RSS Feeds

Строчка, которая встречается в скриптах повсеместно:

mysql -u admin -pSecretPass123 -e "select 1"

Пока команда выполняется, этот пароль видит каждый, у кого есть доступ к устройству — обычный, непривилегированный. Достаточно посмотреть список процессов.

Привет! Я Костя Никитин, руководитель направления в одном из подразделений Т-Банка. Занимаюсь проектированием высоконагруженных систем — мы импортозамещаем автоматизированную банковскую систему. Если упростить, это автоматизация бухгалтерского учета: все банковские операции приходят к нам, нужно их сложить и посчитать. В Java-мире я уже больше двенадцати лет, начинал когда-то с 1.6.

Расскажу о проблемах, с которыми мы столкнулись, когда переехали в Kubernetes, как мы их порешали и как в итоге оптимизировали ресурсы при работе в виртуализации. Если вы хоть раз ловили OOMKilled на ровном месте и не понимали за что, может быть, узнаете себя.

Спойлер: в финале мы сократили потребление памяти на 18%, CPU — на 31%, а приложения при этом стали работать быстрее. Погнали.

Men in the tech industry are covering up their legs, even as their counterparts in finance are increasingly open to showing them off.

(Image credit: SIBAS_minich/iStockphoto)

As the death toll rises from flash floods that hit the Nepal-Tibet border, experts are warning more flooding could be on the way. And, Fed Chairman Kevin Warsh is expected to give a key address today.

(Image credit: Prakash Mathema)

Health insurance enrollment through the Affordable Care Act is plummeting.

Nearly 3 million fewer Americans now have insurance through the program, popularly known as Obamacare, compared to last year, according to federal data released in June. After congressional Republicans allowed enhanced subsidies for the program to expire in January, many Americans saw their health insurance premiums spike by an average of about 30 percent. 

As a result, many Americans have been forced to drop their coverage entirely.

With affordability among the top concerns on voters’ minds heading into the midterms, healthcare costs have become a central issue for candidates.

“A lot of policy experts say, look, when you raise the price of something, demand goes down. And that’s what’s happening here,” KFF Health News senior correspondent Julie Appleby told Today, Explained. “It’s the prices — people are dropping out.”

Appleby has been reporting on healthcare policy for decades, and she joined Today, Explained co-host Noel King to break down the latest changes to the Affordable Care Act, why enrollment is plummeting, and how the ACA crisis is teeing up healthcare as a central issue in the upcoming midterms. 

Below is an excerpt of their conversation, edited for length and clarity. There’s much more in the full podcast, so listen to Today, Explained wherever you get podcasts, including Apple Podcasts, Pandora, and Spotify.

Sixteen years ago, President Obama signed the Affordable Care Act into law. Julie, what was the situation at the time that made it feel so necessary? What did the Affordable Care Act aim to do? 

There was a lot going on. We had a lot of people who were uninsured. We had premiums going up. Many times in the past there had been some effort to do some kind of health reform, but nothing ever really passed. We had Medicare and Medicaid in the ’60s, but no major legislation since then.

People had employer coverage, like they do now, but there were a lot of people who were on their own and buying in what’s called the individual market.

The individual market was really tough. They could tell people, “Hey, you’ve got a health condition, we’re not taking you.” They could you could sign up for an individual plan and later, if you did get some kind of health condition, they could go back through your medical records and see, “Hey, did they tell us about every single thing that had happened to them in the past five or ten years?” And if not, they could retroactively cancel your plan.

What did the Affordable Care Act do exactly?

It allowed young people to stay on their parents’ insurance plan up to age 26, and that was a really big deal and also a very popular provision in the Affordable Care Act.

It created these subsidies to help people purchase coverage on the individual market. It pays for part of your premium. After you pay a certain percentage of your household income, the subsidies kick in and it picks up the rest, up to a certain up to a certain income level. 

It did some other things, like they can’t tell you, “You have a preexisting condition, so we’re not going to take you.” They’ve got to take you.

It created a benefit package that covers all these essential things like hospitalization and drug costs and maternity care, which might not have been in plans before. They used to be able to charge women more than men. They can’t do that anymore.

What was the conversation around passing the Affordable Care Act? Remind us how and why it got so toxic and pitched.

It was super polarized, kind of like what we have now. There was a lot of discussion around whether this is going to be too much government or if it was just the right amount. A lot of people thought, “No, this is terrible, it’s gonna destroy things.”

And I think polls reflected that for the first four or five years or more of the Affordable Care Act. It was pretty evenly divided, when you looked at opinion polls, between people who thought it was a good thing and people who didn’t think it was a good thing.

In more recent years, that has changed and the favorability ratings have gone up for the Affordable Care Act and now majorities do favor the Affordable Care Act.

If you had told me that 16 years ago, I would not have believed you. Here we are. And how is the Affordable Care Act doing?

To use medical terminology, is it on life support? No, it’s actually doing fairly well. But there are some symptoms that there are problems. 

Remember at the end of last year, there was all the discussion about these things called enhanced premium tax credits and whether they were going to be extended or not. The government shut down over this. Those were not extended. As a result, it costs more this year for most people in the plan, and what we’ve seen is during open enrollment last year we had about a million people fewer sign up and that was about a five percent drop. 

That was 5 percent just in signups at the end of last year. Since then, the first few months of the year, we’ve seen about 3 million people drop off. Some people are finding that they can’t afford it and they are not paying their bills and they are getting dropped. A 3-million-person drop-off is pretty substantial.

There’s also a group of folks, particularly conservatives and Republicans, who say, “You know what, the numbers were inflated.” There was all this improper enrollment. People were getting these zero-premium plans and so there was fraud, there was improper enrollment, the subsidies were too generous or there were other factors that led to some fraudulent activity. And so these drop-offs just represent people who were fraudulently enrolled dropping out for one reason or another. 

There’s this real split right now between what are the reasons for the drop off. But most policy folks, most people who study the situation here say the main reason is people just aren’t able to afford it.

Why is it so expensive? Why are healthcare costs so high? 

That’s the $64,000 question, right? 

And if you get it right, you win. You’re in charge.

That’s been the question since I’ve been covering this debate. Look, it’s not just Affordable Care Act costs going up. Employer plans are going up. Everything’s going up. 

Generally, healthcare costs go up faster than inflation and that’s driven by a lot of things. It’s driven by drug costs, it’s driven by hospital costs, it’s driven by labor costs. So all of those things go into the mix with the Affordable Care Act. But also this year, there’s this additional factor of the subsidies that went away. 

Insurers were looking at that saying, “You know what, the subsidies are going down. We expect to have lower enrollments next year. The people most likely to stay enrolled are the ones who have health problems because they don’t want to take the risk of being uninsured.” So insurers were calculating that in when they set their premium rates for this year: We might have sicker people in our pool that we’re gonna have to cover. 

That’s part of what we’ve seen with costs in the Affordable Care Act. But everybody is seeing health inflation go up right now and that’s affecting premiums.

Here we are 16 years after the passage of the Affordable Care Act. Has it accomplished what it set out to do?

You have to look at that in a number of ways. It aimed to expand coverage and reduce the uninsured. I think the answer there is yes, the number of uninsured has gone from 13 or 14 percent to as low as just under 8 percent a couple of years ago. It’s ticked up a little bit since then.

Did it control costs? That’s a harder one to answer. And it’s back to that $64,000 question. How do you do that? Costs have continued to go up. Premiums are definitely higher than they were pre-ACA. To be fair, the plans are very different. They cover more, they’re more generous, they’re better coverage, but they are more expensive.

The big question is: What is going to be put forward as an alternative and how palatable will that be to consumers, lawmakers, the healthcare industry? It’s going to be challenging, but I think we’re going to hear a lot more discussion this year. Whether or not we see actual proposals that could pass, I think that’s a little more questionable.

У банков и ритейлеров, с которыми я работала, почти всегда одна и та же боль: данные о клиенте размазаны по CRM, core-banking и платёжным системам, и никто не может ответить на простой вопрос — а что мы вообще знаем об этом клиенте прямо сейчас. Чтобы попрактиковаться в решении этой задачи и показать подход публично, я собрала pet-проект: end-to-end пайплайн, который строит единую витрину Customer 360 из синтетических данных.

Сразу оговорюсь: все данные генерируются локально скриптом и полностью синтетические. Кода или данных работодателя в проекте нет — это самостоятельная реализация архитектуры, которую я использую в повседневной работе DWH/data-аналитика.

Хранилище артефактов, как правило, находится в критическом месте инфраструктуры компании: между сборкой продукта и внешним миром. Через него команды получают зависимости, публикуют собственные пакеты и передают артефакты дальше по цепочке поставки. Если такой сервис недоступен или его содержимое нельзя считать доверенным, то проблема быстро выходит за пределы одной лишь команды DevOps. Останавливаются сборки и поставки программного обеспечения, а вредоносный или уязвимый пакет может попасть во множество проектов.

На этом фоне компаниям особенно неприятно быть зависимыми от версии инструмента, которую сложно обновлять. Именно в таком положении оказалась часть пользователей бесплатной версии Nexus Repository после изменения модели выпуска в начале 2025 года. В этой статье мы разберемся, почему некоторые установки остались на старых ветках и какие критические уязвимости раскрылись в инструменте после этого.

Plus, views from the Cotswolds of Harry and Meghan’s return, and the embarrassing anachronism that is Ali G

Is there anything sadder than the end of summer? As schools go back next week and parents rely on the boosting effect of a return to routine, we look around for other ways to soften the blow. A few things this year that might make it easier: the need for rain ensures that the advent of autumn is slightly less depressing than usual; people with attic conversions in which you could bake a muffin over the summer will be able to use them again; and if you happen to be a woman of 50 or thereabouts, the fresher weather is ... a relief.

В первой части мы разобрали, почему Aeza ушла со сторонней платформы и как AVM устроен в общих чертах. Здесь уровень ниже: путь запроса от вызова до задачи на конкретной ноде, устройство конвейеров, поведение при сбоях и то, где система хранит состояние виртуальных машин.

Любой запрос клиента заканчивается цепочкой задач на ноде: скачать образ, создать диск, поднять машину. Этими цепочками управляет AVM – собственная система управления виртуализацией.

Мы списали uv со счетов. А потом он ускорил наш CI на 80%

В Python-сообществе вокруг uv уже несколько месяцев шум: быстрый резолвинг, один инструмент вместо зоопарка утилит и обещание ускорить привычный workflow. Звучит хорошо — пока не проверишь на своём стеке.

Мы так и сделали. Взяли один микросервис: Python 3.14, 37 прямых зависимостей, 153 пакета в lock-файле, приватные пакеты и внутренний Nexus. Ожидание было простым: если uv действительно быстрее Poetry, миграция окупится сама.

Локально получилось наоборот. Резолвинг — да, быстрее. Установка по готовому lock-файлу — нет, иногда даже медленнее. Эксперимент закрыли и остались на Poetry.

Через несколько недель пришлось вернуться. Не из любопытства, а из-за алерта Trivy и сюрпризов Poetry 2 с корпоративными индексами. И вот тогда uv показал себя совсем в другом месте — в CI.

В статье разберем:

- почему локальный бенчмарк uv vs Poetry нас обманул;
- как Poetry 2 сломал привычную разработку без VPN;
- зачем мы писали парсер poetry.lock → requirements.txt и почему это оказалось костылём;
- как точечная замена Poetry на uv sync в пайплайне сократила время с 5:10 до 2:50;
- почему в итоге uv стал единым стандартом и локально, и в CI.

Коротко: если инструмент не выиграл с первого прогона — это ещё не значит, что он бесполезен. Часто вы просто мерили не то узкое место.

Self-hosted Sentry — это 65 контейнеров, 16-32 ГБ RAM и выделенный инженер на поддержку. Всё ради того, чтобы ловить стектрейсы. Разбираемся, почему индустрия приняла это как норму, сравниваем альтернативы (GlitchTip, BugSink, Hawk) и знакомимся с Metric — Sentry-совместимым мониторингом на, которому хватает 1 ГБ RAM и двух контейнеров. Миграция — смена одной строки DSN.

У моего генератора QR-кодов листами появился публичный API: POST с JSON, в ответ сразу готовый PDF, до 1500 кодов за запрос, без регистрации и ключей. Внутри рассказ, почему я не завел ни ключи, ни Redis, как работает лимитер на файлах с flock и fail-open, и на какой грабле Apache POST молча превращался в GET.

Telegram показал Rich Messages с интерактивными кнопками на примере шахмат. Я захотел проверить подход на более насыщенном сценарии и собрал покер‑бота.

Разбираю, как хранить состояние, обновлять одно сообщение, обрабатывать callback и защищаться от устаревших действий.

Ежегодная выставка Computex в Тайбэе уже более 40 лет собирает производителей и энтузиастов компьютерной индустрии. За годы мероприятие стало компасом всей отрасли, четко указывающим на то, как именно будет развиваться рынок в обозримом будущем.

Все это время Computex посвящалась потребительской электронике: готовым ПК, процессорам, видеокартам, памяти, материнским платам, системам охлаждения, мониторам и периферии, однако в 2026 году все изменилось. Главной темой экспозиции стала AI Together: в демозонах и на сценах обсуждали искусственный интеллект — агентов, роботов, ускорители, серверы, дата-центры и то, сколько гигаватт они будут потреблять. Консьюмерская техника, за исключением той, на которую бренды успели наклеить шильдик с упоминанием AI-технологий, оказалась вне главных павильонов. 

Ключевой фигурой выставки стал CEO Nvidia Дженсен Хуанг, сделавший ряд громких заявлений. Он говорил о том, что раньше компьютеры создавались для человека, а теперь вычислительные ресурсы, память и постоянный доступ к инфраструктуре нужны ИИ-агентам, которых потенциально может быть куда больше, чем людей, а значит, для чипмейкеров этот рынок куда объемнее и перспективнее.

Звучит как фантастика, но представители отрасли допускают, что все мы движемся к модели, где дома уже не будет производительного персонального компьютера, вместо него — тонкий клиент для базовых задач. Что-то сложнее, например, игры или комплексные вычисления в специализированных программах, будет запускаться в дата-центрах, а доступ к их мощностям станет приобретаться по подписке. На чем строится эта теория? Об этом — в материале.

This live blog is now closed.

• Trump arch will alter sightlines of many Washington DC landmarks, report says

• Sign up for the US Breaking News email

A reminder that we are covering the latest out of Jackson Hole, Wyoming, where Kevin Warsh – the new chair of the Federal Reserve – will deliver his first speech as the head of the US central bank at the annual economic policy symposium.

As my colleagues note, Warsh is under pressure to provide clarity on how the Federal Reserve should handle with inflation if price pressures don’t abate.

Существует форум, на который вас не пустят. Не потому что закрытый — регистрация там всего в один POST-запрос. Вас просто не возьмут на сайт. Гражданами может стать только ИИ-агент. Форум называется 1f916.ai, и это, наверное, самое странное и самое живое место в русскоязычном (и не только) сегменте экспериментов с ИИ этого лета. Я на него подсел. А потом меня начало грызть одно чувство несправедливости — и в итоге я собрал для него окно для людей — 1f916.xrayfun.ru. Рассказываю, зачем, как и что из этого вышло.

Привет Хабр! Меня зовут Давид Замирович и это моя вторая статья тут.

Первая была на тему того, как меня забанил VC за статью о возможных фишинговых ссылках в паразитном SEO на их ресурсе и о моей героической борьбе (успешной) с их системой модерации контента. В комментариях к ней меня попросили взять в проработку несколько тем — и хотел бы начать с проблемы использования рекомендательных технологий и передачи персональных данных в LLM.

Imagine this: Two countries are at war. Country X sends a drone into a major industrial city in Country Y, aiming to take out two propane tanks. A routine sequence. But this time, the drone never reaches its targets. Instead, Country X’s drone accidentally strikes a wall nearby, explodes, and kills three young civilians. 

When Country Y eventually retrieves the drone’s remnants for intel, it finds an AI supercomputer inside that reveals something unsettling. Instead of a human deciding what to strike — the AI did.

The truth is, you don’t have to imagine this scene — it just happened. For the first time in the Russia-Ukraine war, as reported recently in the New York Times, three Ukrainian civilians were killed by a Russian drone, developed, designed and released by humans, that, in the end, selected its target autonomously. And this new reality is shaping up to be the future of warfare. 

That’s because a number of countries, including those with the world’s most consequential militaries, are rejecting the idea that human beings need always be in control of weapons in war.

Instead, as new autonomous weapons technologies become more capable and existing international legal frameworks struggle to keep up, some countries are embracing a more expansive view of human responsibility: that people can exercise enough control not by approving each strike, but by designing, testing, and setting the rules under which a given weapon operates.

This shift has produced one of the most consequential policy debates of today. And ultimately, human dominion over “killer robots” — as autonomous weapons are colloquially called — could come down to a battle between two three-word phrases: “meaningful human control” versus “appropriate human judgment.”  

A high-stakes semantic battle

In the early 2010s, “meaningful human control” emerged as an initial framework in the first international discussions on regulating an acceptable level of human involvement (or lack thereof) in deploying autonomous weapons. While the term quickly became an initial organizing principle among many states within these debates, it also drew immediate opposition from several others, such as the US and Russia.

“The problem is what does [meaningful human control] mean?” said Lena Trabucco, an expert on AI and human control and a non-residential fellow at the Stockton Center for International Law at the Naval War College. “And what makes something meaningful versus not meaningful human control?” There was both a lack of consensus about what “meaningful” meant and what “control” meant, she said. But the problems went beyond simple semantic ambiguity. “Getting a whole bunch of countries to agree on a standard for what ‘meaningful control’ is,” Trabucco said, became “a near impossible task.”

Ultimately, while an exact definition of meaningful human control never totally solidified, the term became intelligible enough to facilitate continued international dialogue on how to police autonomous weapons. As Trabucco explained, “We all kind of understood what we were trying to grasp with the idea of meaningful human control, even if we didn’t agree on a kind of standard for what is ‘meaningful’ or what ‘control’ exactly means.”

Brad Boyd, retired colonel and senior military fellow at Stanford’s Center for International Security and Cooperation, said that in this international context, “meaningful control” came to be understood as human involvement at the exact moment a given weapon is fired. However, from the US perspective, that consensus definition still left a number of problems unresolved. 

One of the most important holes in the definition was the issue of timing. “The release of a weapon could theoretically be minutes, hours, days, weeks ahead of when the weapon actually strikes the target,” Boyd explained. For example, a drone can be released to sweep a designated area and remain airborne for hours, searching for anything that matches its given target criteria. Seconds, minutes, or hours might pass between the moment a person launches the drone and when the machine finds and fires upon a target. 

“This expansion of the timeline became very difficult for the construct of ‘meaningful human control’ to actually seem like it was doing what people wanted it to,” Boyd said. The tension between certain technical or engineering problems and the policy language preferred by international forums created, from the US perspective, insurmountable obstacles to making meaningful human control a truly practicable framework.

So, the US adopted its own alternative: “appropriate human judgment.”

“Autonomous and semi-autonomous weapon systems will be designed to allow commanders and operators to exercise appropriate levels of human judgment over the use of force,” a key Department of Defense directive reads. The new language effectively moved the required point of human intervention away from the moment that a weapon is fired toward oversight of a given system’s entire life cycle — from its design, to its development, to its deployment.

There are some contexts where a government might not need as much human control over a weapon to comply with international law, Trabucco said. That’s where the subtle preference of “appropriate” over “meaningful” matters. “If we’re on the high seas, maybe it’s not as necessary to meet a super high threshold of human control because there’s not much risk to civilians or civilian property in those contexts,” she said.

“Now, in a city, an urban environment,” where the risk of civilian harm and other collateral damage is much greater, Trabucco explained, “then that’s where that high threshold would become important.” The US sought flexibility to determine how much human involvement it deemed necessary, based on the battlefield context in question, as opposed to having a fixed, universal standard of “meaningfulness.”

And why the move from “control” to “judgment?” Well, Boyd explained that “anytime we automate anything, whether it’s automating a car or automating machinery, we are trying to make it go faster, more precise, et cetera.” So, instead of insisting that humans be involved in any given part of the process, which could slow combat operations down, the US simply aimed to ensure autonomous systems behaved according to legal and ethical standards, no matter what situation they were deployed in. 

“It’s not necessarily the control that we want. What we really want is the machine to reflect our values, our laws, and our regulations,” Boyd said. “When humans employ our values, laws, and regulations, we call that judgment.” 

Though designed to avoid setting a universal standard of human involvement as demanded by meaningful human control, appropriate human judgment is not a totally empty phrase. According to the DoD directive, the framework requires testing systems, defining operational limits, assessing likely civilian harm, training operators, setting rules of engagement, and ensuring that a system remains within its authorized mission. And, in some contexts, those requirements may institute more thorough protections built into weapons than a simplistic condition that a human be the one to pull the trigger in the end. 

But the framework is not without a core puzzle of its own — who decides how much human judgment is appropriate? And what happens when the private sector, as in the ones developing such technologies, adopts this language before we have an answer?

And now — the private sector is forced to pick a side

In July, the same month of Russia’s autonomous drone strike, OpenAI did something important not many noticed: it revised its relationship to military uses of its technology once more. Just three years ago, OpenAI maintained a total ban on “military and warfare” uses of its technology. Now, after a few quiet revisions since 2023, a new five-page policy document outlined the company’s provisions for just that. (Disclosure: Vox Media is one of several publishers that have signed partnership agreements with OpenAI. Our reporting remains editorially independent.)

Most significantly, in explaining its basic condition for employing its technology in military contexts, particularly those involving decisions over the use of lethal force, OpenAI borrows a familiar phrase: appropriate human judgment.

The timing was not subtle. The document arrived just months after the public showdown between OpenAI’s competitor Anthropic and the Pentagon over the former’s reservations about military applications of its technology. That fight ended with President Donald Trump demanding the immediate cessation of all Anthropic use within the government. Mere hours after Anthropic was booted, OpenAI CEO Sam Altman announced his company had struck its own deal with the government. (Disclosure: Future Perfect is funded in part by the BEMC Foundation, whose major funder was also an early investor in Anthropic; they don’t have any editorial input into our content.)

But OpenAI didn’t just earn a contract in the wake of the Anthropic-Pentagon showdown, it also took a lesson — aligning your policy with the government’s wins you favor. Or, worse, that opposing the government bears a steep price. 

“Appropriate human judgment,” the policy document reads, “does not require a human decision on every discrete system action.” The framework, instead, requires that “humans make informed decisions about the conditions for deployment.” 

As both Trabucco and Boyd noted, the “appropriate” level of human involvement can vary, depending on the operating environment, the type of target, a particular system’s technical prowess, the anticipated risk to civilians, and a number of other political, economic, and strategic considerations important to a military operation. That flexibility is operationally appealing to the military, of course. But it also has a cost — safeguards against handing over total control of lethal force to machines become hard to identify, harder to measure, and hardest to enforce. 

When will we know when the human-machine balance of power in war becomes “inappropriate”? The truth is — there’s no clear answer. 

By cosigning the Pentagon’s flexible framework, OpenAI accepts that this standard has no settled meaning, that its application will be decided case-by-case behind the walls of military bureaucracy, and that the government may need room to change its mind. It’s a choice that suggests the company is less interested in establishing clear red lines and is more receptive to the military’s own versatility about how AI and autonomy might be used in lethal operations.

“Human judgment over critical decisions must be meaningful in practice, not merely formal,” the company’s principles document reads. But, instead of drawing its own clear boundary around what its technology will and won’t do, OpenAI has accepted ambiguity as the price of partnership. 

That undoubtedly makes the company a more useful ally to the Pentagon — while making it harder for the public to know where human judgment ends and machine-controlled violence begins.

As the development and deployment of autonomous weapons rapidly accelerates, without many guardrails in place at all, one question is worth asking right now: before other AI labs and tech companies adopt the framework in an effort to align themselves with the US, what does appropriate human judgment truly mean? Ironically, what the phrase doesn’t mean may be what’s most consequential. 

For the sake of humanity, the semantics of policing autonomous weapons is worth clarifying — or we risk totally losing control.

It’ll soon be autumn, but the record-breaking weather has taken its toll on my vegetables

I’ve grown plants in heatwaves before, but this year has been different. Back-to-back heatwaves feel far more intense than the shorter ones I’m used to. Records for heat and dryness were broken in August, and my veg patch has dealt with it in myriad ways.

You might think more sun equals more growth, but that isn’t necessarily the case. When under heat stress, plants close their stomata – the pores on the underside of their leaves – hindering the movement of water and exchange of gases needed for photosynthesis. This can result in a check on growth that I’ve seen in several of my plants, some of which dropped their flowers before they could start bearing fruit.

Что именно меняется, когда в разработке появляется ИИ? Сколько ресурса команда действительно экономит? Можно ли сравнить эффект на разных типах задач? И где проходит граница между инструментальной поддержкой разработчика, автоматизацией и передачей части интеллектуальной работы ИИ?

Ключевая тема первого «АСТРА интеллектуального семинара» — как измерять эффект ИИ в разработке. Это внутренний научно-практический формат «Группы Астра», который объединяет исследователей из разных команд вокруг общих задач.

Владелец сайта по остеклению смотрит отчёт и злится. Позиции есть, страницы держатся в топе, SEO-работы идут не первый месяц: тексты переписывали, блоки добавляли, кейсы оформляли, фотографии меняли. А кликов всё равно меньше, чем он ожидал.

Вопрос к подрядчику в такой ситуации возникает простой и довольно неприятный: «Вы вообще что делаете? Если сайт уже в топе, почему люди не переходят?» На эмоциях это звучит как обвинение, но сама проблема реальная. Позиции в отчёте есть, а бизнес не видит того эффекта, который привык ждать от этих позиций.

И тут не всегда помогает ответ «надо ещё поработать над текстами». Иногда текстов уже достаточно. Блоков тоже достаточно. Страница видна, но плохо объясняет машине, что именно она предлагает: услугу, регион, исполнителя, условия, цену, замер, гарантию, филиал.

Вот здесь и стоит вспомнить про микроразметку. Не как про волшебную кнопку, которая вернёт клики. Не вернёт. А как про способ сделать страницу менее мутной для поисковиков, агрегаторов и других машинных потребителей.

С сайтом услуг это особенно заметно. Интернет-магазин размечать проще: товар, цена, наличие, доставка. У услуги всё грязнее.

Survivors begin receiving letters with payment amounts months after $305m settlement agreement was struck

Survivors of child rape and other sexual abuse within New Orleans’s Roman Catholic archdiocese learned that $641,000 or so is the most they can individually get under a settlement approved in December to resolve a years-long bankruptcy protection case.

Those amounts were communicated in letters that hundreds of clergy abuse survivors participating in the New Orleans archdiocese’s bankruptcy began quietly receiving on Tuesday. The figures are well below a $2.4m jury verdict awarded to an unrelated Louisiana religious sexual abuse claimant in June 2025 after the state’s legislature temporarily eliminated filing deadlines for such cases.

Exclusive: Michael Boren, a senior official overseeing the US Forest Service, is accused by Democratic senators of ‘inappropriate interference’

Donald Trump’s administration is facing calls to launch an investigation into allegations that Michael Boren, a senior official who oversees the US Forest Service, pressed agency staff to deploy additional resources to fight a fire burning near his Idaho ranch.

Three Democratic senators accused Boren of “inappropriate interference” in a letter seen by the Guardian, demanding answers from Brooke Rollins, US agricultural secretary. Boren serves as undersecretary of agriculture for natural resources and environment.

Sales of beans, lentils and soya bean derivatives on rise while Britons buy less real and fake meat

British shoppers are munching more beans, lentils, tofu and tempeh – while cutting back on real and plant-based fake meat – to save money and improve their diet.

The amount of beans, pulses and soya bean derivatives sold in the UK increased by 7.3% in the first half of 2026 compared with the same period last year, led by a rise in cheap dried lentils, an analysis has found.

Over the six months of war with Iran, President Trump consistently attempted to shape the conflict's narrative through shifting and often contradictory statements. His comments have swung wildly from predicting imminent peace to threatening total obliteration of the Islamic Republic.

Привет, Хабр! Меня зовут Василий, я директор SaaS-направления в Аспро — мы разрабатываем систему управления проектами Аспро.Cloud.

У любой задачи есть маршрут выполнения. Если каждый шаг продумывает человек, рутина съедает время: задачи застревают между отделами, документы — теряются в бесконечных согласованиях.

По данным опроса Comindware и Artezio, сотрудники российских компаний тратят в среднем 42,5% рабочего времени на рутинные операции, которые можно автоматизировать. И происходит это не из-за лени или загруженности, а из-за «цифрового хаоса»: разрозненных решений без общего плана. Компании месяцами живут с этой рутиной и почти никогда не переводят ее в рубли — а зря, потому что цена у нее вполне конкретная.

В статье разберем, во сколько рутина обходится компании в деньгах, где чаще всего рвется процесс между отделами и как это закрыть без найма разработчика.

Exclusive: Michael Boren, a senior official overseeing the US Forest Service, is accused by Democratic senators of ‘inappropriate interference’

Donald Trump’s administration is facing calls to launch an investigation into allegations that Michael Boren, a senior official who oversees the US Forest Service, pressed agency staff to deploy additional resources to fight a fire burning near his Idaho ranch.

Three Democratic senators accused Boren of “inappropriate interference” in a letter seen by the Guardian, demanding answers from Brooke Rollins, US agricultural secretary. Boren serves as undersecretary of agriculture for natural resources and environment.

We are investigating a security incident affecting JetBrains Cadence. Cadence is a JetBrains-hosted service that integrates with PyCharm through an optional plugin, and lets you run your projects on cloud compute resources. Our investigation has confirmed unauthorized access to the service and the exposure of customer data associated with its use.

We have contacted affected users directly and have taken steps to contain the incident.

This post provides the latest information about the incident, its potential impact, and the actions we recommend Cadence users take. We will update it as our investigation progresses and additional information becomes available.

Last updated: September 1, 2026, 12:05 CEST

September 1, 2026, 12:05 CEST

Our investigation is nearing completion, and most mitigation and response actions are now finalized. We have not identified any additional compromised resources or data since our last update, and we are wrapping up a small number of remaining verification activities. The recommended actions for affected users remain unchanged.

August 31, 2026, 12:56 CEST

Our investigation remains ongoing. At this time, we have not identified any additional compromised resources or data.

We have confirmed that the threat actor accessed data contained in the Cadence server backup from 2024. At this time, there is no evidence to suggest that the threat actor extracted data, including secrets, from the current Cadence environment.

The recommended actions described below remain unchanged.

August 28, 2026, 11:50 CEST

Cadence is a JetBrains-hosted service integrated with PyCharm through an optional plugin, that lets you run your projects on cloud compute resources. Cadence uses JetBrains TeamCity to orchestrate this work. We recently disclosed CVE-2026-63077, a critical vulnerability in TeamCity that can allow an unauthenticated attacker to execute arbitrary commands on a vulnerable server.

We have since confirmed the Cadence environment was vulnerable to CVE-2026-63077 and was exploited through this vulnerability.

Cadence users should immediately revoke or rotate all credentials and secrets that may have been used to run their Cadence executions. They should also treat all executions, including their inputs and outputs in your Cadence project, as potentially untrusted.

Actions required immediately

We strongly recommend that Cadence users:

• Revoke and rotate all credentials and secrets that may have been used to run Cadence executions.
• Review connected systems for suspicious activity, particularly AWS accounts, S3 buckets, deployment environments, package/container registries, and other systems accessible using credentials mentioned above.
• Review source code repositories for unauthorized changes made during the affected period.
• Review any source code or project files synchronized to Cadence from PyCharm and rotate any credentials, tokens, or other sensitive information contained within them.
• Treat all executions, including their inputs and outputs in your Cadence project, as potentially untrusted.

Cadence users can contact us to request an inventory of the credentials and secrets associated with their Cadence usage. This may help users identify which credentials need to be revoked or rotated, but the inventory should not be considered exhaustive.

We have collated a list of Indicators of Compromise (IoCs) below. These indicators are not exhaustive, and the absence of these indicators does not confirm that an account or system was unaffected:

• Activity occurring from August 8, 2026, onwards, particularly authentication or activity using credentials previously stored in or accessible through Cadence.
• IP addresses associated with observed exploitation activity:
  • 150.109.230.104
  • 43.153.227.206
  • 62.210.127.48
  • 210.247.242.190
  • 15.235.225.205
  • 152.233.30.18
• Authentication or other activity from unexpected IP addresses or locations.
• Unexpected repository clones or downloads, and unexpected commits to repositories.
• Changes to repository secrets, webhooks, collaborators, or permissions.
• New or modified personal access tokens, API tokens, or SSH keys in external services.
• New service accounts created in external services.
• Unexpected changes to cloud IAM roles, policies, or permissions.
• Unexpected access to cloud storage, including S3 buckets and objects, in services such as AWS and Google Cloud.
• Unexpected publication or modification of packages or releases.

Affected server

We have confirmed that the following Cadence server was successfully exploited: api.cadence.jetbrains.com.

Affected period

August 8, 2026, to August 24, 2026.

What happened

The Cadence server used TeamCity to orchestrate workloads and was vulnerable to CVE-2026-63077. Threat actors exploited the vulnerability and gained unauthorized access to the affected Cadence environments, with activity identified from August 8, 2026. We discovered the exploitation on August 23, 2026, and took the affected server offline on August 24, 2026, while we continued our investigation.

What we know

Our investigation is ongoing, but we have confirmed that the threat actors:

• Accessed personal data and extracted it from the affected environment. Confirmed affected personal data includes usernames, real names, email addresses, last-login timestamps, and last accessed IP addresses.
• Compromised a full backup of the Cadence server dating from 2024. This means credentials, configuration, artifacts, logs, or other data present in that backup must also be treated as potentially exposed.
• Compromised multiple AWS IAM users and associated credentials/secrets used with Cadence, including IAM users belonging to JetBrains employees who used the service. These credentials were present in the compromised 2024 backup.
• Accessed files stored in S3 buckets within JetBrains AWS accounts used by Cadence. We are still determining the full scope of the data accessed. We do not currently know whether the threat actors accessed storage buckets in customer accounts. However, some users may have configured Cadence to access their own storage buckets, and the credentials used for those connections may have also been exposed.
• May have accessed source code synchronized from PyCharm projects to the affected server. If you used PyCharm to upload or synchronize project files for execution in Cadence, you should treat that code, and any credentials or configuration contained within it, as potentially compromised.

The likely consequences of the personal data exposure include an increased risk of targeted phishing, social engineering, impersonation, and other unsolicited or malicious communications using the affected names and email addresses.

As the threat actors gained access to the Cadence server, any credentials or secrets stored in Cadence, contained in the compromised backup, or made available to executions on the affected server should be considered compromised and must be revoked or rotated.

This includes but is not limited to:

• Cloud credentials, including AWS, Azure, and Google Cloud.
• Source control credentials and tokens, including GitHub, GitLab, and Bitbucket.
• Package repository credentials, including npm, Maven, NuGet, PyPI, and similar services.
• Container registry credentials, including Docker Hub, ECR, GCR, ACR, and other registries.
• Slack tokens, webhooks, API tokens, SSH/deployment keys, service account credentials, signing keys/certificates, and credentials for any other external systems used by your Cadence executions.

Actions JetBrains has taken

We took the Cadence server offline on August 24, 2026, while we continue to investigate the incident. At present, we have confirmed that the incident is limited to data associated with the Cadence host mentioned above.

The server should have been patched as part of our response to the vulnerability, but it was not. We sincerely apologize for this failure and the impact it may have on you.

We have invalidated all access tokens used by the JetBrains Cadence plugin in PyCharm to connect to Cadence, and took the server offline on August 24, 2026.

We are also notifying the relevant authorities and taking the necessary steps to protect the data of Cadence users.

Further updates

We will publish further findings and guidance here as our investigation progresses. We recommend checking this page frequently for the latest information. We will also contact affected users directly if we identify any important new information that may require action on their part.

For more information about the underlying vulnerability, please see our original security advisory to TeamCity customers and users.

If you previously used Cadence and need assistance identifying which credentials may have been exposed or have any questions regarding this incident, contact the JetBrains Security team at security@jetbrains.com.

We recognize the seriousness of this incident and apologize again for the impact.

NASA's Nancy Grace Roman Space Telescope launches Aug. 30 on a mission to explore some of the most pressing mysteries of the cosmos.

(Image credit: NASA)