get real-world tasks done.” He was still, firmly, against the data center. And he’s not alone: Gallup also finds concerns about the local impact of data centers are much bigger drivers of opposition than more general anti-tech ideas, as does Fox News’ polling. People weren’t rejecting the tools altogether — there were plenty of ChatGPT users in that room. They were rejecting the pace, and the secrecy, of a project reshaping their community. 

3. The costs are visible. The benefits are a pitch.

A resident in New Jersey pointed out something important: “A couple hundred jobs for two and a half million square feet? How can that possibly be supported with today’s grid? There’s no plan for the future. … Who benefits with that building? It’s not the people of this town.” 

I think this speaks to one of the challenges the pro-data center crowd has faced. Once the construction jobs leave, the noise, the water draw, the rising electricity bills, the fear about home values, and the sheer brutalist ugliness of the structure all stay. One homeowner told us: “I can’t sell my house — it’s been for sale since February. A woman came back twice, had cash, then realized it was near the data center. Her kids said, ‘Mom—’ and she said, ‘I just can’t do this.’”

And even if local concerns are the dominant issue, AI isn’t offering much of a bigger-picture national argument to overcome them. As Gallego put it to me, “there is no massive-scale benefit to society when it comes to AI” that voters see in their lives so far, and they have competing concerns about tech’s impact on children, privacy, and job losses. 

Rep. Greg Casar, the Congressional Progressive Caucus chair, told me this is the reason the left has found success tying anxiety about artificial intelligence to their broader message of affordability. 

A lot of the establishment traditional Democratic politics…are telling candidates, ‘Don’t even say the words AI.’ And if you do, say there needs to be safety but innovation — and then shut up…because maybe AI lobbyists are gonna spend tons of money against you.

Being progressive means uniting all the people getting their costs jacked up and having them vote for a politician even if the AI industry spends against them.

4. The left has their answer. What’s the center’s? 

As I wrote previously, I think a defining characteristic of this ongoing ideological battle in the Democratic Party is the collapse of the center — even more than the rise of the left. And on artificial intelligence and data centers, I think you see that crumble clearly. 

Progressives like Bernie Sanders and Ro Khanna have made clear cases for the need for a data center moratorium to prioritize the potential impact of AI on workers. And candidates like El-Sayed have laid out a proposed regulatory framework even if they don’t support a moratorium. 

But the most shocking answers on the topic that I’ve heard have both been from elected officials more representative of the liberal center. Gallego called data centers a “necessary evil” — quite possibly the least inspiring words in American politics. Rep. Jim Clyburn’s answer on artificial intelligence was even worse. He told me he hadn’t heard about ChatGPT until recently and that he’s never used an LLM or visited a data center. 

“I have a great staff,” he told me. “I know how to legislate, I know how to build relationships, and I hire people to bring knowledge into the game.” It’s a fine answer for most of governing. It is a terrifying one for a technology moving this fast.

In examining the public backlash against data centers, it’s important to remember statements like these. People don’t want to feel like they’re guinea pigs in an experiment, and it’s not just Sam Altman who has contributed to that feeling. It’s also the politicians who have treated technological change as something they retroactively legislate after a crisis arrives, whether it’s in the economy, or the environment, or society. You can’t govern a revolution you refuse to understand. 

What I’m hearing

This week, I called Adrian Walker, longtime political columnist at the Boston Globe and one of the moderators of the recent debate between Sen. Ed Markey (D-MA) and Rep. Seth Moulton (D-MA), the 47-year-old member of Congress who’s challenging him in a September 1 primary election. The debate also featured a viral moment from Markey on artificial intelligence, where the 80-year-old incumbent did not seem to fully grasp the technology. You can watch that exchange here. 

So is this all about age? What have been the lines of division beyond that? 

You know, it’s surprising that when you poll people, and you ask them about age, they have concerns about Markey being 80 (and 86 potentially at the end of this next term). But it’s not what’s really driving votes. It’s really kind of become more of a race about who’s more progressive, and Markey has successfully, I think, pitched himself as the more progressive candidate.

What are the ways in which they are both seeking to prove their progressive credentials?

Markey constantly touts the Green New Deal, and he talks a lot about his endorsements from AOC and Ayanna Pressley and people like that. It’s basically the same playbook he ran six years ago when he beat Joe Kennedy, when he also did better than anybody expected among young voters.

So he’s still riding that Green New Deal/AOC connection.

He’s running the exact same campaign. And Moulton came in with a lot of skepticism. People are still mad about him going against Pelosi (in 2018). And he had this very high-profile attack about trans kids in youth sports — and people have been skeptical about him as a progressive. So he’s sort of trying to reinvent himself while Markey, you know, kind of rides the same thing that got him a little success. 

So is there a reason we should be watching this beyond just the question of age? 

I think the AI question really speaks to something very fundamental in this debate. I think people really have concerns about the fact that the whole Senate seems to be in their 70s and 80s, and I think it was reflected in that question. You have Markey up there saying, you know, it doesn’t matter whether you call it Siri or Claude or whatever. And people walk away thinking this is not the dude who should be regulating AI; they think “Yeah, you know, the 47-year-old actually understands this, and the 80-year-old pretty clearly does not.”

And it kind of speaks to, I think, the sort of hunger I think a lot of people are feeling for generational change in the Senate: You watch Senate hearings, you watch congressional hearings about things like AI, but they’re really not that impressive. It really does look like a bunch of people who don’t really understand this at a very deep level. And that’s driving this frustration. 

Gao Zhen sentenced to three years in prison after already spending two years in detention

Gao Zhen, a prominent Chinese artist known for provocative sculptures of the former leader Mao Zedong, has been sentenced to three years in prison after being found guilty of slandering China’s “heroes and martyrs”. The sentencing came two years after he was detained while visiting the country with his family, according to his wife and human rights groups.

The case has attracted international condemnation, largely because the artworks at the centre of the case were created more than 10 years before China created the law under which Gao was charged.

Beijing says it will take ‘all necessary measures’ to protect its interests as US steps up efforts to isolate Tehran

• Explainer: could US sanctions threaten China-Iran ties?

China has denounced the threat of US sanctions for its trade with Iran, saying any such measures would be illegal, and warned it would take “all necessary measures” to protect its national interests.

Beijing’s rejection of the US threat of secondary sanctions for any country or entity continuing to trade with Tehran had been predicted. China buys an estimated 80% of Iran’s oil exports and has defied previous US efforts to limit the flow of revenue to the Tehran regime.

В сети разошлось короткое демо разработчика Конрада Речко. На первый взгляд ничего сверхъестественного: кадр с обычной веб‑камеры, поверх которого можно двигать виртуальный источник света.

Самое интересное начинается, когда человек поднимает руку. Свет оказывается за ладонью и мгновенно исчезает. Перемещается к лицу — часть свечения перекрывает голова. Уходит в сторону — меняется освещение поверхности.

MVRDV – the firm behind Marble Arch Mound – says Rotterdam ROCKS! will inspire visitors to live sustainably. But in an era when the greenest building is the one that already exists, this tottering cairn looks set to misfire

‘It looks like something Shrek would throw up,” sniffed one online commentator, unflatteringly comparing Rotterdam ROCKS!, the recently unveiled proposal for a waterfront site in Europe’s largest port, with the vomitings of a cartoon ogre. Designed by Dutch architectural firm MVRDV, which gave London the supremely underwhelming Marble Arch Mound in 2021, Rotterdam ROCKS! (the use of EMPHATIC CAPITALS connoting an in-your-face energy) is the winner of a major architectural competition intended to create “a new world wonder”.

But instead of a modern Hanging Gardens of Babylon or contemporary Colossus of Rhodes, MVRDV’s super slick renderings depict a pile of artificial “rocks” (or ROCKS!) stacked together in a humongously scaled tottering cairn, wreathed in suspiciously luxuriant foliage and sluiced by a preposterous waterfall.

• 215 of 235 donated brains showed signs of CTE

• Condition can only be diagnosed after death

• Symptoms include problems with memory and mood

At least one in four former NFL players who died between 2016 and 2021 was found to have had chronic ⁠traumatic encephalopathy (CTE), according to a study released on Tuesday.

Out of the 878 former players who died during that time frame, 235 donated their brains for study, researchers said, with 215 ⁠of those donated brains ⁠found to have CTE, ​a degenerative disease that can only definitively be diagnosed after death. CTE is associated with repeated blows to the head, including concussions. Symptoms include difficulty with attention and memory, dementia, mood disorders and headaches.

Beijing says it will take ‘all necessary measures’ to protect its interests as US steps up efforts to isolate Tehran

• Explainer: could US sanctions threaten China-Iran ties?

China has denounced the threat of US sanctions for its trade with Iran, saying any such measures would be illegal, and warned it would take “all necessary measures” to protect its national interests.

Beijing’s rejection of the US threat of secondary sanctions for any country or entity continuing to trade with Tehran had been predicted. China buys an estimated 80% of Iran’s oil exports and has defied previous US efforts to limit the flow of revenue to the Tehran regime.

Many enterprises choose GitLab Dedicated for a clear reason: a secure and compliant, single-tenant GitLab instance, managed by GitLab. As agentic workflows drive more pipeline volume, full data isolation and runner infrastructure operational burden become a challenge. This leads to the question, “Does owning the runner fleet still make sense?”

With GitLab Dedicated, there is no more need to provision, patch, build, and scale your own runner fleet. Hosted Runners for GitLab Dedicated handles the heavy lifting and delivers a seamless experience across the entire software development lifecycle so your team can focus on shipping.

Hosted Runners for GitLab Dedicated provides a runner fleet isolated from other customers. To support job-level security, each job runs in a newly provisioned, isolated VM that is deleted after the job completes. We provide a scalable and highly reliable runner fleet to support your bursty CI demands and resiliency needs. Creating and managing runners is self-serviceable through Switchboard (GitLab Dedicated management console).

The runner ownership trade-off: Cost vs. user experience

Pipeline load can be unpredictable. To account for this, runner infrastructure can be over-provisioned to give developers the best experience and maintain low wait times. But this drives up the infrastructure cost. Conversely, under-provisioning can save on infrastructure cost, but your developers will waste time waiting for their CI jobs to be picked up. Efforts to fine-tune this balance can monopolize your platform team’s time.

Shift runner operations to GitLab while maintaining control

Hosted Runners for GitLab Dedicated is a fully managed CI execution SaaS offering. It’s backed by a high-performing and reliable runner infrastructure. Key benefits include:

• Supports compliance: Full isolation/single-tenant runners with same data residency as GitLab Dedicated.
• Job level security: “One runner for one job” — hosted runners run every job in a standalone, short-lived VM to ensure complete process protection.
• Network security: Hosted runners can connect to internal artifact registries, secret managers, and deploy targets securely through AWS PrivateLink.
• Autoscaling for performance and predictability: Customers get reserved, predictable CI runner capacity for critical workloads resulting in improved queue wait times. Our runners scale with your team’s bursty CI demands.
• High reliability: The Hosted Runners for GitLab Dedicated SLA of 99.9% uptime is supported by highly available runner architecture to ensure your workflows remain stable, resilient, and online.
• Usage and cost visibility: Track hosted runners' GitLab Credit consumption on the GitLab Credits Dashboard.
• Consumption pricing: Hosted runners can now draw down from GitLab Credits, allowing you to pay for only what you use.
• Support you can count on: GitLab’s world-class support team responds to incidents around the clock.

Experience hosted runners in GitLab Dedicated

See Hosted Runners for GitLab Dedicated in action:

Hosted Runners for GitLab Dedicated is available in Linux x86-64 and Linux Arm64 architecture in the following machine sizes.

Get started with Hosted Runners for GitLab Dedicated

Hosted Runners for GitLab Dedicated is an add-on to GitLab Dedicated. Reach out to your GitLab account team to get started.

If you want to learn more about how GitLab Dedicated can support your compliance posture, talk to our team.

Need inference inside the same GitLab Dedicated boundary? Learn more in our companion article on the single-tenant AI Gateway.

Автор: Лыков А., к.ф.-м.н., академический руководитель Школы Высшей Математики и ШАДХелпера.

В статье смотрим, как большие языковые модели справляются с задачами первого этапа вступительного экзамена в ШАД 2026 года.

В прошлой статье мы разбирали вступительную кампанию ШАД-2026 и показали, что ИИ проходит второй этап. Теперь берём все 40 задач первого этапа во всех четырёх вариантах (A, B, C, D) и тестируем пять моделей: Claude Opus 4.8, DeepSeek-R1-0528, ChatGPT Sol, Qwen3.7-Max и GigaChat-3-Ultra.

Сразу скажем результат: Claude Opus 4.8 набрал 39,5 балла из 40, DeepSeek-R1-0528 — 38,25, ChatGPT Sol — 37,75, Qwen3.7-Max — 32,5. При проходном балле около 30 все зарубежные модели прошли бы первый этап, а GigaChat с 25,25 — нет. Отдельная история вышла с Gemini 3.1 Pro: его пришлось дисквалифицировать за списывание — но виновата тут наша методика, а не модель. Разбираем, кто на чём ошибался, сколько это стоило по времени и деньгам, и что всё это значит для онлайн-экзаменов.

В 2026 году вести рекламу одновременно и просто, и сложно. С одной стороны, появилось много инструментов, которые ускоряют запуск рекламы, помогают создавать контент и автоматизировать рутинные задачи. С другой — привлечение пользователей дорожает, эффективность каналов становится менее предсказуемой, а требования законодательства продолжают ужесточаться. Николай Лобанов, директор по маркетингу click.ru рассказал, какие подходы помогают бизнесу сохранять эффективность и находить новые точки роста.

Из статьи вы узнаете:

Приветствую читателей Хабра и моих подписчиков.

Сегодня хочу поговорить о наболевшем: о современном кризисе управления. Сразу скажу, что все написанное ниже основано на моем опыте и отражает мою точку зрения. Вы можете с ней не соглашаться.

Здесь обычно принято обсуждать технологии, кейсы, инструменты, цифровизацию. Я сегодня предлагаю вспомнить о другом, о чем немного позабыли в этой погоне — о людях и человеческих отношениях.

Когда год назад я занял должность технического руководителя коммерческой ТЭС, она находилась в аварийном состоянии. Предыдущий начальник, со слов коллег, сбежал от избыточной бюрократии, постоянных совещаний и гиперконтроля топов с постоянной отчетностью. Аварии на станции происходили почти ежедневно, часть автоматики не работала, оборудование требовало ремонта. Каждое утро начиналось с разбора инцидентов, их причин и попыток выйти из бесконечных остановов.

Но кроме технических проблем была еще одна — состояние коллектива. Люди разуверились в руководстве, в компании больше не ожидали перемен. Они просто ждали, когда всё окончательно загнется. На мои вопросы и предложения они отвечали: «Мы уже говорили», «Твой предшественник уже ходил», «Денег не дали или не дадут». В общем местами стандартная история.»

За год совместной работы мы вывели объект из аварийного состояния в режим стабильной работы. Станция молотит уже 4 месяца без единой аварии и останова. Проблемы возникают, но я уверен что моя команда справится. Я стал уверен в своих людях, а они во мне. Я впервые нахожусь в отпуске со спокойной душой, у меня не разрывается телефон и все работает. Этот год дал мне не только технический и управленческий опыт, но и много мыслей для размышлений. Чем и хочу сейчас поделиться.

Лаг Kafka растёт, консьюмеры простаивают, а добавление новых экземпляров только ускоряет проблему. Разберём, как по состоянию consumer group, таймерам и поведению партиций быстро определить причину сбоя и не потратить ночь на лечение неправильного симптома.

Что происходит, если вместо массовой раздачи AI-инструментов сначала изучить, как на самом деле работают команды?

Рассказываю, как мы начали AI Enablement в крупной финансовой организации: оценили 13 команд, визуализировали их delivery pipelines, обучили около 800 человек и построили программу вокруг реальных ботлнеков, а не вокруг модных AI-инструментов.

Всем привет! С вами Михаил Ключников. Я работаю в Positive Technologies уже 10 лет, где руковожу группой по анализу защищенности ПО. Мы занимаемся поиском новых уязвимостей (0-day) и воспроизведением уже известных (1-day) для нужд пентестов. Еще я состою в команде PT SWARM: ее участники пишут статьи, делают различные типсы и разборы уязвимостей по горячим следам.

У меня довольно большой опыт в багхантинге на различных международных платформах и на российской Standoff Bug Bounty. В этой статье я хочу поделиться своим опытом работы с 1-day уязвимостями — багами, которые могут быть опасны, хотя для них уже вышел патч. Мы разберем жизненный цикл уязвимости, способы их мониторинга, инструменты анализа, методы воспроизведения и правила репортинга. Вы узнаете, как правильно работать с 1-day в рамках багбаунти, чтобы не тратить время впустую и добиваться результата.

Cтaтичecкий aнaлиз кoдa дaвнo пepecтaл быть инcтpyмeнтoм иcключитeльнo для paзpaбoтчикoв. Для pyкoвoдитeлeй пpoдyктoв, тexничecкиx диpeктopoв и кoмaнд инфopмaциoннoй бeзoпacнocти oн cтaнoвитcя чacтью cиcтeмы yпpaвлeния кaчecтвoм и бeзoпacнocтью paзpaбoтки.

B этoй cтaтьe мы paccкaжeм, кaк пocлeдoвaтeльнo внeдpить инcтpyмeнт cтaтичecкoгo aнaлизa, ктo oтвeчaeт зa кaкoй этaп и кaк пepeйти oт paзoвoгo иcпoльзoвaния aнaлизaтopa к peгyляpнoмy кoнтpoлю кaчecтвa иcxoднoгo кoдa.

TL;DR

• Microsoft Paint поддерживает и локальную, и облачную генерацию изображений

• Paint и Photos также имеют в комплекте локальные модели ИИ

• Эти приложения отправляют промпт удалённому серверу для модерации

• Вместе с отмодерированным промптом сервер возвращает GUID

• GUID встраивается в локально сгенерированное изображение в качестве невидимого водяного знака

• Переключаемая в настройках функция видимого водяного знака не управляет этим невидимым водяным знаком

• На PC с Copilot+ генерация изображений выполняется локально, но модерация промптов остаётся удалённой

• Microsoft раскрывает, что Paint добавляет к сгенерированным ИИ изображениям метаданные C2PA

• Сгенерированные ИИ изображения можно сохранять только в форматы, поддерживающие C2PA: PNG, JPEG, GIF и .paint

Also: OpenAI CEO Sam Altman expressed his surprising sympathy over the construction of datacenters across the country

Hello, and welcome to TechScape. I’m Blake Montgomery, US tech editor at the Guardian, writing to you from a sunny park in New York City, which was supposed to endure rain all weekend but in fact delivered the best weather of the year.

‘We are hitting a different chapter’: OpenAI leader warns of threat of ‘persistent’ AI cyber-attacks

OpenAI announces slowing pace of development after hack by rogue agent

OpenAI launches ChatGPT for Teens with stronger safeguards

‘Digging the grave of my profession’: the Hollywood creatives training AI to do their jobs

Will AI give you the job? Automated hiring tools spark discrimination and secrecy lawsuits

After more than 15 years of laptops in the classroom, do Australian schools need a rethink?

Crypto bank part-owned by Trump family offers depositors way to ‘gain favor’ with White House, experts say

Did someone wearing Meta Glasses film you today? Are you sure?

Инструмент работает с топологией: GDSII/OASIS и LEF/DEF, верификация DRC/LVS/PEX (зазоры, сверка со схемой, паразиты), список нарушений. Типичный вопрос инженера: «почему LVS ругается на этот инвертор» или «покажи spacing на met2».

Три условия, без которых чат в таком продукте вреден.

Полностью офлайн по умолчанию. Layout это IP заказчика. Кусок дизайна в облако не уезжает, пока человек сам не выбрал облачный бэкенд. Часть установок air-gapped(изолировано).

Нельзя молча испортить данные. Правка геометрии идёт через preview: Apply или Discard. Delete и крупные батчи помечаются жёстче.

Нельзя выдумывать. Числа по нарушениям и правилам берутся из движков и локальной документации. Общая эрудиция модели сюда не допускается.

В 2010 году исследователи из Хоккайдского университета поставили чашку Петри. На дно налили влажный агар, разложили 36 овсяных хлопьев в точках, соответствующих крупнейшим городам вокруг Токио, а кусочек слизевика поместили в центр - в точку, соответствующую Токио. Участки, соответствующие горам и водоёмам, засветили лампой -  физарум избегает яркого света и сам обходил эти зоны, воспроизводя реальные географические ограничения при прокладке железных дорог.

Через 26 часов посмотрели что получилось.

Сеть из протоплазматических трубок, которую вырастил слизевик, воспроизводила топологию реальной железнодорожной сети токийской агломерации. Узел за узлом. Причём не просто воспроизводила - по трём инженерным критериям одновременно: стоимости (суммарная длина трубок), транспортной эффективности (среднее время пути между узлами) и устойчивости (сколько соединений можно убрать, прежде чем сеть развалится).

Family of three-year-old allegedly thrown into pit at Cambridgeshire zoo say he is happy to be back at home

A three-year-old boy who was seriously injured in a zoo’s crocodile enclosure has been discharged from hospital and is settling back in at home, his family has said.

The child returned home a few weeks ago and was “happy to be home, playing with his toys, sleeping in his own bed and being a big brother”, his parents said in an update posted online.

President Trump is calling on world leaders to join his economic war against Iran. And, the Supreme Court is backing the president for now on his order to restrict mail-in voting.

(Image credit: Win McNamee)

Exclusive: Buckinghamshire and Bedfordshire sites predicted to emit 4.5m tonnes a year when fully running

The carbon emissions from just two planned datacentres in England will exceed all of the fossil fuel company ExxonMobil’s UK emissions, analysis has revealed.

Experts have said this demonstrates the “serious threat” datacentres pose to the UK’s legally binding climate goals.

The controversial rapper now known as Ye was due to play two huge shows at St Petersburg’s Gazprom Arena, which now states it cannot host performances for contractual reasons

The St Petersburg stadium that was set to host two concerts by Ye – making the rapper formerly known as Kanye West the biggest western act to play in Russia since start of the Ukraine war – has now said that the concerts will not take place at the venue, although the promoter has stressed that they have not been cancelled.

Gazprom Arena had previously posted on social media saying that “the most influential musical artist of our time” would perform there on 10 and 11 October. “This is no joke!” the post stated. The event sold out immediately, including tickets priced at £1390 ($1896).

Trump administration proposes new rule to dismantle requirement for datacenters to publicly report air pollution

A new rule proposed by the Trump administration aims to kill public notification for datacenter air pollution, public health advocates warn, and allow emission permits to be issued behind closed doors.

The datacenters are often sources of nitrogen oxide, which helps form ozone, carbon monoxide and heavy metals, among other pollutants.

Exclusive: Buckinghamshire and Bedfordshire sites predicted to emit 4.5m tonnes a year when fully running

The carbon emissions from just two planned datacentres in England will exceed all of the fossil fuel company ExxonMobil’s UK emissions, analysis has revealed.

Experts have said this demonstrates the “serious threat” datacentres pose to the UK’s legally binding climate goals.