Васил Левски и тарикатлъкът

Post Syndicated from Димитри Захов original https://www.toest.bg/vasil-levski-i-tarikatlukut/

Васил Левски и тарикатлъкът

„Бизнес идея. Дай да направим филм за Левски. Киното, знам, че е скъпо, но виж к’во приложение намерих. Пишеш му к’во искаш с думи и ти прави видео. Срещу не’кви къси кинти месечно. Смятай. С това ще го направим. И ще кажем, че е с кауза. Билети може да не продадем, но слушай – ще пишем на всяка фирма в България! Ще го представим като благотворителност и ще им искаме по 500 евро, защото просвещаваме децата. Кое не е гениално?“ 

Представям си, че нещо такова се е чуло в главата на някой от членовете на рап-бизнес дуета „Зипо и Слаш“ наскоро. Те са продуценти на „Агенти на времето: Васил Левски“ – филм за историческата личност, чийто трейлър изглежда напълно генериран от изкуствен интелект. Сюжетът представя Апостола, който, бидейки връзка между миналото и настоящето, мотивира група деца да пазят историческата памет. Авторите на продукцията я описват на сайта си (който впрочем също има всички признаци на генериран с ИИ) като „първия български анимационен филм със световен потенциал“. Те твърдят, че филмът вече е привлякъл над 100 корпоративни партньора. Обявената дата на излизане в кината е 11 септември 2026 г.

България на картата на… анимациите?

Дванайсетокласникът Димитри Захов дебютира в „Тоест“, за да ни разкаже де е България във вселената на анимационните филми. Той не само знае много по темата, ами е взел и интервю от известния актьор Юлиан Костов, който… Но хайде да не издаваме най-интересното още преди да сте прочели статията.

Тази продукция кара лентата на Максим Генчев за Левски да изглежда като холивудски шедьовър, правен с грижа и обич. И също ни кара да си зададем сериозни въпроси за границата между бизнес и кино.

Нищо от това не е изкуство, а още по-малко благородна кауза.

На 8 юли дистрибуторът „Александра Филмс“ публикува трейлър, който не съдържа нито едно име на автор, режисьор или аниматор, тъй като вероятно всички се казват Чатджи Пити. 

В него чуваме роботизирани гласове, зле синхронизирани с героите, и виждаме един специфичен, лъскав псевдо-Pixar-ски стил, който ИИ моделите обичат. Забелязват се и характерни неточности, например промени във фона в последователни кадри и сериозни разлики в плавността на движенията в различните сцени, както и разминаване между обект и фон. 

Веднага след анонса се надигна публично недоволство – редица медии критикуваха филма, а над 5000 души подписаха петиция „Забрана на филми създадени изцяло с изкуствен интелект в българските кина“. Това накара „екипа“ зад продукцията да публикува „официална позиция“, която още в увода си вкарва… хомофобия:

Съвременната световна анимация свободно представя най-различни теми, ценности, семейни модели и романтични отношения, включително любов между хора от един и същи пол. Приемаме това като част от творческата свобода на създателите, но искаме да дадем възможност на българските деца да гледат българска анимация, която да носи български морално и семейни ценности.

В критичния дискурс около филма в интернет изобщо не е засягана тази тема. В петицията няма искане Левски да бъде куиър. Изглежда, целта на създателите му е просто да се позиционират като герои в нишата на консервативните родители и учители, чиито мнения оказват влияние върху децата. 

Зад филма стоят реални: сценарий, драматургия, режисьорски решения, визуална разработка, монтаж, музика, озвучаване, постпродукция и финален човешки творчески контрол. Изкуственият интелект е инструмент в производството, а не автор или заместител на творческата отговорност,

твърдят създателите на филма. Подозрително е обаче, че два месеца преди неговата премиера все още не знаем името на режисьора, взел съответните решения, а познаваме само продуцентите-рапъри-боксьори-предприемачи. Освен това едва ли някой безпристрастен зрител, притежаващ базова способност да разпознава ИИ, би определил озвучаването в трейлъра като реално, което автоматично превръща тази част от становището в лъжа.

На всичко отгоре инициаторите на филма тепърва си търсят сценарист. „Много добър сценарист – както се казва във видеообявата, – който е готов веднага, веднага да се включи в едно предизвикателство.“

Като допълнение към официалната позиция Стоян Стоянов – Слаш публикува и своя собствена:

Всички лелки и чичаци, които живеят в XX век, много ви се моля, оставете детските филми на децата. Вие нямате думата.

Алекс, който започва петицията срещу филма, сподели с мен, че е на 16 години. По мои наблюдения, вълната с критики към филма е водена от представители на Gen Z – поколението, което (заедно с милениълите) сме гледали най-много анимации по кината. Истина е, че вече не сме хлапета, но вероятно все още не попадаме в категория „лелки и чичаци“.

Как социалните мрежи измориха Gen Z

Пристрастени ли са младите към социалните мрежи? Според Димитри Захов Gen Z все повече се отдръпва от социалните мрежи, защото осъзнава тяхното безсмислие. Димитри повдига и въпроса за отговорността на инфлуенсърите в днешното комерсиализирано интернет пространство.

Как се финансира филмът?

„Кино Академия за Таланти“ (оригиналният правопис е запазен – б.р.) е продуцентската компания на дуото. Техните предишни „доказани успехи“ са филмите „Русалки“, „Мърда Бойз – Махленска класа“ и „Един грам живот“. Искаше ми се това да е списък с измислени заглавия, но не е – вторият филм наистина съществува, а първият е инфлуенсърска продукция, счупила рекордите за родна премиера в боксофиса. Въпреки подчертано сексуализирания хумор в предназначеното за деца произведение, а може би тъкмо заради него. 

В сайта си за филма „Агенти на времето: Васил Левски“ Зипо и Слаш се опитват да привлекат „партньори“, които да дарят средства, за да бъде прожектирана лентата на деца безплатно. В официалната си позиция те пишат: 

Възможността компании да осигуряват БЕЗПЛАТЕН достъп до филма за деца, включително за деца в неравностойно положение, е допълнителна социална инициатива, а не основният финансов модел на продукцията и смятаме това за отговорно социално поведение. 

Представители на бизнеси в страната обаче алармират в социалните мрежи, че от екипа на филма се свързват по телефона с български фирми, използвайки данни от Търговския регистър. Представят им каузата като възможност за популяризиране на образа на Левски по по-достъпен начин и за възпитаване на родолюбие у най-младите. Предлагат им различни ценови пакети за даряване на средства за благотворителна прожекция в училище по техен избор. 

Корпоративната социална отговорност е нещо важно и полезно, но в този случай според мен става въпрос за опит за злоупотреба с добронамереността на фирмите. По дефиниция подобни средства би трябвало да се използват за дарения за социално отговорни каузи и благотворителност. Тук обаче говорим просто за предварително закупуване на билети – 500 евро за 70 билета е стойността на най-малкия дарителски пакет – за частни прожекции на филм, създаден с ИИ. С помощта на този пакет може да се мотивират 70 деца да мислят повече за миналото ни, но може и да не се мотивират – по-вероятно е просто да се подиграят с филма, тъй като е ИИ продукция с качеството на brainrot клипче. 

Освен това, ако съдим по досегашната практика на продуцентите, само няколко месеца или дори седмици след кинопремиерата филмът ще бъде качен в YouTube. Това ще позволи на всяко училище и всеки родител да го пусне на децата си, без да се налага фирми да плащат минимум по 500 евро. 

Кои са Зипо и Слаш?

Първият ми сблъсък с тези имена беше преди десетина години, когато беше модерно да се подиграваш на Сузанита – дъщерята на Орхан Мурад, тогава още непълнолетна. В едно популярно видео двамата рапъри се хвалят, че са имали интимни отношения с нея, когато е била на 14 години, което тя не отрича. И очевидно не се срамуват от видеото, защото качват откъс от него в собствения си YouTube канал. Те са родом от Стара Загора и са известни с парчета като „Кварталът на богатите“, „Допамин“ и „Дай му, мамо“. Въпреки опитите си да се брандират като „новото поколение рапъри“, които носят костюми вместо дънки, една от най-популярните им лирики, която припомнят наскоро, е „два чифта цици, шмъркат наркотици, карам AMG, авери с BMW осмици“.

В днешно време фокусът им се е изместил от музиката към бизнеса. Впечатление прави профилът на Стоян Стоянов в Instagram. В свое видео той изразява позицията си по отношение на съгласието в отношенията между мъж и жена: 

Мъжът, който пита жената, чака потвърждение. Този мъж вече не е мъж, той е оставил избора в женските ръце. Този мъж, който вече не е мъж, той не иска да рискува, няма да е успешен нито с жените, нито в бизнеса. 

От видеата му става ясно, че освен с продуцентство се занимава и с други дейности, като продажба на парфюми и недвижими имоти. Част от клиповете му започват с „Ако искаш да правиш по 4–5–6 хиляди евро на месец…“ и завършват с „пиши ми“. Въпреки тези примамливи обещания публикациите му обикновено се „радват“ на мижав интерес – коментарите се броят на пръсти, а броят на харесванията е скрит. 


Това е перфектното олицетворение на интернет hustle културата. Манталитет на стремеж към бързо забогатяване, при който няма никакво значение какво точно правиш, стига да го брандираш като успех в Instagram. Искаш да си известен с това, че си богат (и известен). Днес продаваш парфюми, утре – апартаменти, а вдругиден – Васил Левски. Всичко е просто поредният side hustle1, а понятия като занаят и стойност на труда са подробности.

ИИ в анимацията и киното

Навлизането на ИИ в киното е актуална тема не само у нас. През юни 2026 г. Google и филмовото студио A24 сключиха неексклузивно партньорство на стойност 75 млн. долара за съвместно разработване на ИИ инструменти за киното. Изследователи от Google DeepMind ще си сътрудничат с творческите екипи директно на снимачната площадка, за да тестват технологии като видеогенератора Veo и нов асистент за разкадровки (storyboards). Много фенове и автори изразиха разочарование поради опасенията, че намесата на ИИ ще подкопае репутацията на A24 като бастион на автентичното авторско кино.

Друг интересен казус е този от 2025 г., когато Ейдриън Броуди спечели „Оскар“ за ролята си на Ласло Тот в „Бруталистът“. Оказва се, че по време на постпродукцията е използван генеративен ИИ (софтуерът Respeecher), за да се изглади унгарският акцент на част от актьорите, включително и на Броуди. Това става ясно едва след връчването на наградите и кара критици и фенове да се запитат дали отличието е заслужено

​(Да, вече и в актьорското майсторство има допинг скандали.)

Недоразумението „Бруталистът“

Може ли филм, номиниран за „Оскар“, да прилича на създаден от изкуствен интелект и да има твърде фриволно отношение към реалностите, за които се отнася? Според Анета Василева може. А филмът е „Бруталистът“.

Филмите, генерирани стопроцентово от ИИ, също започват да навлизат. Тази година на филмовия пазар в Кан (Marché du Film) беше представен Hell Grind – 95-минутен приключенски екшън, изцяло генериран от ИИ. Той е дело на стартъпа Higgsfield AI, който го е създал само за две седмици с бюджет от 500 000 долара (като 80% от сумата е отишла за изчислителна мощност), за да демонстрира софтуера си за поддържане на визуална последователност между кадрите. За постигането на реалистична визия е използвано изключително детайлно задаване на текстови команди (средно по 3000 думи на кадър).

Подобни филми не се приемат добре от кинообщността, но често постигат успех в боксофиса. Въпреки ниската си оценка от 1.9/10 в IMDb, китайският анимационен филм Chong Ju Zhi Lu (2025), генериран изцяло с ИИ, досега е събрал приходи от 2 млн. долара. В него обаче ИИ анимацията почти не може да бъде различена от класическата, нещо, което изобщо не може да се каже за трейлъра на „Агенти на времето: Васил Левски“.

Изкуственият интелект – творец или терминатор?

Александър Драганов рефлектира върху изкуствения интелект през призмата на опита си като автор на фентъзи, който иска да види героите си нарисувани по начина, по който си ги представя. И за да е пълна картинката, той възложи на ИИ и заглавното изображение на тази статия.

Публичното поведение на Иво Андонов от Temu и Мегаум, прощавайте, Зипо и Слаш, предизвиква асоциации с английската дума grifter, която е синоним на дребен тарикат или шмекер. Това е човек, който разчита на тънки измами, схеми или „врътки“, за да печели. Надявам се никога да не се превърна в нещо такова – да пропагандирам „ценности“ като сексизъм и хомофобия и да ценя високия марж на печалбата повече от националните герои.

Такива експерименти следва да бъдат наказани от зрителя –

крайно време е да покажем, че обществото има гръбнак. Най-добрият начин за това е да се дава гласност на ситуацията, за да разберат повече хора какво се случва, и да изразят категорична позиция. Така и по-малко от фирмите, на които продуцентите на „Агенти на времето: Васил Левски“ звънят, ще станат жертва на сладкодумието им и ще повярват в „добрата кауза“. И разбира се, по-малко хора ще купят билети и ще гледат филма. В системата, в която живеем, единственият начин да накараме хора като „създателите“ на този „филм“ да се откажат е, като го направим непечеливш. Подобни бизнес идеи са добри на хартия, но в реалността наглостта има граници, които трудно можеш да прекрачиш, без да разгневиш хората.

1 Странична работа за допълнителен доход. – Б.р.

End-to-End Encryption and “Going Dark”

Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2026/07/end-to-end-encryption-and-going-dark.html

New paper: “Encryption and Globalization 15 Years Later: End-to-End Encryption and the Third Round of the ‘Going Dark’ Debate“:

Abstract: This Article updates and expands on 2012 research on encryption and globalization, analyzing what the authors call “Round 3” of the Going Dark Debate: the current controversies over end-to-end encryption (E2EE). Governments around the world have proposed, and in some cases enacted, laws limiting E2EE for law enforcement and national security purposes.

This Article explains the underlying technologies and market developments for a law and policy audience to assess those proposals critically. The Article proceeds in three parts tracking three rounds of the Going Dark Debate. Round 1 covers the Crypto Wars of the 1990s, when U.S. export controls on strong encryption ultimately fell in 1999. Round 2 covers the period roughly 2010 to 2015, when encryption-in-transit became widespread but lawful access remained available through cloud providers, giving rise to what the authors called a “golden age of surveillance” rather than a period of going dark. Round 3 addresses the current debate over E2EE, where no entity between sender and recipient can read the plaintext.

The Article’s first major contribution is identifying five technically distinct scenarios for how E2EE operates in practice, each with different implications for lawful access. These scenarios reveal a substantial gap between the assumption that E2EE categorically blocks lawful access and the reality of how communications are sent and received. Second, the Article shows that E2EE is not limited to messaging; instead, it is embedded throughout the modern technology stack, including in Transport Layer Security, Secure Shell, Virtual Private Networks, and Zero Trust Architecture, the last of which is now legally required under U.S. and EU law. Any law broadly limiting E2EE would thus have severe serious consequences for cybersecurity, commerce, and government operations. The Article concludes that the two key lessons from Round 2—the least trusted country problem and the golden age of surveillance—remain true in Round 3, and that new government claims for restricting effective encryption deserve great skepticism.

From one club to a global movement: Celebrating 15 years of CoderDojo!

Post Syndicated from John McAtominey original https://www.raspberrypi.org/blog/from-one-club-to-a-global-movement-celebrating-15-years-of-coderdojo/

4 years ago I decided to start a new CoderDojo in my community. The logic was simple: to provide the best support I could to the CoderDojo community, I wanted to understand what it was really like to be a CoderDojo Champion. And so, with the help of local volunteers, Selby CoderDojo was born. We had an amazing response from the community, we’ve been running every month since then to meet demand, and we’ve been the catalyst for the launch of six other local clubs reaching hundreds of young people every month.

CoderDojos embrace fun, creativity, collaboration, and openness
CoderDojos embrace fun, creativity, collaboration, and openness

This month, Selby CoderDojo celebrated its 40th Dojo event. 40 opportunities for young people to come together, have fun, learn new skills and build new creations. 40 opportunities to see that moment a young person lets out a scream of joy, claps their hands, and jumps up and down when they turn on an LED for the first time. 40 opportunities for young people and parents to genuinely collaborate on a project, and 40 opportunities to see young people grow as they find their voice and proudly show off their new creations to a room full of people. When you create a space for young people to have fun and get creative with technology on their terms, there’s so much joy to see.

15 years of CoderDojo

This year we celebrate 15 years since the first-ever CoderDojo event in Cork, Ireland. I want to say a huge thanks to co-founders James Whelton and Bill Liao for starting a movement that embraces the power of non-formal education and continues to impact so many young people, including those right here in my community in Selby. We also owe a massive thank you to every Mentor, Champion, supporter, funder, parent, and of course every single Ninja past and present who have made CoderDojo what it is.

CoderDojo create opportunities to learn and get creative with tech for tens of thousands of kids
CoderDojo create opportunities to learn and get creative with tech for tens of thousands of kids

Today there are over 600 active CoderDojos running around the world, creating opportunities for tens of thousands of young people. CoderDojos are part of the Code Club movement, the world’s largest coordinated network of free coding clubs for young people, with over 10,000 Code Clubs meeting monthly.

Representatives from Dojos around the world took part in our global partners summit Raspberry Fields earlier this month
Representatives from Dojos around the world took part in our global partners summit Raspberry Fields earlier this month

Earlier this month we held Raspberry Fields, our first global partners summit in Cambridge. It was great to have representatives from Dojos around the world join in important conversations about the future of computing education and the impact of AI. Undoubtedly schools play a significant role in preparing young people for the future, but not every child thrives at or even attends school. Every conversation, panel discussion, and workshop at Raspberry Fields reminded me that the original CoderDojo approach — championing non-formal education and embracing fun, creativity, collaboration, and openness — is still immensely important. I’m really proud that these values remain a core part of CoderDojo and the wider Code Club movement today.

Continuing the mission

Raspberry Fields was a useful reminder that even in the age of AI, it’s imperative that we encourage and enable young people to learn to code. We need to help young people understand, question and shape the AI systems affecting their lives, and we need to think carefully about how we reach young people who can’t or don’t access school. We need even more clubs that will continue the mission that CoderDojo began.

The 2025 DojoCon event in the Netherlands welcomed our CEO Philip Colligan among its guests
The 2025 DojoCon event in the Netherlands welcomed our CEO Philip Colligan among its guests

Launching a CoderDojo is one of the most rewarding things I’ve ever done. I’m proud to be part of both CoderDojo and Code Club, and I’m proud that we continue to support all of our clubs, no matter what name they choose. If you’d like to join or launch a club in your community, head to the Code Club website to get started — I promise you won’t regret it!

Thank you to James, Bill, and everyone who has been part of the CoderDojo journey. Be cool!


PS For those of you reading this in the community in Ireland, where CoderDojo first began all those years ago, I can’t wait to hear your experiences and learn together in Athlone at Meet, Learn, Make this October.

The post From one club to a global movement: Celebrating 15 years of CoderDojo! appeared first on Raspberry Pi Foundation.

Normalizing NVIDIA Vera Benchmarks to AMD EPYC Turin A Framework

Post Syndicated from Patrick Kennedy original https://www.servethehome.com/normalizing-nvidia-vera-benchmarks-to-amd-epyc-turin-a-framework/

We go into a framework for normalizing NVIDIA Vera benchmarks from its latest whitepaper to some of AMD EPYC Turin’s other parts

The post Normalizing NVIDIA Vera Benchmarks to AMD EPYC Turin A Framework appeared first on ServeTheHome.

Building a serverless AI assistant at Pelago: concept to care in two weeks

Post Syndicated from Anton Aleksandrov original https://aws.amazon.com/blogs/architecture/building-a-serverless-ai-assistant-at-pelago-concept-to-care-in-two-weeks/

Healthcare organizations face a critical scaling challenge – how to maintain deeply personalized patient interactions as member bases grow, without overwhelming care teams or compromising quality. At Pelago, a digital health company specializing in substance use disorder support, the engineering team found a way to build an AI-powered solution to address this challenge using AWS services in just two weeks.

In this post, you will learn how Pelago used AWS serverless and AI services, such as Amazon Bedrock and AWS Lambda, to build and deploy an event-driven AI assistant. The result is a service that generates contextually aware suggested considerations for the care team. This system preserves the human-in-the-loop oversight that healthcare demands while removing months of traditional development work and overhead of managing complex infrastructure.

The challenge overview

Pelago is a digital clinic for substance use treatment that provides comprehensive support including 1:1 coaching, medication management, and behavioral therapy. It serves members across the US to support recovery journeys for alcohol, tobacco, stimulants, cannabis, and opioid use disorder, and adjacent behaviors often associated with substance use. The Pelago care team coaches members through substance use recovery. A single coach may hold active conversations with dozens of members at once. Each message a coach sends needs to reflect weeks of prior context and drafting that response manually from scratch takes time the care team doesn’t always have.

When the Pelago engineering team set out to build an AI assistant for the care team, they faced a set of interconnected constraints. Behavioral health conversations build over weeks and months. Coaches need to account for that history in every reply. An AI assistant that only understands the most recent messages isn’t useful here – it must grasp the full long-term conversation history. That depth of context is also why human oversight is non-negotiable. The system had to generate suggestions for Pelago’s care team, not automated responses. Every piece of feedback must be read, evaluated, and adapted by a human coach before it reaches a member.

Protected Health Information (PHI) requirements added another layer of complexity – data could not leave Pelago’s AWS environment. All AI integrations must operate entirely within existing Amazon Virtual Private Cloud (VPC) infrastructure with no exposure to the public internet.

Beyond compliance and clinical safety, there were also practical constraints. Care team members need information the moment they open a conversation but generating relevant content processing dozens, sometimes hundreds, of prior messages through a large language model. A long wait was not acceptable when coaches open dozens of conversations per shift.

The engineering team needed to deliver all this quickly with full audit trails and security controls in a highly regulated environment. They had to solve the problem of pre-generating contextual suggestions without blocking the user experience while maintaining the compliance posture.

Solution design: Event-driven serverless architecture

The Pelago team separated concerns using event-driven architecture. The care team needed suggested responses instantly when accessing the system but generating them synchronously in real-time blocked the user experience for tens of seconds because of LLM processing time. By treating each incoming member message as an asynchronous event, the system can fan out processing to independent consumers without coupling them to the message delivery path. A new consumer, such as the AI assistant, can be added without affecting existing components or code. And because each processing step runs in its own Lambda function, a spike in inference requests doesn’t affect message delivery or processing.

End-to-end solution architecture showing the event-driven flow from member messages through SNS fanout to AI suggestion generation and retrieval

Figure 1 — The full end-to-end solution architecture

The architecture uses Amazon Simple Notification Service (Amazon SNS) for message fanout and Lambda functions for processing. Here’s how it works:

  1. Members send messages through AWS AppSync, forwarded to a Lambda function.
  2. The Lambda function stores messages in an Amazon DynamoDB table.
  3. The Lambda function publishes messages to an SNS topic.
  4. SNS fans out messages to multiple Lambda subscriber functions, such as Metadata storage, Amplitude analytics, and Chat assistant responsible for AI-based suggested message generation.
  5. The Chat Assistant Lambda runs asynchronously. It retrieves the full conversation history from DynamoDB, invokes Amazon Bedrock to generate contextual suggestions, and stores the result in MySQL hosted on Amazon Relational Database Service (Amazon RDS). This flow happens in the background without blocking user experience and typically completing in under 10 seconds.
  6. When a care team member opens a conversation (often minutes or hours later), the request flows through Amazon API Gateway.
  7. A Lambda function retrieves pre-generated suggestions from MySQL.
  8. The front end displays the suggestion in under 100 milliseconds.

This pattern keeps message delivery, analytics, and AI generation decoupled. Each member’s PHI is processed separately and stays fully within the Pelago AWS boundary. A failure or spike in feedback generation for one member does not disrupt or impact processing for other members.

Because inference happens asynchronously in the background, the care team does not wait for LLM processing. Suggested messages are pre-generated, stored, and ready to use when a coach opens a conversation. This keeps retrieval times under 100 milliseconds regardless of how long the AI generation took.

This serverless architecture also provides organic scaling. Each Lambda function automatically scales horizontally based on current traffic – scaling up during spikes and back down when demand drops, with no pre-provisioning or scaling configuration required. Adding a new event-driven downstream capability, like the AI assistant itself, requires only a new SNS subscription with no changes to existing message-publishing or handling code.

Event-driven fanout with Amazon SNS

The foundation of the Pelago chat architecture is an SNS topic that acts as a message bus for conversation events. SNS is a fully managed pub/sub messaging service. When a message is published to a topic, SNS automatically delivers it to subscribed consumers in parallel. This means a single incoming message can trigger multiple independent processing steps simultaneously.

When a user or coach sends a message, the system publishes a standardized payload to the SNS topic, for example:

{
    "identityId": "085cdc3c-f223-419a-9c80-5535c9983549",
    "messageId": "7a4d2b8e-1c9f-4e3a-b5d6-8f2e1a3c4b5d",
    "sender": "user",
    "timestamp": "2025-07-15T14:32:18Z",
    "conversationId": "conv-abc123"
}

SNS delivers this event to four Lambda function subscribers. The Metadata Storage Lambda writes message metadata to MySQL for reporting. The Analytics Lambda sends events to Amplitude for product analytics. The Push Notification Lambda triggers mobile notifications for coaches. The Chat Assistant Lambda generates Assistant-based suggestions using Amazon Bedrock.

SNS topic delivering events to four Lambda subscriber functions for metadata storage, analytics, push notifications, and AI suggestion generation

Figure 2 — Using SNS for message fan-out and decoupled processing

This fanout pattern allowed the Pelago team to add the AI Chat Assistant feature with zero changes to existing message-handling code. The team simply created a new Lambda function and added it as an SNS subscription. The publisher doesn’t need to know how many consumers exist or what they do, so new capabilities can be built and deployed independently without risking regressions in the message processing path.

Async AI generation with Amazon Bedrock

The Chat Assistant Lambda handles computationally expensive AI generation. The function implements a multi-step workflow:

Chat Assistant Lambda workflow showing conversation history retrieval from DynamoDB, context formatting, Bedrock inference, and suggestion storage

Figure 3 — The chat assistant architecture and workflow

The first step is to retrieve conversation history. Behavioral health conversations can span dozens or even hundreds of messages over weeks, and the AI assistant needs all that context to generate a useful suggestion to Pelago’s care team. The function queries DynamoDB for previous messages in the conversation. The DynamoDB single-digit millisecond read performance means even lengthy conversations (50+ messages) are typically retrieved in under 20ms.

# Simplified pseudocode
conversation_messages = dynamodb.query(
    TableName='conversations-messages',
    IndexName='identityId-index',
    KeyConditionExpression='identityId = :id',
    ExpressionAttributeValues={':id': identity_id}
)

The next step is to prepare and format context for inference. The function transforms the retrieved messages structure into a conversation history format that provides Amazon Bedrock with full context, for example:

[User]: Hi, I'm struggling with cravings today

[Coach]: I hear you. Cravings can be really tough. What's happening right now that's making this moment difficult?

[User]: I'm at a party and everyone is drinking. I feel left out.

[Coach]: That's a really challenging situation, and it's completely understandable to feel that way...

[User]: I ended up leaving early. Feeling proud but also kind of sad.

After formatting the conversation, the Lambda function uses the Amazon Bedrock Runtime API to invoke Claude models. The prompt engineering focuses on empathy and validation – it helps the model acknowledge what the member is feeling rather than jumping to advice. It is tuned to maintain contextual continuity – picking up things the member mentioned in earlier messages instead of treating each exchange without prior context. It also steers the model away from false optimism or dismissive language and keeps suggestions short, more like a text message than an email. This matches how coaching conversations flow on the application.

response = bedrock_runtime.invoke_model(
    body=json.dumps({
        "anthropic_version": "bedrock-2023-05-31",
        "max_tokens": 4096,
        "temperature": 0.7,
        "system": "You are a supportive coach...",
        "messages": [{
            "role": "user",
            "content": f"""
Here is the conversation history:

<chatHistory>
{chat_history_string}
</chatHistory>

Provide the next coach message suggestion as plain text.
"""
        }]
    })
)

Measuring system performance and business impact

This entire flow, from SNS trigger to a suggestion stored in MySQL, typically completes in less than 4 seconds, well within acceptable processing time. When a care team member opens a conversation on the dashboard, the front end instantly retrieves pre-generated suggested messages. Total response time perceived by the care team is under 100 milliseconds.

The Pelago team went from technical designs to first production deployment in 2 weeks. Two days on architecture and model selection with the clinical team, three days building the core Lambdas, three days on integration testing and prompt refinement, and two final days on deployment and monitoring.

The system delivered strong early results. From the business perspective, response preparation times dropped 40% on average, and the care team rated 79.6% of AI suggestions as helpful, based on internal Pelago measurements. Operationally, using serverless services introduced no new overhead. There was no new infrastructure to manage, servers to patch, or scaling configurations to maintain. The architecture successfully handled an 8x message volume spike during a seasonal campaign without configuration changes.

Implementation details and key decisions

With the core event-driven architecture in place, the Pelago team made several implementation choices to satisfy healthcare industry requirements, handle traffic patterns unique to the application, and maintain reliability across the system.

PHI must stay secured

Pelago uses multiple AWS security features to maintain HIPAA eligibility while using AI models. One requirement is for PHI to never traverse the public internet. To address this, the Pelago team uses VPC endpoints for Amazon Bedrock, so model invocations stay within the private network. The Boto3 client in the Python Lambda automatically routes traffic through the private endpoint. Data is encrypted at rest on DynamoDB and RDS, service communications use TLS 1.2+, and IAM policies are scoped with least-privilege permissions to specific resource actions and ARNs. Audit logs of model invocations are emitted to Amazon CloudWatch and capture message IDs only, not content.

Polyglot cross-runtime implementation

The team used Python for Lambda functions that invoke Amazon Bedrock models. Boto3 native Amazon Bedrock support and simpler string manipulation made Python the right choice for building and iterating on prompts. The retrieval function is written in TypeScript to stay consistent with most of the Pelago backend code and to reuse shared libraries and Zod schemas for type-safe API contracts. This split let the team use the best language for each job without forcing a single runtime across the entire system.

Spiky traffic and pay-per-invocation compute

The Pelago application serves heavily US-based traffic. Message volume concentrates during weekday working hours, with peak hours seeing 10x or more the volume of quiet periods. The pay-per-invocation model of Lambda fits this well. During a Monday morning surge, Lambda scales out automatically with no pre-provisioning required. During off-peak hours, Lambda functions automatically scale down, so Pelago avoids idle compute costs. Using alternative long-lived compute would mean either over-provisioning for peak load or maintaining auto scaling policies that can lag during sudden spikes. With Lambda, the solution costs are directly proportional to member engagement with no idle cost.

Picking the right storage and handling idempotency

The team chose to use DynamoDB for conversation messages and MySQL for assistant suggestions based on different access patterns of each scenario. Conversation messages require high write throughput (100+ writes/sec at peak), single-digit millisecond reads, and automatic scaling. These requirements made DynamoDB a good fit. Assistant suggestions have a lighter write load (10-20 writes/sec) but need structured queries, foreign key relationships, and nested analytics joins that a relational database supports naturally.

Because SNS can deliver messages more than once, the Chat Assistant Lambda checks MySQL for an existing message before generating a new one. This idempotency check helps prevent duplicate Amazon Bedrock invocations, which would waste compute and could surface conflicting suggestions to coaches. If an Amazon Bedrock invocation fails because of throttling or model unavailability, the function logs the error without blocking message flow. A built-in retry mechanism handles transient failures, so suggestions are eventually generated even when Amazon Bedrock experiences momentary capacity constraints.

Monitoring and observability

The team tracks multiple business and operational metrics. CloudWatch metrics capture suggestion generation latency, which helps the team identify when model response times exceed acceptable thresholds. Retrieval rate measures what percentage of generated message suggestions are used by coaches. This gives insights into how well the async timing aligns with real usage patterns. The system also allows coaches to rate each suggestion with thumbs up or down. These ratings are stored in MySQL for future prompt tuning and model evaluation. CloudWatch alarms monitor error rates for Amazon Bedrock throttling and database connection failures. These alarms alert the engineering team before operational issues impact the care team experience.

Conclusion

Managed AI services like Amazon Bedrock and serverless architectures let healthcare organizations move quickly while maintaining compliance controls. The Pelago chat assistant shows what’s possible when you combine serverless event-driven processing with async AI generation and fast synchronous retrieval. The key patterns that made this work are SNS fanout to decouple processing and make new features straightforward to add, pre-generating message suggestions asynchronously so the care team does not wait, VPC endpoints to keep PHI off the public internet, and starting with foundation models and prompt engineering instead of spending months on custom model training.

The Pelago journey from concept to production deployment shows how small engineering teams in regulated industries can balance moving fast and maintaining their compliance posture.


About the authors

[$] Save and restore may be coming to GNOME

Post Syndicated from jzb original https://lwn.net/Articles/1083750/

One of the features that users often miss when moving from X11 to Wayland is
the ability to save and restore the position of windows between sessions. At GUADEC 2026, held in
A Coruña, Spain, Adrian Vovk provided an overview of work that has gone
into providing a platform-wide save and restore framework for GNOME. After two
failed attempts at landing an API, he believes that the third try will be the
one to succeed—though not in time for the upcoming GNOME 51 release
due in October.

PyPI now rejects new files after 14 days

Post Syndicated from jzb original https://lwn.net/Articles/1084218/

Python Software Foundation security developer-in-residence Seth
Larson has announced
that the Python Package Index (PyPI) will now reject new files that
are uploaded to releases older than 14 days. The restriction is to
prevent the poisoning of old releases if publishing tokens or
workflows of PyPI projects are compromised.

The discussion
of this behavior began
during PEP 740 (Digital Attestations) back in January
2024. The discussion was restarted
in March 2026
after the popular packages LiteLLM
and Telnyx were compromised
. These packages were compromised due to a “mutable
reference
” in these projects’ usage of the Trivy GitHub Action.

Originally the discussion stalled due to some projects depending on this behavior
to add support for new Python versions to already-published releases. To quantify how
disruptive this change would be to existing workflows, the PyPI database was queried
for projects
that have published new files to old releases
(bucketed by number of days since
the release). Later, specifically cp314 wheels were queried for the top
15,000 packages, revealing that only
56 projects of 15,000
had published a 3.14-compatible wheel more than 14 days
after a release was available.

LWN covered the LiteLLM compromise
in March.

Cloud Vendors Make It Easy to Get In. They’re Counting on It Being Hard to Leave.

Post Syndicated from Kari Wilson original https://www.backblaze.com/blog/cloud-vendors-make-it-easy-to-get-in-theyre-counting-on-it-being-hard-to-leave/

A decorative image showing different columns with a dollar sign indicator.

You’ve done the storage evaluation. The per-terabyte price is right. The durability numbers check out. Compliance boxes are ticked. And still, the cloud migration project hasn’t been approved.

That’s not a coincidence.

The cloud storage industry has spent years competing on what happens after you’re already locked in: performance, redundancy, features. Almost nobody competes on what it costs to get there—or what it costs to leave. 

Migration friction isn’t an oversight. For most hyperscalers, it’s a business model.

Why cloud migration projects stall before they start

The business case for cloud storage usually looks solid on paper. Lower per-terabyte costs. Less hardware to maintain. A path off aging tape libraries and overloaded NAS environments.

Then someone runs the actual migration math.

Egress fees from the current provider. Data transfer charges. Migration software licenses. Professional services. Tape digitization. Internal engineering hours. Project coordination overhead. For a large dataset, those costs can erase years of projected storage savings before a single byte moves.

Teams spend months building an approval-ready business case, only to find the upfront migration cost makes the model unworkable. The project stalls. Infrastructure the organization already knows is unsustainable stays in place. Modernization gets pushed to next quarter.

This is where most cloud vendors win. The storage decision becomes moot if the organization can never afford to move.

How egress fees trap organizations with their current provider

By the time most IT teams discover what cloud egress fees actually cost, they’re already mid-negotiation with a new provider.

The pricing model is deliberately asymmetric: getting data in is cheap, often free. Moving it out is where providers charge—and for multi-petabyte environments, those charges can run to hundreds of thousands of dollars before a migration has even started. Technically, the organization owns its data. Financially, moving it is a different question.

This reframes the evaluation in a way that favors incumbents. The question stops being which platform best fits long-term needs and becomes whether the organization can afford to leave at all. Once you’re in a major cloud platform with a large archive, exit costs are a structural retention mechanism.

Ask any prospective provider, early: what does it cost to leave? If they’re vague, that’s the answer.

How long does a cloud data migration actually take?

Cost gets scrutinized. Time usually doesn’t—until a migration is already underway and slipping.

A large-scale migration means inventorying data and metadata, evaluating and procuring tooling, coordinating across vendors, monitoring transfer jobs, validating integrity at the destination, and troubleshooting the inevitable edge cases. For multi-petabyte environments, self-managed projects routinely stretch from months into years.

Every quarter that drags on is a quarter the organization is paying to maintain infrastructure it’s already committed to replacing, while its engineering team runs a file-moving operation instead of working on anything strategic. The total cost of a slow migration almost always exceeds the initial estimate—and almost nobody builds that into the business case upfront.

What actually goes wrong during cloud data migration

Migration risk tends to be underestimated until something breaks.

The core questions—will files transfer without corruption, will metadata survive intact, will dependent applications keep working—are harder to answer than they look for LTO tape archives that haven’t been accessed in years, NAS and SAN environments with proprietary metadata structures, media archives with irreplaceable assets, regulated content with chain-of-custody requirements, and datasets large enough that verification at scale is its own engineering problem.

The cost of getting this wrong isn’t just the migration itself. Data loss, integrity gaps, or application failures discovered post-migration can be significantly more expensive than any egress fee. Validation and verification need to be designed into the plan before transfers start, not bolted on after something fails.

Why most cloud providers leave migration to you

Infrastructure teams evaluating cloud storage aren’t looking for a transfer tool. They want infrastructure modernized without burning their engineering team on a multi-year internal project. Predictable costs. A path to cloud that doesn’t require standing up a program management office just to move data.

The standard provider response is documentation and an onboarding checklist. After that, you’re largely on your own.

This isn’t an accident. Selling storage is straightforward. Owning migration means taking on cost, risk, and operational complexity that most providers would rather leave with the customer. The economics of the business favor making entry easy and exit expensive, with as little friction to growth as possible in between.

Providers that treat migration as their problem to solve are a different category. They’re betting that making it genuinely easier to get to their platform is worth more than one-time migration revenue—because a customer who gets there successfully tends to stay.

How Backblaze Universal Data Migration works

We built Universal Data Migration because we kept seeing the same thing: organizations that had already decided to move to Backblaze B2 getting stuck on the migration itself. The technology decision was made. The budget was approved. The project just couldn’t get started.

The program moves data from virtually any source—AWS S3, Microsoft Azure Blob, Google Cloud Storage, Wasabi, NAS and SAN, file servers, LTO tape across all generations, physical hard drives, legacy archives—with Backblaze managing the process rather than handing the customer a tool and a runbook.

The migration cost doesn’t have to be a reason the project stalls. That’s the point.

Before you sign a cloud storage contract, ask these two questions

The storage evaluation isn’t complete until you know what it costs to get there and what it costs to leave.

Most providers make the second number hard to find. If you have to dig for egress pricing, or if a sales rep answers the exit question with “we’d work with you on that,” build the worst-case number into your model before signing anything.

The right provider won’t make you ask. They’ll make migration part of the conversation from the start—because they’re confident enough in their platform to compete on the full picture, not just the monthly storage line.


Have a migration project that keeps getting pushed? Talk to our team about what it would actually take to move your environment to B2.

The post Cloud Vendors Make It Easy to Get In. They’re Counting on It Being Hard to Leave. appeared first on Backblaze Blog | Cloud Storage & Cloud Backup

[$] Attaching programs to multiple tracepoints

Post Syndicated from daroc original https://lwn.net/Articles/1082948/

Tracepoints in the kernel are useful for a variety of purposes: debugging,
active monitoring, and performance measurements, among other things. Previously,
any given BPF program could only be attached to a single tracepoint.
Jiri Olsa has been working to change that, and led a discussion about
his progress at the 2026

Linux Storage, Filesystem, Memory-Management, and BPF
Summit
. That work has since been

merged
, and can be expected as part of the 7.2
kernel.

Security updates for Wednesday

Post Syndicated from jzb original https://lwn.net/Articles/1084210/

Security updates have been issued by AlmaLinux (389-ds-base, c-ares, dovecot, freerdp, glib2, gstreamer1-plugins-good, gstreamer1-plugins-ugly-free, hplip, kernel, kernel-rt, nodejs:22, perl-XML-LibXML, webkit2gtk3, and yggdrasil), Debian (kernel, nss, roundcube, rtpengine, and xz-utils), Fedora (btrbk, kernel, mupdf, nuclei, perl-Crypt-OpenSSL-X509, rust-fern, rust-ifcfg-devname, rust-routinator, rust-rpki, and rust-syslog), Mageia (tig), Oracle (.NET 10.0, .NET 8.0, .NET 9.0, acl, dovecot, glib2, httpd, libtiff, pacemaker, perl-IO-Compress, plexus-utils, python3, and webkit2gtk3), Slackware (libssh and mozilla-firefox), SUSE (acl, avahi, aws-nitro-enclaves-cli, beets, chromium, firefox, go1.25-openssl, ImageMagick, iscsiuio, kernel, kubevirt1.8-container-disk, libgit2-1_9, libkrun, libsoup-3_0-0, nghttp2, opam, php7, python-aiohttp, python-tornado6, and vim), and Ubuntu (accountsservice, CUPS, imagemagick, jbig2dec, openssh, and snapd).

Building multi-Region resiliency for AWS CloudFormation custom resource deployment

Post Syndicated from Raman Pujani original https://aws.amazon.com/blogs/architecture/building-multi-region-resiliency-for-aws-cloudformation-custom-resource-deployment/

AWS CloudFormation is the foundational tool of infrastructure-as-code for thousands of organizations running workloads on AWS. But as teams push the boundaries of what CloudFormation can do natively, custom resources have emerged as a powerful extension mechanism that unlocks a broad range of possibilities. Yet, when it comes to building resilient, multi-Region deployments with custom resources, customers quickly discover a gap: there is no built-in multi-Region support. In this post, we will explore that challenge and go over a robust active-active architecture that solves it.

A CloudFormation custom resource allows you to write custom provisioning logic that AWS CloudFormation invokes during stack operations (Create, Update, or Delete). When CloudFormation encounters a custom resource in a template, it sends a lifecycle event to a target, typically an AWS Lambda function through an Amazon Simple Notification Service topic. CloudFormation waits for a response with a presigned URL, and then proceeds or rolls back based on that response.

Customers use Custom Resources for a wide variety of use cases, including:

  • Third-party API integrations to provision resources in external systems (for example, DNS providers, SaaS providers) as part of a CloudFormation stack.
  • Complex initialization logic for seeding databases, generating secrets, or bootstrapping configurations that CloudFormation doesn’t natively support.
  • Cross-account or cross-service orchestration for triggering workflows in other AWS accounts or services during stack lifecycle events.
  • Custom validation and compliance checks enforcing organizational policies before a stack is allowed to complete.
  • Resource types not yet supported natively for bridging the gap until AWS adds first-class support.

In short, Custom Resources turn CloudFormation into a fully extensible orchestration engine instead of only an AWS resource provisioner.

While single-Region deployments can achieve high resilience, multi-Region architectures become essential for organizations that need to meet specific business requirements. These include stringent disaster recovery objectives, data residency mandates, latency-sensitive use cases across geographies, and mission-critical business continuity needs. However, when it comes to CloudFormation Custom Resources, multi-Region design introduces a set of hard problems that CloudFormation does not solve natively:

  • No native fan-out mechanism: CloudFormation stacks in different Regions each trigger their own custom resource events independently. There is no built-in way to coordinate these events across Regions.
  • Duplicate execution risk: If you deploy the same Lambda function handler in multiple Regions to achieve redundancy, both instances may process the same event. This can lead to duplicate side effects (for example, creating the same record twice in a database or calling an external API multiple times).
  • No distributed locking: CloudFormation provides no mechanism to verify that only one handler processes a given event, even when multiple handlers are active.
  • No automated failover: If the primary Region’s Lambda function handler fails, there is no built-in mechanism to automatically route the event to a secondary Region.
  • Idempotency is your problem: Helping verify that retries and failover scenarios don’t cause unintended duplicate operations is entirely the responsibility of the developer.

Until now, these gaps meant that teams either accept the risk of single-Region custom resource handlers (a reliability concern) or build complex, bespoke solutions to handle multi-Region scenarios.

Walkthrough

Prerequisites

Solution approach

This proposed architecture delivers an active-active multi-Region solution for CloudFormation custom resource processing. It is designed around four core principles:

  • Active-Active processing: Both the primary Region (us-east-1) and secondary Region (us-west-2) are always live and capable of handling events.
  • No duplicate execution: A DynamoDB Global Table-based distributed locking mechanism helps verify that only one Region processes any given event, regardless of which Region receives it first.
  • Idempotency mechanism: Every request is tracked by state, so retries and failover scenarios are designed to avoid duplicate side effects.
  • Fully automated failover: Amazon Application Recovery Controller detects failures and triggers failover without manual intervention.

This architecture avoids the single points of failure inherent in single-Region custom resource designs while preventing the duplicate processing risks of naive multi-Region approaches. This architecture is ideal for mission-critical workloads where regional failures cannot be tolerated.

The following section provides a detailed walkthrough of how this architecture processes a CloudFormation lifecycle event from end to end.

This architecture diagram describes a multi-Region CloudFormation custom resource architecture operating in an Active-Active configuration. It handles CloudFormation lifecycle events (Create/Update/Delete) with high availability and no duplicate processing across multiple AWS Regions. The architecture uses a central primary Region (us-east-1) and a secondary Region (us-west-2) to process custom resource events, with Amazon DynamoDB Global Tables providing distributed locking and idempotency, and Amazon Application Recovery Controller providing automated failover. Customer AWS Regions fan out events simultaneously to both infrastructure Regions, supporting resilience even if the primary Region fails.

Architecture diagram showing the multi-Region CloudFormation custom resource processing flow with SNS fan-out, SQS queues, Lambda handlers, DynamoDB Global Tables for distributed locking, and Amazon Application Recovery Controller for automated failover

Step 1: Event initiation (Customer Regions)

A CloudFormation Stack in one of the customer Regions (us-east-1, eu-west-1, or ap-southeast-1) initiates a Create, Update, or Delete lifecycle event. Along with the event payload, CloudFormation generates a presigned response URL that the handler must call to signal success or failure. This event is published to a local Amazon Simple Notification Service (SNS) topic within that customer Region.

Step 2: Cross-Region fan-out with SNS subscriptions

The Amazon SNS topic is configured with cross-region subscriptions that simultaneously fan out the event to two Amazon SQS queues in the central infrastructure AWS Regions:

  • Primary SQS queue: Central Infrastructure Region: us-east-1.
  • Secondary SQS queue: Central Infrastructure Region: us-west-2.

Both queues receive the event at the same time, setting up the Active-Active processing model.

Step 3: Primary Lambda function handler (Immediate processing)

The Primary SQS queue triggers the Primary Lambda Custom Resource Handler immediately, with no delay. The Lambda function executes the following steps:

  • Check the DynamoDB Global Table for an existing lock on this request.
  • Acquire the lock by using a conditional write (only succeeds if no lock exists, preventing race conditions).
  • Execute the custom resource business logic.
  • Send a SUCCESS or FAILED response back to CloudFormation using the presigned URL.
  • Update the DynamoDB state to mark the request as fully processed.

Step 4: Secondary Lambda function handler (Delayed processing)

The Secondary SQS queue is configured with a delay, implemented by using either an SQS Delay Queue or a Visibility Timeout. After this delay, the Secondary Lambda Custom Resource Handler runs:

  • Check the DynamoDB Global Table Replica for an existing lock.
  • Skip processing if the primary has already handled the request (idempotency check).
  • Acquire the lock if the primary has not yet processed it (failover scenario).
  • Execute the custom resource logic if the lock was successfully acquired.
  • Send the response to CloudFormation.

The delay is intended to give the primary Region time to process the event first. The secondary only takes over if the primary has not completed processing within the delay window.

Step 5: DynamoDB Global Tables: Distributed locking and idempotency

Amazon DynamoDB Global Tables are the backbone of coordination in this architecture. Both Regions read from and write to the Global Table with strong consistency. The table tracks:

  • Lock state: Which Region holds the lock for a given request.
  • Idempotency records: Whether a request has already been processed.
  • Request state: The full lifecycle status of each event.

Bidirectional replication is designed to help maintain both Regions with the latest state, supporting the lock mechanism’s reliability despite network partitions or regional degradation.

Step 6: CloudFormation response

After either the primary or secondary Lambda function handler completes processing, CloudFormation receives the SUCCESS or FAILED callback using the pre-signed URL. Based on this response, CloudFormation either continues the stack operation or initiates a rollback.

Step 7: Amazon CloudWatch monitoring

Amazon CloudWatch alarms continuously monitor SQS queue depth and Lambda execution health in both Regions. These alarms serve as the early warning system for the automated failover mechanism.

Step 8: Automated failover with ARC

If the primary Region (us-east-1) experiences a failure, CloudWatch detects it and triggers Amazon Application Recovery Controller to initiate automated failover to the secondary Region (us-west-2). No manual intervention is typically required. The secondary Region is designed to take over processing responsibilities.

Clean up

Delete resources created using the following AWS services in every Region to avoid additional costs:

  • ARC.
  • SNS topic.
  • SQS queue/messages.
  • DynamoDB table.
  • Lambda code.
  • CloudWatch Log Groups.
  • IAM roles.
  • CloudFormation (if used for automation).
  • Any other AWS service used for customizing your deployment.

Conclusion

CloudFormation Custom Resources are an indispensable tool for teams building sophisticated infrastructure automation on AWS. However, the lack of native multi-Region support has long been a barrier to building truly resilient custom resource architectures.

This architecture addresses the major challenge directly:

  • Resilience: Active-Active design means no single Region is a bottleneck or single point of failure.
  • Correctness: Amazon DynamoDB distributed locking and idempotency designed to eliminate duplicate processing.
  • Automation: Amazon Application Recovery Controller-driven failover removes the need for manual intervention during regional outages.
  • Scalability: The fan-out model with SNS cross-Region subscriptions supports multiple customer Regions simultaneously.

For teams operating at scale across multiple AWS Regions, this architecture provides a blueprint for extending the power of CloudFormation without sacrificing reliability. Whether you’re managing compliance-driven multi-Region deployments or building for global high availability, this pattern gives you a foundation for resilient custom resource processing.

Call to action

Refer to the following content to learn more about relevant AWS services:

Позиция по проекта на решение за американските цистерни в България

Post Syndicated from Bozho original https://blog.bozho.net/blog/4602

САЩ е съюзник и стратегически партньор на България. А режимът на аятоласите е репресивен режим, който стреля по собствените си граждани по улиците.

Но за съжаление никое българско правителство не би имало лукса да вземе свободно решение дали да разположи американските цистерни на българско летище. Защото realpolitik фактите са, че ако откажем, дерогацията за рафинерията в Бургас може да бъде отменена, а никое правителство не може да остави страната без бензин, дизел и авиационно гориво.

И ние разбираме това. Затова няма да злорадстваме, да ехидничим, да наричаме Прогресивна България „войнолюбци“, да плашим хората или да се отдаваме на евтин популизъм. Но именно Радев и Прогресивна България се отдадоха на такъв популизъм само преди няколко месеца. Обясняваха какви заплахи имало за страната и продаваха страх.

Очакванията на обществото трябва да се посрещат, но като политици имаме отговорност и да създаваме разумни очаквания. Да не злоупотребяваме с трибуната, която ни е дадена и да не се заиграваме със страхове. Нещо, което сега управляващите и конкретно Радев правеха дълго време.

Но когато дълбаеш разделителни линии в обществото дълги години, неизбежно пропадаш в тях.

Разбираме и желанието им да удържат несъвместимата електорална коалиция, която ги избра, но със захаросване на фактите, с атака по опозицията и с приказки за грандизиони бъдещи сделки няма да стане.

Всичко ни се представя като серия от сделки, транзакции, от които уж България печели. Но сме наясно, че няма как да си най-хитрия, и да въртиш едностранни „сделки“ със САЩ, Русия, Китай, Турция – това няма да свърши добре.

За съжаление, правителството на Радев не говори за Европейския съюз като за решение на всички тези проблеми, които сега се налага да решаваме с непрозрачни транзакции. Вероятно защото Европейският съюз е съюз на ценности и на солидарност, а не на политически транзакции.

ЕС е формиран на база на отстъпките, на консенсуса, на солидарността и на споделените ценности, а правителството на Прогресивна България руши презумпцията за солидарност – казва „дайте ни еврофондовете и ние няма да ви пречим“ – нещо, което противоречи на европейската идея.

Дългосрочното решение за сигурността на България минава през превръщането на ЕС в силен геополитически полюс. Иначе всяка държава ще се превърне в плячка на по-големите, защото никоя държава сама не може да преговаря от достатъчно добра позиция. А ние, с нашите пробити служби и неизградени институции ще сме сред най-лесните плячки. И докато си мислим, че се договаряме със САЩ, Русия, Китай и Турция, всъщност ще губим още и още суверенитет – т.е. способността да вземаме сами решения, без някоЙ да ни казва „ако не го направиш, ще ти спра това или онова“.

Правителството няма мандат за руши европейския консенсус, няма мандат да отклонява България от европейската солидарност. И трябва да бъде честно с българските граждани, да каже какъв курс реално поема.

Правителството днес можеше да получи нашата подкрепа за трудното и непопулярно решение, ако бяха честни, смиерни и ако с действията си до момента представяха план за алтернатива на транзакционното затъване.

Но вместо това те внесоха за гласуване решението без да ни предоставят нотата на САЩ, без цялостен доклад за рисковете от военното разузнаване и без отговор за това каква сделка всъщнсот сключват.

Затова днес не участвахме в гласуването, оставяйки управлявщите насаме със собственото си лицемерие и популизъм, и в компанията на Пеевски, който гласува всичко американско, с продължаващата надежда да бъде изваден от санкционния списък.

И правим това не за да натрием носа на управляващите за предишните им изказвания, с които насаждаха страх и разделение, а за да разберат, че когато управляваш, носиш много повече отговорност от това да казваш няколко добре формулирани изречения пред камери.

Материалът Позиция по проекта на решение за американските цистерни в България е публикуван за пръв път на БЛОГодаря.

The collective thoughts of the interwebz