Sovereign failover – Design for digital sovereignty using the AWS European Sovereign Cloud

Post Syndicated from Ivo Kammerath original https://aws.amazon.com/blogs/architecture/sovereign-failover-design-for-digital-sovereignty-using-the-aws-european-sovereign-cloud/

Organizations operating across multiple jurisdictions need to consider the impact of regulatory changes or geopolitical events on their access to cloud infrastructure. This post explains how to design failover architectures that span AWS partitions—including the AWS European Sovereign Cloud, AWS GovCloud (US) and other AWS Regions in the global infrastructure — so workloads can continue operating when sovereignty requirements shift.

Although the AWS European Sovereign Cloud is designed to help customers with operational autonomy and data residency requirements, it can also be used to address broader geopolitical and sovereignty risks. This post explores the architectural patterns, challenges, and best practices for building cross-partition failover, covering network connectivity, authentication, and governance. By understanding these constraints, you can design resilient cloud-native applications that balance regulatory compliance with operational continuity.

Understanding sovereignty risks

Digital sovereignty entails managing digital dependencies — deciding how data, technologies, and infrastructure are used, and reducing the risk of loss of access, control, or connectivity. As with any disaster recovery strategy, there are several means to provide continuity for the systems to be designed. Most of them involve some form of failover architecture, i.e. providing a second set of infrastructure to be used when the disaster incapacitates the original infrastructure. What differs for sovereign disaster recovery are the control mechanics and structures of the target to fail over to. Incorporating the AWS European Sovereign Cloud into your workload design adds failover capabilities that help you to reestablish or maintain enhanced sovereignty if the primary environment becomes unavailable.

As regulatory requirements evolve, modern failover architectures must account for sovereign environments such as the AWS European Sovereign Cloud, AWS GovCloud (US), and multi-vendor deployments. This post focuses on three core areas for incorporating sovereignty requirements into failover design: failover strategy, network connectivity across isolated partitions, and authentication and authorization in cross-partition architectures. These patterns apply to both short regional outages and long-term partition failures.

Understanding AWS partitions

As a global cloud provider, AWS operates multiple infrastructure partitions tailored to meet specific operational and regulatory requirements. In addition to its AWS global infrastructure, AWS offers specialized partitions such as AWS GovCloud for US government agencies, the AWS China Regions, and the AWS European Sovereign Cloud for customers that require stringent data residency and control within the EU.

Each partition is a logically isolated group of AWS Regions with its own set of resources, including AWS Identity and Access Management (IAM). Because of this separation, partitions act as hard boundaries. Credentials don’t carry over, and services such as Amazon S3 and features like S3 Cross-Region Replication or AWS Transit Gateway inter-region peering cannot function across partitions. These limitations are intentional, providing operational isolation. AWS GovCloud (US), launched in 2011, supports US public sector customers with compliance needs such as FedRAMP and ITAR. The AWS China regions are operated through local partnerships to meet Chinese data sovereignty laws. Similarly, the AWS European Sovereign Cloud is a partition built entirely within the EU, launched in 2026.

These partitions provide enhanced data control and physical infrastructure isolation, making them essential if you operate in regulated sensitive sectors and need to satisfy strict compliance requirements.

Key benefits of AWS partitions

AWS introduced partitions for several reasons. They are key to helping customers meet country-specific compliance and regulatory requirements, whether in AWS GovCloud (US), AWS China, or the AWS European Sovereign Cloud. This is underpinned by multiple safeguards and controls, including physical, logical, and operational separation of the cloud infrastructure between partitions. This directly corresponds to the security aspects of partitions. Partitions allow AWS to provide a complete isolation of resources, which helps manage security, especially for architectures running sensitive workloads.

Another important point to keep in mind when talking about partitions is service availability. Not all AWS services are available in every partition. To learn more about the AWS services available by Region, refer to AWS Capabilities by Region.

Cross-partition architectures

A cross-partition architecture enables partition failover by deploying resources and infrastructure across multiple isolated AWS partitions. Because partitions are fully separated by identity, networking, and service boundaries, failover can’t simply switch between them as within a single partition or region. Instead, environments must be pre-provisioned and kept in sync through internal or external tooling. Without such an architecture, failover between partitions is impractical. Cross-partition architectures make failover possible but require duplicate infrastructure, separate identity systems, and custom data synchronization.

Figure 1: Different reasons for failover and their possible locations

When designing cross-Region or cross-partition failover strategies, the choice of Regions depends on the type of disaster you want to mitigate:

  • Natural disasters – select Regions in different geographic zones or with distinct geographic features.
  • Technical disasters – separate workloads across independent parts of the global technical infrastructure, such as power grids, networks, and other shared resources.
  • Human-driven disasters – consider political, socioeconomic, and legal factors that might affect operations.

Figure 2: Active-active failover scenario including a sovereign failover option

Partition failover

Cross-partition workloads arise from industry needs to maintain continuity across sovereign domains while meeting regional regulations. Examples include military and defense connecting specialized clouds (such as AWS GovCloud (US)) with commercial environments, and emergency response systems requiring secure partition isolation combined with unified management (a single pane of glass approach). Control planes managing workloads across partitions are critical for handling multi-tenant structures, enabling centralized metrics, log aggregation, onboarding, security management and more.

However, cross-partition connections increase operational complexity, security and compliance overhead, costs, and governance challenges. These factors make it important to implement such architectures only when they are truly required. Standard cloud resilience models range from simple backups to multi-site setups, and can be implemented across multiple Availability Zones as well as multiple Regions. The same concept equally applies across multiple partitions. We can move backups into a second partition to be able to recover into that partition. Equally we can run an application pilot light in another partition. This greatly reduces the cost of the infrastructure required in the second partition because it will only be built up when needed. Finally, warm standby or multi-site active-active setups mainly differ in the need for more complex network synchronization across partitions.

Figure 3: Different types of disaster recovery scenarios

You might also consider vendor independence as an additional sovereignty requirement when planning failover. One way to achieve vendor independence is to use another cloud provider. However, failing over to another AWS partition is simpler than switching cloud providers because you can reuse your infrastructure as code templates across partitions.

Reasons to connect partitions

Although partitions are designed for isolation, some workloads within a partition might need to communicate with workloads in less regulated partitions or with external systems accessible over the public internet. For such instances several architectural strategies and the corresponding architectural decisions should be considered. There might be use cases where you need AWS Services to communicate across partitions and orchestrate actions spanning multiple partitions, such as:

  • Cross-domain applications
  • Feature parity and service availability
  • Cost-optimization while meeting security demands
  • Infrastructure consolidations
  • Control plane patterns

Implementing these use cases requires a deeper look into the technical aspects of connecting partitions from both a network standpoint and a security standpoint.

Regional connections vs. connected partitions

Regional connections let you link AWS Regions within the same partition using features like S3 Cross-Region Replication and Transit Gateway peering, facilitating relatively seamless workload distribution and failover within the partition’s global infrastructure. Understanding the distinction between regional connections and connected partitions is crucial for designing resilient, compliant architectures that meet both operational and regulatory demands.

Connecting partition networks

You can connect AWS partitions in three ways: internet connectivity secured by TLS, IPsec Site-to-Site VPN over the internet, or through an AWS Direct Connect gateway to on-premises routers or using Direct Connect point of presence (PoP) partner connections to another Direct Connect PoP. Each approach offers different trade-offs in terms of security complexity and recovery. For more information about connectivity patterns between AWS GovCloud (US) and the global AWS infrastructure, see Connectivity patterns between AWS GovCloud (US) and AWS commercial partition. In addition to the customer gateway solution shown previously, partners located in Direct Connect PoPs can provide cross-partition connectivity services. These services can move traffic from one Direct Connect PoP to another. Such a setup enables dedicated lines between the AWS European Sovereign Cloud Direct Connect PoPs and the Direct Connect locations in other partitions.

Because IAM credentials don’t work across partitions, you need to create separate roles or use external identity providers. Common approaches include using IAM roles with trust relationships and external IDs, AWS Security Token Service (AWS STS) regional endpoints, resource-based policies, or cross-account roles managed through AWS Organizations. A modern best practice is to federate identities from a single, centralized identity provider to multiple partitions, avoiding the need for IAM users wherever possible. If IAM users are still used, credentials can be stored in AWS Secrets Manager, rotated using Lambda, and a backup user can improve availability. These patterns are often combined with standard access controls, such as Amazon API Gateway with authorizers, to secure cross-partition interactions. For a deeper dive into cross-partition authentication and authorization with AWS IAM, see IAM Identity Center for AWS environments spanning AWS GovCloud (US) and standard Regions.

When securing communication between AWS partitions, certificate-based approaches present both opportunities and challenges. Because AWS Certificate Manager (ACM) certificates and AWS Private Certificate Authority (AWS Private CA) are bound to individual partitions, you must typically deploy and manage separate public key infrastructure (PKI) infrastructures in each environment, including dedicated root CAs and manual handling of private key transfers. To establish secure cross-partition communication, a more advanced solution involves using double-signed certificates, where root CAs in each partition cross-sign each other’s certificates, creating a bidirectional chain of trust. Implementing this requires setting up root CAs with AWS Certificate Manager Private CA, establishing cross-signing agreements, managing trust stores across partitions, and handling complex certificate validation and revocation checks. You must also comply with differing regulatory requirements and maintain detailed audit trails. Although this approach adds operational complexity, it is essential for enabling authenticated, encrypted communication across isolated partitions, particularly in regulated environments where security and compliance are paramount.

Managing AWS Organizations across partitions

Setting up AWS European Sovereign Cloud accounts within your AWS Organization must be done in a completely separate organization. In the AWS GovCloud (US) partition, accounts can be paired into a commercial organization, as described in Inviting Accounts into an Organization for AWS GovCloud. With sovereignty as the main goal, failing over to an AWS European Sovereign Cloud-only state is simpler if the AWS Organizations setup is separate from the start. This doesn’t require starting from scratch. Instead, you can manage the same organizational units (OUs) and policies for the AWS European Sovereign Cloud by reusing your existing deployment automation.

Ideally, AWS Organizations account structures should be separated to make it straightforward to use the AWS landscape within the AWS European Sovereign Cloud without relying on the other partitions.

Figure 4: connectivity and service distribution across AWS partitions like the AWS European Sovereign Cloud

Security controls should be tailored per partition using distinct Service Control Policies (SCPs), with AWS Control Tower managing the commercial side. Networking requires isolated Transit Gateways, separate Amazon Route 53 DNS zones, and secure cross-partition communication using AWS PrivateLink. For monitoring, AWS Config aggregators and AWS Security Hub instances must be configured separately in each partition, while consolidated billing can be managed through Organizations. It’s important to consider limitations (for example, AWS Control Tower can’t directly manage AWS GovCloud (US) or AWS European Sovereign Cloud accounts), and the limited availability of some AWS Organizations features in these partitions. Overall, this approach supports governance, security, and operational clarity across partitions.

Conclusion

Navigating sovereignty-driven cloud architectures requires a strategy that addresses partition isolation, network connectivity, and secure cross-partition authentication. Prioritizing sovereignty in failover design adds complexity, but it might be worth the trade-off if your workloads need protection against geopolitical risks or regulatory changes. Start by identifying the disaster scenarios that matter most to your business, then select the simplest architecture that addresses those risks. By designing proactively for evolving regulations, you can maintain both compliance and resilience in the cloud.


About the authors

Google’s AI advantage: why crawler separation is the only path to a fair Internet

Post Syndicated from Maria Palmieri original https://blog.cloudflare.com/uk-google-ai-crawler-policy/

Earlier this week, the UK’s Competition and Markets Authority (CMA) opened its consultation on a package of proposed conduct requirements for Google. The consultation invites comments on the proposed requirements before the CMA imposes any final measures. These new rules aim to address the lack of choice and transparency that publishers (broadly defined as “any party that makes content available on the web”) face over how Google uses search to fuel its generative AI services and features. These are the first consultations on conduct requirements launched under the digital markets competition regime in the UK. 

We welcome the CMA’s recognition that publishers need a fairer deal and believe the proposed rules are a step into the right direction. Publishers should be entitled to have access to tools that enable them to control the inclusion of their content in generative AI services, and AI companies should have a level playing field on which to compete. 

But we believe the CMA has not gone far enough and should do more to safeguard the UK’s creative sector and foster healthy competition in the market for generative and agentic AI. 

CMA designation of Google as having Strategic Market Status 

In January 2025, the UK’s regulatory landscape underwent a significant legal shift with the implementation of the Digital Markets, Competition and Consumers Act 2024 (DMCC). Rather than relying on antitrust investigations to address risks to competition, the CMA can now designate firms as having Strategic Market Status (SMS) when they hold substantial, entrenched market power. This designation allows for targeted CMA interventions in digital markets, such as imposing detailed conduct requirements, to improve competition. 

In October 2025, the CMA designated Google as having SMS in general search and search advertising, given its 90 percent share of the search market in the UK. Crucially, this designation encompasses AI Overviews and AI Mode, with the CMA now having the authority to impose conduct requirements on Google’s search ecosystem. Final requirements imposed by the CMA are not merely suggestions but legally enforceable rules that can relate specifically to AI crawling with significant sanctions to ensure Google operates fairly. 

Publishers need a meaningful way to opt out of Google’s use of their content for generative AI

The CMA’s designation could not be more timely. As we’ve said before, we are indisputably in a time when the Internet needs clear “rules of the road” for AI crawling behavior. 

As the CMA rightly states, “publishers have no realistic option but to allow their content to be crawled for Google’s general search because of the market power Google holds in general search. However, Google currently uses that content in both its search generative AI features and in its broader generative AI services.” 

In other words: the same content that Google scrapes for search indexing is also used for inference/grounding purposes, like AI Overviews and AI Mode, which rely on fetching live information from the Internet in response to real-time user queries. And that creates a big problem for publishers—and for competition.

Because publishers cannot afford to disallow or block Googlebot, Google’s search crawler, on their website, they have to accept that their content will be used in generative AI applications such as AI Overviews and AI Mode within Google Search that return very little, if any, traffic to their websites. This undermines the ad-supported business models that have sustained digital publishing for decades, given the critical role of Google Search in driving human traffic to online advertising. It also means that Google’s generative AI applications enter into direct competition with publishers by reproducing their content, most often without attribution or compensation. 

Publishers’ reluctance to block Google because of its dominance in search gives Google an unfair competitive advantage in the market for generative and agentic AI. Unlike other AI bot operators, Google can use its search crawler to gather data for a variety of AI functions with little fear that its access will be restricted. It has minimal incentive to pay publishers for that data, which it is already getting for free. 

This prevents the emergence of a well-functioning marketplace where AI developers negotiate fair value for content. Instead, other AI companies are disincentivized from coming to the table, as they are structurally disadvantaged by a system that allows one dominant player to bypass compensation entirely. As the CMA itself recognizes, “[b]y not providing sufficient control over how this content is used, Google can limit the ability of publishers to monetise their content, while accessing content for AI-generated results in a way that its competitors cannot match”. 

Google’s advantage

Cloudflare data validates the concern about Google’s competitive advantage. Based on our data, Googlebot sees significantly more Internet content than its closest peers. 

Over an observed period of two months, Googlebot successfully accessed individual pages almost two times more than ClaudeBot and GPTBot, three times more than Meta-ExternalAgent, and more than three times more than Bingbot. The difference was even more extreme for other popular AI crawlers: for instance, Googlebot saw 167 times more unique pages than PerplexityBot. Out of the sampled unique URLs using our network that we observed over the last two months, Googlebot crawled roughly 8%.

In rounded multiple terms, Googlebot sees:

  • vs. ~1.70x the amount of unique URLs seen by ClaudeBot;

  • vs. ~1.76x the amount of unique URLs seen by GPTBot;

  • vs. ~2.99x the amount of unique URLs by Meta-ExternalAgent;

  • vs. ~3.26x the amount of unique URLs seen by Bingbot;

  • vs. ~5.09x the amount of unique URLs seen by Amazonbot;

  • vs. ~14.87x the amount of unique URLs seen by Applebot;

  • vs. ~23.73x the amount of unique URLs seen by Bytespider;

  • vs. ~166.98x the amount of unique URLs seen by PerplexityBot;

  • vs. ~714.48x the amount of unique URLs seen by CCBot; and

  • vs: ~1801.97x the amount of unique URLs seen by archive.org_bot.

Googlebot also stands out in other Cloudflare datasets.  

Even though it ranks as the most active bot by overall traffic, publishers are far less likely to disallow or block Googlebot in their robots.txt file compared to other crawlers. This is likely due to its importance in driving human traffic to their content—and, as a result, ad revenue—through search. 

As shown below, almost no website explicitly disallows the dual-purpose Googlebot in full, reflecting how important this bot is to driving traffic via search referrals. (Note that partial disallows often impact certain parts of a website that are irrelevant for search engine optimization, or SEO, such as login endpoints.)

Robots.txt merely allows the expression of crawling preferences; it is not an enforcement mechanism. Publishers rely on “good bots” to comply. To manage crawler access to their sites more effectively—and independently of a given bot’s compliance—publishers can set up a Web Application Firewall (WAF) with specific rules, technically preventing undesired crawlers from accessing their sites. Following the same logic as with robots.txt above, we would expect websites to block mostly other AI crawlers but not Googlebot. 

Indeed, when comparing the numbers for customers using AI Crawl Control, Cloudflare’s own AI crawler blocking tool that is integrated in our Application Security suite, between July 2025 and January 2026, one can see that the number of websites actively blocking other popular AI crawlers (e.g., GPTBot, Claudebot), was nearly seven times as high as the number of websites that blocked Googlebot and Bingbot. (Like Googlebot, Bingbot combines search and AI crawling and drives traffic to these sites, but given its small market share in search, its impact is less significant.)


So we agree with the CMA on the problem statement. But how can publishers be enabled to effectively opt out of Google using their content for its generative AI applications? We share the CMA’s conclusion that “in order to be able to make meaningful decisions about how Google uses their Search Content, (…) publishers need the ability effectively to opt their Search Content out of both Google’s search generative AI features and Google’s broader generative AI services.” 

But we’re concerned that the CMA’s proposal is insufficient.

CMA’s proposed publisher conduct requirements

On January 28, 2026, the CMA published four sets of proposed conduct requirements for Google, including conduct requirements related to publishers. According to the CMA, the proposed publisher rules are designed to address concerns that publishers (1) lack sufficient choice over how Google uses their content in its AI-generated responses, (2) have limited transparency into Google’s use of that content, and (3) do not get effective attribution for Google’s use of their content. The CMA recognized the importance of these concerns because of the role that Google search plays in finding content online. 

The conduct requirements would mandate Google grant publishers “meaningful and effective” control over whether their content is used for AI features, like AI Overviews. Google would be prohibited from taking any action that negatively impacts the effectiveness of those control options, such as intentionally downranking the content in search. 

To support informed decisionmaking, the CMA proposal also requires Google to increase transparency, by publishing clear documentation on how it uses crawled content for generative AI and on exactly what its various publisher controls cover in practice. Finally, the proposal would require Google to ensure effective attribution of publisher content and to provide publishers with detailed, disaggregated engagement data—including specific metrics for impressions, clicks, and “click quality”—to help them evaluate the commercial value of allowing their content to be used in AI-generated search summaries.

The CMA’s proposed remedies are insufficient

Although we support the CMA’s efforts to improve options for publishers, we are concerned that the proposed requirements do not solve the underlying issue of promoting fair, transparent choice over how their content is used by Google. Publishers are effectively forced to use Google’s proprietary opt-out mechanisms, tied specifically to the Google platform and under the conditions set by Google, rather than granting them direct, autonomous control. A framework where the platform dictates the rules, manages the technical controls, and defines the scope of application does not offer “effective control” to content creators or encourage competitive innovation in the market. Instead, it reinforces a state of permanent dependency.  

Such a framework also reduces choice for publishers. Creating new opt-out controls makes it impossible for publishers to choose to use external tools to block Googlebot from accessing their content without jeopardizing their appearance in Search results. Instead, under the current proposal, content creators will still have to allow Googlebot to scrape their websites, with no enforcement mechanisms to deploy and limited visibility available if Google does not respect their signalled preferences. Enforcement of these requirements by the CMA, if done properly, will be very onerous, without guarantee that publishers will trust the solution.

In fact, Cloudflare has received feedback from its customers that Google’s current proprietary opt-out mechanisms, including Google-Extended and ‘nosnippet’, have failed to prevent content from being utilized in ways that publishers cannot control. These opt-out tools also do not enable mechanisms for fair compensation for publishers. 

More broadly, as reflected in our proposed responsible AI bot principles, we believe that all AI bots should have one distinct purpose and declare it, so that website owners can make clear decisions over who can access their content and why. Unlike its leading competitors, such as OpenAI and Anthropic, Google does not comply with this principle for Googlebot, which is used for multiple purposes (search indexing, AI training, and inference/grounding). Simply requiring Google to develop a new opt-out mechanism would not allow publishers to achieve meaningful control over the use of their content. 

The most effective way to give publishers that necessary control is to require Googlebot to be split up into separate crawlers. That way, publishers could allow crawling for traditional search indexing, which they need to attract traffic to their sites, but block access for unwanted use of their content in generative AI services and features.

Requiring crawler separation is the only effective solution 

To ensure a fair digital ecosystem, the CMA must instead empower content owners to prevent Google from accessing their data for particular purposes in the first place, rather than relying on Google-managed workarounds after the crawler has already accessed the content for other purposes. That approach also enables creators to set conditions for access to their content. 

Although the CMA described crawler separation as an “equally effective intervention”, it ultimately rejected mandating separation based on Google’s input that it would be too onerous. We disagree.

Requiring Google to split up Googlebot by purpose — just like Google already does for its nearly 20 other crawlers — is not only technically feasible, but also a necessary and proportionate remedy that empowers website operators to have the granular control they currently lack, without increasing traffic load from crawlers to their websites (and in fact, perhaps even decreasing it, should they choose to block AI crawling).

To be clear, a crawler separation remedy benefits AI companies, by leveling the playing field between them and Google, in addition to giving UK-based publishers more control over their content. (There has been widespread public support for a crawler separation remedy by Daily Mail Group, the Guardian and the News Media Association.) Mandatory crawler separation is not a disadvantage to Google, nor does it undermine investment in AI. On the contrary, it is a pro-competitive safeguard that prevents Google from leveraging its search monopoly to gain an unfair advantage in the AI market. By decoupling these functions, we ensure that AI development is driven by fair-market competition rather than the exploitation of a single hyperscaler’s dominance.

******

The UK has a unique chance to lead the world in protecting the value of original and high-quality content on the Internet. However, we worry that the current proposals fall short. We would encourage rules that ensure that Google operates under the same conditions for content access as other AI developers, meaningfully restoring agency to publishers and paving the way for new business models promoting content monetization.

Cloudflare remains committed to engaging with the CMA and other partners during upcoming consultations to provide evidence-based data to help shape a final decision on conduct requirements that are targeted, proportional, and effective. The CMA still has an opportunity to ensure that the Internet becomes a fair marketplace for content creators and smaller AI players—not just a select few tech giants.

Critical Ivanti Endpoint Manager Mobile (EPMM) zero-day exploited in the wild (CVE-2026-1281 & CVE-2026-1340)

Post Syndicated from Rapid7 original https://www.rapid7.com/blog/post/etr-critical-ivanti-endpoint-manager-mobile-epmm-zero-day-exploited-in-the-wild-eitw-cve-2026-1281-1340

Overview

On January 29, 2026, Ivanti disclosed two new critical vulnerabilities affecting Endpoint Manager Mobile (EPMM): CVE-2026-1281 and CVE-2026-1340. The vendor has indicated that exploitation in the wild has already occurred prior to disclosure. This has been echoed by CISA who added CVE-2026-1281 to their Known Exploited Vulnerabilities (KEV) catalog shortly after the vendor disclosure. As an indication of how critical this development is, CISA has given a “due date” of only 3 days (Due Feb 1, 2026) for organizations, such as federal agencies, to remediate the vulnerabilities before the affected devices must be removed from a network.

While CVE-2026-1281 has been confirmed as exploited in the wild as a zero day, it is unclear if CVE-2026-1340 has also, or if this vulnerability was found separately to CVE-2026-1281. The two critical vulnerabilities are summarized below.

⠀

CVE

CVSSv3

CWE

CVE-2026-1281

9.8 (Critical)

Improper Control of Generation of Code (CWE-94)

CVE-2026-1340

9.8 (Critical)

Improper Control of Generation of Code (CWE-94)

⠀

Both CVE-2026-1281 and CVE-2026-1340 are described identically by the vendor; they are code injection issues, allowing a remote unauthenticated attacker to execute arbitrary code on an affected device. Based on the vendor’s guidance, the attackers can provide Bash commands as part of a malicious HTTP GET request to the endpoints that service either the “In-House Application Distribution” feature (i.e. /mifs/c/appstore/fob/) or the “Android File Transfer Configuration” feature (i.e. /mifs/c/aftstore/fob/), resulting in arbitrary OS command execution on the target. 

As EPMM is an endpoint management solution for mobile devices, the impact of an attacker compromising the EPMM server is significant. An attacker may be able to access Personally Identifiable Information (PII) regarding mobile device users, such as their names and email addresses, but also their mobile device information, such as their phone numbers, GPS information, and other sensitive unique identification information. This is in addition to the privileged position an attacker will have on the EPMM device itself, which may allow for lateral movement within the compromised network.
Given the nature of the product, EPMM is a high-profile target. It has been repeatedly targeted by zero-day vulnerabilities in the past. In 2023 the product was exploited in the wild via CVE-2023-35078, and again in 2025 via an exploit chain of CVE-2025-4427 and CVE-2025-4428. As of January 30, 2026, a public working proof-of-concept exploit for remote code execution is available. Organizations running EPMM are urged to act quickly and follow the vendor guidance to remediate these issues.

Threat hunting 

The following vendor supplied regular expression can be used to search the HTTP daemon’s log files for evidence of potential exploitation of CVE-2026-1281 and CVE-2026-1340:⠀

^(?!127\.0\.0\.1:\d+ .*$).*?\/mifs\/c\/(aft|app)store\/fob\/.*?404

Mitigation guidance

A vendor supplied update is available to remediate both vulnerabilities.

The following affected versions of Ivanti EPMM are remediated via the RPM 12.x.0.x patch:

  • Versions 12.7.0.0 and below

  • Versions 12.6.0.0 and below

  • Versions 12.5.0.0 and below

The following affected versions of Ivanti EPMM are remediated via the RPM 12.x.1.x patch:

  • Versions 12.6.1.0 and below

  • Versions 12.5.1.0 and below

Customers are advised to update to the latest remediated version of EPMM, on an emergency basis outside of normal patching cycles, as exploitation in-the-wild is already occurring.

For the latest mitigation guidance for Ivanti EPMM, please refer to the vendor’s security advisory. In addition to remediation, the vendor has provided additional threat hunting guidance.

Rapid7 customers

Exposure Command, InsightVM, and Nexpose

Exposure Command, InsightVM, and Nexpose customers can assess exposure to CVE-2026-1281 and CVE-2026-1340 with authenticated vulnerability checks expected to be available in today’s (Jan 30) content release. Note that the “Potential” category must be enabled in the scan template to run the checks.

Updates

  • January 30, 2026: Added reference to the watchTowr technical analysis and proof-of-concept exploit.

[$] Compiling Rust to readable C with Eurydice

Post Syndicated from daroc original https://lwn.net/Articles/1055211/

A few years ago, the only way to compile Rust code was using the rustc compiler
with LLVM as a backend. Since then, several projects, including

Mutabah’s Rust Compiler
(mrustc), GCC’s Rust
support
(gccrs),

rust_codegen_gcc
, and

Cranelift
have made enormous progress
on diversifying Rust’s compiler implementations. The most recent such project,

Eurydice
, has a
more ambitious goal: converting Rust code to clean C code. This is especially
useful in high-assurance software, where existing verification and compliance
tools expect C. Until such tools can be updated to work with Rust, Eurydice could
provide a smoother transition for these projects, as well as a stepping-stone
for environments that have a C compiler but no working Rust compiler. Eurydice
has been used to compile some post-quantum-cryptography routines from Rust to C,
for example.

AIs Are Getting Better at Finding and Exploiting Security Vulnerabilities

Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2026/01/ais-are-getting-better-at-finding-and-exploiting-security-vulnerabilities.html

From an Anthropic blog post:

In a recent evaluation of AI models’ cyber capabilities, current Claude models can now succeed at multistage attacks on networks with dozens of hosts using only standard, open-source tools, instead of the custom tools needed by previous generations. This illustrates how barriers to the use of AI in relatively autonomous cyber workflows are rapidly coming down, and highlights the importance of security fundamentals like promptly patching known vulnerabilities.

[…]

A notable development during the testing of Claude Sonnet 4.5 is that the model can now succeed on a minority of the networks without the custom cyber toolkit needed by previous generations. In particular, Sonnet 4.5 can now exfiltrate all of the (simulated) personal information in a high-fidelity simulation of the Equifax data breach—one of the costliest cyber attacks in history­­using only a Bash shell on a widely-available Kali Linux host (standard, open-source tools for penetration testing; not a custom toolkit). Sonnet 4.5 accomplishes this by instantly recognizing a publicized CVE and writing code to exploit it without needing to look it up or iterate on it. Recalling that the original Equifax breach happened by exploiting a publicized CVE that had not yet been patched, the prospect of highly competent and fast AI agents leveraging this approach underscores the pressing need for security best practices like prompt updates and patches.

AI models are getting better at this faster than I expected. This will be a major power shift in cybersecurity.

The Award for Excellence in Open Source goes to Greg Kroah-Hartman

Post Syndicated from corbet original https://lwn.net/Articles/1056699/

Daniel Stenberg, the recipient of last year’s Award for Excellence in Open
Source from the European Open Source Academy, presented
that award to this year’s recipient
: Greg Kroah-Hartman.

It’s impossible to overstate the importance of the work Greg has
done on Linux. In software, innovation grabs headlines, but
stability saves lives and livelihoods. Every Android phone, every
web server, every critical system running Linux depends on Greg’s
meticulous work. He ensures that when hospitals, banks,
governments, and individuals rely on Linux, it doesn’t fail
them. His work represents the highest form of service: unglamorous,
relentless, and essential.

Serverless ICYMI Q4 2025

Post Syndicated from Julian Wood original https://aws.amazon.com/blogs/compute/serverless-icymi-q4-2025/

Stay current with the latest serverless innovations that can transform your applications. In this 31st quarterly recap, discover the most impactful AWS serverless launches, features, and resources from Q4 2025 that you might have missed.

In case you missed our last ICYMI, check out what happened in Q3 2025.

2025 Q4 calendar

2025 Q4 calendar

Serverless at re:Invent 2025

This post covers the biggest serverless announcements from re:Invent 2025, highlighting key feature updates that can improve your applications, and shares valuable resources to keep you informed.

AWS re:Invent 2025 had more than 60,000 in-person attendees and more than 2 million online viewers for the keynotes. The event featured 3,500 sessions from 3,000 speakers, which included information on 530 AWS service and feature announcements.

Keynote Igniting the serverless movement

Keynote Igniting the serverless movement

The serverless content consisted of two tracks: Containers and Serverless (CNS) and Application Integration (API). These tracks included 150 unique sessions watched in-person by more than 16,000 attendees. There were developer-focused experiences including a Road to re:Invent Hackathon, AWS Builder Loft, and Builders Arena. Serverlesspresso, the coffee shop powered by serverless technology, operated in two locations during the event: the Expo Hall and the certification lounge.

Serverless and developer community photo

Serverless and developer community photo

Find a curated list of serverless videos on Serverless Land YouTube.

AWS Lambda durable functions

Managing state across multi-step serverless workflows has traditionally required complex external orchestration tools. AWS Lambda durable functions expand how developers can use Lambda. You can now build reliable multi-step applications and AI workflows directly within Lambda.

AWS Lambda durable functions code

AWS Lambda durable functions code

Durable functions automatically checkpoint progress by saving the current state and completed steps at key points during execution. This allows them to suspend execution for up to one year during long-running tasks and recover from failures by resuming from the last checkpoint rather than restarting from the beginning, all without requiring additional infrastructure management.

Developers can now build in Python or TypeScript, wrap calls in steps with automatic retries and checkpointing. You can use waits to suspend execution for minutes, hours, or even up to a year without paying for idle compute. Durable functions use a replay mechanism to maintain state and handle failures gracefully. The replay mechanism works by re-executing your function code from checkpoints when recovering from failures, ensuring state consistency without data loss. This also means you don’t need complex external orchestration tools for many use cases. This can be helpful for AI workflows and multi-step applications where you need reliable state management without managing external infrastructure.

For more information, read the launch blog post and watch the re:Invent Breakout Session video: Deep Dive on AWS Lambda durable functions (CNS380)

AWS Lambda Managed Instances

Lambda now offers Lambda Managed Instances, a new compute option that combines Amazon EC2 flexibility with fully managed infrastructure. AWS automatically handles instance provisioning, scaling, and maintenance while allowing access to the full range of EC2 capabilities, including Graviton4, network-optimized instances, and other specialized compute options.

AWS Lambda Managed Instances configuration

AWS Lambda Managed Instances configuration

Your functions run on dedicated EC2 capacity from your account, in your own Amazon Virtual Private Cloud (Amazon VPC). AWS still manages the operational overhead, including OS patching, load balancing, and auto-scaling. This gives you access to specialized hardware options while maintaining the serverless operational model. You can further improve costs by using EC2 pricing models, including Compute Savings Plans and Reserved Instances for Lambda workloads. Each instance can handle multiple concurrent requests, making this particularly valuable for high-volume, steady-state workloads where predictable pricing and specific hardware requirements matter.

For more information, read the launch blog post and watch the re:Invent Breakout Session video: Lambda Managed Instances: EC2 Power with Serverless Simplicity (CNS382).

Other Lambda announcements

Multi-tenant SaaS applications face challenges like data leakage between tenants and noisy neighbor effects where one tenant’s workload impacts others. They also struggle with implementing custom isolation mechanisms. Tenant isolation mode addresses these by processing function invocations in separate execution environments for each tenant. This manages tenant-level compute environment isolation automatically.

AWS Lambda tenant isolation

AWS Lambda tenant isolation

Lambda adds Provisioned Mode for Amazon SQS event-source mappings, providing predictable performance and reduced cold starts for high-throughput SQS processing workloads.

You can now send up to 1 MB of data in asynchronous Lambda invocations, increased from 256 KB, helping you build more complex data processing scenarios.

Lambda functions now support IPv6 networking, so you don’t need NAT Gateways when accessing the internet or other AWS services from VPC-connected functions.

Lambda internet connectivity through a NAT Gateway (IPv4) and Lambda internet connectivity through an egress-only internet gateway (IPv6).

Lambda internet connectivity through a NAT Gateway (IPv4) and Lambda internet connectivity through an egress-only internet gateway (IPv6).

Lambda Rust support is now generally available, moving from experimental status. This is backed by AWS Support and the Lambda availability SLA.

Lambda has expanded its runtime support by adding Python 3.14, Node.js 24, and Java 25 as both managed runtimes and container base images, providing access to the latest language features and ensuring long-term support.

Amazon ECS

Amazon Elastic Container Service (Amazon ECS) Express Mode streamlines the deployment and management of containerized applications by automating the infrastructure setup that traditionally slows down developers.

Amazon ECS Express Mode deployment

Amazon ECS Express Mode deployment

This means you can focus on building applications while deploying with confidence using AWS best practices. Express Mode lets you deploy production-ready containerized web applications and APIs with a single command. This automatically handles domains, networking, load balancing, AWS Identity and Access Management (IAM) roles, and auto-scaling through simplified APIs. When your applications evolve and require advanced features, you can seamlessly configure and access the full capabilities of the resources, including Amazon ECS. Learn more from the launch blog post.

Amazon ECS announced a public preview of a fully managed MCP server, enabling AI-powered experiences for development and operations. The Model Context Protocol (MCP) server provides enterprise-grade capabilities like automatic updates and patching, centralized security through AWS IAM integration, comprehensive audit logging via AWS CloudTrail, and the proven scalability, reliability, and support of AWS.

Amazon Elastic Container Registry (ECR) managed container image signing enhances your security posture and eliminates the operational overhead of setting up signing. Container image signing allows you to verify that images are from trusted sources. ECR automatically signs images as they are pushed using the identity of the entity pushing the image. Signing operations are logged through CloudTrail for full auditability.

Amazon API Gateway

Amazon API Gateway allows you to improve the responsiveness of your REST APIs by progressively streaming response payloads back to the client. With this new capability, you can use streamed responses to enhance user experience when building LLM-driven applications (such as AI agents and chatbots), improve time-to-first-byte (TTFB) performance for web and mobile applications, stream large files, and perform long-running operations while reporting incremental progress using protocols such as server-sent events (SSE).

Amazon API Gateway streaming

API Gateway introduces private integration with Application Load Balancers (ALBs). You can use this to expose your VPC-based applications securely through REST APIs without exposing your ALBs to the public internet.

You can also now configure enhanced TLS security policies on API endpoints and custom domain names, providing you with greater control over the security posture of your APIs.

Amazon EventBridge

Amazon EventBridge introduced an enhanced visual rule builder that helps developers discover and subscribe to events from custom applications and over 200 AWS services. The console-based interface integrates the EventBridge schema registry with a comprehensive event catalog and intuitive drag-and-drop canvas that simplifies building event-driven applications. Developers can browse and search through events with readily available sample payloads and schemas without having to hunt through individual service documentation. The schema-aware visual builder guides developers through creating event filter patterns and rules, reducing syntax errors and accelerating development time.

EventBridge also allows targeting SQS fair queues.

AWS Step Functions

AWS Step Functions allows for enhanced local testing through the TestState API, providing programmatic access to comprehensive testing capabilities without deploying to AWS. This helps you build automated test suites that validate your workflow definitions locally on your development machines. Test error handling patterns, data transformations, and mock service integrations using your preferred testing frameworks.

There is also a new metrics dashboard, giving you visibility into your workflow operations at both the account and state machine levels.

Other announcements

Savings Plans flexible pricing model extends to AWS managed database services with the launch of Database Savings Plans. This helps reduce database costs by up to 35% when committing to a consistent amount of usage ($/hour) over a 1-year term. Savings automatically apply each hour to eligible usage across supported database services, and additional usage beyond the commitment is billed at on-demand rates.

Amazon DynamoDB now supports multi-attribute composite keys in global secondary indexes. You no longer need to concatenate values into synthetic keys manually, which sometimes results in the need to backfill data before adding new indexes. Instead, you can create primary keys using up to eight existing attributes, making it easier to model diverse access patterns and adapt to new query requirements.

Amazon Bedrock introduced AgentCore with quality evaluations and policy controls for deploying trusted AI agents at scale.

Bedrock also added 18 fully managed open weight models, expanding AI model options for developers.

The Strands Agents SDK is an open source framework that takes a model-driven approach to building and running AI agents in just a few lines of code. TypeScript support is now available in preview so you can choose between Python and TypeScript for building Strands Agents.

Amazon S3 Vectors became generally available. S3 Vectors delivers purpose-built, cost-optimized vector storage for AI agents, inference, Retrieval Augmented Generation (RAG), and semantic search at billion-vector scale.

Serverless blog posts

October

November

Serverless Office Hours

Join our livestream every Tuesday at 11 AM PT for live discussions, Q&A sessions, and deep dives into serverless technologies. Episodes are available on-demand at serverlessland.com/office-hours.

October

November

December

Still looking for more?

The Serverless landing page has overall information about building serverless applications. The Lambda resources page contains case studies, webinars, whitepapers, customer stories, reference architectures, and even more Getting Started tutorials.

You can also follow the Serverless Developer Advocacy team to see the latest news, follow conversations, and interact with the team.

And finally, visit Serverless Land for all your serverless needs.

Възелът на съгласието

Post Syndicated from Емилия Милчева original https://www.toest.bg/vuzelut-na-suglasieto/

Възелът на съгласието

Кого ще избере президентката Илияна Йотова за служебен министър-председател, след като има петима съгласни за поста, съвсем не е обикновено кадрово решение. Напълно възможно е изборът да падне върху име, което умишлено не беше пуснато в мелницата от последните седмици. Например заместник-председателката на Сметната палата Маргарита Николова, която даде съгласие да поеме поста, след като това направиха и подуправителят на БНБ Андрей Гюров, заместник-омбудсманката Мария Филипова и председателят на Сметната палата Димитър Главчев. 

Другата заместничка в Сметната палата – Силвия Къдрева, която също потвърди, е работила от 2018 г. в Комисията за противодействие на корупцията и отнемане на незаконно придобито имущество (КПКОНПИ). За поста беше предложена от оскандалилия се с декларирането на терасата си председател на Комисията Пламен Георгиев. Кандидатурата ѝ беше одобрена от парламента, доминиран от ГЕРБ и „Обединени патриоти“ (ОП). 

Прекратилият президентския си мандат Румен Радев остави на Йотова отговорността за решението, което по всяка вероятност е негово. Въпреки че няма публично известна информация, бившият президент разполагаше с достатъчно време, за да планира следващите стъпки. Така избегна ситуация, в която служебният кабинет би бил разчетен като последен президентски ход, който да повлияе на политическата му кариера. Причината е, че ще бъде изтълкуван като опит за политическо съюзяване след изборите. 

Формално неутрален избор

Николова е привидно най-непартийният кандидат сред останалите, дали съгласие. Влиза в политиката от „Атака“ най-напред като столична общинска съветничка, а после и като депутатка в два парламента – докато партията на Волен Сидеров подкрепяше кабинета „Орешарски“ в периода 2013–2014 г. и по-късно от коалицията „Обединени патриоти“ (ОП), в която влизаше и „Атака“. А ОП беше партньор на ГЕРБ в третото правителство на Бойко Борисов. Николова е била член на Консултативния съвет на Сметната палата, както и финансов директор в три министерства и в БНТ. 

Доказала съм, че мога да създавам работещи екипи и добра организация на работа, не бягам от трудните решения… 

По закон председателят на Сметната палата посочва заместниците си, така че Николова и Къдрева формално са избор на Главчев. Още тогава, през април 2025 г., и двете потвърдиха, че са готови да изпълнят предвидените по Конституцията ангажименти. Опитът на Къдрева в Антикорупционната комисия обаче едва ли би допринесъл да бъде избрана за служебен премиер – структурата беше закрита тази седмица с решение на Народното събрание. 

Макар и да не са така здраво обвързани с ГЕРБ и ДПС като повечето от „домовата книга“, Николова и Къдрева също са продукт на това мнозинство. Но ако Йотова се спре на някоя от тях, ще е значително по-безопасно и няма да търпи укори за политически предпочитания и спекулации за бъдещи съюзи, отколкото ако посочи Гюров или Главчев.

Който и от двамата да бъде избран, ще има негативи за партията, изстреляла го в политиката, тъй като ще понесе тежестта, включително греховете, за организацията на изборите. 

След като събра съгласието за служебни премиери на половината от „домовата книга“, се очаква Илияна Йотова да проведе консултации с парламентарно представените политически сили и едва тогава да обяви избора си за служебен премиер. Така Радев получава още време, за да учреди партията си.

Всичко случващо се до предсрочните избори е сигнал за политическа стратегия, а не просто административно назначение. Невъзможно е да се избегне калкулацията на едно или друго действие за вота, който се очаква да бъде насрочен за 19 април.

Поредицата служебни правителства наложиха схемите, по които се действа. Най-напред се сменят директорите на областните дирекции на МВР и областните управители, върху които пада тежестта на организацията на изборите. Кметовете, които също имат сериозен принос в този процес, няма как да бъдат сменени. 

Президент в кампания за президент

За разлика от Радев, впуснал се в политически инженеринг, на Йотова вероятно ѝ предстои предизборна кампания за президент (макар кандидатурата ѝ още да не е издигната). Тя има значително предимство пред останалите кандидати – през цялата кампания ще мине като действащ държавен глава. Но това съвсем не означава, че избирателите, гласували за Радев–Йотова като президентска двойка, автоматично ще подкрепят Йотова–Х. Ядрото обаче ще е идентично – консервативни, по-възрастни, симпатизиращи на режима в Москва, евроскептици.

Политическото ДНК на Йотова е лявото, макар то да е практически изличено от палитрата на българската политика. Политическата ѝ кариера започва в далечната 1997-ма като шеф на пресцентъра на БСП след разгрома на партията, чийто кабинет докарва национална катастрофа на България. После е депутатка и евродепутатка от БСП, като не успява да довърши третия си мандат, тъй като през 2016 г. влиза на „Дондуков“ 2. Изборът на служебен премиер ще е съобразен и с нейните интереси, освен с тези на Румен Радев. 

Част от Българската социалистическа партия в момента отчаяно се бори да се оттласне от съвместното управление с ГЕРБ и ДПС – Ново начало, тъй като то по всяка вероятност ще я загроби. Така че за Йотова няма особено значение дали „Позитано“ 20 ще я подкрепи – важното е да го направи бъдещата партия на Радев.

Готов е!

Веднага щом стана ясно, че предсрочните избори са неизбежни, започна претеглянето на шансовете за служебен премиер на Андрей Гюров – политик от „Продължаваме промяната“, бивш депутат от ПП–ДБ, избран за подуправител през 2023 г. Той беше първият, дал съгласие да оглави служебно правителство на консултациите тази седмица на „Дондуков“ 2. 

Гюров е готов, макар при предишното разиграване на консултациите за служебен премиер да беше изключен: 

Готов съм да поема отговорността, ако това стане при ясни принципи и без скрити условия… Честни избори можем да имаме тогава, когато едно служебно правителство не се намесва на политическия терен, то е достатъчно неутрално, равно отдалечено от всички партии и работи само в рамките на правомощията, които му дава Конституцията.

Равноотдалечеността е химера. Правителство, чийто премиер се избира измежду политически назначения, били те и високопоставени институционални фигури, няма как да е „неутрално“. 

Правният казус, свързан с Андрей Гюров, не е бонус за избора му. Година след като беше гласуван от парламента за подуправител и след разтурянето на „сглобката“ между ГЕРБ–СДС, ПП–ДБ и ДПС, Комисията за противодействие на корупцията (КПК) установи несъвместимост.

КПК уведоми БНБ, че той не може да заема длъжността. Причината: бил съдружник в „Йонтех Инженеринг“ ООД и член на управителните органи на юридически лица с нестопанска цел – сдружение „Балкански – Паница Институт за научни издирвания“ и сдружение „Голф-клуб Благоевград“. Резултатът е, че от юни 2024 г. е в неплатен отпуск и оспорва решенията пред ВАС, който спря делото, докато не получи отговор от Съда на ЕС. След произнасянето му делото във ВАС продължава.

Доцент Христо Христев, преподавател по право на ЕС, коментира пред bTV, че ако Гюров поеме ангажимента да бъде служебен премиер, „би следвало да излезе от управата на банката“ – което не означава да се прекрати делото във ВАС. 

Андрей Гюров няма опит в изпълнителната власт, а професионалният му профил е свързан основно с академичната и експертната сфера. За честността на изборите би разчитал на министъра на вътрешните работи, който би избрал, и на мрежата от нови назначения, които би съгласувал с ПП–ДБ. Срещу тях ще са машината на местната власт и утвърденият модел за контрол на вота, създаден от ГЕРБ и ДПС – Ново начало.

И тя е готова!

„Работя за благополучието на хората от 15 години като държавен служител“, каза Филипова, втората съгласила се да бъде служебен премиер. Още при номинацията ѝ за заместник-омбудсман изборът ѝ беше обвързан с попълването на „домовата книга“ за кандидат служебни премиери с лоялни на ГЕРБ и ДПС (Пеевски) хора. 

Съдейки по кариерния ѝ възход, тя е царицата на новите начала. Стартирала като експерт в Министерството на правосъдието, оглавила Държавната комисия по хазарта (помним я от есемесите на хазартния бос Васил Божков с тогавашния министър на финансите от ГЕРБ Владислав Горанов). Следва постът на заместник-председател на Комисията за финансов надзор (КФН), после става председателка на Комисията за защита на потребителите (КЗП), където прави две-три шумни акции, и прескок към заместник-омбудсман. 

Зад това възкачване по йерархията, започнало при първия кабинет на ГЕРБ, прозира моделът Борисов–Пеевски. За честността на изборите тя може да допринесе единствено с верността, която ще му засвидетелства. Но Филипова няма шансове да бъде избрана, твърде „брандирана“ е с кукловодите зад гърба си и името ѝ по-скоро бе спуснато за медиен шум и димки, докато истинският кандидат е друг.

Още един в готовност

Друг конкурент за служебен премиер е Димитър Главчев, двукратен служебен министър-председател с политическа кариера като депутат от ГЕРБ, катапултирала го на поста в Сметната палата.

Желанието му за трети път да оглави служебно правителство е безочие предвид факта, че последните избори, които организира, докато беше на този пост – на 27 октомври 2024 г., бяха частично касирани от Конституционния съд. 

Къща от карти. Ще се скъса ли косъмът на „Величие“?
Съспенсът с партията на Ивелин Михайлов „Величие“ и нейното влизане в парламента продължава. Драмата е на много нива и работата е там, че все още никой не може да каже какво точно ще се случи, дори и да се променят последните изборни резултати. Емилия Милчева със статия по темата.
Възелът на съгласието

Резултатът от разкритите драстични нарушения при повторното преброяване в някои секции вкара „Величие“ в парламента и отмени избора на 16 народни представители.

Но Главчев не се чувства отговорен:

Да се прехвърля вината върху който и да е служебен премиер или служебно правителство за това, което се е случило в секционните избирателни комисии, говори или за невежество, или за съзнателни спекулации.

Готовността да се оглави служебно правителство означава, че кандидатът гарантира честността на вота. Но и самата готовност не е гаранция за честен вот, когато системата остава непроменена. Партиите обаче не биха имали нищо против да се застраховат с един (не)партиен кандидат за служебен премиер, който да понесе отговорността за контролиран и купен вот и за нарушения на изборите. В този смисъл изборът на Илияна Йотова ще е политически щит – служебният премиер е буферът, който ще поеме удара, ако изборите бъдат оспорени, без това да засяга пряко нито партиите, нито президента.

Security updates for Friday

Post Syndicated from corbet original https://lwn.net/Articles/1056692/

Security updates have been issued by AlmaLinux (curl, gimp:2.8, glibc, grafana, grafana-pcp, kernel, osbuild-composer, php:8.3, python-urllib3, python3.11, and python3.12), Debian (chromium), Mageia (ceph, gpsd, libxml2, openjdk, openssl, and xen), SUSE (abseil-cpp, assertj-core, coredns, freerdp, java-11-openjdk, java-25-openjdk, libxml2, openssl-1_0_0, openssl-1_1, python, python-filelock, and python311-sse-starlette), and Ubuntu (kernel, linux, linux-aws, linux-aws-hwe, linux-hwe, linux-kvm, linux-oracle, linux, linux-aws, linux-kvm, linux-lts-xenial, linux-aws-fips, linux-fips, linux-fips, and texlive-bin).

Building vertical microfrontends on Cloudflare’s platform

Post Syndicated from Brayden Wilmoth original https://blog.cloudflare.com/vertical-microfrontends/

Updated at 6:55 a.m. PT

Today, we’re introducing a new Worker template for Vertical Microfrontends (VMFE). This template allows you to map multiple independent Cloudflare Workers to a single domain, enabling teams to work in complete silos — shipping marketing, docs, and dashboards independently — while presenting a single, seamless application to the user.

Most microfrontend architectures are “horizontal”, meaning different parts of a single page are fetched from different services. Vertical microfrontends take a different approach by splitting the application by URL path. In this model, a team owning the `/blog` path doesn’t just own a component; they own the entire vertical stack for that route – framework, library choice, CI/CD and more. Owning the entire stack of a path, or set of paths, allows teams to have true ownership of their work and ship with confidence.

Teams face problems as they grow, where different frameworks serve varying use cases. A marketing website could be better utilized with Astro, for example, while a dashboard might be better with React. Or say you have a monolithic code base where many teams ship as a collective. An update to add new features from several teams can get frustratingly rolled back because a single team introduced a regression. How do we solve the problem of obscuring the technical implementation details away from the user and letting teams ship a cohesive user experience with full autonomy and control of their domains?

Vertical microfrontends can be the answer. Let’s dive in and explore how they solve developer pain points together.

What are vertical microfrontends?

A vertical microfrontend is an architectural pattern where a single independent team owns an entire slice of the application’s functionality, from the user interface all the way down to the CI/CD pipeline. These slices are defined by paths on a domain where you can associate individual Workers with specific paths:

/      = Marketing
/docs  = Documentation
/blog  = Blog
/dash  = Dashboard

We could take it a step further and focus on more granular sub-path Worker associations, too, such as a dashboard. Within a dashboard, you likely segment out various features or products by adding depth to your URL path (e.g. /dash/product-a) and navigating between two products could mean two entirely different code bases. 

Now with vertical microfrontends, we could also have the following:

/dash/product-a  = WorkerA
/dash/product-b  = WorkerB

Each of the above paths are their own frontend project with zero shared code between them. The product-a and product-b routes map to separately deployed frontend applications that have their own frameworks, libraries, CI/CD pipelines defined and owned by their own teams. FINALLY.

You can now own your own code from end to end. But now we need to find a way to stitch these separate projects together, and even more so, make them feel as if they are a unified experience.

We experience this pain point ourselves here at Cloudflare, as the dashboard has many individual teams owning their own products. Teams must contend with the fact that changes made outside their control impact how users experience their product. 

Internally, we are now using a similar strategy for our own dashboard. When users navigate from the core dashboard into our ZeroTrust product, in reality they are two entirely separate projects and the user is simply being routed to that project by its path /:accountId/one.

Visually unified experiences

Stitching these individual projects together to make them feel like a unified experience isn’t as difficult as you might think: It only takes a few lines of CSS magic. What we absolutely do not want to happen is to leak our implementation details and internal decisions to our users. If we fail to make this user experience feel like one cohesive frontend, then we’ve done a grave injustice to our users. 

To accomplish this sleight of hand, let us take a little trip in understanding how view transitions and document preloading come into play.

View transitions

When we want to seamlessly navigate between two distinct pages while making it feel smooth to the end user, view transitions are quite useful. Defining specific DOM elements on our page to stick around until the next page is visible, and defining how any changes are handled, make for quite the powerful quilt-stitching tool for multi-page applications.

There may be, however, instances where making the various vertical microfrontends feel different is more than acceptable. Perhaps our marketing website, documentation, and dashboard are each uniquely defined, for instance. A user would not expect all three of those to feel cohesive as you navigate between the three parts. But… if you decide to introduce vertical slices to an individual experience such as the dashboard (e.g. /dash/product-a & /dash/product-b), then users should never know they are two different repositories/workers/projects underneath.

Okay, enough talk — let’s get to work. I mentioned it was low-effort to make two separate projects feel as if they were one to a user, and if you have yet to hear about CSS View Transitions then I’m about to blow your mind.

What if I told you that you could make animated transitions between different views  — single-page app (SPA) or multi-page app (MPA) — feel as if they were one? Before any view transitions are added, if we navigate between pages owned by two different Workers, the interstitial loading state would be the white blank screen in our browser for some few hundred milliseconds until the full next page began rendering. Pages would not feel cohesive, and it certainly would not feel like a single-page application.


Appears as multiple navigation elements between each site.

If we want elements to stick around, rather than seeing a white blank page, we can achieve that by defining CSS View Transitions. With the code below, we’re telling our current document page that when a view transition event is about to happen, keep the nav DOM element on the screen, and if any delta in appearance exists between our existing page and our destination page, then we’ll animate that with an ease-in-out transition.

All of a sudden, two different Workers feel like one.

@supports (view-transition-name: none) {
  ::view-transition-old(root),
  ::view-transition-new(root) {
    animation-duration: 0.3s;
    animation-timing-function: ease-in-out;
  }
  nav { view-transition-name: navigation; }
}

Appears as a single navigation element between three distinct sites.

Preloading

Transitioning between two pages makes it look seamless — and we also want it to feel as instant as a client-side SPA. While currently Firefox and Safari do not support Speculation Rules, Chrome/Edge/Opera do support the more recent newcomer. The speculation rules API is designed to improve performance for future navigations, particularly for document URLs, making multi-page applications feel more like single-page applications.

Breaking it down into code, what we need to define is a script rule in a specific format that tells the supporting browsers how to prefetch the other vertical slices that are connected to our web application — likely linked through some shared navigation.

<script type="speculationrules">
  {
    "prefetch": [
      {
        "urls": ["https://product-a.com", "https://product-b.com"],
        "requires": ["anonymous-client-ip-when-cross-origin"],
        "referrer_policy": "no-referrer"
      }
    ]
  }
</script>

With that, our application prefetches our other microfrontends and holds them in our in-memory cache, so if we were to navigate to those pages it would feel nearly instant.

You likely won’t require this for clearly discernible vertical slices (marketing, docs, dashboard) because users would expect a slight load between them. However, it is highly encouraged to use when vertical slices are defined within a specific visible experience (e.g. within dashboard pages).

Between View Transitions and Speculation Rules, we are able to tie together entirely different code repositories to feel as if they were served from a single-page application. Wild if you ask me.

Zero-config request routing

Now we need a mechanism to host multiple applications, and a method to stitch them together as requests stream in. Defining a single Cloudflare Worker as the “Router” allows a single logical point (at the edge) to handle network requests and then forward them to whichever vertical microfrontend is responsible for that URL path. Plus it doesn’t hurt that then we can map a single domain to that router Worker and the rest “just works.”

Service bindings

If you have yet to explore Cloudflare Worker service bindings, then it is worth taking a moment to do so.

Service bindings allow one Worker to call into another, without going through a publicly-accessible URL. A Service binding allows Worker A to call a method on Worker B, or to forward a request from Worker A to Worker. Breaking it down further, the Router Worker can call into each vertical microfrontend Worker that has been defined (e.g. marketing, docs, dashboard), assuming each of them were Cloudflare Workers.

Why is this important? This is precisely the mechanism that “stitches” these vertical slices together. We’ll dig into how the request routing is handling the traffic split in the next section. But to define each of these microfrontends, we’ll need to update our Router Worker’s wrangler definition, so it knows which frontends it’s allowed to call into.

{
  "$schema": "./node_modules/wrangler/config-schema.json",
  "name": "router",
  "main": "./src/router.js",
  "services": [
    {
      "binding": "HOME",
      "service": "worker_marketing"
    },
    {
      "binding": "DOCS",
      "service": "worker_docs"
    },
    {
      "binding": "DASH",
      "service": "worker_dash"
    },
  ]
}

Our above sample definition is defined in our Router Worker, which then tells us that we are permitted to make requests into three separate additional Workers (marketing, docs, and dash). Granting permissions is as simple as that, but let’s tumble into some of the more complex logic with request routing and HTML rewriting network responses.

Request routing

With knowledge of the various other Workers we are able to call into if needed, now we need some logic in place to know where to direct network requests when. Since the Router Worker is assigned to our custom domain, all incoming requests hit it first at the network edge. It then determines which Worker should handle the request and manages the resulting response. 

The first step is to map URL paths to associated Workers. When a certain request URL is received, we need to know where it needs to be forwarded. We do this by defining rules. While we support wildcard routes, dynamic paths, and parameter constraints, we are going to stay focused on the basics — literal path prefixes — as it illustrates the point more clearly. 

 In this example, we have three microfrontends:

/      = Marketing
/docs  = Documentation
/dash  = Dashboard

Each of the above paths need to be mapped to an actual Worker (see our wrangler definition for services in the section above). For our Router Worker, we define an additional variable with the following data, so we can know which paths should map to which service bindings. We now know where to route users as requests come in! Define a wrangler variable with the name ROUTES and the following contents:

{
  "routes":[
    {"binding": "HOME", "path": "/"},
    {"binding": "DOCS", "path": "/docs"},
    {"binding": "DASH", "path": "/dash"}
  ]
}

Let’s envision a user visiting our website path /docs/installation. Under the hood, what happens is the request first reaches our Router Worker which is in charge of understanding what URL paths map to which individual Workers. It understands that the /docs path prefix is mapped to our DOCS service binding which referencing our wrangler file points us at our worker_docs project. Our Router Worker, knowing that /docs is defined as a vertical microfrontend route, removes the /docs prefix from the path and forwards the request to our worker_docs Worker to handle the request and then finally returns whatever response we get.

Why does it drop the /docs path, though? This was an implementation detail choice that was made so that when the Worker is accessed via the Router Worker, it can clean up the URL to handle the request as if it were called from outside our Router Worker. Like any Cloudflare Worker, our worker_docs service might have its own individual URL where it can be accessed. We decided we wanted that service URL to continue to work independently. When it’s attached to our new Router Worker, it would automatically handle removing the prefix, so the service could be accessible from its own defined URL or through our Router Worker… either place, doesn’t matter.

HTMLRewriter

Splitting our various frontend services with URL paths (e.g. /docs or /dash) makes it easy for us to forward a request, but when our response contains HTML that doesn’t know it’s being reverse proxied through a path component… well, that causes problems. 

Say our documentation website has an image tag in the response <img src="./logo.png" />. If our user was visiting this page at https://website.com/docs/, then loading the logo.png file would likely fail because our /docs path is somewhat artificially defined only by our Router Worker.

Only when our services are accessed through our Router Worker do we need to do some HTML rewriting of absolute paths so our returned browser response references valid assets. In practice what happens is that when a request passes through our Router Worker, we pass the request to the correct Service Binding, and we receive the response from that. Before we pass that back to the client, we have an opportunity to rewrite the DOM — so where we see absolute paths, we go ahead and prepend that with the proxied path. Where previously our HTML was returning our image tag with <img src="./logo.png" /> we now modify it before returning to the client browser to <img src="./docs/logo.png" />.


Let’s return for a moment to the magic of CSS view transitions and document preloading. We could of course manually place that code into our projects and have it work, but this Router Worker will automatically handle that logic for us by also using HTMLRewriter. 

In your Router Worker ROUTES variable, if you set smoothTransitions to true at the root level, then the CSS transition views code will be added automatically. Additionally, if you set the preload key within a route to true, then the script code speculation rules for that route will automatically be added as well. 

Below is an example of both in action:

{
  "smoothTransitions":true, 
  "routes":[
    {"binding": "APP1", "path": "/app1", "preload": true},
    {"binding": "APP2", "path": "/app2", "preload": true}
  ]
}

Get started

You can start building with the Vertical Microfrontend template today.

Visit the Cloudflare Dashboard deeplink here or go to “Workers & Pages” and click the “Create application” button to get started. From there, click “Select a template” and then “Create microfrontend” and you can begin configuring your setup.


Check out the documentation to see how to map your existing Workers and enable View Transitions. We can’t wait to see what complex, multi-team applications you build on the edge!

Научни новини: Генни технологии, астронавти, химически фосили и климатични промени

Post Syndicated from Михаил Ангелов original https://www.toest.bg/nauchni-novini-genni-tehnologii-astronavti-himicheski-fosili-i-klimatichni-promeni/

Крачка към съвременните генни технологии в Европа

Научни новини: Генни технологии, астронавти, химически фосили и климатични промени

Регулациите относно намесите в генома на растенията в Европа са сравнително стари и все още третират растенията, създадени с новите геномни техники (НГТ), например CRISPR, като „традиционни ГМО“ въпреки големия обем научни доказателства за тяхната безопасност и еквивалентност на сортовете, получени с конвенционални селекционни подходи. С нарастването на риска Европа да изостане от другите държави, в които тези растения са одобрени, широката научна общност и по-прогресивните земеделски производители очаквано започнаха да настояват за осъвременяване на законите.

Така в средата на 2023 г. Европейската комисия предложи преразглеждане на регулациите, като тогава бяха описани някои основни положения. Накратко, идеята беше генетично манипулираните растения да се разделят в две категории. В първата влизат растения с промени, които могат да се срещнат в природата или да се постигнат с традиционните техники за селекция. Втората включва останалите, които могат да носят ДНК от чужди организми или имат по-големи намеси в генома. Оттогава, освен в науката, прогрес има и в бюрокрацията.

Научни новини: ГМО и глобално затопляне
Да си поговорим за ГМО и глобално затопляне. В случая ще говори Михаил Ангелов чрез своите научни новини. Този път е подбрал две големи теми – за генетичните манипулации и за затоплянето на планетата.
Научни новини: Генни технологии, астронавти, химически фосили и климатични промени

В началото на миналия месец Съветът на Европейския съюз постигна предварително споразумение с Европейския парламент за установяване на нов набор от правила, които да оформят законовата рамка за НГТ.

Според споразумението двете категории растения се запазват и тези в първата ще се разглеждат като еквивалентни на традиционните растения. Както и в предложението от 2023 г., етикети ще се поставят само на семената, от които се отглеждат, но на самите растения, както и на продуктите, получени от тях, няма да има етикет, за да се спази принципът за еквивалентност. Според Съвета това няма да доведе до тежест за селекционерите, но ще позволи на производителите да изключат НГТ от процесите си. Все пак се предвиждат някои изключения за конкретни агрономични принципи. Например толерантността към хербициди, както и отделянето на инсектицидни вещества ще означава автоматично прехвърляне на растенията към втората категория.

Растенията в нея ще бъдат регулирани по-стриктно. Освен семената, етикети ще носят и продуктите, получени от такива растения, като етикетът ще съдържа информация за всички агрономични признаци, в които е имало намеса. Така Съветът цели да гарантира, че потребителите ще имат информация за извършените редакции. Важно решение е да се даде възможност на държавите членки да изберат да не отглеждат растения, получени чрез по-сериозни намеси.

Пречките и надеждите пред CRISPR
Като всеки инструмент, CRISPR може да бъде използван и за спорни цели. Но възможностите, които предлага, са много обещаващи. Някоя от модификациите му или нова подобна система ще бъде в основата на…
Научни новини: Генни технологии, астронавти, химически фосили и климатични промени

Интересно е, че националните органи ще проверяват дали растенията принадлежат към първата категория. За това може би ще се разчита и на организациите, регистриращи новите растения, защото намесите в общия случай са неразличими от случайно настъпили мутации, които се срещат в природата, и от традиционния селекционен процес, което е основата на принципа на еквивалентност. Когато тези растения вече са разпределени в първа категория (например регистрирани като сорт), потомството им няма да бъде проверявано впоследствие, подобно на процедурите за новите сортове в момента.

Една от особено важните теми по отношение на новите регулации е защитата на интелектуалната собственост. Намирането на баланс между различните интереси може да се окаже трудно, но е от изключителна важност за постигане на целта на предложението, а тя е нов подем в развитието на биотехнологичния сектор в Европа. Една от големите тънкости ще бъде да се осигурят равни условия за по-малките компании, така че пазарът да не се консолидира в корпорациите, които имат основен контрол върху него в момента.

Съветът и Парламентът ще създадат експертна група по патентоване, която ще се състои от експерти от всички страни членки, с цел разглеждане на въздействието на патентите. Една година след влизането в сила на регламента Комисията ще публикува проучване на въздействието на патентоването върху иновациите, наличието на семена за земеделските стопани и конкурентоспособността на сектора на растителната селекция в ЕС. 

За финализиране на процедурата предварителното споразумение трябва да бъде одобрено от Съвета и Парламента. Това ще открие много нови възможности пред европейските селекционери, като същевременно ще гарантира безопасността на потребителите.

Неочаквано завръщане

Графикът на астронавтите, които пребивават в Международната космическа станция (МКС), се подготвя изключително стриктно и в него няма много място за импровизации. Наред с всекидневната им програма, датите за пристигане на станцията и тръгването от нея се планират месеци предварително. Въпреки това понякога се налагат промени – например удължаването на престоя на Суни Уилямс и Бъч Уилмор, които прекараха 286 вместо планираните 8 дни поради технически проблеми с капсулата, която трябваше да ги върне.

Научни новини: Титанови сърца, генни редакции, биополимери и една космическа одисея с щастлив край
Както сме отбелязвали, научните новини са по-добрите новини. Този път Михаил Ангелов ни разказва за човека с титаново сърце, за яванските макаци и за възможната нова употреба на целулозата, а за финал имаме щастливия край на историята с космокрушенците Суни Уилямс и Бъч Уилмор.
Научни новини: Генни технологии, астронавти, химически фосили и климатични промени

Промени са настъпвали и в предвидени космически разходки извън станцията вследствие на здравословни проблеми, така че когато NASA първоначално съобщи за отлагане на следващото излизане на астронавтите, нямаше особена тревога за тяхното състояние. От МКС трябваше да излязат двамата американци от екипаж 11 на SpaceX – Зина Кардман и Майк Финк. Не се предвиждаше участие на японеца Кимия Юи и руснака Олег Платонов. 

Но ситуацията бързо се превърна в безпрецедентна, когато на пресконференция ръководителят на NASA Джаред Айзъкман съобщи, че един от членовете на екипаж 11 има нужда от медицински преглед, който няма как да бъде извършен на борда на МКС. От Агенцията запазиха името на астронавта и естеството на проблема в тайна, но Айзъкман го определи като „сериозен здравословен проблем“, уточнявайки, че пациентът „вече [е] стабилен“. Това предизвика спекулации от любителите на Космоса, които започнаха внимателно тълкуване на официалните изявления в търсене на следа какво точно се е случило и с кой астронавт.

Потенциална улика беше чут разговор на Юи, в който той иска да говори с медицинско лице, питайки конкретно за хирург. Но това не даде задоволителен отговор на мистерията, тъй като Юи не бе част от планираните ремонтни дейности извън станцията. От Японската агенция за аерокосмически изследвания (JAXA) също съобщиха, че той е здрав.

Така седмица след съобщението капсулата „Дракон“ с екипажа се приводни успешно в бреговата ивица на Калифорния, близо до Сан Диего. По време на живото излъчване астронавтите изглеждаха в добро състояние, без видими здравословни проблеми. Четиримата прекараха една вечер в местна болница, след което се завърнаха в Хюстън за разбор на мисията и среща със семействата си.

Един от интересните коментари, направени от главния медицински директор на NASA д-р Полк, беше, че според математическите анализи на Агенцията вероятността за подобни събития е средно едно на всеки три години. Дали това, че се случва за първи път в рамките на 25 години, е следствие от доброто общо здраве на хората, подбрани за астронавти, или е чист късмет, не е ясно.

Вследствие на извънредната ситуация с екипаж 11, на станцията остана намален състав от други трима астронавти, само един от които американец. Той трябваше да поеме грижите за всички американски модули – вариантът не е оптимален, но не застрашава нормалното функциониране на МКС. Въпреки това в NASA и SpaceX веднага започнаха да разглеждат възможността за изстрелване на следващите астронавти по-рано от предвиденото в средата на февруари. Те вече са в карантина и се подготвят за пътуване след 11 февруари.

Случилото се показва, че дори и при отлично планиране, с каквото е известна NASA (на борда на МКС има сериозен набор от медицинско оборудване), възникват извънредни ситуации, които не могат да се разрешат в орбита. С оглед на предвижданото засилване на човешкото присъствие в Космоса, здравето на астронавтите ще става все по-важен фактор за космическите агенции. Това беше и едно от нещата, на които обърнаха внимание астронавтите на пресконференцията след завръщането си. 

Стъпка към това е планираната за тази година мисия до Луната – „Артемис 2“, в която четирима астронавти (трима от САЩ и един от Канада) ще обиколят спътника ни, както в мисията „Аполо 8“. Целта е да се изпитат ракетата носител SLS и апаратът „Орион“, в който ще пътува екипажът. Както при ранните мисии „Аполо“, орбитата на „Орион“ ще е на „свободно връщане“ към Земята. Тя има форма на осмица и използва гравитационната сила на Луната, така че дори да възникне проблем с двигателите, капсулата да се завърне на планетата. Плановете са ракетата да бъде изстреляна след началото на февруари, но точната дата все още не е ясна.

Еволюционни изненади

Как и кога са възникнали по-сложните форми на живот, е въпрос, на който най-вероятно няма да получим конкретен отговор. Тъй като става дума за малки организми, които нямат кости или черупки, откриването и работата с техните фосили (или сходни отпечатъци) са изключително трудни. За справяне с проблема са разработени различни подходи, всеки със своите предимства и недостатъци.

Един от тях е търсенето на „химически фосили“ – вещества, които се отделят само от отделен тип организми. Сред най-често използваните са стераните, които са стабилни форми на стеролите (вид липиди, най-известният от които е холестеролът). При определени условия на средата те се запазват в скалните пластове, което дава възможност да бъдат извлечени, а после според тяхната структура да се определи от какъв организъм идват. 

Именно по този начин са открити следи от родственици на роговите водни гъби, живели преди Камбрийския взрив. Потвърждението идва от стерани, съдържащи 30 и 31 въглеродни атома – сравнително редки форми, характерни за този тип водни гъби. Това ги прави едни от най-ранно известните ни животни, като почти сигурно те са живеели в океана. Според авторите на изследването, освен доказателство за съществуването на тези животни още през неопротерозоя, това показва полезността на метода за проследяване на появата и разпространението на животните през епохите.

Научни новини: Генни технологии, астронавти, химически фосили и климатични промени
Снимка: Albert Kok, Източник: Wikimedia / CC BY-SA 3.0

Въпреки че този подход е обещаващ, съществува възможност за получаване на грешни резултати вследствие на замърсяване или изненади в биологията на неизследваните видове. Поради това някои учени предпочитат използването на т.нар. молекулярен часовник. Методът се основава на допускането, че мутациите в организмите се натрупват сравнително линейно и така, като се сравняват ДНК на няколко организма, може да се определи еволюционното разстояние между тях.

Именно по този начин ново изследване ни връща още по-назад във времето в опит да се открие повече информация за еволюцията на ранните еукариотни клетки (тези с обособено ядро). Анализът е извършен върху голям набор геноми, а фокусът е върху разликите между прокариотите (без ядро) и еукариотите. Според получените данни в периода мезоархай – палеопротерозой (между 3 и 2,5 млрд. години) еукариотните клетки вече са съществували, при това със сложен клетъчен апарат. Освен ядро те са имали цитоскелет и различни мембранни структури, през които се е извършвал транспорт на вещества. В по-късен момент те са получили и друг важен органел – митохондриите.

Това са структури, в които протича процесът на клетъчно дишане – при него с помощта на кислород въглехидратите се превръщат във въглероден диоксид, вода и енергия, която организмът може да използва за своите нужди. Те са важен фактор за развитието на по-сложни форми на живот и са популяризирани с фразата „митохондриите са електроцентралите на клетката“.

Към момента е приета „ендосимбионтната теория“, според която митохондриите са едноклетъчни организми, погълнати от еукариотна клетка. Вместо да бъдат „изядени“, те са останали в симбиоза с нея: получават хранителни вещества, а гостоприемникът – значително количество енергия. Въпреки че не е пряко доказана, теорията е подкрепена от много информация. Поредното парче от пъзела идва от това изследване, описващо съществуването на сложна еукариотна клетка, в която се асимилира предшественикът на митохондриите.

Климатичните промени накратко

Температурните рекорди продължават.

Данни от услугата за изменение на климата на европейската програма „Коперник“ показват, че температурите през последните 11 години са най-високите измерени досега, с рекорди през последните три. На първо място е 2024-та, последвана от 2023-та, която е на пренебрежимите 0,01℃ от 2025-та. Очакванията са, че тази година няма да бъде много по-различна и ще продължи тенденцията за затопляне. Сходна е ситуацията и в океаните, които са погълнали рекордно количество топлина в последната година. Това е предпоставка за по-непредвидими промени в глобалния климат, които могат да се изразяват и в по-засилени валежи и необичайни застудявания. Отделените емисии продължават да се покачват въпреки различните мерки, които се предлагат. Част от емисиите най-вероятно могат да се обяснят с растящите електрически мощности, нужни за новите ИИ изчислителни центрове.

Комарите стават все по жадни за човешка кръв.

Откриването на човешка кръв в насекоми, събрани от защитена местност в бразилската джунгла, е изненада. Изглежда, с намаляването на видовия състав в екосистемите насекомите се принуждават да търсят нови източници на ценния ресурс. Това се среща дори при видове, които обикновено предпочитат само един вид – изводът е, че те изпитват трудности да откриват обичайните си гостоприемници. 

Освен до промяна в хранителните им навици това може да доведе и до увеличаване на броя им – за връзката между изсичането на горите и намножаването на маларийните комари се знае от повече от 15 години. Данните ясно показват как нарушаването на хабитатите рязко повишава риска от разпространяване на познати или нови заболявания. 

Според авторите на изследването е нужно да се обособят системи за наблюдение, с които да се следи храненето на комарите, а информацията от тях да се използва за по-добър контрол на популациите им и за дейности по възстановяване на засегнатите екосистеми.

Изненада от Ледената епоха.

В стомаха на млад вълк, попаднал в сибирския пермафрост преди около 14 400 години, е открито парче месо, което според ДНК анализа принадлежи на вълнест носорог. Геномът на носорога показва, че местната популация към момента е била достатъчно голяма и няма признаци за близкородствено чифтосване.

Научни новини: Генни технологии, астронавти, химически фосили и климатични промени
Рисунка на вълнести носорози, открита в пещерата Шове в Южна Франция. Според учените пещерата е обитавана преди повече от 30 000 години. Снимка: Claude Valette Източник: Wikimedia / CC BY-SA 4.0

Липсата на следи от намаляване на популацията най-вероятно означава, че тя е изчезнала сравнително бързо. Времево това съвпада с периода на междинно затопляне Bølling–Allerød (14 700–12 900 години), през който температурите в Северното полукълбо се повишават рязко с около 2–3℃. Това води до съществена промяна и за повечето мамути, както и за северноамериканската мегафауна. Освен чисто техническото постижение да се секвенира геном от остатъци, открити в стомаха на животно, живяло през Ледниковата епоха, изследването показва колко пагубни могат да бъдат резките промени в глобалните температури, особено за видове със специфичен ареал и трудности при адаптирането.


Веднъж месечно Михаил Ангелов – биолог, агроном и любим нърд от нашия екип, ни представя най-интересните скорошни новини от различни сфери на науката и обяснява защо тези постижения са толкова значими за света и човечеството. Или най-малкото – любопитни и забавни.

Зимна песен

Post Syndicated from Тоест original https://www.toest.bg/zimna-pesen/

Зимна песен

Газиш в преспи сняг и кал,
севернякът хапе,
лед реката е сковал,
а носът ти капе.
Зимата без зрънце жал
блъска и бедняк и крал,
селяни и папи.

В шал увит, студа кълнеш,
мръзнат ти ушите,
вежди и брада са в скреж,
дебнат те бронхити.
Надалеч от хора беж,
вчера здрав – днес палят свещ,
болестта не пита.

По обед още пада здрач,
три пръста лед върху перваза,
кашлюка всеки минувач
и пръска със зарази.
Върви си, музо, с твоя плач
и с твоя скръбен тъжен грач,
че лютнята ги мрази.

Със другар и кръвен брат
злата зима ще забравя –
още съм и здрав, и млад,
чаши пресушавам,
студ и мраз не ще ме спрат,
тази течна благодат
като огън сгрява.

Ана Мария Ленгрен, 1793 г.
превод от шведски Мария Змийчарова


Ана Мария Ленгрен (1754–1817) е шведска поетеса и един от ключовите автори на Шведското просвещение. Член на Гьотеборгското кралско научно-литературно дружество и на Utile Dulci, научно-музикална общност, която се смята за предшественик на Шведската академия. В поезията си често пародира жанра на пасторала и баладата, използва сатира, сарказъм и ирония и съчетава трезва снизходителност към слабостите на хората с критики срещу класовото разделение в Швеция, привилегиите на аристокрацията и незавидното положение на умната и образована жена.

Мария Змийчарова (р. 1983) превежда поезия, проза и драматургия от английски, шведски, датски и норвежки. Нейни поетични преводи са включени в сборниците „Голямата загадка“, избрани стихотворения от Тумас Транстрьомер („Жанет-45“, 2013) и „Антология на датската поезия XVII–XXI в.“ (Университетско издателство „Св. Климент Охридски“, 2025).


Според Екатерина Йосифова „четящият стихотворение сутрин… добре понася другите часове“ от деня. Убедени, че поезията държи умовете ни будни, а сърцата – отворени, в края на всеки месец ви предлагаме по едно стихотворение. Защото и в най-смутни времена доброто стихотворение е добра новина.

Announcing the AWS Digital Sovereignty Well-Architected Lens

Post Syndicated from Swapnonil Mukherjee original https://aws.amazon.com/blogs/architecture/announcing-the-aws-digital-sovereignty-well-architected-lens/

As organizations accelerate cloud adoption, meeting digital sovereignty requirements has become essential to build trust with customers and regulators worldwide. The challenge isn’t whether to adopt the cloud—it’s how to do so while meeting sovereignty requirements, using a multidisciplinary approach.

Even though requirements vary by geography, organizations commonly address them through technical and operational controls applied consistently at scale. Controls address specific needs related to data residency, data protection, data privacy, access control, and resiliency. These controls also map to security and privacy baselines plus industry regulations. Examples include German BSI C5, UK GDPR, EU DORA, and newer regulations such as the EU AI Act.

Beyond technical and operational controls, in some jurisdictions, customers might have to align with interoperability and portability mandates requiring the adoption of specific infrastructure components, technology standards, and locally sourced software components.Partners and customers have said that they understand how AWS is sovereign-by-design, but they want to go further and apply those same design principles and best practices to their own workloads. Today, we’re introducing the AWS Digital Sovereignty Well-Architected Lens, a framework that helps you design, build, and operate workloads that are sovereign, compliance-aligned, and auditable while being survivable, interoperable, and portable across a range of deployment options.

The Digital Sovereignty Lens is available in the form of a whitepaper and as a custom lens file from AWS Well-Architected custom lens GitHub repository.

The AWS Well-Architected Framework

The AWS Well-Architected Framework is a structured assessment tool divided into six pillars. Each pillar is organized into a hierarchy of themes, questions, and best practices. Best practices describe the benefits of adoption. They also list actionable implementation guidance and implementation steps. The Digital Sovereignty Lens follows the same structure and is meant to complement the Well-Architected Framework. It presents additional questions and best practices designed to improve the digital sovereignty posture of your workloads.

How is the lens organized?

The Digital Sovereignty Lens outlines more than 60 best practices spread across the four pillars of Operational Excellence, Security, Reliability, and Performance Efficiency. It does not add new best practices to the Cost Optimization and Sustainability pillars. You should use existing best practices already defined in the Well-Architected Framework under those two pillars.

Each best practice in the Digital Sovereignty Lens maps to a specific question of the form “How do you do X?” For example, for the question “How do you design your workload for continuous auditability?”, the associated best practices include planning and preparing for audits, and automating evidence collection and reporting.

Underpinning the questions and the associated best practices are a set of design principles. The design principles list the key challenges organizations face and document steps required to address those challenges.

Design principles

The Digital Sovereignty Lens outlines five core design principles that engineering teams can adopt to address sovereignty requirements. These design principles build on top of secure by design and privacy by design principles. The principles and the key areas they address include:

  • Apply standardized enforceable controls – Rather than relying on spreadsheets and manual enforcement, apply standardized compliance-aligned controls using policy as code and compliance as code practices. Automated controls leave no room for interpretation and reduce the risk of inconsistent implementations across teams.
  • Establish adequate security posture in line with data sensitivity levels – Apply access controls, build data perimeters, and protect data at rest, in transit, and during compute. Calibrate controls to data sovereignty requirements—such as residency and export controls—to maintain business agility without compromising security or compliance.
  • Design for continuous compliance – Point-in-time certifications are just snapshots. Integrate compliance checks throughout your software development lifecycle and collect evidence required for audits on a continuous basis. When compliance is built in from the start, you reduce compliance violations and maintain a consistently audit-ready posture.
  • Design for interoperability and portability – Design workloads for interoperability and portability from the start. Build abstractions into your code and configurations, then test across multiple environments to verify consistent functionality.
  • Design for survivability – Document system dependencies and fault isolation boundaries. Align your recovery objectives with business continuity goals, define what a minimum restorable service looks like, and test your recovery paths regularly.

Best practices

The following diagram provides a snapshot of some of the best practices in the lens.

Trust and transparency are key attributes of a sovereign workload. Trust is achieved through verification, not through claims. The Operational Excellence pillar focuses on best practices that lead to continuous compliance and auditability, improving verifiability. The Security pillar provides best practices that lead to greater visibility of controls and recommends independent Regional operations. The Reliability pillar addresses the need to achieve a balance between sovereignty and survivability by carefully considering how you design workloads for automated recoverability and protect data sovereignty. The Performance Efficiency pillar focuses on adopting standard protocols to optimize networking and compute in alignment with regulatory needs.

Who should use this lens?

The following users can benefit from this lens:

  • Policy-makers and regulators – Use the sovereignty outcomes and general design principles as described earlier in this post to develop jurisdictional and sectoral digital sovereignty models.
  • Technical leaders (CxOs and enterprise architects) – Use the lens as an input while outlining enterprise architecture strategies, or towards making objective technology decisions.
  • Security and compliance consultants – Use the design principles and best practices to develop privacy and security policies that can subsequently be translated into technical and operational controls.
  • Builders – Use the lens as a key input while designing, developing, and validating sovereign-ready workloads.
  • Audit professionals – Use the implementation steps described in the best practices to understand possible sources of evidence and artifacts they should seek during security and privacy audits.
  • Governance risk and compliance professionals – Use the lens to understand and document the overall risk landscape. Develop per-application risk profiles and manage risks over time.

Your path to sovereign-ready workloads

The Digital Sovereignty Lens is part of a wider effort at AWS to equip our customers with comprehensive guidance and tools required to address their sovereignty needs. We recently introduced the AWS European Sovereign Cloud: Sovereign Reference Framework (ESC-SRF). Customers and partners can use the ESC-SRF (available from AWS Artifact) as a foundation upon which they can build their own complementary controls when using the AWS European Sovereign Cloud. This can also be used as supporting documentation as part of audits showing how AWS meets sovereignty requirements across dimensions such as independence, operational control, data residency, and technical isolation.

During and leading up to AWS re:Invent 2025, we announced several new capabilities designed to increase trust, bring more transparency, and provide customers with more control and choice. They include the Nitro Isolation Engine, IAM Policy Autopilot, the Landing Zone Accelerator on AWS Universal Configuration, Controls Dedicated experience in AWS Control Tower, and productivity tools such as the CloudFormation IDE Experience.

We are not stopping here. We look forward to your feedback as we continue to improve the lens content. We will also continue to develop decision guides, reference architectures, prescriptive guidance, and solution accelerators that embed and codify the best practices described in the lens.


About the authors

The collective thoughts of the interwebz