Stenberg: Dropping hyper

Post Syndicated from corbet original https://lwn.net/Articles/1003161/

Curl maintainer Daniel Stenberg announces
that the curl project will be dropping hyper, its experimental HTTP backend
written in Rust, due to lack of developer interest.

While the experiment itself is deemed a failure, I think we learned
from it and improved curl in the process. We had to rethink and
reassess several implementation details when we aligned HTTP
behavior with hyper. libcurl parses and handles HTTP stricter
now. Better.

Седмицата (16–21 декември)

Post Syndicated from Йовко Ламбрев original https://www.toest.bg/sedmitsata-16-21-dekemvri-2024/

Седмицата (16–21 декември)

Може ли последната предпразнична работна седмица на декември да се окаже определяща за политическия дневен ред на цялата 2025 година? Макар и да не изглежда особено вероятно, всъщност не е невъзможно. Под повърхността текат процеси, които предопределят някои събития или посоки. Не всички от тях са лесни за разгадаване. Нито за преглъщане. Тези процеси ще продължим да следим и през новата година, а Емилия Милчева обобщава последните няколко дни във финалния си вътрешнополитически коментар за 2024-та, озаглавен „Какво следва? Украйнааа и еврооо“. Не може да не се досещате защо.

Във фокуса на втория материал в съвместната ни поредица с „Екипът на София“ е Пловдив – градът, за който не успяваме да пишем толкова, колкото би ни се искало. Урбанистът Калоян Карамитов, един от двигателите на трансформацията на популярния квартал „Капана“ в Града под тепетата, дебютира тази седмица в „Тоест“ с текста си „Как се съсипва квартал“. Неговият анализ на един от ключовите за Пловдив инфраструктурни ремонти показва едни и същи грешки в управлението на проектите на втория по големина град в България – грешки, които продължават да се повтарят година след година и мандат след мандат.

А през Новата година пловдивчани ще бъдат „сурвакани“ и с 40% по-висока такса смет. Градът и досега беше с една от най-високите ставки за сметосъбиране, без обаче да е особено чист.

Тази седмица Атанас Шиников ни предлага да прочетем продължението на неговия разказ за хомосексуалните практики в ислямските общества. Във втората част на четивото, която публикувахме през седмицата, той прави исторически преглед на мюсюлманските правни норми, като особено любопитни са препратките и отраженията им в съвременността.

С края на годината, за съжаление, приключва и поредицата от интервюта на Надежда Цекулова, посветени на достъпа до образование на децата от уязвими групи, която тя осъществи с подкрепата на „Лидл България“. Този път Надежда разговаря с Ева Ямбор, майка на младеж със синдром на Даун, за отговорността на обществото към такива деца в Австрия. Трудно ми е да не цитирам вероятно най-важната част от това интервю:

… най-голяма полза от приобщаващото образование имат хората без увреждания. Присъствието на различни деца в класовете учи останалите на толерантност, на емпатия, създава им социално-емоционални умения, които са толкова ценни в съвременния свят.

Винаги очаквам с нетърпение да прочета всеки нов текст на културолога Александър Драганов в „Тоест“ – заради свежия поглед върху темите, които разнищва, а и вероятно заради щипката ирония, която задължително добавя тук-там в размишленията си. „Спайдър-Мен срещу чалгата, или за необходимостта от популярна масова култура“ е много любопитно четиво, което в никакъв случай не бива да пропускате.

Празниците са време за книги и нашите книжни феи са се погрижили да ви подберат няколко заглавия.

По изключение Зорница Христова този път разказва не за три, а за цели четири нови книги – един роман, две стихосбирки и една илюстрована поема. В най-новата разходка по буквите ще прочетете за петия роман на ирландския писател Пол Линч и за новите поетични книги на Яна Букова, Антоан Асенов и Мария Донева.

Антония Апостолова пък ни припомня за „Олив Китридж отново“ на Елизабет Страут, издадена на български език миналата година. Според нея това е…

… роман в разкази за свързването дори когато то изглежда невъзможно; за намирането на изход в унинието и безнадеждността; за поемането на отговорност въпреки слабостта и усещането за изгубеност. За човека, който винаги трябва да бъде срещан отвъд политиката, съображенията и формалностите. И за грешките – онази субстанция на пределно човешкото, без която е невъзможно да съществуваме. За грешките със снизходителност и състрадание.

Мисля си, че в края на годината всички имаме потребност от осмисляне на грешките. Както и от снизходителност и състрадание към нас самите.

И понеже с настоящия обзорен бюлетин изпращаме и 2024 г., то какво по-добро да предложим за финал, освен малко поезия с последното за годината „Стихотворение на месеца“. „Ако не тази неделя, другата“ не е публикувано досега. Радваме се, че за първи път то ще срещне своята публика сред читателите на „Тоест“. Автор на стихотворението е Георги Господинов.

И преди да се втурнем към празничните трапези… Знаете ли какво е медийна пустиня? Това е, когато цели региони или общности са лишени от журналистика, която да осветлява и обяснява на техния език и по достъпен начин важните за тях събития. Още в началото на тази година беше публикувано тревожно изследване в тази посока. Изпращаме я без усещане за различно развитие.

Гравитацията на социалните платформи все повече измества фокуса от качеството към количеството, при това без никакви филтри или критерии за стойност. Избутването на смисленото и полезно съдържание в ъгъла за сметка на кратки, емоционални и лишени от рационалност аудио-визуални изблици е все по-голяма заплаха за функционирането на демокрацията. Особено когато това бъде организирано действие, подплатено със значителни финансови средства.

Екипът на „Тоест“ със съвсем скромен бюджет се бори месец след месец в българската медийна пустиня да има малко повече рационалност и смисъл. И баланс. Опитваме се да съхраним тези български гласове, които имат какво да кажат, и заслужават да бъдат чути и прочетени. Колкото и нескромно да звучи, това са усилия за съхраняване на крехката ни българска демокрация. И разчитаме единствено на вас, читателите, и на даренията ви, за да продължаваме да го правим.

Благодарим ви, че бяхме заедно и през тази година. Пожелаваме ви светлина и уют през празничните дни, но най-вече през цялата нова 2025 година!

Amazon Q data integration adds DataFrame support and in-prompt context-aware job creation

Post Syndicated from Bo Li original https://aws.amazon.com/blogs/big-data/amazon-q-data-integration-adds-dataframe-support-and-in-prompt-context-aware-job-creation/

Amazon Q data integration, introduced in January 2024, allows you to use natural language to author extract, transform, load (ETL) jobs and operations in AWS Glue specific data abstraction DynamicFrame. This post introduces exciting new capabilities for Amazon Q data integration that work together to make ETL development more efficient and intuitive. We’ve added support for DataFrame-based code generation that works across any Spark environment. We’ve also introduced in-prompt context-aware development that applies details from your conversations, working seamlessly with a new iterative development experience. This means you can refine your ETL jobs through natural follow-up questions—starting with a basic data pipeline and progressively adding transformations, filters, and business logic through conversation. These improvements are available through the Amazon Q chat experience on the AWS Management Console, and the Amazon SageMaker Unified Studio (preview) visual ETL and notebook interfaces.

The DataFrame code generation now extends beyond AWS Glue DynamicFrame to support a broader range of data processing scenarios. You can now generate data integration jobs for various data sources and destinations, including Amazon Simple Storage Service (Amazon S3) data lakes with popular file formats like CSV, JSON, and Parquet, as well as modern table formats such as Apache Hudi, Delta, and Apache Iceberg. Amazon Q can generate ETL jobs for connecting to over 20 different data sources, including relational databases like PostgreSQL, MySQL and Oracle; data warehouses like Amazon Redshift, Snowflake, and Google BigQuery; NoSQL databases like Amazon DynamoDB, MongoDB, and OpenSearch; tables defined in the AWS Glue Data Catalog; and custom user-supplied JDBC and Spark connectors. Your generated jobs can use a variety of data transformations, including filters, projections, unions, joins, and aggregations, giving you the flexibility to handle complex data processing requirements.

In this post, we discuss how Amazon Q data integration transforms ETL workflow development.

Improved capabilities of Amazon Q data integration

Previously, Amazon Q data integration only generated code with template values that required you to fill in the configurations such as connection properties for data source and data sink and the configurations for transforms manually. With in-prompt context awareness, you can now include this information in your natural language query, and Amazon Q data integration will automatically extract and incorporate it into the workflow. In addition, generative visual ETL in the SageMaker Unified Studio (preview) visual editor allows you to reiterate and refine your ETL workflow with new requirements, enabling incremental development.

Solution overview

This post describes the end-to-end user experiences to demonstrate how Amazon Q data integration and SageMaker Unified Studio (preview) simplify your data integration and data engineering tasks with the new enhancements, by building a low-code no-code (LCNC) ETL workflow that enables seamless data ingestion and transformation across multiple data sources.

We demonstrate how to do the following:

  • Connect to diverse data sources
  • Perform table joins
  • Apply custom filters
  • Export processed data to Amazon S3

The following diagram illustrates the architecture.

Using Amazon Q data integration with Amazon SageMaker Unified Studio (preview)

In the first example, we use Amazon SageMaker Unified Studio (preview) to develop a visual ETL workflow incrementally. This pipeline reads data from different Amazon S3 based Data Catalog tables, performs transformations on the data, and writes the transformed data back into an Amazon S3. We use the allevents_pipe and venue_pipe files from the TICKIT dataset to demonstrate this capability. The TICKIT dataset records sales activities on the fictional TICKIT website, where users can purchase and sell tickets online for different types of events such as sports games, shows, and concerts.

The process involves merging the allevents_pipe and venue_pipe files from the TICKIT dataset. Next, the merged data is filtered to include only a specific geographic region. Then the transformed output data is saved to Amazon S3 for further processing in future.

Data preparation

The two datasets are hosted as two Data Catalog tables, venue and event, in a project in Amazon SageMaker Unified Studio (preview), as shown in the following screenshots.

Data processing

To process the data, complete the following steps:

  1. On the Amazon SageMaker Unified Studio console, on the Build menu, choose Visual ETL flow.

An Amazon Q chat window will help you provide a description for the ETL flow to be built.

  1. For this post, enter the following text:
    Create a Glue ETL flow connect to 2 Glue catalog tables venue and event in my database glue_db_4fthqih3vvk1if, join the results on the venue’s venueid and event’s e_venueid, and write output to a S3 location.
    (The database name is generated with the project ID suffixed to the given database name automatically).
  2. Choose Submit.

An initial data integration flow will be generated as shown in the following screenshot to read from the two Data Catalog tables, join the results, and write to Amazon S3. We can see the join conditions are correctly inferred from our request from the join node configuration displayed.

Let’s add another filter transform based on the venue state as DC.

  1. Choose the plus sign and choose the Amazon Q icon to ask a follow-up question.
  2. Enter the instructions filter on venue state with condition as venuestate==‘DC’ after joining the results to modify the workflow.

The workflow is updated with a new filter transform.

Upon checking the S3 data target, we can see the S3 path is now a placeholder <s3-path> and the output format is Parquet.

  1. We can ask the following question in Amazon Q:
    update the s3 sink node to write to s3://xxx-testing-in-356769412531/output/ in CSV format
    in the same way to update the Amazon S3 data target.
  2. Choose Show script to see the generated code is DataFrame based, with all context in place from all of our conversation.
  3. Finally, we can preview the data to be written to the target S3 path. Note that the data is a joined result with only the venue state DC included.

With Amazon Q data integration with Amazon SageMaker Unified Studio (preview), an LCNC user can create the visual ETL workflow by providing prompts to Amazon Q and the context for data sources and transformations are preserved. Subsequently, Amazon Q also generated the DataFrame-based code for data engineers or more experienced users to use the automatic ETL generated code for scripting purposes.

Amazon Q data integration with Amazon SageMaker Unified Studio (preview) notebook

Amazon Q data integration is also available in the Amazon SageMaker Unified Studio (preview) notebook experience. You can add a new cell and enter your comment to describe what you want to achieve. After you press Tab and Enter, the recommended code is shown.

For example, we provide the same initial question:

Create a Glue ETL flow to connect to 2 Glue catalog tables venue and event in my database glue_db_4fthqih3vvk1if, join the results on the venue’s venueid and event’s e_venueid, and write output to a S3 location.

Similar to the Amazon Q chat experience, the code is recommended. If you press Tab, then the recommended code is chosen.

The following video provides a full demonstration of these two experiences in Amazon SageMaker Unified Studio (preview).

Using Amazon Q data integration with AWS Glue Studio

In this section, we walk through the steps to use Amazon Q data integration with AWS Glue Studio

Data preparation

The two datasets are hosted in two Amazon S3 based Data Catalog tables, event and venue, in the database glue_db, which we can query from Amazon Athena. The following screenshot shows an example of the venue table.

Data processing

To start using the AWS Glue code generation capability, use the Amazon Q icon on the AWS Glue Studio console. You can start authoring a new job, and ask Amazon Q the question to create the same workflow:

Create a Glue ETL flow connect to 2 Glue catalog tables venue and event in my database glue_db, join the results on the venue’s venueid and event’s e_venueid, and then filter on venue state with condition as venuestate=='DC' and write to s3://<s3-bucket>/<folder>/output/ in CSV format.

You can see the same code is generated with all configurations in place. With this response, you can learn and understand how you can author AWS Glue code for your needs. You can copy and paste the generated code to the script editor. After you configure an AWS Identity and Access Management (IAM) role on the job, save and run the job. When the job is complete, you can begin querying the data exported to Amazon S3.

After the job is complete, you can verify the joined data by checking the specified S3 path. The data is filtered by venue state as DC and is now ready for downstream workloads to process.

The following video provides a full demonstration of the experience with AWS Glue Studio.

Conclusion

In this post, we explored how Amazon Q data integration transforms ETL workflow development, making it more intuitive and time-efficient, with the latest enhancement of in-prompt context awareness to accurately generate a data integration flow with reduced hallucinations, and multi-turn chat capabilities to incrementally update the data integration flow, add new transforms and update DAG nodes. Whether you’re working with the console or other Spark environments in SageMaker Unified Studio (preview), these new capabilities can significantly reduce your development time and complexity.

To learn more, refer to Amazon Q data integration in AWS Glue.


About the Authors

Bo Li is a Senior Software Development Engineer on the AWS Glue team. He is devoted to designing and building end-to-end solutions to address customers’ data analytic and processing needs with cloud-based, data-intensive technologies.

Stuti Deshpande is a Big Data Specialist Solutions Architect at AWS. She works with customers around the globe, providing them strategic and architectural guidance on implementing analytics solutions using AWS. She has extensive experience in big data, ETL, and analytics. In her free time, Stuti likes to travel, learn new dance forms, and enjoy quality time with family and friends.

Kartik Panjabi is a Software Development Manager on the AWS Glue team. His team builds generative AI features for the Data Integration and distributed system for data integration.

Shubham Mehta is a Senior Product Manager at AWS Analytics. He leads generative AI feature development across services such as AWS Glue, Amazon EMR, and Amazon MWAA, using AI/ML to simplify and enhance the experience of data practitioners building data applications on AWS.

Metasploit Weekly Wrap-Up 12/20/2024

Post Syndicated from Alan David Foster original https://blog.rapid7.com/2024/12/20/metasploit-weekly-wrap-up-12-20-2024/

New module content (4)

GameOver(lay) Privilege Escalation and Container Escape

Metasploit Weekly Wrap-Up 12/20/2024

Authors: bwatters-r7, g1vi, gardnerapp, and h00die
Type: Exploit
Pull request: #19460 contributed by gardnerapp
Path: linux/local/gameoverlay_privesc
AttackerKB reference: CVE-2023-2640

Description: Adds a module for CVE-2023-2640 and CVE-2023-32629, a local privilege escalation in some Ubuntu kernel versions that abuses overly trusting OverlayFS features.

Clinic’s Patient Management System 1.0 – Unauthenticated RCE

Authors: Aaryan Golatkar and Oğulcan Hami Gül
Type: Exploit
Pull request: #19733 contributed by aaryan-11-x
Path: multi/http/clinic_pms_fileupload_rce
AttackerKB reference: CVE-2022-40471

Description: New exploit module for Clinic’s Patient Management System 1.0 that targets CVE-2022-40471. The module exploits unrestricted file upload, which can be further used to get remote code execution (RCE) through a malicious PHP file.

WordPress WP Time Capsule Arbitrary File Upload to RCE

Authors: Rein Daelman and Valentin Lobstein
Type: Exploit
Pull request: #19713 contributed by Chocapikk
Path: multi/http/wp_time_capsule_file_upload_rce
AttackerKB reference: CVE-2024-8856

Description: This exploits a remote code execution (RCE) vulnerability (CVE-2024-8856) in the WordPress WP Time Capsule plugin (versions ≤ 1.22.21). This vulnerability allows unauthenticated attackers to upload and execute arbitrary files due to improper validation within the plugin.

WSO2 API Manager Documentation File Upload Remote Code Execution

Authors: Heyder Andrade <@HeyderAndrade>, Redway Security <redwaysecurity.com>, and Siebene@ <@Siebene7>
Type: Exploit
Pull request: #19647 contributed by heyder
Path: multi/http/wso2_api_manager_file_upload_rce
AttackerKB reference: CVE-2023-2988

Description: Adds an exploit module for a vulnerability in the ‘Add API Documentation’ feature of WSO2 API Manager (CVE-2023-2988) that allows malicious users with specific permissions to upload arbitrary files to a user-controlled server location. This flaw allows for RCE on the target system.

Enhancements and features (4)

  • #19546 from adfoster-r7 – Improves the database module cache performance from ~3 minutes to ~1 minute by performing bulk inserts of module metadata instead of multiple smaller inserts for every module/reference/author/etc.
  • #19660 from zeroSteiner – Updates OptEnum to validate values without being case sensitive while preserving the case the author was expecting.
  • #19715 from oddlittlebird – Improves db/README.md documentation.
  • #19718 from sjanusz-r7 – Expose the currently authenticated rpc_token to RPC handlers.

Bugs fixed (4)

  • #19719 from bwatters-r7 – Fixed a syntax error in the code generated by fetch payloads when the FETCH_DELETE option was enabled.
  • #19721 from bwatters-r7 – This updates the way the module checks the Windows build version to determine if it’s vulnerable to CVE-2020-0668.
  • #19726 from pczinser – The reverse HTTP and HTTPS Meterpreter x64 payloads now correctly set the User-Agent HTTP header when connecting back to Metasploit. Before this fix, the HttpUserAgent option was not used properly. You can now use this option to customize the User-Agent HTTP header when using these payloads.
  • #19739 from sjanusz-r7 – Fixes an issue with the post/multi/recon/local_exploit_suggester module which would crash if a TARGET value was set.

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate and you can get more details on the changes since the last blog post from GitHub:

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest. To install fresh without using git, you can use the open-source-only Nightly Installers or the commercial edition Metasploit Pro.

Jumia builds a next-generation data platform with metadata-driven specification frameworks

Post Syndicated from Ramon Diez Lejarazu original https://aws.amazon.com/blogs/big-data/jumia-builds-a-next-generation-data-platform-with-metadata-driven-specification-frameworks/

Jumia is a technology company born in 2012, present in 14 African countries, with its main headquarters in Lagos, Nigeria. Jumia is built around a marketplace, a logistics service, and a payment service. The logistics service enables the delivery of packages through a network of local partners, and the payment service facilitates the payments of online transactions within Jumia’s ecosystem. Jumia is present in NYSE and has a market cap of $554 million.

In this post, we share part of the journey that Jumia took with AWS Professional Services to modernize its data platform that ran under a Hadoop distribution to AWS serverless based solutions. Some of the challenges that motivated the modernization were the high cost of maintenance, lack of agility to scale computing at specific times, job queuing, lack of innovation when it came to acquiring more modern technologies, complex automation of the infrastructure and applications, and the inability to develop locally.

Solution overview

The basic concept of the modernization project is to create metadata-driven frameworks, which are reusable, scalable, and able to respond to the different phases of the modernization process. These phases are: data orchestration, data migration, data ingestion, data processing, and data maintenance.

This standardization for each phase was considered as a way to streamline the development workflows and minimize the risk of errors that can arise from using disparate methods. This also enabled migration of different kinds of data following a similar approach regardless of the use case. By adopting this approach, the data handling is consistent, more efficient, and more straightforward to manage across different projects and teams. In addition, although the use cases have autonomy in their domain from a governance perspective, on top of them is a centralized governance model that defines the access control in the shared architectural components. Importantly, this implementation emphasizes data protection by enforcing encryption across all services, including Amazon Simple Storage Service (Amazon S3) and Amazon DynamoDB. Furthermore, it adheres to the principle of least privilege, thereby enhancing overall system security and reducing potential vulnerabilities.

The following diagram describes the frameworks that were created. In this design, the workloads in the new data platform are divided by use case. Each use case requires the creation of a set of YAML files for each phase, from data migration to data flow orchestration, and they are basically the input of the system. The output is a set of DAGs that run the specific tasks.

Overview

In the following sections, we discuss the objectives, implementation, and learnings of each phase in more detail.

Data orchestration

The objective of this phase is to build a metadata-driven framework to orchestrate the data flows along the whole modernization process. The orchestration framework provides a robust and scalable solution that has the following capacities: dynamically create DAGs, integrate natively with non-AWS services, allow the creation of dependencies based on past executions, and add an accessible metadata generation per each execution. Therefore, it was decided to use Amazon Managed Workflows for Apache Airflow (Amazon MWAA), which, through the Apache Airflow engine, provides these functionalities while abstracting users from the management operation.

The following is the description of the metadata files that are provided as part of the data orchestration phase for a given use case that performs the data processing using Spark on Amazon EMR Serverless:

owner: # Use case owner
dags: # List of DAGs to be created for this use case
  - name: # Use case name
    type: # Type of DAG (could be migration, ingestion, transformation or maintenance)
    tags: # List of TAGs
    notification: # Defines notificacions for this DAGs
      on_success_callback: true
      on_failure_callback: true
    spark: # Spark job information 
      entrypoint: # Spark script 
      arguments: # Arguments required by the Spark script
      spark_submit_parameters: # Spark submit parameters. 

The idea behind all the frameworks is to build reusable artifacts that enable the development teams to accelerate their work while providing reliability. In this case, the framework provides the capabilities to create DAG objects within Amazon MWAA based on configuration files (YAML files).

This particular framework is built on layers that add different functionalities to the final DAG:

  • DAGs – The DAGs are built based on the metadata information provided to the framework. The data engineers don’t have to write Python code in order to create the DAGs, they are automatically created and this module is in charge of performing this dynamic creation of DAGs.
  • Validations – This layer handles YAML file validation in order to prevent corrupted files from affecting the creation of other DAGs.
  • Dependencies – This layer handles dependencies among different DAGs in order to handle complex interconnections.
  • Notifications – This layer handles the type of notifications and alerts that are part of the workflows.

Orchestration

One aspect to consider when using Amazon MWAA is that, being a managed service, it requires some maintenance from the users, and it’s important to have a good understanding of the number of DAGs and processes that you’re expected to have in order to fine-tune the instance and obtain the desired performance. Some of the parameters that were fine-tuned during the engagement were core.dagbag_import_timeout, core.dag_file_processor_timeout, core.min_serialized_dag_update_interval, core.min_serialized_dag_fetch_interval, scheduler.min_file_process_interval, scheduler.max_dagruns_to_create_per_loop, scheduler.processor_poll_interval, scheduler.dag_dir_list_interval, and celery.worker_autoscale.

One of the layers described in the preceding diagram corresponds to validation. This was an important component for the creation of dynamic DAGs. Because the input to the framework consists of YML files, it was decided to filter out corrupted files before attempting to create the DAG objects. Following this approach, Jumia could avoid undesired interruptions of the whole process. The module that actually builds DAGs only receives configuration files that follow the required specifications to successfully create them. In case of corrupted files, information regarding the actual issues is logged into Amazon CloudWatch so that developers can fix them.

Data migration

The objective of this phase is to build a metadata-driven framework for migrating data from HDFS to Amazon S3 with Apache Iceberg storage format, which involves the least operational overhead, provides scalability capacity during peak hours, and guarantees data integrity and confidentiality.

The following diagram illustrates the architecture.

Migration

During this phase, a metadata-driven framework built in PySpark receives a configuration file as input so that some migration tasks can run in an Amazon EMR Serverless job. This job uses the PySpark framework as the script location. Then the orchestration framework described previously is used to create a migration DAG that runs the following tasks:

  1. The first task creates the DDLs in Iceberg format in the AWS Glue Data Catalog using the migration framework within an Amazon EMR Serverless job.
  2. After the tables are created, the second task transfers HDFS data to a landing bucket in Amazon S3 using AWS DataSync to sync customer data. This process brings data from all the different layers of the data lake.
  3. When this process is complete, a third task converts data to Iceberg format from the landing bucket to the destination bucket (raw, process, or analytics) using again another option of the migration framework embedded in an Amazon EMR Serverless job.

Data transfer performance is better when the size of the files to be transferred is around 128–256 MB, so it’s recommended to compress the files at the source. By reducing the number of files, metadata analysis and integrity phases are reduced, speeding up the migration phase.

Data ingestion

The objective of this phase is to implement another framework based on metadata that responds to the two data ingestion models. A batch mode is responsible for extracting data from different data sources (such as Oracle or PostgreSQL) and a micro-batch-based mode extracts data from a Kafka cluster that, based on configuration parameters, has the capacity to run native streams in streaming.

The following diagram illustrates the architecture for the batch and micro-batch and streaming approach.

Ingestion

During this phase, a metadata-driven framework builds the logic to bring data from Kafka, databases, or external services, that will be run using an ingestion DAG deployed in Amazon MWAA.

Spark Structured Streaming was used to ingest data from Kafka topics. The framework receives configuration files in YAML format that indicate which topics to read, what extraction processes should be performed, whether it should be read in streaming or micro-batch, and in which destination table the information should be saved, among other configurations.

For batch ingestion, a metadata-driven framework written in Pyspark was implemented. In the same way as the previous one, the framework received a configuration in YAML format with the tables to be migrated and their destination.

One of the aspects to consider in this type of migration is the synchronization of data from the ingestion phase and the migration phase, so that there is no loss of data and that data is not reprocessed unnecessarily. To this end, a solution has been implemented that saves the timestamps of the last historical data (per table) migrated in a DynamoDB table. Both types of frameworks are programmed to use this data the first time they are run. For micro-batching use cases, which use Spark Structured Streaming, Kafka data is read by assigning the value stored in DynamoDB to the startingTimeStamp parameter. For all other executions, priority will be given to the metadata in the checkpoint folder. This way, you can make sure ingestion is synchronized with the data migration.

Data processing

The objective in this phase was to be able to handle updates and deletions of data in an object-oriented file system, so Iceberg is a key solution that was adopted throughout the project as delta lake files because of its ACID capabilities. Although all phases use Iceberg as delta files, the processing phase makes extensive use of Iceberg’s capabilities to do incremental processing of data, creating the processing layer using UPSERT using Iceberg’s ability to run MERGE INTO commands.

The following diagram illustrates the architecture.

Processing

The architecture is similar to the ingestion phase, with just changes to the data source to be Amazon S3. This approach speeds up the delivery phase and maintains quality with a production-ready solution.

By default, Amazon EMR Serverless has the spark.dynamicAllocation.enabled parameter set to True. This option scales up or down the number of executors registered within the application, based on the workload. This brings a lot of advantages when dealing with different types of workloads, but it also brings considerations when using Iceberg tables. For instance, while writing data into an Iceberg table, the Amazon EMR Serverless application can use a large number of executors in order to speed up the task. This can result in reaching Amazon S3 limits, specifically the number of requests per second per prefix. For this reason, it’s important to apply good data partitioning practices.

Another important aspect to consider in these cases is the object storage file layout. By default, Iceberg uses the Hive storage layout, but it can be set to use ObjectStoreLocationProvider. By setting this property, a deterministic hash is generated for each file, with a hash appended directly after write.data.path. This can considerably minimize throttle requests based on object prefix, as well as maximize throughput for Amazon S3 related I/O operations, because the files written are equally distributed across multiple prefixes.

Data maintenance

When working with data lake table formats such as Iceberg, it’s essential to engage in routine maintenance tasks to optimize table metadata file management, preventing a large number of unnecessary files from accumulating and promptly removing any unused files. The objective of this phase was to build another framework that can perform these types of tasks on the tables within the data lake.

The following diagram illustrates the architecture.

Maintenance

The framework, as well as the other ones, receives a configuration file (YAML files) indicating the tables and the list of maintenance tasks with their respective parameters. It was built on PySpark so that it could run as an Amazon EMR Serverless job and could be orchestrated using the orchestration framework just like the other frameworks built as part of this solution.

The following maintenance tasks are supported by the framework:

  • Expire snapshots – Snapshots can be used for rollback operations as well as time traveling queries. However, they can accumulate over time and can lead to performance degradation. It’s highly recommended to regularly expire snapshots that are no longer needed.
  • Remove old metadata files – Metadata files can accumulate over time just like snapshots. Removing them regularly is also recommended, especially when dealing with streaming or micro-batching operations, which was one of the cases of the overall solution.
  • Compact files – As the number of data files increases, the number of metadata stored in the manifest files also increases, and small data files can lead to less efficient queries. Because this solution uses a streaming and micro-batching application writing into Iceberg tables, the size of the files tends to be small. For this reason, a method to compact files was imperative to enhance the overall performance.
  • Hard delete data – One of the requirements was to be able to perform hard deletes in the data older than a certain period of time. This implies removing expiring snapshots and removing metadata files.

The maintenance tasks were scheduled with different frequencies depending on the use case and the specific task. For this reason, the schedule information for this tasks is defined in each of the YAML files of the specific use case.

At the time this framework was implemented, there was no any automatic maintenance solution on top of Iceberg tables. At AWS re:Invent 2024, Amazon S3 Tables functionality has been released to automatize the maintenance of Iceberg Tables . This functionality automates file compaction, snapshot management, and unreferenced file removal.

Conclusion

Building a data platform on top of standarized frameworks that use metadata for different aspects of the data handling process, from data migration and ingestion to orchestration, enhances the visibility and control over each of the phases and significantly speeds up implementation and development processes. Furthermore, by using services such as Amazon EMR Serverless and DynamoDB, you can bring all the benefits of serverless architectures, including scalability, simplicity, flexible integration, improved reliability, and cost-efficiency.

With this architecture, Jumia was able to reduce their data lake cost by 50%. Furthermore, with this approach, data and DevOps teams were able to deploy complete infrastructures and data processing capabilities by creating metadata files along with Spark SQL files. This approach has reduced turnaround time to production and reduced failure rates. Additionally, AWS Lake Formation provided the capabilities to collaborate and govern datasets on various storage layers on the AWS platform and externally.

Leveraging AWS for our data platform has not only optimized and reduced our infrastructure costs but also standardized our workflows and ways of working across data teams and established a more trustworthy single source of truth for our data assets. This transformation has boosted our efficiency and agility, enabling faster insights and enhancing the overall value of our data platform.

– Hélder Russa, Head of Data Engineering at Jumia Group.

Take the first step towards streamlining the data migration process now, with AWS.


About the Authors

Ramón Díez is a Senior Customer Delivery Architect at Amazon Web Services. He led the project with the firm conviction of using technology in service of the business.

Paula Marenco is a Data Architect at Amazon Web Services, she enjoys designing analytical solutions that bring light into complexity, turning intricate data processes into clear and actionable insights. Her work focuses on making data more accessible and impactful for decision-making.

 Hélder Russa is the Head of Data Engineering at Jumia Group, contributing to the strategy definition, design, and implementation of multiple Jumia data platforms that support the overall decision-making process, as well as operational features, data science projects, and real-time analytics.

Pedro Gonçalves is a Principal Data Engineer at Jumia Group, responsible for designing and overseeing the data architecture, emphasizing on AWS Platform and datalakehouse technologies to ensure robust and agile data solutions and analytics capabilities.

[$] Process creation in io_uring

Post Syndicated from corbet original https://lwn.net/Articles/1002371/

Back in 2022, Josh Triplett presented a
plan
to implement a “spawn new process” functionality in the io_uring
subsystem. There was a fair amount of interest at the time, but developers
got distracted, and the work did not progress. Now, Gabriel Krisman
Bertazi has returned with a patch series
updating and improving Triplett’s work. While interest in this
functionality remains, it may still take some time before it is ready for
merging into the mainline.

Hi Claude, build an MCP server on Cloudflare Workers

Post Syndicated from Dina Kozlov original https://blog.cloudflare.com/model-context-protocol/

In late November 2024, Anthropic announced a new way to interact with AI, called Model Context Protocol (MCP). Today, we’re excited to show you how to use MCP in combination with Cloudflare to extend the capabilities of Claude to build applications, generate images and more. You’ll learn how to build an MCP server on Cloudflare to make any service accessible through an AI assistant like Claude with just a few lines of code using Cloudflare Workers. 

A quick primer on the Model Context Protocol (MCP)

MCP is an open standard that provides a universal way for LLMs to interact with services and applications. As the introduction on the MCP website puts it,

“Think of MCP like a USB-C port for AI applications. Just as USB-C provides a standardized way to connect your devices to various peripherals and accessories, MCP provides a standardized way to connect AI models to different data sources and tools.” 

From an architectural perspective, MCP is comprised of several components:

  • MCP hosts: Programs or tools (like Claude) where AI models operate and interact with different services

  • MCP clients: Client within an AI assistant that initiates requests and communicates with MCP servers to perform tasks or access resources

  • MCP servers: Lightweight programs that each expose the capabilities of a service

  • Local data sources: Files, databases, and services on your computer that MCP servers can securely access

  • Remote services: External Internet-connected systems that MCP servers can connect to through APIs

Imagine you ask Claude to send a message in a Slack channel. Before Claude can do this, Slack must communicate which tools are available. It does this by defining tools — such as “list channels”, “post messages”, and “reply to thread” — in the MCP server. Once the MCP client knows what tools it should invoke, it can complete the task. All you have to do is tell it what you need, and it will get it done. 

Allowing AI to not just generate, but deploy applications for you

What makes MCP so powerful? As a quick example, by combining it with a platform like Cloudflare Workers, it allows Claude users to deploy a Cloudflare Worker in just one sentence, resulting in a site like this: 



But that’s just one example. Today, we’re excited to show you how you can build and deploy your own MCP server to allow your users to interact with your application directly from an LLM like Claude, and how you can do that just by writing a Cloudflare Worker.

Simplifying your MCP Server deployment with workers-mcp

The new workers-mcp tooling handles the translation between your code and the MCP standard, so that you don’t have to do the maintenance work to get it set up.

Once you create your Worker and install the MCP tooling, you’ll get a worker-mcp template set up for you. This boilerplate removes the overhead of configuring the MCP server yourself:

import { WorkerEntrypoint } from 'cloudflare:workers'
import { ProxyToSelf } from 'workers-mcp'
export default class MyWorker extends WorkerEntrypoint<Env> {
  /**
   * A warm, friendly greeting from your new Workers MCP server.
   * @param name {string} the name of the person we are greeting.
   * @return {string} the contents of our greeting.
   */
  sayHello(name: string) {
    return `Hello from an MCP Worker, ${name}!`
  }
  /**
   * @ignore
   **/
  async fetch(request: Request): Promise<Response> {
    return new ProxyToSelf(this).fetch(request)
  }
}

Let’s unpack what’s happening here. This provides a direct link to MCP. The ProxyToSelf logic ensures that your Worker is wired up to respond as an MCP server, without any complex routing or schema definitions. 

It also provides tool definition with JSDoc. You’ll notice that the `sayHello` method is annotated with JSDoc comments describing what it does, what arguments it takes, and what it returns. These comments aren’t just for human readers, but they’re also used to generate documentation that your AI assistant (Claude) can understand. 

Adding image generation to Claude

When you build an MCP server using Workers, adding custom functionality to an LLM is easy. Instead of setting up the server infrastructure, defining request schemas, all you have to do is write the code. Above, all we did was generate a “hello world”, but now let’s power up Claude to generate an image, using Workers AI:

import { WorkerEntrypoint } from 'cloudflare:workers'
import { ProxyToSelf } from 'workers-mcp'

export default class ClaudeImagegen extends WorkerEntrypoint<Env> {
 /**
   * Generate an image using the flux-1-schnell model.
   * @param prompt {string} A text description of the image you want to generate.
   * @param steps {number} The number of diffusion steps; higher values can improve quality but take longer.
   */
  async generateImage(prompt: string, steps: number): Promise<string> {
    const response = await this.env.AI.run('@cf/black-forest-labs/flux-1-schnell', {
      prompt,
      steps,
    });
        // Convert from base64 string
        const binaryString = atob(response.image);
        // Create byte representation
        const img = Uint8Array.from(binaryString, (m) => m.codePointAt(0)!);
        
        return new Response(img, {
          headers: {
            'Content-Type': 'image/jpeg',
          },
        });
      }
  /**
   * @ignore
   */
  async fetch(request: Request): Promise<Response> {
    return new ProxyToSelf(this).fetch(request)
  }
}

Once you update the code and redeploy the Worker, Claude will now be able to use the new image generation tool. All you have to say is: “Hey! Can you create an image of a lava lamp wall that lives in San Francisco?”


If you’re looking for some inspiration, here are a few examples of what you can build with MCP and Workers: 

  • Let Claude send follow-up emails on your behalf using Email Routing

  • Ask Claude to capture and share website previews via Browser Automation

  • Store and manage sessions, user data, or other persistent information with Durable Objects

  • Query and update data from your D1 database 

  • …or call any of your existing Workers directly!

Why use Workers for building your MCP server?

To build out an MCP server without access to Cloudflare’s tooling, you would have to: initialize an instance of the server, define your APIs by creating explicit schemas for every interaction, handle request routing, ensure that the responses are formatted correctly, write handlers for every action, configure how the server will communicate, and more… As shown above, we do all of this for you.

For reference, an implementation may look something like this:

import { Server } from "@modelcontextprotocol/sdk/server/index.js";
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

const server = new Server({ name: "example-server", version: "1.0.0" }, {
  capabilities: { resources: {} }
});

server.setRequestHandler(ListResourcesRequestSchema, async () => {
  return {
    resources: [{ uri: "file:///example.txt", name: "Example Resource" }]
  };
});

server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
  if (request.params.uri === "file:///example.txt") {
    return {
      contents: [{
        uri: "file:///example.txt",
        mimeType: "text/plain",
        text: "This is the content of the example resource."
      }]
    };
  }
  throw new Error("Resource not found");
});

const transport = new StdioServerTransport();
await server.connect(transport);

While this works, it requires quite a bit of code just to get started. Not only do you need to be familiar with the MCP protocol, but you need to complete a fair amount of set up work (e.g. defining schemas) for every action. Doing it through Workers removes all these barriers, allowing you to spin up an MCP server without the complexity.

We’re always looking for ways to simplify developer workflows, and we’re excited about this new standard to open up more possibilities for interacting with LLMs, and building agents.

If you’re interested in setting this up, check out this tutorial which walks you through these examples. We’re excited to see what you build. Be sure to share your MCP server creations with us on Discord, X, or Bluesky!

Security updates for Friday

Post Syndicated from jzb original https://lwn.net/Articles/1003019/

Security updates have been issued by Debian (chromium and gunicorn), Fedora (jupyterlab), Oracle (bluez, containernetworking-plugins, edk2:20220126gitbb1bba3d77, edk2:20240524, gstreamer1-plugins-base, gstreamer1-plugins-good, kernel, libsndfile, libsndfile:1.0.31, mpg123, mpg123:1.32.9, pam, python3.11-urllib3, skopeo, tuned, and unbound:1.16.2), SUSE (avahi, docker, emacs, govulncheck-vulndb, haproxy, kernel, libmozjs-128-0, python-grpcio, python310-xhtml2pdf, sudo, and tailscale), and Ubuntu (dpdk, linux-hwe-5.15, and linux-iot).

Bring multimodal real-time interaction to your AI applications with Cloudflare Calls

Post Syndicated from Will Allen original https://blog.cloudflare.com/bring-multimodal-real-time-interaction-to-your-ai-applications-with-cloudflare-calls/

OpenAI announced support for WebRTC in their Realtime API on December 17, 2024. Combining their Realtime API with Cloudflare Calls allows you to build experiences that weren’t possible just a few days earlier.

Previously, interactions with audio and video AIs were largely single-player: only one person could be interacting with the AI unless you were in the same physical room. Now, applications built using Cloudflare Calls and OpenAI’s Realtime API can now support multiple users across the globe simultaneously seeing and interacting with a voice or video AI.

Have your AI join your video calls 

Here’s what this means in practice: you can now invite ChatGPT to your next video meeting:

We built this into our Orange Meets demo app to serve as an inspiration for what is possible, but the opportunities are much broader.

In the not-too-distant future, every company could have a  ‘corporate AI’ they invite to their internal meetings that is secure, private and has access to their company data. Imagine this sort of real-time audio and video interactions with your company’s AI:

“Hey ChatGPT, do we have any open Jira tickets about this?”

“Hey Company AI, who are the competitors in the space doing Y?”

“AI, is XYZ a big customer? How much more did they spend with us vs last year?”

There are similar opportunities if your application is built for consumers: broadcasts and global livestreams can become much more interactive. The murder mystery game in the video above is just one example: you could build your own to play live with your friends in different cities.  

WebRTC vs. WebSockets

These interactive multimedia experiences are enabled by the industry adoption of WebRTC, which stands for Web Real-time Communication.

Many real-time product experiences have historically used Websockets instead of WebRTC. Websockets operate over a single, persistent TCP connection established between a client and server. This is useful for maintaining a data sync for text-based chat apps or maintaining the state of gameplay in your favorite video game. Cloudflare has extensive support for Websockets across our network as well as in our AI Gateway.

If you were building a chat application prior to WebSockets, you would likely have your client-side app poll the server every n seconds to see if there are new messages to be displayed. WebSockets eliminated this need for polling. Instead, the client and the server establish a persistent, long-running connection to send and receive messages.

However, once you have multiple users across geographies simultaneously interacting with voice and video, small delays in the data sync can become unacceptable product experiences. Imagine building an app that does real-time translation of audio. With WebSockets, you would need to chunk the audio input, so each chunk contains 100–500 milliseconds of audio. That chunking size, along with the head-of-line blocking, becomes the latency floor for your ability to deliver a real-time multimodal experience to your users.

WebRTC solves this problem by having native support for audio and video tracks over UDP-based channels directly between users, eliminating the need for chunking. This lets you stream audio and video data to an AI model from multiple users and receive audio and video data back from the AI model in real-time. 

Realtime AI fanout using Cloudflare Calls

Historically, setting up the underlying infrastructure for WebRTC — servers for media routing, TURN relays, global availability — could be challenging.

Cloudflare Calls handles the entirety of this complexity for developers, allowing them to leverage WebRTC without needing to worry about servers, regions, or scaling. Cloudflare Calls works as a single mesh network that automatically connects each user to a server close to them. Calls can connect directly with other WebRTC-powered services such as OpenAI’s, letting you deliver the output with near-zero latency to hundreds or thousands of users.

Privacy and security also come standard: all video and audio traffic that passes through Cloudflare Calls is encrypted by default. In this particular demo, we take it a step further by creating a button that allows you to decide when to allow ChatGPT to listen and interact with the meeting participants, allowing you to be more granular and targeted in your privacy and security posture. 

How we connected Cloudflare Calls to OpenAI’s Realtime API 

Cloudflare Calls has three building blocks: Applications, Sessions, and Tracks:

“A Session in Cloudflare Calls correlates directly to a WebRTC PeerConnection. It represents the establishment of a communication channel between a client and the nearest Cloudflare data center, as determined by Cloudflare’s anycast routing … 

Within a Session, there can be one or more Tracks. … [which] align with the MediaStreamTrack concept, facilitating audio, video, or data transmission.”

To include ChatGPT in our video conferencing demo, we needed to add ChatGPT as a track in an ongoing session. To do this, we connected to the Realtime API in Orange Meets:

// Connect Cloudflare Calls sessions and tracks like a switchboard
async function connectHumanAndOpenAI(
	humanSessionId: string,
	openAiSessionId: string
) {
	const callsApiHeaders = {
		Authorization: `Bearer ${APP_TOKEN}`,
		'Content-Type': 'application/json',
	}
	// Pull OpenAI audio track to human's track
	await fetch(`${callsEndpoint}/sessions/${humanSessionId}/tracks/new`, {
		method: 'POST',
		headers: callsApiHeaders,
		body: JSON.stringify({
			tracks: [
				{
					location: 'remote',
					sessionId: openAiSessionId,
					trackName: 'ai-generated-voice',
					mid: '#user-mic',
				},
			],
		}),
	})
	// Pull human's audio track to OpenAI's track
	await fetch(`${callsEndpoint}/sessions/${openAiSessionId}/tracks/new`, {
		method: 'POST',
		headers: callsApiHeaders,
		body: JSON.stringify({
			tracks: [
				{
					location: 'remote',
					sessionId: humanSessionId,
					trackName: 'user-mic',
					mid: '#ai-generated-voice',
				},
			],
		}),
	})
}

This code sets up the bidirectional routing between the human’s session and ChatGPT, which would allow the humans to hear ChatGPT and ChatGPT to hear the humans.

You can review all the code for this demo app on GitHub. 

Get started today 

Give the Cloudflare Calls + OpenAI Realtime API demo a try for yourself and review how it was built via the source code on GitHub. Then get started today with Cloudflare Calls to bring real-time, interactive AI to your apps and services.

Какво следва? Украйнааа и еврооо

Post Syndicated from Емилия Милчева original https://www.toest.bg/kakvo-sledva-ukraynaaa-i-evrooo/

Какво следва? Украйнааа и еврооо

Ако човек следи комюникетата от преговорите за съставяне на редовно правителство между четирите политически сили, би помислил, че всичко върви по мед, масло и свинско със зеле. В прессъобщенията изобилстват обсъдени теми – законодателни приоритети, социални мерки, инфраструктурни проекти и дори амбициозни намерения за пълен 4-годишен мандат. Изглеждат като съвсем истински преговори за коалиционно управление, а участниците – ГЕРБ–СДС, „Демократична България“ (ДБ), „Има такъв народ“ (ИТН) и БСП – Обединена левица, позиционират себе си като национално отговорни партии, погълнати от задачата да работят за доброто на държавата и нормализацията на политическия живот. И разбира се, за своето собствено добруване. 

Онова, което не се вижда зад декорацията, са същинските преговори кой какви ресурси ще контролира, как ще бъдат разпределени постовете в бъдещо правителство, позициите в регулаторите и договореностите за съдебната власт, и най-сетне – кой ще е министър-председател (защото мантрата за Бойко Борисов премиер не върви). Изобщо колко от „добруването“ ще стигне до гражданите? 

Но участниците следва да се договорят първо по стратегическите приоритети, които да дадат рамка на бъдещото споразумение: еврозоната, стратегията за българската енергетика, в това число въглищната индустрия, подкрепата за Украйна, концепцията за националната сигурност. А те стъпват на пръсти около тях, един вид превенция да не се развали едва наченалият диалог с… неудобни въпроси. Това е сигурен признак, че ще бъдат направени сериозни компромиси, а власт, която се крепи на такива, бързо се срутва. Неотдавнашната сглобка е доказателство.

Украйна и споразумението за сигурност

Скандалът, избухнал заради споразумението с Украйна в областта на сигурността за срок от 10 години, е ярък пример как стратегически теми, свързани с по-голямата европейска интеграция на България, могат да бъдат превърнати в политически футбол. (Случайно или не, шумът съвпадна с посещението на генералния секретар на НАТО Марк Рюте в България.) Въпреки решението на Министерския съвет от ноември 2023 г. за одобрение на документа, неговото подписване се забави с месеци, включително и заради Украйна. България не го е подписала, също и Унгария, Малта, Кипър, Австрия и Словакия – все държави от ЕС, в които руското присъствие е осезателно или чрез капитали, или чрез енергийни ресурси и влияние, осъществявано чрез политици и медии. 

Служебният премиер Димитър Главчев прехвърли отговорността на парламента в навечерието на заминаването си за Брюксел, където се срещна с украинския президент Зеленски, макар ратификация да не е необходима. Председателката на парламента доц. Наталия Киселова (БСП – Обединена левица) не включи точката за споразумението в дневния ред. Олигархът Делян Пеевски от групата, предложила точката (ДПС – Ново начало), се възползва, за да демонстрира евроатлантизъм. 

Ако днес не дадем мандат на Главчев да одобри споразумението с Украйна, значи бройте ги… Който не го подкрепи, е слуга на Москва… По гласуването ще видим кои са евроатлантическите партии.

Пред БНР бившата външна министърка Гергана Паси определи случая като дипломатически скандал и отиде по-далеч.

Репликите в пленарна зала на НС показват, че всяко действие ще се използва за объркване на обърканото ни общество. Терминът е „рефлексивен контрол“ – неприятелят Русия се опитва да ни внуши решение, което е в противовес със собствения ни национален интерес.

А изявление на Бойко Борисов даде основания да бъде заподозрян в тръмпистки завой.

Преди 6 месеца категорично щяхме да подкрепим такъв договор. Сега, когато Европа и САЩ, и изказванията на Тръмп за прекратяване на войната в Украйна, ние малко като на 9 септември фабрика купуваме. Ние с Украйна ще работим, ще участваме във възстановяването на мирния процес и просто едно редовно правителство ще подпише изгоден взаимно документ.

Украйна е лакмус за коалиционните намерения и устойчивост. Подписването или отказът от споразумението ще покаже доколко бъдещото правителство е готово да се обвърже с ясна позиция в подкрепа на евроатлантическата ориентация на България. А дали въпросът ще бъде използван като повод за вътрешнополитически разпри? Напълно възможно. Зад въртеливата позиция на Главчев се спотайват онези (сред тях и Пеевски), които работят за нови предсрочни избори.

БСП например се обяви публично – в отворено писмо до Главчев, против споразумението, защото е „срещу интересите на българския народ“. (Но преди две години и половина бившата вече лидерка на БСП Корнелия Нинова, министърка на икономиката в кабинета на Кирил Петков, се кълнеше, че „нито един патрон не е заминал за Украйна“, а военната индустрия не смогваше от поръчки.)

С това споразумение България поема 10-годишен ангажимент към Украйна за политическа, икономическа и социална помощ за украинските бежанци, разселени на територията на Република България, обучение на военни и продължаваща военна помощ. Заложена е възможността то да бъде удължено и след този период.

Как толкова категорично несъгласие се връзва с уверението на Борисов, че редовно правителство ще подпише документа? Или просто ще се „изчегърта“ войната в Украйна от коалиционните договорки, което би означавало отстъпление пред страха от вътрешни противоречия и натиск от Русия вместо ясни ангажименти към националната сигурност и европейската солидарност? За ДБ отстъпление не може да има. Във Facebook депутатът Ивайло Мирчев коментира, че „Украйна остава стратегически приоритет, за който ще преговаряме и в светлината на който ще оценяваме цялостния резултат от преговорите“.

От една страна, бъдещите коалиционни партньори ще трябва да демонстрират единна позиция за Украйна, ако искат да убедят съюзниците. От друга страна, колебание или липса на такава може да бъде тълкувано като слабост, което ще подкопае и без това крехката стабилност на евентуална нова коалиция. 

„Македонияааа!“ извика лидерът на ИТН Слави Трифонов през юни 2022 г. и правителството падна. 

Сега се плаши с Украйна.

Какво се случва с еврото?

Безпрецедентен фронт от финансисти и анализатори се обяви срещу проектобюджета за 2025-та, внесен от служебното правителство, заради неговия „разходен популизъм“. Някои от изразените опасения са, че мерките в него ще попречат на пътя на България към еврото. А за първи път БНБ си позволи да отправи призив да не се приема бюджетът, внесен от служебното правителство. 

„Топката е в политиците“, каза гуверньорът Димитър Радев, според когото за България има шансове да бъде прието решение за еврозоната догодина, защото през януари ще бъде изпълнен последният технически критерий за инфлацията. Ако се случи в средата на годината, то от 1 януари 2026 г. българското евро ще е факт. Но ако бюджетът за догодина бъде приет във вида, в който е внесен, с гигантските разходи за възнаграждения, еврозоната се отдалечава.

Трасирането на пътя към единната европейска валута е особено трудно в държава, в която липсва последователност и ангажимент от страна на правителства и политически лидери да предприемат необходимите стъпки за ускоряване на процеса по приемане на еврото. Проблемът с икономическата подготовка на България за еврозоната е свързан с необходимостта от структурни реформи в публичните финанси, съдебната система и държавните институции. След пълноправното включване в Шенген шансовете нарастват.

Засега ГЕРБ–СДС и ДБ са декларирали, че еврозоната остава приоритет. За този приоритет обаче БСП и ИТН мълчат – те са противници на единната валута, а значи не биха я приели.

Последствията от провала

Първият работен ден на парламента след дългата коледна ваканция, която започва на 23 декември, е 8 януари, седмица преди заседанието на ВСС, насрочено за изслушване на единствения кандидат за главен прокурор – Борислав Сарафов. Конституционният съд даде зелена светлина за избора на бившата дясна ръка на бившия главен прокурор Гешев, като отказа да се произнесе по исканията на партии за това какво може да прави Висшият съдебен съвет (ВСС) с изтекъл мандат. 

Законопроектът за промени в Закона за съдебната власт, внесен от ПП–ДБ, спира Сарафов да завземе поста и го сваля и от „изпълняващ функциите“. Но предизвикателството е дали ще бъде приет до изслушването му от ВСС. Ако това не стане, президентът Румен Радев може да откаже да подпише указа за назначението и да върне избора на ВСС – председателката на парламента Наталия Киселова го спомена няколко пъти като възможност. Така Радев би могъл да осигури време за приемане на законопроекта и на второ четене. Освен че ще натрупа рейтинг като радетел за върховенство на закона и борец срещу задкулисието.

Може да се окаже обаче, че Сарафов ще изненада всички, като се оттегли (или бъде оттеглен от кръговете зад себе си). Фигура на обвинител-номер-едно, зад която няма стабилно политическо мнозинство, не е изгодна.

Също като Гешев, който се обърна срещу благодетелите си в последните седмици на поста, и сега прокуратурата развъртя сопата с искания за сваляне на депутатски имунитети. Въпреки опитите за многообразие най-силно пострада ПП, в това число и ударът срещу Асен Василев с ареста на приближения му Лъчезар Ставрев. Лъчо – шофьор, охранител, сътрудник на Василев, е бил и член на политическия му кабинет, когато беше министър на финансите. Показания на обвинени за аферата в митниците замесиха името му като човек, разпореждал кадрови промени и събиращ подкупи. Василев отрича, както и самият Ставрев.

България посреща новата 2025 година в очакване ще има ли редовно правителство. Година по-рано тръпнеше дали ще е успешна ротацията, при която Мария Габриел (ГЕРБ–СДС) трябваше да смени премиера Николай Денков (ПП–ДБ). Борисов я определи тогава като скачване на космически кораб с орбитална станция. Неуспешно. 

Сега наблюдаваме едни почти истински преговори за редовно правителство. 

The collective thoughts of the interwebz