RSS Feeds

Вся история микрокомпьютеров, расцвет которых пришелся на начало 1980-х, фактически сводится к борьбе программистов и инженеров за каждый свободный байт. Именно оперативная память определяла границы дозволенного. Игры и прикладное ПО усложнялись, каждая новая функция отрезала кусочки от объема ОЗУ, доступного пользователю. Приходилось хитрить, выдумывать нестандартные подходы и всячески изворачиваться, чтобы втиснуть свой код и ресурсы в скромные 48, а то и 16 килобайт оперативной памяти.

Именно об этом мы хотим поговорить под катом. Вспомним самые популярные системы и подглядим, как именно программистам и инженерам удавалось «запихнуть» довольно сложные и объемные проекты в скромное железо того времени.

‘We were swept up in the moment and full of testosterone. The 90s wasn’t a time when men were encouraged to be sensitive’

We were hanging out with the lovely producer George Drakoulias at Abbey Road. He said, “We’re going to bring in some instruments for you guys” – and replaced the fairly low-budget ones we’d been playing. I was given this beautiful 1960s Fender Jazz bass.

В прошлый раз я писал, как из за ограничений и необходимости админить смешанный парк корп устройств, появился собственный MDM. Несмотря на то что предыдущий пост вышел совсем недавно, упорная работа над проектом шла параллельно, поэтому готов представить вам продолжение. Параллельно буду прикреплять скрины нового веб интерфейса, чтобы можно было почувствовать разницу.

Erica Fox left Lovers Point near Monterey in December alongside group of swimmers but never made it back

A single, devastating shark bite was fatal for an ocean swimmer whose body was found on a California beach in December, a new autopsy report confirmed.

Erica Fox, 55, drowned after that shark bite broke her pelvis and severed a major artery, according to the findings of the autopsy, which were first reported on by California’s Monterey Herald newspaper.

The EU’s panic and the lack of solidarity emboldens smugglers and the far right – and makes Spain even more vulnerable

For the European hard right and the White House, it seemed almost too good to be true: left-liberal Spain punished with a migration crisis of its own making.

The histrionics came right on cue. As thousands of mainly Moroccan citizens streamed into the tiny Spanish enclave of Ceuta at the tip of north Africa, Spain’s far-right party Vox decried a migrant “invasion”, blaming Spanish prime minister Pedro Sánchez’s regularisation and leftist politics. The Trump administration did the same. A senior Israeli diplomat goaded Madrid over its “colonial” territories while Italy’s prime minister, Giorgia Meloni, called for Spain to be suspended from the Schengen area. Denmark and Finland backed Italy’s move and, by the weekend, 22 EU leaders had penned a letter pointing an implicit finger at Madrid over its presumed failure to “relentlessly combat illegal migration”.

Фриланс часто представляют либо как свободу с ноутбуком у моря, либо как бесконечную борьбу за дешёвые заказы. Реальность сложнее: это рынок, на котором специалисту приходится одновременно быть исполнителем, продавцом, маркетологом и предпринимателем.

Я, Александр, автор телеграм-канала «Shulepov Code», поговорил с Кириллом Аношиным — основателем Freelance.ru, форума «Цифровые воротнички», Гильдии фрилансеров и премии «Золотое копьё». В этом выпуске мы разбираем двадцатилетнюю историю площадки, ошибки и DDoS-атаки, доходы исполнителей, безопасные сделки, выход на зарубежные рынки, конкуренцию с ИИ и то, почему одного хорошего навыка уже недостаточно. Кирилл делится практическим опытом и объясняет, как устроен реальный рынок фриланса.    

Erica Fox left Lovers Point near Monterey in December alongside group of swimmers but never made it back

A single, devastating shark bite was fatal for an ocean swimmer whose body was found on a California beach in December, a new autopsy report confirmed.

Erica Fox, 55, drowned after that shark bite broke her pelvis and severed a major artery, according to the findings of the autopsy, which were first reported on by California’s Monterey Herald newspaper.

В данной статье я подробно описал в теории, что такое CSRF-атака и CORS-атака и с помощью чего от них защищаться.

Открывая онлайн-кинотеатр, сервис для прослушивания аудиокниг или музыки, пользователи редко задумывается о том, почему перед ним оказались именно эти фильмы, книги или треки. Между тем рекомендательные системы в последнее время переживают крупную трансформацию. Если раньше задача сервисов сводилась к поиску похожих пользователей или товаров, то сегодня они уже умеют предугадывать намерения человека, и развитие LLM ускорило этот процесс.

Делюсь инсайтами с конференции «Урбан ML», которая прошла 2 августа в Loft Hall (ЗИЛ) в Москве. Эксперты по Data Science поделились, от чего отказываются современные рекомендательные системы, какие проблемы остаются нерешенными и куда движется отрасль.

Over the past six months at JetBrains, our AI development expenses have increased roughly 10x. When the costs started rising, of course we noticed – and realized that we simply didn’t know how to control them systematically.

We didn’t know because our developers don’t just use the AI tools we build. They decide for themselves which ones will best help them get their jobs done. 

Most of them use between three and five AI tools in a given month. They’re using our IDEs as much as ever – it’s just that now they’ve added more CLI agents, agentic development environments (for running several AI agents in parallel), and IDE-integrated AI tools into the mix. 

Most JetBrains devs use at least three AI tools.

They’re using all those tools in and alongside our IDEs.

One way to address the problem of ballooning costs would be to limit the number of AI tools our developers can use. In discussions with people from other companies, we often hear about decisions to use just one or two options. That would potentially reduce entropy and limit the overhead of managing everything.

However, limiting ourselves in this way would likely cause us to miss out on the best options at any given time. This week the best setup is Claude Code on Opus models, tomorrow it’s Codex, and next week it might be Claude Code on a mix of GLM and Opus.

Ideally there should be a balance between developer freedom and managing this “tooling zoo” in terms of cost, efficiency, budgeting, compliance, and security. Here’s how we’ve tried to strike that balance.

Initial pain points

Skyrocketing costs. Starting in January 2026, we saw a sharp rise in the adoption of AI tools, along with an increase in token consumption. We attribute this spike to the release of the Claude Opus 4.5 and 4.6 models, which significantly improved agent performance. JetBrains developers began using these models in various places, like Claude Code CLI, the AI chat in JetBrains IDEs, and Junie.

After that, usage started almost doubling every month. Soon enough, we hit 150 Claude Code seats and moved onto the Enterprise plan with rates based on API usage. That’s when costs really took off. 

Admin headaches. Average consumption per developer was rising. So was the number of developers who wanted access to different tools – to compare Claude Code to Codex or to try third-party agents, for example. Several people needed to sign off on each request. The tickets piled up for administrators, and the wait times slowed down developers.

Experimenting our way to a solution

Manual spreadsheet work → unsustainable 

Our tooling zoo had grown to include the various agents available through the AI сhat in JetBrains IDEs, as well as Junie CLI, the CLI and desktop versions of Claude Code and Codex, Cursor, GitHub Copilot, and a long tail of other tools. To start forecasting and managing this growth – as well its costs – we manually opened up different consoles, downloaded data, and grouped it across several dimensions by department and business unit.

This one-time exercise took four days. We had a snapshot of the situation and not much else when it came to setting organizational usage or managing them on an ongoing basis. This was a reasonable start, but that time commitment obviously made it an unsustainable approach moving forward.

Internal dashboards → ongoing expenses read-only 

Most AI tools, including JetBrains ones, have centralized APIs that allow you to pull per-user usage data. We put together a couple of quick-and-dirty solutions that did so (and tried a few more polished third-party ones) and combined the results into dashboards mapped to our organizational structure. This allowed us to drill down into ongoing expenses, but we still couldn’t set or enforce spending limits conveniently.

Internal console and a CLI wrapper → the winning prototype

For our own AI tools, we already had a management console with analytics for consumption and efficiency baked in. It just didn’t cover third-party tools – which was exactly where most of our growth was happening.

One of our developers had quietly built a CLI wrapper for his own use: to authenticate his JetBrains account, send requests through our AI traffic routing layer, and debug local third-party agents during development. It was a personal tool, not a governance one, but it turned out to be the piece we were missing.

From prototype to product

At the beginning of April 2026, we set out to turn the repurposed personal debugging tool into a product every JetBrains developer could and would actually use. That meant it had to: 

• Handle authentication, removing login hassles.
• Auto-detect installed agents, so time was no longer wasted on configuration.
• Send all requests through our traffic routing layer, allowing us to apply token budgeting rules to third-party tools (as well as our own) in the form of AI credits. 
• Stay compliant with our security, encryption, and access isolation requirements.
  

Some of this we already had. The JetBrains AI Platform is our under-the-hood AI router, and it has powered JetBrains AI for our customers and individual developers since 2023, handling more than a billion LLM requests with solid stability. On the server side, we were collecting consumption statistics and other metrics, processing them through an ETL pipeline into separate, highly elastic storage in asynchronous mode – storage that met the requirements above. We were also applying AI credit budgets to our own tools.

Over the next two months, we refined the CLI wrapper into the JetBrains Central CLI.

How we are all benefitting:

• Developers are running terminal agents with whatever models they want with virtually no administrative friction – no more waiting weeks for approvals.

• Managers can:
  • Create and view reports in the Central Console showing:
    • Current, historical, and forecasted AI consumption and costs for their departments.
    • Distribution of AI costs and usage by developer, agent, and IDE.
    • All the data aggregated with other AI expenses through an analytics API.
      
  • Set granular AI limits for individual developers, teams, and groups across every agent and IDE.
    
  • Eliminate the piles of contracts and invoices from a growing list of third-party AI providers!

Is it possible to piece together something like this with open-source tools, scripts, and other spare parts? Yes. We know because we tried. But mid-size organizations (like ours) want a solution to work reliably out of the box without extra overhead for deployment, configuration, and maintenance. Developers want access to the AI tools they need, not extra work getting them in a way that everyone is happy with. That’s why we built this solution.

What happened when we launched fast 

We built and rolled out this solution internally in a couple months. That was unexpectedly fast for us, and it came with:

Good problems

• Rapid growth found the edge cases. Over a thousand JetBrains developers switched to this tool in just a few weeks. Many of them, however, brought edge cases – an obscure Windows terminal here, a remote machine there. We had to work on fine-tuning our login flow to cover everyone.

• The Central CLI became infrastructure overnight. Our developers began depending on it every day, and feature requests and support questions came along with that. The CLI team is small, and keeping up with that demand is most of what they do right now, which is a good sign for a tool that’s a few months old. 
  

Loose ends

• We needed more granular policies. Now that we had a clear mechanism for setting AI usage policies, the next question was what those policies should be. We needed to determine how much a given developer can consume, whether they can request more, whether they can use their quota for personal purposes, etc. Many departments have different AI workflows and consumption patterns. We’re now working on an advanced rights and permission system that puts limits in the hands of engineering managers, since they’re the ones who know how many tokens their team needs and who needs them.

• We’re expanding coverage. The CLI currently supports three of the most popular terminal agents. Four more are in internal Beta. Niche setups and personal AI subscriptions will remain out of scope, as our goal is to cover the AI traffic running through the tools developers rely on most. 

Try it for yourself

After being our own test subjects, on July 8 we opened the Central CLI to early access. It’s available to anyone, individual or organization, who has JetBrains AI credits. A quick heads up: This solution is designed for teams running heavy API-based usage across multiple third-party tools. If your AI usage is not that big and costs aren’t yet a pressure point, the economics probably won’t work in your favor. But if you’re already feeling the pinch, it’s worth a look.

The CLI is one of several entry points into JetBrains AI for teams and organizations, our system for agentic software development, which we started rolling out in early access in July. It covers everything, from the tools, agents, and models developers choose to the governance layer this post has been about. 

We’ve made fast progress, but we’ve got plenty of work still in front of us. Let us know in the comments what you’d like to hear more about – whether that’s how we got here, or where we’re headed next.

Written by hand, proofed by claude-opus-4-8 ($0.60): 3.9k input, 3.9k output, 105.3k cache read, 43.0k cache write

Agentic coding is moving faster than many enterprise governance programs can keep up with. Coding assistants, like the Claude security guidance plugin and Claude Security, can flag and fix common vulnerabilities in code as it's written, in the same session. This is valuable for writing more secure code, but security doesn't stop there. A commit is one stage in the path to production: Merges, dependency updates, infrastructure changes, and audits happen after the session ends.

GitLab covers securing the remainder of the path to production. There are five handoffs in the typical Anthropic Claude-to-GitLab security workflow. This article walks through each one to illustrate how to govern agentic coding at scale.

Teams already using Claude security guidance and Claude Security can plug that context directly into GitLab through the GitLab MCP server and keep their existing workflow. Claude handles the moment of authoring; GitLab handles everything from there through production, on one platform.

From flagged to enforced controls

The Claude security guidance plugin reviews code within a single developer's session, catching issues fast enough to keep an agent moving. Once that code leaves a session, security teams need a record of what happened inside it and controls over what happens next.

GitLab gives teams the visibility and the control to define guardrails for secure coding, before code reaches production, no matter where the code originated.

• Define controls once, enforce scale. Security configuration profiles apply the scans you require across every project and pipeline from outside the repository, so coverage is consistent and can't be bypassed.
• Enforce separation of duties, even for agents. Merge request approval policies ensure that the agent that wrote a change can't approve it. An agent, or the developer who prompted it, can't merge its own work without a designated approver.
• Block critical vulnerabilities before they ship. Merge request approval policies hold any merge with unresolved critical findings until a named approver signs off, so dismissed or missed vulnerabilities can't reach production quietly.
• Track every finding's status, permanently. The Vulnerability report and Security dashboard show whether each finding was detected, dismissed with a reason, or resolved.

From scanned in session to audit evidence

Change management audit requirements are expanding to include agents. Compliance frameworks such as SOC 2, PCI DSS, and FedRAMP require documented evidence that every change was tested, reviewed, and approved before it shipped.

GitLab makes compliance controls enforceable and evidence collection automatic for auditors:

• Prove the scan ran and review. Compliance controls guarantee a scan runs on every merge request, and every finding surfaces in the merge request and vulnerability report, visible to a human.
• Answer auditors in minutes. Pipeline logs, approval records, and audit events give you reproducible history of what was scanned and who approved it, change by change, tied to the people and agents involved.
• Map evidence to the framework your auditor requests. Compliance frameworks group evidence into named requirements, such as SOC 2 or a custom framework, each built from specific controls, and the compliance status report shows which controls passed, are pending, or failed, per framework.

Control what sensitive data is sent

You probably send more of your code, and the business context around it, to a model for review than you do a person. Regulated, government, and IP-sensitive teams need to decide what leaves their environment, such as credentials, proprietary logic, and regulated data. That decision has to happen before any scan runs, and across every tool that touches their code.

With GitLab, you decide what data reaches a model before it ever leaves your environment:

• Keep secrets and sensitive code out of what you send to a model. Context exclusions hold secrets and sensitive files back from everything an agent sends to models.
• Keep code and inference inside your boundary, on models you approve. Run a self-managed environment with self-hosted models so nothing leaves your environment. Select the model per flow, restrict which models are permitted, and keep your code out of training.
• Filter what gets sent. GitLab Duo's prompt guardrails scan code suggestions for secrets before they reach a model, and isolate the content a prompt can act on to reduce prompt injection risk, on top of whatever you've already excluded.

From one scan to full scanning coverage across the development lifecycle

Anthropic's documentation is explicit that the Claude security guidance plugin is a best-effort assistive tool, meant to sit alongside human code review and various security scanners, not replace them. That scoping is important to pay attention to, because some vulnerabilities don't exist at the moment code ships. A dependency you ship today can have a critical vulnerability disclosed against it next year, with no change to your own code. Log4Shell is the clearest example; applications that shipped years earlier were suddenly exploitable the moment the vulnerability became public knowledge in December 2021.

Dependencies, container images, infrastructure configuration, and secrets already sitting in your commit history need scanning that runs independently of any single session.

GitLab secures the entire software delivery lifecycle:

• Cover the whole attack surface. Dependency, container, infrastructure-as-code, secret, and dynamic application security testing (DAST) scanning check the parts of an application a session-based review never reaches: the dependencies you pull in, the images you ship, the infrastructure you provision, the secrets that leak into commits, and the running app.
• Catch the flaws that scanners might miss. Deterministic scanners cannot catch business logic errors, broken authorization, or race conditions. Security Review Flow reasons about intent to catch that category directly, posted as comments on the affected code for a human to act on.
• Have a deterministic scan the results don't drift on. LLM-based review could return different findings on the same code from one run to the next. A deterministic scan, such as advanced SAST, traces tainted data across function boundaries using a fixed algorithm and returns reproducible, CWE-mapped results — the consistent evidence a compliance audit needs.

One set of guardrails, for every agent and every developer

The Claude security guidance plugin reviews the code Claude writes and commits inside a session. Commits made from a developer's own shell, including the "!" shell escape inside a session, fall outside what the plug-in reviews. Claude Security extends that to a full codebase or human-written code, on demand, when a developer or admin runs it.

GitLab’s scan execution and merge request approval policies run on the pipeline for every change, so coverage doesn't depend on whether a human or an agent wrote the code, or whether they remembered to initiate a scan.

Govern what ships

Claude security guidance and Claude Security help developers catch and fix issues the moment code is written. Once that code leaves the session, enterprise security and platform teams are accountable for shipping it securely to production. They need visibility into what an agent did, proof that security procedures were followed, and the ability to stop a problematic change before it ships.

GitLab bridges your Claude workflow. Set guardrails once in GitLab, and every agent and every developer ships faster and more securely inside them. Claude helps write secure code. GitLab governs everything from there to production, without slowing teams down.

Start a free trial of GitLab Ultimate!

Already on Ultimate? Set up scan execution and merge request approval policies to start enforcing guardrails today.

Learn more

• Claude Code and GitLab: Three workflows that ship
• GitLab Duo Agent Platform with Claude accelerates development
• How to use GitLab's Custom Compliance Frameworks in your DevSecOps environment

Программисты пишут свои вики в obsidian, в org файлах и других инструментах. С ними готовятся к собеседованию, ищут команды для баша, хранят информацию про их сервер и много чего еще.

Почему бы не использовать такой подход для кода, а не только для текста? У меня хранится куча вспомогательных скриптов, я пробую новые библиотеки и часто начинаю новые пет-проекты. Даже если проект никогда не зарелизится, все может остаться в такой “вики”, и потом это можно переиспользовать.

Можно сделать персональный монорепозиторий, в котором будет храниться весь код, как вики, но для кода.

Что ж, этот день наконец-то настал. Спустя годы путешествий по Египту, Греции, Скандинавии и Японии мы получили хорошую игру от некогда великой компании Юбисофт. Однако игра эта представляет собой лишь ремейк, а не полноценное продолжение серии Assassin's Creed. Но, как говорится, имеем что имеем, поэтому предлагаю послушать восторженную оценку бывшего фаната и впоследствии, быть может, самим прикоснуться к ожившей классике.

Nigel Farage admits he discussed returning as Reform leader months before election, appearing to undermine previous claims

Nigel Farage has made his clearest admission that he was in talks to return to lead Reform UK months before the 2024 general election, casting fresh doubt on previous claims that he was not involved in politics when he received a £5m gift.

The admission will reopen questions about the nature of the gift – Farage has repeatedly insisted it was not linked to his political career since the Guardian first revealed it in April.

• Pochettino joined US national team in 2024

• Coach led US to last 16 at 2026 World Cup

US men’s national team head coach Mauricio Pochettino and the US Soccer Federation have agreed to a contract extension that will keep Pochettino attached to the program through 2030, US Soccer announced on Monday.

The two sides had been actively engaged in discussions on a contract extension for several months, long before the USMNT’s disappointing, last-16 exit in this summer’s World Cup, with the federation making it clear it desired Pochettino to stay. Conversations picked up in the weeks following the World Cup, with the Guardian reporting last week that the sides had been in the “final stages” of agreeing to a deal. Financial details of the contract extension were not released, but Pochettino is expected to get a raise on top of the $6m per year he earned under his previous deal with the federation – already the largest outlay for a US head coach.

Развитие информационных технологий стало катализатором четвёртой промышленной революции. По оценке Клауса Шваба, основателя Всемирного экономического форума в Давосе, её отличительная черта – экспоненциальный, а не линейный темп развития. Тем не менее системы предиктивной диагностики, являющиеся частью этой концепции, пока не получили широкого распространения на промышленных предприятиях. Возникает вопрос: что препятствует их внедрению и почему ожидания от их использования часто не оправдываются? В статье обобщён опыт внедрения таких систем на предприятиях РФ – материал будет полезен техническим руководителям промышленных компаний.

GLP-1 drugs like Ozempic, Wegovy, and Mounjaro have been wildly successful. But as popular as they are, Americans still have very negative feelings about the people using them. In this month’s Highlight cover story, Dylan Scott explains why ‘Ozempic stigma’ hasn’t gone away, how it’s impacting GLP-1 users, and whether it could begin to fade as more and more people take the drugs. Also in this issue: How to tolerate uncertainty. What rent freezes could mean for renters. Good news about declining road deaths. And the coming AI wealth boom.

Can knowing less make you happier?

By Shayla Love

The simple idea that helped prevent millions of traffic deaths

By Bryan Walsh

Coming August 4

The one thing Ozempic still can’t fix

By Dylan Scott

Coming August 4

How to tolerate uncertainty in a world that’s full of it

By Elizabeth Weingarten

Coming August 5

The truth about rent control

By Marina Bolotnikova

Coming August 5

Rise of the AI-ristocracy

By Sara Herschander

Coming August 6