Разговор о том, кто на самом деле контролирует облако, часто начинается с регионов: где выполняется рабочая нагрузка и где хранятся её данные. Но выбор региона — только часть картины, архитектура платформы значит ровно столько же. Особенно важно, как она разделяет между кластерами ответственность за управление, исполнение, сборку и наблюдаемость.
Недавняя публикация сообщества CNCF, «От резидентности данных к цифровому суверенитету: архитектурные паттерны для cloud native-платформ», хорошо это обосновала. Под такими режимами, как EU Data Act, NIS-2, DORA и UK Data (Use and Access) Act, платформенным командам теперь приходится показывать не только то, где выполняются рабочие нагрузки. Нужно показать и то, как платформу эксплуатируют, защищают и по каким правилам ею распоряжаются, вплоть до плоскости управления.
Та статья изложила требования и представила паттерн «кластер на тенант» как один из способов провести границы изоляции. Команда VK Cloud перевела статью, в которой на те же требования смотрят под другим, но дополняющим углом: что происходит, если считать контроль над платформой свойством топологии её плоскостей. В качестве примера, который можно изучить самому, авторы берут OpenChoreo, внутреннюю open source-платформу разработки и проект CNCF Sandbox. Впрочем, сами архитектурные идеи применимы широко.
Static credentials in CI/CD environments are a significant source of security risks and operational overhead. They can be accidentally leaked through logs and build artifacts. And you can never be sure who’s copying, saving, or sharing them with others during the CI/CD setup process. In addition, they require regular rotation to meet security requirements.
That’s why many services, including major cloud providers, now support authentication with short-lived OIDC identity tokens, allowing CI/CD pipelines to authenticate without storing static credentials.
In this article, we will explain how OIDC authentication works and show how the new TeamCity OIDC JWT plugin enables your build configurations to authenticate securely to AWS, Google Cloud, and other services that support OIDC.
What is OIDC?
OpenID Connect (OIDC) is an authentication standard originally designed to verify user identities. However, many popular cloud providers and services, such as AWS and Google Cloud, use parts of the OIDC specification to authenticate workloads. This article focuses only on those parts.
The authentication flow starts when an identity provider (IdP) issues a cryptographically signed JSON Web Token (JWT) containing information about a workload. Each piece of information in the token is called a claim. Each token contains a validity period, an intended audience (the service or services the token was issued for), and an issuer URL. The issued token can then be presented to a third-party service (such as a cloud provider), which we will refer to as a token consumer.
When a token consumer receives a token, it uses the issuer URL to retrieve the metadata document ({issuer_url}/.well-known/openid-configuration). Among other information, this document includes a link to the issuer’s JSON Web Key Set (JWKS), which contains public keys used to verify token signatures. OIDC issuer URLs must use the https scheme, so the metadata document can only be served over HTTPS. Some consumers also support validation against a preconfigured set of keys instead, in which case the issuer does not need to serve the metadata document over the internet.
After retrieving the public keys, the consumer verifies the token signature against them. If the signature is valid, the consumer checks whether the token was issued for an expected audience and is currently valid (not expired). The validated token’s claims are then used by the consumer to authenticate the workload.
Some consumers accept IdP tokens directly. Others perform atoken exchange and return service-specific temporary credentials for workloads to use.
To enable this authentication method for TeamCity builds, the server needs to act as an identity provider and issue tokens for them.
Introducing the TeamCity OIDC JWT Plugin
The new OIDC JWT plugin adds IdP capabilities required to issue tokens for third-party services that support OIDC, such as AWS and Google Cloud.
The tokens are signed using algorithms based on RSA or ECDSA. Signing keys can be rotated either from the web UI or with an authorized request to an HTTP endpoint. By default, key rotation does not affect running builds or invalidate previously issued tokens.
For publicly accessible TeamCity instances, the plugin provides the .well-known/openid-configuration document and a JWKS with the issuer’s public keys. It also features a configurable issuer URL for instances that are not accessible from the internet,allowing you to host these documents on a public HTTPS host without exposing the TeamCity instance itself.
Finally, the plugin provides an API that allows other plugins to add new ways to sign tokens. By implementing a simple interface, plugin authors can add support for external hardware security modules (HSMs) or other key management services, such as Google Cloud KMS.
The installed and enabled plugin can be configured via Admin | Integrations | OIDC Tokens. You can set the issuer URL (for instances inaccessible from the internet), configure signing settings, and manage signing keys.
Configuration changes may disrupt existing integrations. We recommend configuring the plugin before you set up OIDC for your builds. Once the plugin is configured, you can add build features that provide OIDC tokens.
The OIDC Token (in build parameters) build feature is the easiest way to issue a token. It generates a token at the start of the build and stores it in the specified build parameter. The lifetime of the token is configurable. By default, it equals the build timeout or 10 minutes if no timeout is specified.
The feature allows you to issue a token for one or more audiences. When different services require separate single-audience tokens, add a separate build feature for each token.
With long-running builds, tokens issued at the start of a build may remain valid for longer than necessary. For such builds, there is the OIDC Token (on demand via HTTP request) build feature. It allows build scripts to obtain short-lived tokens during the build with an HTTP request. The lifetime of issued tokens is always 5 minutes and cannot be changed.
The build can then present the issued token directly to the target service or use it as part of that service’s authentication flow.
The correct audience and token lifetime depend on the service you are integrating with. Consult the service’s official documentation for instructions on setting up OIDC authentication. You can also follow the setup guides we have for AWS and Google Cloud.
Learn more
Visit the plugin’s JetBrains Marketplace page for more information:
The public sector handles sensitive citizen data, which is why software projects built with secure coding are imperative to deliver high trust levels. Code compliance with data protection laws, financial governance standards, and various regulations and policies is an obligation that must be consistently met to maintain trust and accountability.
According to IBM’s Cost of a Data Breach Report 2026, the global average cost of a data breach is $4.99 million. That’s a lot of money for any organization in the public sector. Similarly, the Ponemon Institute and Globalscape’s report, The True Cost of Compliance with Data Protection Regulations, determined that the cost of non-compliance is 2.71 times higher than being compliant. Hardcoded credentials or insufficient input/output validation are common, costly issues, often caused by working at speed and incomplete validation checks.
Many issues create compliance problems, and poor code security is one of the biggest risks, which code maintainability can mitigate. Ensuring compliance also helps avoid the costs associated with productivity loss, financial penalties, legal fees, and settlements that can quickly add up after a breach.
Understanding the risks of non-compliance in the public sector when building and updating software and taking steps to ensure code compliance helps avoid financial and reputational damage.
Strict standards apply across public sector software for data protection, security controls, accessibility, and supply chain transparency. Compliance with specific regulations, frameworks, and standards is mandatory, but may vary depending on your location and the applicable policies.
Our cheat sheet helps developers working on public sector software understand potential compliance risks, the considerations to make, and how using a code quality tool can help ensure compliance. It outlines common issues for public sector software, so your development team can review its code quality against each factor before deployment to minimize any risks.
Save time, stay safe, and ensure you’re not breaking any rules.
Compliance Risk
Dev Consideration
Code Quality Tool Use
Non-uniform delivery quality breaches contract standards, resulting in disputes over “whose code failed”
Inconsistent coding standards across contractors and subcontractors
Automatic enforcement of centrally configured quality profiles across all teams
Institutional knowledge loss leading to undetected regressions in critical systems
Dev teams change over long lifecycles, causing quality drift
Baking continuous inspection into the CI/CD pipeline, regardless of who writes the code
Rising maintenance costs and risks breaching long-term supportability commitments in contracts
Unchecked code smells, duplication, and complexity accumulate
Track technical debt metrics on an ongoing basis
Breach of secure development lifecycle mandates with potential data breaches exposing citizen data
Injection flaws, insecure deserialization, and unsafe input handling
Static application security testing (SAST) detects known vulnerability patterns
Violation of identity and access management standards causes a credential leak risk
Hardcoded credentials or secrets in source code
Secret detection built into code scans
Non-compliance with data protection laws (e.g. GDPR), which require appropriate security measures
Weak or outdated cryptography
Flags insecure crypto implementations
Supply chain security failure, which breaches vulnerability management requirements
Vulnerable open-source dependencies
Dependency vulnerability scanning
Breach of procurement restrictions on acceptable licenses that cause IP/legal exposure
License conflicts in dependencies
Automated license compliance checks
Unsupported components in production mean incident response and patching obligations aren’t met
Outdated libraries are no longer supported
Dependency freshness tracking
Failing to produce evidence during compliance audits or contract milestone sign-off
A lack of objective audit evidence for code quality/security
Automated and time-stamped historical reports
Audit findings cite inadequate or inconsistent quality assurance process
Deliverable acceptance criteria breach and contractual SLA non-conformance
Non-compliant code progressing through the pipeline unchecked
Quality gates block merges/releases below the threshold
Business continuity risks during vendor/contractor handover
Inherited/legacy code with unknown risk areas
Complexity and risk for unfamiliar codebases surfacing
A breach of government IT policy restricts external SaaS/cloud dependencies
A need for on-prem/air-gapped tooling
Self-hosted deployment option
Code compliance risk 1: Security and data protection compliance
Failing to comply with security and data protection standards and regulations puts sensitive and personal information at risk of exposure. Public sector software processes large amounts of personal data. Aligning it with applicable security and data protection standards, such as the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, is vital.
Requirements vary by country, too. For example, public sector bodies in EU countries must abide by General Data Protection Regulation (GDPR), a strict data privacy and security law, while UK central government departments and agencies are subject to the National Audit Office (NAO) standards.
US agencies work within Federal Acquisition Regulation (FAR), Defense Federal Acquisition Regulation Supplement (DFARS), and Federal Risk and Authorization Management Program (FedRAMP).
The real-world impact for developers
Developers must build privacy and defense procedures into the software development lifecycle (SDLC) from the start to protect sensitive data. Leaving it too late or considering security too close to testing and deployment can jeopardize privacy protection.
Using weak and outdated cryptography is another compliance risk, as it leaves public sector software vulnerable to attacks. Weak cryptography can also breach controls required under frameworks like ISO/IEC 27001 (Information Security Management), risking loss of certification and reputational damage.
Considering supply chain vulnerabilities and the accountability for personal data handled by third-party vendors is important, too. Third-party dependencies must be treated as active risks. Integrating a code compliance tool like Qodana into the IDE and CI/CD pipeline brings automated SAST checks, secret detection, and cryptography scanning directly into developers’ existing workflow, catching issues before they reach production.
Secure credential storage, explicit user-consent handling, penetration testing before deployment, and ongoing automated testing help with security and data protection compliance. This can ensure public sector software retains NCSC Cyber Essentials certification.
Code compliance risk 2: Contractual and procurement compliance
Public sector software can automate government purchasing and supplier agreements. This improves efficiency but may introduce compliance risks, such as service level agreement (SLA) non-conformance. Failure to comply with an SLA can result in contract termination and financial penalties.
Various regulatory guidelines cover contractual and procurement compliance. These include the FAR in the US and the UK Public Contracts Regulations 2015 (procurement law). Government departments can add specific rules and regulations, like the DFARS and the Cabinet Office Technology Code of Practice.
Potential risks include non-compliant code progressing through the pipeline unchecked, like committing an active API secret key to a feature branch and not running SAST, which can lead to a breach of deliverable acceptance criteria. Vague requirements and missing edge cases may cause this. It may also result in disputes over delivery quality across contractors due to siloed teams.
Open-source dependencies, risks and actions
Open-source dependencies often carry licensing terms too, such as copyleft clauses and commercial-use restrictions. These may conflict with procurement rules on acceptable software. An undetected license conflict can expose the public sector body to IP disputes or breach of contract. Automated license compliance scanning flags these conflicts at the dependency level, before they become a legal problem.
Developers should embed automated quality gates into the CI/CD pipeline, so non-compliant code can’t progress toward a contractual deliverable. This replaces manual sign-off with an objective and repeatable check that provides useful evidence if a dispute over delivery quality arises.
Code compliance risk 3: Audits and accountability
Failing to produce evidence during compliance audits results in unverified controls being treated as non-existent. For public sector software, this can lead to failed certifications and financial penalties. A digital paper trail is essential for objective audit evidence of code quality and security, ensuring accountability.
A reliance on subjective, manual sign-off alongside inconsistent findings from the quality assurance process risks audit failure. Lacking objective audit evidence for code quality and security also exposes public sector software to compliance failure and technical debt. Automated tools can replace subjectivity to help ensure compliance with relevant regulatory guidelines and audits.
The National Institute of Standards and Technology (NIST) provides guidelines for federal information systems and organizations, which apply to some public sector software in the US. There are also audit requirements of ISO/IEC 27001 and the National Audit Office (NAO) standards for public spending accountability in the UK.
Developers must automate audit reports, embedding automated controls within the SDLC to ensure compliance with audits. This also mitigates any risk from manual sign-off. Integrating testing and traceability into CI/CD pipelines creates a digital audit trail to help produce evidence during any compliance audit.
Code compliance risk 4: Long-term supportability and continuity
Public sector software failures can lead to critical citizen service outages. Long-term supportability enables the continuity of such software and the effective application of updates over time to maintain performance and security levels. It also helps compliance with relevant regulations and global standards, such as ISO 22301 (Business Continuity Management System).
Any public sector software that relies on open-source code is also at risk of being built on libraries that become outdated. Incident response and patching obligations won’t be met due to unsupported components. There are also business continuity risks during vendor or contractor handovers, as teams may inherit code with unknown risk areas, where the complexity of an unfamiliar codebase can hide problems until it’s too late.
Prioritizing quick fixes can create technical debt and breach long-term maintenance commitments. A short-term patch that isn’t built for long-term support often needs revisiting later. That future fix is usually costlier and more time-consuming than doing it properly the first time.
Developers should implement dependency freshness tracking to identify and use the latest stable version or patch release. This minimizes potential security risks due to using outdated libraries and ensures public sector software is up-to-date.
Keeping the number of external dependencies to a minimum also makes long-term supportability easier. Automated unit and integration tests help catch bugs before deployment, while static code analysis catches code errors early, making it easier to address them and ensure long-term supportability.
Code compliance risk 5: IT governance and infrastructure policy
Public sector software must meet security baselines and comply with various regulatory guidelines for IT governance. For example, the UK’s Government Cloud First policy ensures public sector organizations use public cloud services as the default when procuring new or existing IT and software solutions.
Government IT policy often restricts the use of external SaaS or cloud dependencies. Using non-compliant tooling puts sensitive public sector data at risk. This can violate FedRAMP (Federal Risk and Authorization Management Program), a standardized approach based on NIST guidelines that ensures cloud providers meet strict federal data protection rules.
IT infrastructure is also at risk of erosion due to institutional knowledge loss linked to the governance of long-running systems. When developers and staff leave without documenting context, workarounds, and the rationale for decisions, it can make understanding and maintaining the infrastructure difficult.
Digital audit trails
A digital audit trail helps with ongoing infrastructure maintenance. Development teams can also consider on-premises and air-gapped tooling as a self-hosted deployment option for better code compliance.
These secure systems require no external cloud dependencies. Embedding automated guardrails into the SDLC helps achieve compliance through continuous scanning and policy-as-code.
Discover more about using Qodana for DevOps to help ensure code compliance in public sector software projects or try Qodana for 30 days.
As part of the deal, the U.S. is creating a private company as a joint venture with North American Blue Energy Partners, owned by Venezuelan businessman Alejandro Betancourt.
Однажды вечером я, как обычно, листал ленту одного синего маркетплейса и случайно наткнулся на электронный замок со сканером отпечатка пальца. По описанию — почти идеальное устройство за небольшие деньги: биометрия, защита от воды, какая-то «уникальная» микросхема. Звучит убедительно, но исследователь на то и исследователь, чтобы не принимать рекламные обещания на веру, а потому уже на следующий день замок лежал у меня на столе. Ну, а дальше сработал знакомый принцип: где один интересный девайс, там быстро появляется пара других…
Меня зовут Астафиев Денис, я ведущий специалист по аппаратным исследованиям в Бастионе. По работе я регулярно разбираю самые разные устройства, чтобы проверить, насколько можно доверять тому, что производитель обещает на коробке. Сегодня будем смотреть сразу на три замка с биометрией и искать слабые места в их защите.
Сразу оговорюсь: цель этой статьи — не любой ценой «дожать» дешевый китайский замок до уровня лабораторного исследования. Наоборот, мне хочется на простом и доступном примере показать, как обычно строится базовый аудит аппаратной безопасности и почему начинать его стоит совсем не с самых сложных атак.
В маленькой команде почти любая ошибка сначала выглядит как полезная работа.
Вы выпускаете функции, чините воронку, отвечаете пользователям, собираете аналитику. Каждый отдельный шаг кажется разумным. Только через несколько месяцев становится видно, что вся эта скорость вела немного не туда.
У меня ушло несколько лет, чтобы научиться замечать такие решения раньше. Не всегда до запуска, иногда хотя бы через неделю, а не через квартал. Ниже семь принципов, которыми я сейчас проверяю продуктовые ходы. Они выросли из работы над Viralmaxing, нашей аналитикой для контентных команд, и из моих повторяющихся ошибок.
Продолжение статьи «Назад в машинный зал: как собрать эмулятор PDP-11/70 с телетайпом, блэкджеком и без Rust» (первая часть). Первая часть — про то, что получилось; эта — про то, почему так, и во что это выйдет дальше.
Meteorologists release list of monikers for potential storms this season after 40,000 suggestions from public
From a five-year-old weather enthusiast to a beloved animated sheep, the inspiration for the list of storm names for this autumn and winter is wide and varied.
Austen, Boelo and Chloe will be the first named storms of this winter, meteorologists have revealed, after more than 40,000 suggestions were submitted by the public.
Exclusive: Some staff call decision a betrayal of young apprentices who are often selected to increase diversity
The BBC is facing internal anger after a group of apprentices were told they could no longer expect jobs they had been promised, as a result of the corporation’s sweeping cuts.
In a sign of the pressure the BBC is under to find savings, apprentices working with BBC News were told that “exceptional circumstances” meant the broadcaster could no longer stand by its pledge to find them permanent positions.
At the height of her 1998 re-election fight, Pauline Hanson was challenged to give her honest assessment of John Howard.
Two years on from her firebrand maiden speech, the One Nation leader was contesting the Queensland seat of Blair when she was bailed up by a group of punters at a country race meeting. The men had been drinking and one demanded to know if Howard was “a prick”.
Прочтя недавний перевод про запаковку БД в exe, решил рассказать об идеи, которую реализовал лет 6 назад в своем домашнем проекте. Сам проект недоделал, но речь в статье об архитектуре файлов и их запаковке.
A grieving couple who have lost their son find a way to a mirror universe where time runs backwards – but the narrative machinery is shonky and distracting
There is something farcical – grotesque, even – about life played in reverse. A child falling into a tree. A sandwich emerging from a mouth, bite by reconstituted bite. A doctor unstitching a wound. The world is strange in any order, but rewind helps us notice – makes the ordinary absurd.
Novels that pick a fight with forward momentum tend to harness this absurdity, revel in it. In The Cockroach (2019), Ian McEwan gives us a sneering Brexit fable about political nostalgia. If voters want to turn back the clock, let them. He unleashes “Economic Reversalism”, which sees employees pay for the privilege of work, and every pound sent back to where it came from. In Time’s Arrow (1991), Martin Amis inverts the Holocaust. Just imagine it, he dares us: a network of sanatoriums instead of death camps. A vast machinery of reparation run by benevolent Nazis. How monstrously laughable.
Iko Uwais directs and acts in the story of a band of elite soldiers who must rescue a group of researchers taken captive in the jungle
Can an elite team of soldiers rescue a band of innocent hostages from a bunch of mean old terrorists? Yes, probably, since there are few (if any) action movies in which the hostages are wiped out and the terrorists win. Not to be confused with the Extraction action franchise starring Chris Hemsworth as a mercenary named Tyler, nor with action thriller Escape Plan: The Extractors, starring Dave Bautista as a prison security expert named Trent, this is an Indonesian action thriller in which actor/director Iko Uwais plays a soldier named Timur. The film was actually called Timur originally, but there’s no denying that The Extractor is a more commercial title (unless you are particularly interested in the medieval Mongol khanates) and will attract more viewers to this tale of hostages, heroes and long-ago childhood friends.
In some ways, though, the rebrand is a shame, because the new title suggests the film is more generic than it is. While the basic plot, in which a bunch of researchers are taken hostage in the jungle by an armed group of wrong ’uns, is hardly unique, there are sequences in the film that stand out from the direct-to-video action content mill. In Indonesia, timur means “east”, where the sun rises, and it carries the connotation of hopefulness. That softer feeling in the original title is a key part of the film’s identity, which includes sentimental flashbacks to the childhoods of various characters whose lives have taken tragically different paths. (Can you imagine a world in which a terrorist and a soldier knew each other as children? The Extractor can.)
Привет, Хабр! Я Артём Борисов, Java-разработчик, в основном занимаюсь развитием микросервисов в команде РСХБ «Свои инвестиции». Представьте ситуацию: вы работаете с инвестиционными сделками, обрабатываете миллионы сделок в день, но все они обрабатываются один раз только ночью. А бизнес требует реального времени. Это была наша рутина, пока мы не внедрили Kafka Streams. В этой статье я расскажу о том, как мы трансформировали систему обработки сделок на фондовом рынке (SOFR) с batch-обработки на полноценную real-time систему, способную обрабатывать миллионы сделок в сутки.
PM says he has a ‘clear diagnosis of what has gone wrong’ with UK, and pays tribute to Keir Starmer after his predecessor quit parliament
My colleague Richard Partington, the Guardian’s senior economics correspondent, grew up, like Andy Burnham, in the Warrington suburb of Culcheth. He has been home to find out what people there are saying about the new PM.
Yesterday, Kemi Badenoch announced a reshuffle, replacing Mel Stride with Andrew Griffith as shadow chancellor and Priti Patel with Tom Tugendhat as shadow foreign secretary.
Resignation comes after months of turmoil at Pentagon, from leaked investigation to ousting of senior officials
The army secretary, Dan Driscoll, has handed his resignation to Donald Trump, the White House said on Monday, becoming the latest high-profile figure to depart the defense department.
The army official, who is second in line to the defense secretary, Pete Hegseth, had reportedly been eyeing an exit from the Pentagon amid apparent friction with the secretary.
This liveblog is now closed. Read the Guardian’s report of today’s political news here
My colleague Richard Partington, the Guardian’s senior economics correspondent, grew up, like Andy Burnham, in the Warrington suburb of Culcheth. He has been home to find out what people there are saying about the new PM.
Yesterday, Kemi Badenoch announced a reshuffle, replacing Mel Stride with Andrew Griffith as shadow chancellor and Priti Patel with Tom Tugendhat as shadow foreign secretary.
Russia believed to be behind hybrid activities in Germany and Europe, minister says
Over in Brussels, the European Commission is just starting its first midday briefing of the autumn.
It opens with an announcement that Commission president Ursula von der Leyen will receive Nato’s Mark Rutte tomorrow. This comes amid growing scrutiny of Russia’s activities on the eastern flank.
Что может быть привычнее для разработчика, чем ежедневный ввод команд установки или обновления зависимостей: npm install, pip install, uv add, bundle add, cargo add? Пакетный менеджер находит нужную библиотеку, скачивает её вместе с транзитивными зависимостями и за несколько секунд устанавливает в проект сотни тысяч строк чужого кода. В этот самый момент мы не задумываемся о том, что совершаем серьёзный акт доверия. Мы доверяем автору пакета, его аккаунту, системе публикации, сборочному конвейеру и всем зависимостям, которые пакет подтянет вместе с собой. Бесспорно, большую часть этого кода мы не читали и, скорее всего, не прочитаем никогда. Пока всё работает как задумано, этот процесс остаётся незаметным. Но стоит злоумышленнику скомпроментировать хотя бы одно звено этой цепочки, и обычное добавление или обновление библиотеки превращается в установку вредоносного кода в сотни или даже тысячи проектов.
Именно на этой идее и строится атака на цепочку поставок — supply-chain attacks. Зачастую злоумышленнику не обязательно искать уязвимости непосредственно в вашем приложении, планировать дорогостоящие многовекторные атаки и применять социальную инженерию. Ему достаточно увести учётку разработчика даже не особо известного пакета, добавить бэкдор в новую версию, опубликовать её в тот же npm или PyPi — и вуаля: вот уже вредоносный код отправляет персональные данные ваших клиентов прямиком на серверы хакеров.
На связи Сергей Скирдин, технический директор ИТ-интегратора «Белый код». Когда меня спрашивают, как выбрать интеграционную платформу, я обычно советую не ограничиваться сравнением функций и демонстрацией вендора. Гораздо полезнее проверить платформу на конкретной задаче из собственного ИТ-ландшафта.
Недавно для одного из заказчиков мы провели такой пилот: вместо существующей цепочки COM-обменов проверили централизованную схему через DATAREON Platform. Всего три интеграционных потока позволили проверить не только саму платформу, но и ключевую архитектурную гипотезу — может ли одна из систем стать единым источником данных, а зависимость от промежуточной системы быть устранена.
На этом примере разберу, что именно имеет смысл проверять во время пилота ESB и почему пилот не должен превращаться в формальную передачу нескольких сообщений из точки А в точку Б.
The chicken liver sponge has sailed through a test of its ability to filter pollutants in a harbour in Spain’s Costa Brava
In the polluted waters of Marina Palamós on Spain’s Costa Brava, Manuel Maldonado, a sponge biologist, noticed something unusual last month: red starfish had started settling in the area.
Nearly two years earlier, the Spanish National Research Council scientist and his colleagues had begun transplanting sea sponges into the port to study whether they could survive in its polluted waters.
Russia believed to be behind hybrid activities in Germany and Europe, minister says
Over in Brussels, the European Commission is just starting its first midday briefing of the autumn.
It opens with an announcement that Commission president Ursula von der Leyen will receive Nato’s Mark Rutte tomorrow. This comes amid growing scrutiny of Russia’s activities on the eastern flank.
‘Technology cannot move fast enough to prevent loss’, official says, as rescue efforts for the 4,500 still missing continue
Nepal last week turned down foreign involvement in general search and rescue but said it needed specialised services and advanced technological support in areas such as life-detecting machines, large refrigerators and pre-fabricated bridges.
Aid worth more than $42m has poured into the country and Nepal is now working with experts from other countries to help with rescue operations.
«Это ТСПУ РКН, поделать ничего нельзя» — а проблема три месяца ждала в консоли сервера
Время расследования · 2 дня Причин найдено · 3 Команд для победы · 1
Клиент — онлайн-СМИ застройщика федерального уровня, несколько десятков публикаций в день, своя редакция. С июня сайт периодически становился недоступен. Подрядчик, который ведёт техподдержку, прислал такое сообщение:
Привет, Хабр! Меня зовут Завур, я фронтенд-разработчик в Selectel. Каждый день я работаю в привычной многим среде разработки VS Code. Однако в личных проектах, которые создаю для исследования новых инструментов и методов написания кода, часто использую Cursor.
Он классно ускоряет разработку, но мне давно хотелось проверить: способен ли искусственный интеллект самостоятельно воплотить сырую идею в полноценное рабочее приложение? Иногда хочется быстро увидеть прототип в действии, чтобы решить, стоит ли развивать проект дальше. Именно поэтому я не смог пройти мимо многообещающего сервиса Devin.
Давайте посмотрим, как на практике выглядит реализация идеи с помощью Devin, и попробуем разобраться, действительно ли перед нами потенциальный конкурент Cursor.
По данным непальских властей, после мощного ливневого наводнения в Непале, произошедшего в среду, погибли как минимум 903 человека. Число пропавших без вести возросло до 4 247 человек. Предположительно более 900 из них — сотрудники гидроэлектростанций, многие из которых в момент наводнения находились в туннелях.
Присяжные в Лас-Вегасе признали 63-летнего Дуэйна «Киффи Ди» Дэвиса виновным в убийстве в 1996 году звезды хип-хопа Тупака Шакура (2Pac). Ранее Дэвису было предъявлено обвинение в организации расправы над рэпером.
До реализации этого пилота нам пришлось основательно погрузиться в тему клещей, эпидемиологической обстановки в нужном регионе и современных средств защиты. Звучит как начало триллера, но эта история с хорошим финалом.
Меня зовут Оксана Эйнеш, я руководитель направления «Высокоточное позиционирование в МТС». В этот раз мы с командой решили поделиться кейсом, который реализовали для одного крупного лесхоз-предприятия: как технологии высокоточного позиционирования помогают считать каждый гектар, контролировать вырубку и не спорить о границах землеотводов.
Liberal party figure tells inquiry he never asked Jean Nassif ‘for payments for political outcomes’ as lawyer tells him she is ‘gobsmacked’ by his ‘obfuscation’
The younger brother of Dominic Perrottet has insisted he never asked a fugitive property developer for money for political outcomes – including at a meeting at fine-dining restaurant Nobu in Crown Casino, an inquiry has heard.
On Tuesday, the New South Wales Independent Commission Against Corruption (Icac) heard that developer Jean Nassif had withdrawn from a scheduled videolink appearance from Lebanon later this week, after Charles Perrottet faced questions about the dinner meeting between the two men in Melbourne in May 2021.
Three projected victories are a message to US that Carney has support of the Canadian people, says one MP
Canada’s ruling Liberal party has swept three byelections, a result that showed voters backing the prime minister, Mark Carney, after his face-off with Donald Trump.
The Canadian Press, Canada’s national news agency, projected Liberal victories in Chicoutimi-Le Fjord in Quebec, Beaches-East York in Toronto and North Vancouver-Capilano in British Columbia.
Я довольно активно использую ИИ в разработке примерно с конца 2024 года.
Наверное, многие слышали оценки в духе: «ИИ ускоряет разработчика на 20–30%». Возможно, для каких‑то привычных задач это и неплохая метрика.
Но недавно у меня случился кейс, который вообще плохо укладывается в эту систему координат.
За один очень плотный рабочий день — примерно 11 часов от идеи до боевого переключения — удалось исследовать закрытый Windows‑компонент, восстановить недокументированный бинарный протокол, разобраться с особенностями криптографии, написать совместимую реализацию на Java, сформировать регрессионный корпус из реального трафика, завернуть всё в контейнер, развернуть в Kubernetes, провести независимое ревью и переключить production.
И вот после такого слова про «+30% производительности» начинают казаться немного смешными.
Честно говоря, это пока самый впечатляющий кейс разработки с AI, который у меня был. Восторг скрывать не буду:)
Three projected victories are a message to US that Carney has support of the Canadian people, says one lawmaker
Canada’s ruling Liberal party has swept three special elections, a result that showed voters backing the prime minister, Mark Carney, after his face-off with Donald Trump.
The Canadian Press, Canada’s national news agency, projected Liberal victories in Chicoutimi-Le Fjord in Quebec, Beaches-East York in Toronto and North Vancouver-Capilano in British Columbia.
Почему исправные 20-мс аудиопакеты всё равно превращались в щелчки? В БОЛТУНе каждый пакет запускался как отдельный AudioBufferSourceNode — до 50 мини-плееров в секунду на одного говорящего. Мы заменили это расписание одним непрерывным AudioWorklet с кольцевым буфером и проверили новую схему тестами.
Привет, Хабр! На связи Лена, аналитик Directum Projects. Сегодняшние экономические условия тихо (или уже громко) шепчут: «Пора сокращать расходы». И вот уже финансовый директор режет бюджеты на подписки, корпоративные сервисы, командировки и обучение. Пересматриваются закупки и оптимизируется штат.
Проходит полгода, и издержки снова начинают расти.
Наверное, многие уже видели или хотя бы слышали про цепочки атак, где пользователю показывают красивую фейковую Cloudflare CAPTCHA, а дальше предлагают выполнить несколько действий «для проверки».
Схема далеко не новая. Более того, я вообще не удивлюсь, если кто-то скажет: «Да мы это уже видели». И будет прав. Но, как обычно, старые идеи периодически достают из шкафа, немного перекрашивают и снова пускают в ход.
Вся эта история опять упирается в одну простую вещь — внимательность пользователя. Если человек сам выполнит то, что ему подсунули, дальше защита компьютера уже может не сильно помочь.
After Novak Djokovic's latest bid for a historic 25th major title ends in tears in New York, where does the most decorated men's player of the Open era go from here?
Покупатель в техномаркете задает вопрос: «Этот системник потянет обработку 4K-видео?». Продавец-стажер лихорадочно ищет информацию: открывает спецификацию, гуглит обзор в интернете, но безуспешно. Тогда он пытается дозвониться до сервисного центра, долго ждет ответ, переспрашивает. Через полчаса раздраженный покупатель уходит без покупки.
