Post Syndicated from The Atlantic original https://www.youtube.com/shorts/Kt9HvSa8OXQ
Friday Squid Blogging: Squid Helps Discover New Marine Species
Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2026/07/friday-squid-blogging-squid-helps-discover-new-marine-species.html
The Squid is a new scientific machine:
One of the technological breakthroughs was the onboard use of a spinning wheel confocal microscope, nicknamed the Squid, which uses lasers to scan microscopic details of how organisms are put together. “That opens up a whole new world of exploring. We could see cells interacting with each other, exchanging material and building skeletons. And we could do that live on the ship, when usually it takes a couple of weeks of staining and mounting to see anything,” Osborn said.
The expedition discovered thirty-one new marine species in two weeks. The article doesn’t say if any of them were new species of squid.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
HIPAA Security Rule on AWS – Technical Safeguards Implementation and Readiness Guidance
Post Syndicated from Abdul Javid original https://aws.amazon.com/blogs/security/hipaa-security-rule-on-aws-technical-safeguards-implementation-and-readiness-guidance/
Today, we’re releasing the HIPAA Security Rule on AWS: Technical Safeguards Implementation and Readiness Guidance. This helps covered entities and business associates configure, implement, and evidence compliance with the HIPAA Security Rule Technical Safeguard requirements (45 CFR §164.312) when building healthcare workloads on AWS.
The HIPAA Security Rule’s Technical Safeguards (§164.312) define five standards and nine implementation specifications covering access control, audit controls, integrity, authentication, and transmission security.
The guidance also covers the 2025 NPRM proposed changes, including encryption at rest and in transit becoming required, multi-factor authentication (MFA) becoming mandatory for all electronic Personal Health Information (ePHI) access, and new specifications for network segmentation, configuration management, anti-malware protection, patch management, software removal, incident response and breach notification.
Key topics included
- Shared responsibility for HIPAA on AWS – A responsibility matrix mapping each §164.312 specification to what AWS manages nd what the customer must configure and operate.
- ePHI boundary architecture – Guidance on establishing a defined ePHI boundary
- ePHI data flow and encryption – A reference architecture tracing ePHI with the applicable §164.312 specification
- Foundation checklist – Prerequisite recommendation before configuring individual Technical Safeguard controls.
This guidance is written for cloud architects, security engineers, CISOs, and compliance teams at covered entities and business associates building or operating AWS healthcare workloads. It assumes familiarity with AWS services and is intended as a practical implementation reference, not a legal or regulatory interpretation. This guidance focuses exclusively on Technical Safeguards.
HHS published a Notice of Proposed Rulemaking in January 2025, proposing significant updates to the HIPAA Security Rule—including eliminating the Addressable designation, making encryption, MFA, and asset inventory mandatory, and introducing new technical requirements not present in the current rule. As of June 2026, the final rule has not been published. This guidance covers both the current rule and the proposed changes and recommends treating all specifications as Required for new workloads.
Download HIPAA Security Rule on AWS: Technical Safeguards Implementation and Readiness Guidance.
For questions about HIPAA readiness on AWS, including Administrative Safeguards, Physical Safeguards, risk analysis, and assessment preparation, contact the AWS Security Assurance Services team or your AWS account representative.
This guidance is provided by AWS Security Assurance Services, LLC, a HITRUST External Assessor Firm and PCI-QSAC along with contribution from AWS HCLS, AWS Compliance teams. It is for informational and guidance purposes only and does not constitute legal, regulatory, or compliance advice. Recipients are solely responsible for determining applicability to their specific environments and legal obligations.
If you have feedback about this post, submit comments in the Comments section below.
Anthropic’s Opus 5 Is Better at Resisting Prompt Injection
Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2026/07/anthropics-opus-5-is-better-at-resisting-prompt-injection.html
The chart is interesting.
On the IPI benchmark, Opus 5 improved over Opus 4.8, reducing the probability of an attacker succeeding within 15 attempts from 5.5% to 2.0%, and from 0.5% to 0.2% on 1 attempt. It also improved on Sonnet 5 (5.9% at k=15) and Mythos 5 (2.6%), making it the most robust model evaluated. Opus 5 also outperformed all non-Claude models on this benchmark. The most robust non-Claude model was Muse Spark at 16.5% within 15 attempts—more than eight times Opus 5’s rate. The most capable GPT 5.6 variant, Sol, was comparable to its predecessor GPT 5.5 (20.0% versus 20.8% within 15 attempts), and was 10 times as likely to be successfully attacked as Claude Opus 5 at 2.0%. The other GPT 5.6 variants are less robust, at 30.4% (Terra) and 43.9% (Luna). A single attempt against GPT 5.6 Sol succeeded 3.1% of the time, higher than the 2.0% an attacker achieved against Opus 5 after fifteen attempts.
We know that preventing prompt injection is impossible in the general case. But we are getting much better at blocking it in specific cases.
Servo 0.4.0 released
Post Syndicated from jzb original https://lwn.net/Articles/1086555/
The Servo web-browser engine
project has published an update
about all of the changes that landed in June 2026, along with version
0.4.0 of the Servo Tech Demo. This release includes a record 558
commits, better
layout correctness for web sites, improved WebGPU support, enhancements
for users who are using the servoshell
test browser, and many performance
and stability fixes.
Modeling Device Capabilities for Analytics
Post Syndicated from Netflix Technology Blog original https://netflixtechblog.com/modeling-device-capabilities-for-analytics-e7607acebde8
by Aarti Laddha, Richard Diaz-Cool, Rishika Idnani, Venkatesh Selveraj
Netflix supports a vast and evolving set of features and content types, ranging from 4K streaming and immersive audio to live streaming and cloud gaming, across a diverse ecosystem of devices. However, not all devices are created equal. Hardware limitations such as available RAM, CPU cores, display capabilities, or platform support mean that some features cannot be supported on certain device models. To ensure the best possible user experience, we rely on a deep understanding of device capabilities. We have invested in building a comprehensive device capability data model and integrating feature flags from internal systems, paving the way for smarter, more granular feature management across our global device landscape. This approach helps us identify bottlenecks in feature penetration and accelerates the pace of innovation.
We have designed our data storage and modeling strategies to efficiently support analytics at scale. We use a cumulative table to process information about the device’s capabilities. This table is structured to efficiently capture the latest state of each device and its associated capabilities (like Screen resolutions, Video Profiles Supported, Surround Sound, RAM size etc) making it ideal for analytics and reporting use cases.
{
"Screen Height": ["720"],
"Screen Width": ["1280"],
"Video Profiles":
[
"playready",
"hevc",
],
}
For aggregate analytics, we leverage a histogram table that captures active device counts over the past 28 days, broken down by device model and software version. This table also records the number of devices supporting specific capabilities, enabling detailed distribution analysis. One use case for this histogram data is to analyze the distribution of external display capabilities attached to streaming sticks. For example, the histogram below shows that out of total X number of devices, all supported the HD profile (playready), while only 20% devices supported the UHD profile (hevc).
{
"Video Profiles": {
"playready": 100%, # HD profile
"hevc": 20% # UHD profile
}
}
We have built analytical products that leverage these datasets to provide a comprehensive view of feature reach such as 4K Ultra HD, Netflix Spatial Audio, Cloud Gaming and the latest UI. By relying on data-driven insights, we can make informed decisions about which features to enable on specific devices, ensuring both performance and reliability.
Modeling Device Capabilities for Analytics was originally published in Netflix TechBlog on Medium, where people are continuing the conversation by highlighting and responding to this story.
S9 E20: Afghanistan Update & AI Images: Last Week Tonight with John Oliver
Post Syndicated from LastWeekTonight original https://www.youtube.com/watch?v=ME7AUUSlnmo
Don’t stop early: Case-folding source code at memory speed
Post Syndicated from Alexander Neubeck original https://github.blog/engineering/architecture-optimization/dont-stop-early-case-folding-source-code-at-memory-speed/
Suppose a user searches for café and your corpus contains CAFÉ, or they type straße and you’ve stored STRASSE. To make these count as matches, you need a canonical form that erases case distinctions, so that two strings which differ only in case compare equal. That form is case folding, and it shows up wherever text is matched rather than displayed: search engines, regex (?i) flags, case-insensitive usernames and hostnames.
It’s a basic operation, but at GitHub we run it a lot. Blackbird, GitHub’s code search engine, indexes over 180 million repositories—more than 480TB of source code. Every byte is case-folded before we extract ngrams and build the index, and for every potential query result, another (implicit or explicit) case folding operation is needed to locate matches. At that scale, the speed of even a basic operation starts to matter.
This post is about how we made it fast, and it starts somewhere counterintuitive: the biggest win in the ASCII fast path came from removing an optimization, not adding one. It turns out to be faster to sweep the whole buffer with no branches than to stop early at the first non-ASCII byte. We open-sourced the result as a Rust crate called casefold.
Folding is not lowercasing
It is tempting to reach for str::to_lowercase, but lowercasing and folding are different operations with different goals:
Lowercasing is for display, and it’s locale- and context-sensitive: Greek final sigma lowercases to ς at the end of a word and σ elsewhere, and Turkish I lowercases differently than English I. Case folding is for comparison, and it’s deliberately context-free and locale-independent. The point is a relation that stays stable and symmetric, so that if A folds to match B, B folds to match A in any locale. The Unicode Character Database ships an explicit CaseFolding.txt for exactly that.
The two operations diverge on real characters—ß, İ, final sigma—which is why lowercasing as a stand-in silently produces wrong matches. This crate implements only the simple (1-to-1) folds—statuses C and S in CaseFolding.txt—and not the multi-character “full” folds (ß → ss) or Turkic locale folds (the dotted İ). This isn’t an unusual choice: common tools and regex engines like ripgrep make the same restriction, and being consistent across tools is important.
The counterintuitive core: Don’t stop early
We deal mostly with source code, so the text we fold is overwhelmingly ASCII and making it run at memory speed is the single most important thing we can do. Everything else just has to keep the rare non-ASCII path from spoiling it.
The fold of an ASCII letter is trivial—A..=Z map to a..=z, everything else is unchanged—so the ASCII pass is really just “sweep the buffer, lowercase in place.” Ask any LLM for it and you might get something like this:
let bytes = s.as_bytes_mut();
for (i, b) in bytes.iter_mut().enumerate() {
if *b >= 0x80 {
break; // non-ASCII at index i: hand the rest to the Unicode path
}
if b.is_ascii_uppercase() {
*b += 32; // 'A'..='Z' → 'a'..='z'
}
}
It looks ideal: do the cheap byte work, and the instant you hit a non-ASCII byte, break and let the “real” Unicode path take over: “only do the cheap work until you have to.” On an Apple M4 this runs at about 3 GiB/s. That sounds fine in isolation, but it is more than 15× short of “optimal” because of the if branches.
Let’s delete every branch, line by line:
if b >= 0x80 { break }→ don’t stop at all.ORevery byte into an accumulator and test it once, after the loop:high_bit_acc |= *b. Same information (was there any non-ASCII byte?), zero branches in the body.- The
A..=Zrange test → make it arithmetic.b.wrapping_sub(b'A') < 26is true exactly forA..=Z(any other byte wraps to ≥ 26), yielding a 0/1 mask with no branch. - The conditional write → fold the mask into the store.
| (is_upper << 5)sets bit 5—turning an upper-case letter lower-case and being a no-op on everything else—the byte is always written, never branched on.
What’s left has no branch in its body and no early exit:
let mut high_bit_acc: u8 = 0;
for b in &mut bytes {
high_bit_acc |= *b; // detect any non-ASCII byte
let is_upper = b.wrapping_sub(b'A') < 26; // branchless A..=Z test
*b |= u8::from(is_upper) << 5; // set bit 5 → lowercase, else no-op
}
if high_bit_acc & 0x80 == 0 {
return bytes; // pure ASCII: already folded in place, no second buffer
}
A loop with no data-dependent control flow is trivially vectorizable: LLVM emits 16-byte-at-a-time NEON and the whole thing runs at > 45 GiB/s—essentially memory bandwidth. And we come out of the pass already knowing, from high_bit_acc, whether there’s any non-ASCII work left to do.
How much did each step matter? Measuring the cumulative ladder on pure ASCII (Apple M4, 5.7 KB buffer):
| Version | Throughput | Vectorized? |
|---|---|---|
| naive (break + branch test) | 3.1 GiB/s | no (0 vector instrs) |
| → branchless test/write, keep break | 2.6 GiB/s | no (0 vector instrs) |
| → drop the early-exit break | 7.6 GiB/s | partially (25 vector instrs) |
| → branchless test + write (the loop) | >45 GiB/s | fully (41 vector instrs) |
The early-exit is what gates vectorization: keep the break but make the body perfectly branch-free and you still get zero vector instructions (~2.6 GiB/s); a data-dependent loop exit is enough on its own to keep the loop scalar. Only once the break is gone can the compiler vectorize. The final step—making the upper-case fold branchless—then turns a partially vectorized loop (which still compiles the conditional store to a compare-blend-masked-store, ~7.6 GiB/s) into the straight-line arithmetic that hits memory bandwidth.
Note: Branchless is a pessimization in scalar code. Look again at the table: making the body branchless while keeping the break (2.6 GiB/s) is actually slower than the naive branchy loop (3.1 GiB/s). The asm explains why. The branchy version only stores a byte when it actually changes one; its conditional strbis skipped for every lowercase letter, digit and space (the vast majority of real text), and the well-predicted branch that guards it is nearly free. The branchless version replaces that rarely taken store with an unconditional strbevery iteration, writing back all ~5,700 bytes instead of just the handful of upper-case ones. Extra write traffic for no benefit. Branchless-write only wins once the loop vectorizes, because then the store becomes a single 16-byte vector write regardless of content, and the per-byte cost disappears. The lesson: a branchless body is worth it only as the enabler for vectorization. On its own, in scalar code, it can cost you. |
There’s also a middle ground, and it’s what standard libraries use. Instead of testing one byte at a time, [u8]::is_ascii scans a machine word at a time—on a 64-bit target it tests 16 bytes per iteration by OR-ing two u64 lanes and checking all their high bits with a single & 0x8080_8080_8080_8080 mask. You can build the ASCII fast path on top of that: chunk-scan to find the ASCII prefix, then run the branchless (vectorizable) convert over it. That keeps the early-exit ability—it still bails on the first non-ASCII block—while letting both halves go fast. The catch is that it reads the data twice (once to scan, once to convert), landing at about 23 GiB/s—roughly half of the single-pass branchless sweep, and ~7× the naive break loop. A solid, general-purpose default; just not the absolute ceiling when you control the whole loop and can fold detection and conversion into one branch-free pass.
Wouldn’t fusing the two passes be faster? It’s the obvious next thought: keep the chunked early-exit but convert each 16-byte block right after you’ve confirmed it’s ASCII, reading the data only once. Measured, it’s ~2.6× slower—8.7 GiB/s versus the two-pass 23. The inner block convert still vectorizes to a single 16-byte op, but now there’s a data-dependent early-exit branch every 16 bytes, and that branch pins the loop to one block at a time: the compiler doesn’t unroll or software-pipeline across blocks, and each iteration pays the full load→test→branch→convert→store latency with nothing to hide it behind. Split into two passes, each one is clean: the scan is a branch-light, store-free word scan that races through memory, and the convert is the fully-vectorized branch-free sweep at >45 GiB/s. Two fast, branch-free passes beat one branchy fused pass—even though the fused version touches the data half as many times. It’s the same lesson one more time: in the hot loop, the branch is the enemy.
Avoiding the heap
Forty-Five GiB/s also means doing zero unnecessary allocation. simple_fold takes the input String by value, owning the heap buffer it can mutate and return it. If the OR-accumulator’s high bit was clear, the input was pure ASCII already folded in place. We hand the same allocation straight back, no second buffer and no copy. Otherwise, we memchrto the first non-ASCII byte and scan the tail from there, leaving the output buffer unallocated (a null write cursor) until we hit a character that folds to different bytes. Text whose multibyte content never folds—CJK, Hangul, Kana, Arabic, Hebrew, symbols—also returns the original allocation untouched, never copying a byte.
Why a second buffer rather than rewriting in place like the ASCII pass? Because folding can make the string longer: almost every fold preserves the UTF-8 length or shrinks it, but two outliers grow—U+023A (Ⱥ) and U+023E (Ɀ) are 2 bytes each yet fold to 3-byte characters (ⱥ, ɀ). Once one appears, the output no longer fits in the input’s bytes, and we need somewhere new to write.
We allocate that buffer once, sized for the worst case, rather than growing it as more folds appear. Incremental reserve calls would mean re-checking capacity, occasionally reallocating, copying everything written so far, and juggling extra length/capacity bookkeeping; a single up-front allocation lets a raw write cursor run straight to the end with none of that. And since the cursor is nulluntil that first growing/changing fold, it doubles as the “have we allocated the extra buffer yet?” flag.
Sizing it needs a bound on growth, and those same two outliers give it: every 2 input bytes yield at most 3 output bytes, capping the output at 1.5× the input—exactly the capacity we reserve:
out = Vec::with_capacity(bytes.len() + bytes.len() / 2 + 4);
After that the loop writes through a raw pointer with no capacity checks and calls set_len once at the end. Two more details keep it branch-light. The run of unchanged bytes between two folds is moved with a single copy_nonoverlapping rather than byte by byte. And each fold unconditionally writes all 4 bytes of a little-endian word before bumping the cursor by only the folded length (1–4)—dropping a branch on the output length from the hot path, with the + 4 in the reservation as the headroom that makes the final character’s over-store safe.
Making Unicode cheap too
When a character does fold, we still don’t want to fall off a cliff—decode UTF-8, hash lookup, re-encode. Unicode 16.0 has 1484 simple-fold mappings, but they’re a very sparse and very structured relation. Four observations shrink them to 1776 bytes and let the fold run without ever decoding a full character.
Even on the non-ASCII path, the overwhelming majority of characters do not fold. The hot operation isn’t really “fold this character,” it’s “does this character fold?” Almost always no. The table has to make that negative test as cheap as possible; the actual folding is the rare case on an already-rare path. That priority is what shapes the layout below—the page bitmap exists precisely so a non-folding character is rejected in a single bit test, straight from its leading UTF-8 bytes, without decoding or scanning anything.
This is exactly why a HashMap<u32, u32> is the wrong shape for the job, not just a bigger one. A hash map is optimized for the hit: it finds a present key in roughly one probe, and only spends extra work (more probes, full key comparison) when load factor or collisions bite. But our workload is dominated by misses—characters that aren’t in the table at all—and a miss is a hash map’s least favorite query: it still has to hash the key, jump to a bucket, and walk the probe sequence far enough to prove absence.
Foldable code points cluster into 64-code-point “pages”
Foldable code points bunch together. Slice the code space into 64-code-point “pages” and the ~1484 folds touch just 59 of ~1960 possible pages. A one-bit-per-page presence bitmap answers the negative test on its own: a clear bit is a definitive “no fold”—copy through, done—which is what makes fold-free scripts cheap. Only on a set bit do we consult a second structure, a cumulative-popcount side table that ranks the page (how many populated pages precede it) to find its slice of entries, storing nothing for the ~1900 empty pages.
let (word_idx, bit_idx, c_len) = if lead < 0xE0 {
(0usize, lead & 0x1F, 2usize) // 2-byte: word 0
} else if lead < 0xF0 {
((lead & 0x0F) as usize, bytes[read + 1] & 0x3F, 3) // 3-byte: word = nibble
} else {
(
(((lead & 0x07) as usize) << 6) | (bytes[read + 1] & 0x3F) as usize,
bytes[read + 2] & 0x3F,
4usize,
) // 4-byte: merge 2 bytes
};
// reject without decoding: clear bit ⇒ no fold
if word_idx >= PAGE_BITMAP.len() || (PAGE_BITMAP[word_idx] >> bit_idx) & 1 == 0 {
read += c_len;
continue;
}
Because word_idxdepends only on the lead byte (and, for four-byte sequences, the first continuation byte), the bitmap load can be issued early.
Within a page, folds come in runs
A set page bit tells us something on this page folds, but not which code points or to what. The obvious encoding is one entry per foldable code point—but that is both bulky and slow to search: a page can hold dozens of folds, and we’d have to scan them all to find the one matching the current code point. The structure of the data rescues us again. Adjacent code points overwhelmingly share the same delta to their fold: A–Z all map +32, and Latin Extended is full of alternating runs like 0x0100, 0x0102, 0x0104, … where every second code point folds. Instead of per-code-point entries we store runs—start, end, stride, delta—and a 1-bit stride flag covers both the contiguous and the every-other case. This interval compression collapses the ~1484 individual folds into just 238 runs across the 59 pages (≈four per page), leaving the within-page search only a handful of entries to look at instead of dozens. This range-with-delta encoding (including the stride trick) is borrowed from Go’s unicode package, whose CaseRange records store a Lo/Hi range plus per-case deltas, with an UpperLower sentinel marking the alternating blocks. Runs are split at the page boundaries so a run never straddles two pages.
A run record is two clean bytes
With both endpoints inside one page they fit in 6 bits, split across two arrays: RUN_END_LOW[``i``] = end & 0x3F (the scan key) and RUN_START_STRIDE[``i``] = (start & 0x3F) | ((stride − 1) << 6) (read only on a hit). Because each key is one clean byte, the within-page search can go wide: rather than comparing cp & 0x3F against the runs one at a time, we load 8 end_low bytes into a single u64 and test all of them at once with one branchless SWAR step—(chunk | 0x80…80) − broadcast(low) & 0x80…80 sets the top bit of every lane whose key is ≥ cp & 0x3F. A single bit-scan of that mask (the keys are sorted, so the first set lane is the run we want) finds the slot. A page holds ~4 runs on average; that one 8-wide compare almost always resolves the entire search in a single step. One unlucky page does hold 30 runs, which puts the compare inside a short loop that strides eight keys at a time—but that loop trips at most a handful of times on exactly one page in all of Unicode, and never on the common ones. Either way: no per-run branch, and no code-point reconstruction anywhere.
/// Offset of the first run with `end_low >= low_v` in a page of `n` runs,
/// or `n` if none. Scans 8 `end_low` bytes at a time via SWAR.
#[inline]
fn scan_end_low(lo: usize, n: usize, low_v: u8) -> usize {
const HIGH: u64 = 0x8080_8080_8080_8080;
const ONES: u64 = 0x0101_0101_0101_0101;
let bcast = (low_v as u64).wrapping_mul(ONES);
let mut base = 0;
while base < n {
// RUN_END_LOW is padded by 8 bytes so this read is always in bounds.
let chunk = u64::from_le_bytes(
RUN_END_LOW[lo + base..lo + base + 8]
.try_into()
.expect("8-byte slice"),
);
// `(b | 0x80) - low_v` keeps its high bit iff `b >= low_v` (no
// cross-lane borrow). The first set lane is the first run `>= low_v`.
let ge = (chunk | HIGH).wrapping_sub(bcast) & HIGH;
if ge != 0 {
let j = base + (ge.trailing_zeros() / 8) as usize;
return if j < n { j } else { n };
}
base += 8;
}
n
}
Folding is a little-endian byte addition
On a little-endian machine the folded character’s UTF-8 bytes, read as a u32, equal the source bytes (as a u32) plus a per-run constant. A parallel BYTE_DELTA[i] table then turns the whole fold into a masked load, one wrapping_add, and a 4-byte store:
let word = u32::from_le_bytes(next_four_bytes) & length_mask; // keep this char's bytes
let folded = word.wrapping_add(BYTE_DELTA[i]); // the fold, as one byte add
write_u32_le(dst, folded); // store all 4 bytes...
dst += utf8_len(folded); // ...advance by the folded length
Both lengths in that snippet—the length_mask for the source character and the advance by the folded length for the destination—come from one more tiny trick. A UTF-8 sequence’s length is fixed by the top four bits of its lead byte, letting the 16 possible lengths pack one nibble each into a single 64-bit constant (0x4322_1111_1111_1111); the length is then a shift and a mask, (LEN_BITS >> (4 * (lead >> 4))) & 0xF—no if chain, no table memory, nothing for the predictor to get wrong. (A count leading ones—(!lead).leading_zeros()—would also work, since a lead byte carries one leading 1-bit per byte of the sequence.)
/// Number of bytes in the UTF-8 sequence whose lead byte is `lead`.
#[inline]
pub fn utf8_len(lead: u8) -> usize {
const UTF8_LEN_BY_LEAD: u64 = 0x4322_1111_1111_1111;
((UTF8_LEN_BY_LEAD >> (4 * (lead >> 4))) & 0xF) as usize
}
Because we advance by the folded length, this even handles length-changing folds—U+212A KELVIN SIGN (3 bytes) → k (1 byte), or U+023A Ⱥ (2 bytes) → U+2C65 ⱥ (3 bytes)—by writing fewer or more bytes than were read. That’s the part we believe is genuinely new: every other folder we looked at—ICU, Go’s unicode, Rust’s regex, CPython, glibc—decodes UTF-8 to a code point, applies the fold there, and re-encodes (even SIMD folders decode first). Doing the arithmetic in byte space skips both the decode and the encode, which is exactly why this path can outrun a hash map that already has the answer tabulated—the hash map still has to decode its key and encode its result. The byte-space arithmetic assumes the input is well-formed, shortest-form UTF-8—every code point encoded with the minimal number of bytes. Reading the source bytes as a u32and adding a per-run delta only lands on the correct folded encoding when the source is in canonical form; an overlong encoding (a code point padded into more bytes than necessary, e.g. / as 0xC0 0xAF) has a different byte pattern and would break thelength_mask and the delta arithmetic. This is not a real restriction in Rust—&str/String are guaranteed to hold valid UTF-8, which by definition rejects overlong sequences—but a caller feeding raw bytes from elsewhere must validate (or otherwise normalize) them first.
The ASCII shortcut in the tail loop
One more shortcut rounds out the tail loop. Remember the first pass already lowercased every ASCII byte, so when the scan meets an ASCII byte in the tail it advances a single byte and moves on—no page probe, no table touch at all. And it doesn’t copy that byte either: unmodified bytes (ASCII and non-folding multibyte alike) aren’t moved one at a time. The scan just keeps walking until it reaches a character that actually folds, then flushes the whole unchanged run between the last fold and this one with a single copy_nonoverlapping. Mixed text—CJK with ASCII spaces and punctuation, or code with the occasional accented identifier—therefore races through the ASCII filler and only consults the bitmap for genuine multibyte characters, copying in bulk rather than byte by byte.
Putting it together: the whole table
| Component | Bytes |
|---|---|
| PAGE_BITMAP (1 bit per 64-cp page) | 248 |
| POPCNT_SAMPLES (cumulative popcount) | 32 |
| PAGE_OFFSET (per populated page) | 60 |
| RUN_END_LOW (scan key, end & 0x3F, +8 pad) | 246 |
| RUN_START_STRIDE (start & 0x3F | stride) | 238 |
| BYTE_DELTA (little-endian fold delta per run) | 952 |
| Total | 1776 |
That’s 9.6 bits per fold entry, over half of it the BYTE_DELTA side table we trade for the decode-free path; the index + run records alone are ~4.4 bits/entry.
Next to the obvious alternatives, that 1776 bytes is an order of magnitude or more smaller—and unlike most of them, it never decodes a character:
| Representation | Size |
|---|---|
| Naïve [(u32, u32); 1484] | ~11.6 KB |
| regex-syntax’s case_folding_simple table | ~70 KB |
| Go’s unicode.SimpleFold (orbit + ASCII + ranges) | ~7.3 KB |
| A runtime HashMap<u32, u32> | ~17 KB |
| This crate (paged bitmap + packed runs) | 1776 B |
Where it lands against the alternatives
On the common case, ASCII, folding runs at memory bandwidth (>45 GiB/s), more than an order of magnitude ahead of other real folders and more than 50% faster than the (non-equivalent) str::to_lowercase function. To get a rough “upper bound” for the non-ASCII case, we measured the optimized Utf8 decoding + encoding round trip without performing any actual case folding using the simdutf crate. This experiment achieves consistently about 2GB/sec and is only about twice as fast than our solution for the worst case all-folding input. A naive hash map trails everything on all workloads.
The three columns are real case folders that produce identical output: simple_fold (this crate), simd_normalizer (the simd-normalizer crate), and HashMap (naive CaseFolding.txt lookup). The workload rows are chosen to simulate different scenarios from typical to worst case:
| Workload (input size) | simple_fold | simd_normalizer | HashMap (byte path) |
|---|---|---|---|
| Pure ASCII (5.7 KB) | >45 GiB/s | 1.21 GiB/s | 213 MiB/s |
| Chinese/Japanese/Korean, no folds (8.1 KB) | 2.95 GiB/s | 1.97 GiB/s | 558 MiB/s |
| Symbols / Myanmar, no folds (9.0 KB) | 2.96 GiB/s | 1.56 GiB/s | 410 MiB/s |
| Worst case: Latin/Greek/Cyrillic (Unicode U+0000–U+FFFF), all folding (8.8 KB) | 869 MiB/s | 922 MiB/s | 334 MiB/s |
| Length-changing folds (1.7 KB) | 1.26 GiB/s | 716 MiB/s | 233 MiB/s |
Treat the absolute figures as illustrative, not portable: the whole design leans on auto-vectorization, SWAR, and little-endian byte arithmetic, so the numbers—and even the ratios between rows—can shift substantially on a different microarchitecture (a wider or narrower vector unit, different memory bandwidth, a big-endian target, x86 vs ARM).
More details can be found in the performance section of the README.
Take this with you
Case folding is about as basic as text operations get, which is exactly why it was worth the effort: we run it across every byte we index. The wins came from two ideas that both cut against instinct—sweep the whole buffer branch-free instead of stopping early, and do the fold as byte-space arithmetic instead of decoding to a code point. Together they let the common case run at memory bandwidth and the rare fold run without a decode, in a table small enough (1776 bytes) to stay resident. The decode-free byte-space fold is the piece we believe is genuinely new; it’s why this path can beat a hash map that already has the answer.
There’s surely more to find here, and we’d like to see it. The crate is casefold; the generated table and full design notes live alongside the source.
The post Don’t stop early: Case-folding source code at memory speed appeared first on The GitHub Blog.
The Former ‘Voice of Google’ Speaks Out
Post Syndicated from The Atlantic original https://www.youtube.com/watch?v=ptzwcTgBGgI
8 Premium Soundbars Reviewed – Some Were Surprisingly Bad!
Post Syndicated from The Hook Up original https://www.youtube.com/watch?v=rKq8HoeTCnU
Wild Boars Invade Property: AI Feeder’s Shocking Night Vision Discovery! #shorts
Post Syndicated from BeardedTinker original https://www.youtube.com/shorts/UuEhoIyFemE
$Trump & $Melania #lastweektonight
Post Syndicated from LastWeekTonight original https://www.youtube.com/shorts/07YrWWB09Zo
[$] The future of libraries in BPF
Post Syndicated from daroc original https://lwn.net/Articles/1084869/
Song Liu believes that the way that programmers assemble complex BPF programs
will be changing rapidly in the future.
At a session of the 2026
Linux Storage,
Filesystem, Memory-Management, and BPF Summit, he shared his thoughts on what
that change could look like, though he did not have any concrete proposals for
what, if anything, the BPF maintainers should do. He anticipates an
ecosystem of Rust BPF packages developing, which is significant because BPF
does not really have a package manager at the moment.
Arch Linux disables AUR package adoption
Post Syndicated from jzb original https://lwn.net/Articles/1086489/
The Arch Linux DevOps team has announced
that adoption of orphaned packages in the Arch User Repository (AUR)
has been disabled due to “the current influx of malicious package
“. Michael Taggart
adoptions and follow-up commits made via the AUR
has posted a brief analysis of the malware being added to a long
list of packages in this round of attacks. The payload appears
to be an remote-access trojan (RAT) that takes commands over the
Tor network and attempts to upload a wide range of user data.
The project had suspended
new account registration in June. That followed a campaign in which an
attacker or attackers created new accounts to adopt orphaned packages
and push malicious updates to them that would install malware on user
systems. AUR registration was reopened
on July 13 after the DevOps team added some minor, and apparently
ineffective, restrictions on creating new accounts.
Security updates for Friday
Post Syndicated from jzb original https://lwn.net/Articles/1086487/
Security updates have been issued by AlmaLinux (kernel, nodejs-nodemon, nodejs22, nodejs24, openssh, and vim), Debian (gsasl and ruby-rack), Fedora (dokuwiki, lego, libnbd, nasm, pack, unbound, and valkey), Mageia (389-ds-base, libxfont2, nghttp2, and perl-DBI), SUSE (apptainer, bind, ffmpeg-7, freerdp, google-osconfig-agent, graphicsmagick, helm, ImageMagick, java-17-openjdk, java-25-openjdk, keybase-client, kubernetes1.34-apiserver, kubernetes1.35-apiserver, kubernetes1.36-apiserver, kubevirt1.8-container-disk, libarchive, logcli, net-tools, openssl-3, PackageKit, perl-Net-DNS, prometheus-ha_cluster_exporter, python-dulwich, python-sqlparse, python-urwid, python3-pyOpenSSL, python313, python3, runc, s2n, tomcat, tomcat10, tomcat11, and valkey), and Ubuntu (libinput, linux-intel-iot-realtime, linux-intel-iotg-5.15, openssl, python2.7, python3.5, and ruby-sinatra).
An API for MoQ: provision your own isolated relays
Post Syndicated from Jacob Curtis original https://blog.cloudflare.com/moq-relays/
Last year, we enabled Media over QUIC (MoQ) on every Cloudflare server and opened the network for anyone to test. It provided a global MoQ endpoint, but not the isolation and access controls needed to run an application.
Today, we’re adding those isolation and access controls. The new MoQ provisioning API lets you create an isolated relay for your application and issue separate credentials for publishers and subscribers. The relays you create are available across Cloudflare’s network within seconds, with no servers to deploy, size, or load balance.
Cloudflare now supports the draft-14 and draft-16 versions of the MoQ Transport protocol with authentication support.
You can create relays through the API and the Cloudflare dashboard. They are completely free to use during beta.
A QUIC recap on MoQ
MoQ (originally short for Media over QUIC) is a new open protocol under development at the Internet Engineering Task Force (IETF), the standards body that also standardized HTTP, TLS, and QUIC. It is being developed in the open and will become a free public standard (an RFC) that anyone can implement. No single company owns it.
MoQ is a publish/subscribe system. A publisher sends out streams of data that have names, and subscribers ask for those streams by name. Between them sit relays, which are just CDN servers that copy each stream to everyone who wants it. A relay never has to look inside the data it forwards, so one publisher can reach a large audience without handling the fan-out itself.
Because relays don't care what's in the data, the same protocol can carry many things that each used to need a separate system: live video, video calls, low-latency messaging, and more. It runs on QUIC, the transport under HTTP/3, which is what keeps latency low.
The practical result is that you don't have to build and run your own fleet of specialized servers. You publish to a CDN through one simple API and get both low latency and large scale for much less cost.
How we got here: the MoQ open preview
Last year, we launched the first global MoQ relay network: every Cloudflare server in over 330 cities became a MoQ relay, free and open to anyone. Because these endpoints required no authentication, they were ideal for protocol testing and client development. More than 1,000 unique clients still connect each day to test against them.
But an unauthenticated relay isn't suitable for production, because you can't control who publishes and who subscribes. That rules out any application that needs confidentiality, access control, or a clear split between publisher and subscriber roles. Take a live auction site, where bids have to reach bidders in milliseconds. MoQ is a good fit, but publishers and subscribers need different permissions, so that a viewer's credentials can't be used to hijack the publisher's tracks.
What is a relay on the Cloudflare MoQ Network?
In most MoQ deployments today, a relay is a dedicated server or a dedicated process on a shared server. Scaling this architecture means running more instances, assigning clients to them, and adding load balancers as demand changes. This is not how any Cloudflare service works, including our Realtime SFU WebRTC service.
Provisioning a relay doesn’t start a virtual machine, container, or dedicated process. Instead, it creates an isolated scope across the existing global network.
That scope separates your namespaces, tracks, and objects from those belonging to other relays. It also defines who can enter the scope and whether they can publish or subscribe. Clients connect to the Anycast endpoint, and Cloudflare handles routing them across the network.
If you’re familiar with web hosting, creating a Cloudflare relay is more like adding a virtual host than starting a new web server. Since the infrastructure is already running, the provisioning API adds your application’s configuration and credentials. This makes the relay available immediately without choosing regions, estimating capacity, or setting up a load balancer.
The control plane API for MoQ at Cloudflare
The provisioning API is a control plane: it manages relays and the tokens used to reach them, and it never touches the media that flows through them.
There are two kinds of resources.
- A relay is the isolated scope from the previous section, so one application's streams never mix with another's.
- A token is a credential that grants a set of operations (publish, subscribe, or both) on a single relay. Handing publishers and subscribers different tokens is what stops a viewer from taking over a broadcaster's tracks.
Each token is scoped to the operations a client needs, can be given an expiration, and can be revoked on its own. That lets you grant exactly the access a client should have, and take it back later without disrupting anyone else.
For now, each token applies to an entire relay and permits publishing, subscribing, or both. We're working in the IETF and the wider MoQ community on a richer scheme that works for everyone. If you have opinions, tell us at [email protected].
Provision a relay
You can provision a relay two ways: with the HTTP API and in the Cloudflare dashboard.
With the API
Creating a relay takes a single API call and only needs a name:
Cloudflare returns a relay ID and the two default tokens:
The first token can publish and subscribe, and the second can only subscribe.
To give a client narrower access, add more tokens. This one is a subscribe-only token for viewers that expires at the start of 2027:
In the Cloudflare dashboard
You can also create a relay in the dashboard:
Go to Media > Realtime > MoQ Relay. Select Create relay, give it a name, and then confirm.
Connect a publisher and a subscriber
You can create and manage tokens through the API or dashboard, just as you can the relay itself. Give your broadcaster the publish-and-subscribe token and your viewers the subscribe-only token. Each client sends its token when it opens a MoQ session, and the relay enforces what that token is allowed to do.
The token travels in the URL path. For example, with the open-source moq-rs tools, a broadcaster can publish a fragmented MP4 stream from ffmpeg:
A viewer connects with moq-sub:
The relay reads the token when the session opens and checks whether the requested operation is allowed.
What we changed to support draft-16
The provisioning API is only one part of what’s new. The MoQ transport itself is advancing fast, and Cloudflare now supports draft-16 of the IETF MoQ spec in its relays. This draft adds two features relevant to publishing and subscribing.
PUBLISH now lets a publisher send a track to a relay before a viewer requests it. Without PUBLISH, the first subscription must travel through the relay chain to the publisher before the publisher starts sending. With PUBLISH, the relay can already be receiving the track when the first viewer connects.
SUBSCRIBE_NAMESPACE lets a subscriber request every track announced under a namespace instead of requesting tracks individually. The subscription also covers tracks added later, such as a new video rendition or audio track introduced during a live stream.
You can now connect a draft-16 client to use both features.
Built in the open
MoQ is an open standard, developed at the IETF by engineers across the industry. This lets clients and relays implement a common protocol. That interoperability is less useful if every relay provider requires a different control plane for creating scopes and issuing credentials.
In that vein, we’re documenting the design behind this API in the MoQ CDN Provisioning Internet-Draft. The draft calls the provisioned resource a scope rather than a relay, but both terms refer to the same logical delivery context: a boundary that applications create and then enter with a credential.
The goal is for multiple CDN and relay implementations to support a common provisioning model. The document is still an Internet-Draft, not an RFC, and its API model may change as the working group develops it.
Available today, still free in beta
The MoQ relay provisioning API is available now, as part of the MoQ beta. It's free to use at any scale during this preview period.
The API will change as we develop it, so we recommend checking the developer docs for updates and breaking changes.
We’d also love to hear what you want next. Finer-grained permissions? Bring-your-own signing keys? Let us know at [email protected].
Get started today
- Read the developer documentation
- Read the API reference docs.
- Read the provisioning draft.
- Email us: [email protected]
- Building with MoQ? Join the Cloudflare Developers Discord to share your projects and tell us what the tech preview needs.
Operation Sea Orbit
Post Syndicated from The History Guy: History Deserves to Be Remembered original https://www.youtube.com/watch?v=Wg6k9CdOSQ0
Rapid7 at Black Hat USA 2026: See preemptive security in action
Post Syndicated from Emma Burdett original https://www.rapid7.com/blog/post/dr-black-hat-usa-2026-preemptive-security-in-action
Black Hat USA returns to Mandalay Bay in Las Vegas this August, bringing together security practitioners, researchers, and leaders from around the world. Rapid7 will be there in the Business Hall, with new capabilities, live demonstrations, expert-led sessions, and two days of activities at the Border Grill.
This year, our focus is preemptive security: helping security teams anticipate credible risk, respond at machine speed, and maintain an accurate view of their security and compliance posture as their environment changes.
Visit the Rapid7 booth at Black Hat USA
You can find Rapid7 at booth #2445 in the Mandalay Bay Business Hall, open and running on the following days and times:
-
Tuesday, August 4: 4:00–7:00 p.m.
-
Wednesday, August 5: 9:00 a.m.–6:00 p.m.
-
Thursday, August 6: 9:00 a.m.–4:00 p.m.
The booth will include two demonstration stations, seating, giveaways, and our friendly team of Rapid7 experts – there to help you explore the challenges most relevant to your organization. A chess-inspired theme reflects the principle behind preemptive security: understanding what may happen next and acting before risk becomes an incident.
Live demonstrations will cover four connected areas of the Rapid7 platform:
Predictive risk and vulnerability management: See how attacker behavior and exposure context can help teams focus remediation on vulnerabilities that present credible risk.
Agentic threat detection and response: Explore how the Rapid7 AI Engine and technology from Kenzo Security support adaptive investigations and reduce the time analysts spend gathering context.
Continuous compliance automation: See how Cyber GRC connects governance workflows with live security data, automates evidence collection, and identifies control drift.
Preemptive MDR: Learn how continuous SOC operations, exposure context, and Rapid7 Labs threat intelligence can extend the coverage of internal security teams.
Explore the latest Rapid7 launches at Black Hat
Black Hat will provide a closer look at several additions to the Rapid7 platform, including the general availability of Cyber GRC.
Cyber GRC brings security operations and governance teams closer together by connecting GRC workflows with live security data. The solution draws evidence from SecOps telemetry into compliance dashboards, helping teams maintain a current view of their controls, while AI-assisted workflows reduce the manual inputs involved in third-party risk questionnaires and other repetitive tasks.
Attendees can also learn more about Preemptive MDR Alerts, predictive vulnerability management, and enhanced agentic SOC investigations. These capabilities combine exposure data, asset criticality, threat intelligence, and detection context to help teams identify where attackers are most likely to act. Some will be presented as early-access previews, so availability will vary.
Join us at Border Grill
Rapid7 will take over the Border Grill at Mandalay Bay on Wednesday, August 5 and Thursday, August 6. The space will include additional demonstrations, meeting areas, expert presentations, breakfasts & lunches, and opportunities to speak with Rapid7 leaders and product teams.
Highlights from the agenda include:
Preemptive Security for the Age of AI
Wednesday, August 5, 12:00–12:45 p.m.
Rapid7 Executive Chairman Corey Thomas will discuss how AI-driven threats are changing security operations and what it takes to move toward a more preemptive model.
Agentic SOC: Threat Detection and Response
Thursday, August 6, 9:30–10:15 a.m.
Lisa Washburn, Senior Director of Product Management, will explore how AI agents can investigate alerts at machine speed while keeping expert judgment involved.
Cyber GRC in the Age of AI
Thursday, August 6, 11:30 a.m.–12:15 p.m.
Jon Schipp, Senior Director of Product Management, will show how live security data and automated evidence can support continuous audit readiness.
Border Grill will also host live demos, customer and executive meetings, and the Rapid7 Happy Hour on Wednesday. VIP access begins at 4:00 p.m., followed by general admission from 5:00–7:30 p.m.
Hear from Rapid7 security researchers
Rapid7 researchers Jack Heysel and Spencer McIntyre will present The Metasploit Framework 6.5: Malleable C2 Payloads, New Relay Capability and Protocol Session Upgrades at Arsenal Station 4 in the Business Hall on Wednesday, August 5 from 4:00–5:00 p.m.
Book time with Rapid7 at Black Hat
Whether your priority is reducing exposure, giving SOC analysts better context, improving response speed, or strengthening audit readiness, you can book a meeting or tailored demonstration with the Rapid7 team.
Visit us at booth #2445, join us at Border Grill, or reserve time in advance. Register for the Rapid7 Black Hat experience here.
Facial Recognition at Madison Square Garden
Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2026/07/facial-recognition-at-madison-square-garden.html
Last month, the story broke (alternate link) that Madison Square Garden uses facial recognition software on everyone entering the facility, and—among other groups—flags activists that oppose using facial recognition.
Turns out that the system was shut off for Taylor Swift’s wedding.
Evan Greer—one of the people that MSG alerts on—comments:
Ironically, Swift herself has reportedly used facial recognition at her own concerts to identify stalkers. This “privacy for me, surveillance for thee” attitude feels like a perfect encapsulation of the future we’re already living in: one where wealthy elites can afford privacy, while the rest of us are forced to live in a corporate surveillance panopticon.
Whatever privacy measures Swift had in place for the wedding seems to have worked. No photos have leaked online.
Формата като усилие. За дизайна в полите на Витоша и в Европа
Post Syndicated from Лина Кривошиева original https://www.toest.bg/formata-kato-usilie-za-dizayna-v-polite-na-vitosha-i-v-evropa/

Дизайнът винаги ме е привличал. Дотолкова, че в един момент от младостта си дори си представях как го изучавам в университета. Слава богу, открих фотожурналистиката преждевременно (или тя мен), а веднага след нея – и визуалния сторителинг (разказване на истории – б.р.). Всичко оттам нататък бе подчинено на едно-единствено желание: да разказвам истории в образи.
В дизайна също има немалко сторителинг. В него безкомпромисно стои и функцията. Именно тук се различават дизайнът и художествените изкуства. Много млади хора биват привлечени от територията на дизайна, бъркайки я с място за естетическо себеизразяване. Както често отбелязва моята колежка и бизнес партньорка Деница Тонева, между двете съществува фундаментална разлика: дизайнът е длъжен да служи на човека, докато изкуството няма такова прагматично задължение. Поне не и в ежедневния, утилитарен смисъл. Изкуството служи на духовните ни потребности и на емоционалното свързване със самия себе си и с другите в обществото.
Въпреки това в дизайна има огромно пространство за творчество, защото той сам по себе си е метод/начин на работа и светоглед (като не-дизайнер мога да си позволя лукса да се изказвам лаически). Дизайнът борави с визуалния език и с всички смисли и знаци от историята на изкуството, през семантиката, до съвременния начин на живот и съответните културни и трансдисциплинарни елементи от ежедневието. Но истината е, че оставам силно заинтригувана от методологията, тоест от начина, по който дизайнерите сканират околната ни среда, как събират, курират, разчитат и накрая превеждат хаоса на езика на формите. Това за мен си е висш пилотаж на вкуса.
Под полите на Витоша
Дизайнът е просторно понятие. В него съжителстват дузина паралелни светове: от анатомията на буквите и шрифтовете, през физическите обекти, до пространствените инсталации и дигиталните преживявания. Затова и не пропускам фестивала „Мелба“, на който екипът на студио „Комплект“ привлича световни имена от тази сфера.
Тази година София беше домакин на фестивала Европейски награди за дизайн 2026 (European Design Awards). Зад организацията на това мащабно гостуващо събитие стои дългогодишният упорит труд на Бояна Гяурова и Адриана Андреева от студио „Комплект“, които парче по парче градят местната дизайн среда. Този път те буквално поставиха България на европейската карта, привличайки стотици чуждестранни специалисти, които се „вмъкнаха под полите на Витоша“ (директно намигване към визуалната идентичност на събитието, разработена от дигиталната агенция Next-DC).
Фестивалът за комуникационен дизайн се проведе между 11 и 14 юни в София и предложи богата програма с изложба на плакати, посещения в български дизайн студиа, обмен между европейски специалисти, изложба „20 години комуникационен дизайн“ и два дни вълнуващи лекции на международни и български дизайнери. Всичко това, последвано от черешката на тортата – наградите в множество категории. Един от най-интересните моменти на подобни събития са лекциите, за някои от които ще споделя в следващите редове.
Оголване на излишното
В добрия дизайн всяка стъпка логично следва предишната. Едно от златните му правила гласи: „Кажи го кратко и ясно.“ Няколко от лекторите подчертаха, че простите идеи не са скучни или повърхностни – те са достъпни. Извън този празничен балон обаче в България все още дизайнът се бърка с декорацията, с повърхностното „разкрасяване“, а не със смисленото структуриране. В този контекст простото се възприема като враг – като нещо празно, недостатъчно сочно и лишено от превземки.
Нидерландското студио G2K (представено от Франк Баас и Юри Наута) обаче изповядва тъкмо обратното верую: Keep it simple. Неговата философия изисква да се оголи излишното, за да се разкрие есенцията. Баас и Наута илюстрираха своя подход, давайки пример с работата си по визуалната идентичност на театъра в Гронинген. След като достигат до есенцията на тази културна институция, се ражда и техният визуален преразказ на същността ѝ: „Да провокираме и разбъркаме мисълта.“ Така се създава една смела, директна визия, която умишлено залага на объркания текст, доверявайки се на факта, че човешкият мозък има капацитета да се справи с хаоса и да сглоби смисъла сам.


Визуалната идентичност на театъра в Гронинген, създадена от студио G2K © G2K
Понякога дизайнът се проявява и в ежедневните решения. Доказаха го немският графичен дизайнер Пол Вогенрайтер и българският му колега Мирослав Живков. Тяхното сътрудничество се разгръща по оста София – Велико Търново – габровското село Баланите. Пол постепенно се мести от Германия към Пловдив, после към Търново и накрая се установява в къща в село наоколо, а Мирослав основава независимото си печатно студио NoPoint Atelier в село Баланите.



Плакатната инсталация за 13-тия рожден ден на TaM е замислена като 30-метрова хартиена ролка, отпечатана чрез ситопечат с един повтарящ се типографски модул © ТаМ
NoPoint Atelier преобразява една стара къща в творческа лаборатория, където ежедневното рисуване и аналоговите процеси се превръщат в терапия и начин за осмисляне на света. За Мирослав Живков е нормално да произведе 20 скици за час. Динамика, в която той умишлено търси свобода, за да не позволи на рутината да пречупи творческото му аз. Заедно с Пол Вогенрайтер осъществяват концепцията за плакат със своите проекти, създадени за пространството ТаМ. Постоянното изследване на границите между подреденото мислене и визуалния експеримент донесе на техния съвместно номиниран проект сребърно отличие от Европейските награди за дизайн 2026 – първото подобно признание за България на този форум.
Изчезващото усилие
Дизайнът освен всичко друго може да бъде и титанично усилие. Янис Константинидис от спечелилото „Еми“ анимационно студио NOMINT започна презентацията си с интригуваща метафора: атлазените беседкови птици, които прекарват целия си живот в изтощително градене и цветово подреждане на гнездо, като рискът да загинат е близо 70%. Цялото това огромно усилие служи единствено за привличане на партньор.
Константинидис пренася акцентиращия върху трудността подход в киното: неговите филми за WWF и BBC са заснети с истински топящ се лед, реален огън и дим. Процесът е толкова труден, че става неделим от посланието. Константинидис ни напомни, че вложеното усилие е основната награда от творческия процес – съзнанието, че си дал всичко от себе си, за да сътвориш нещо автентично.
Това физическо усилие изчезва с всеки технологичен напредък в света на изкуствения интелект, смята гръцкият дизайнер. А когато усилието изчезне, рискуваме да останем в капана на бързата, лесна и дълбоко посредствена заблуда за липсата на смисъл. Ето защо Константинидис е противник на използването на изкуствен интелект в дизайна.
Кампанийното видео, създадено за WWF от студиото NOMINT, използва сложен и трудоемък формат, за да разкаже за проблемите на затоплящите се океани
По време на лекциите дизайнът стана и поле на противоречие. Тъкмо в сблъсъка на противоположни мнения по екзистенциални въпроси се ражда интересният дебат. Веднага след Янис Константинидис на сцената излезе Мария Тодорова от Next-DC, която от години изследва дигиталната трансформация и иновациите. Пред зала, пълна с утвърдени дизайнери, тя сподели, че трябва да прегърнем трансформацията, защото в противен случай ще останем зад борда. И хвърли тежка ръкавица:
Изкуственият интелект вероятно ще заличи средната класа дизайнери.
Фестивалът SHAPESHIFT празнува трансформиращата сила на творчеството, науката, технологиите и иновациите.
Никой не може да предвиди бъдещето с абсолютна точност, но тревогата от подмяната е съвсем реална. Когато си прекарал голяма част от живота си в учене и усъвършенстване на занаят, мисълта, че уменията ти могат изведнъж да се окажат остарели исторически артефакти, предизвиква сериозна криза. Криза, която усещам както в себе си, така и в цялата гилдия. И все пак чувството след този сблъсък не беше пораженческо, а по-скоро мобилизиращо – желание да останеш в играта, дори това да изисква пълна лична трансформация.
Изборът да останеш
Дизайнът може да бъде и позиция. За пловдивското студио Punkt (Красимир Ставрев и Светла Тодорова) той е поредица от решения, дълбоко свързани с концепцията за дома. Във времена, когато е най-лесно да бъдеш глобален номад, Красимира и Светла избират да останат. В Пловдив, където впоследствие постепенно променят визуалната култура на града, привличайки ключови културни институции, чийто публичен образ преработват и осъвременяват.
Визуалната идентичност за „Пловдив – Европейска столица на културата 2019“, разработена от студио Punkt и прераснала в идентичността на града
Техен е и визуалният език на „Пловдив 2019 – Европейска столица на културата“, както и проектът за дигиталния шрифт на града Plovdiv Typeface, сглобен от почерците на самите пловдивчани. Когато проследиш развитието на подобен визуален език, си даваш сметка за суперсилата на дизайна: способността му да укроти нещо толкова голямо, шумно и абстрактно, като едно общество, и да го разкаже чрез образи и форми.
Представителите на Beetroot се припознаха в наратива на Punkt, защото според тях също „да останеш е активен избор“, както се изразиха. Простираща се между Атина и Солун, творческата вселена на студиото Beetroot обединява дизайн студио, концептуално кафене, арт галерия, гурме ресторант и собствен бранд за деликатеси в едно вдъхновяващо градско пространство.
Освен че поддържа тези знакови места, Beetroot създава своя собствена линия продукти. Тоест от подизпълнител трансформира себе си в „свой собствен клиент“. Мечта за много дизайн студиа, сигурна съм.

За съжаление, в една статия не може да се събере всичко от двата наситени дни на фестивала.
Дизайнът, както и архитектурата ни изграждат и могат да оказват влияние върху нас в продължение на дълги периоди. България изпитва силна потребност от разговор за визуалния език. Рекламите, неоновите табели, застарелите знаци и въобще голяма част от заобикалящата ни среда могат да бъдат тема на този разговор. Радвам се, че все повече хора се занимават с тази проблематика. Макар и невинаги да е ясно защо и какво може да донесе визуалният подход. Понякога не всички имат ресурс да оценяват или търсят високо ниво, но както казва и Янис Константинидис от Nomint, би било тъжно, ако колективно спрем да полагаме усилия, защото няма търсене.
Нужни ли са тогава усилията?
Ако възприемем дизайна като „просто комуникация“, тогава изкуственият интелект може да я свърши по-бързо, по-евтино и по-мащабно. Но ако дизайнът е позиция; ако той е съзнателният избор на Мирослав Живков и Пол Вогенрайтер да оставят мегаполиса и да се потопят в своето творчество в габровското село Баланите; на студио Punkt – да остане и изгради визуалния дом на Пловдив; или на Янис Константинидис – да снима филми с истински топящ се лед, тогава вложените усилия са всичко, което имаме.
Защото формата без усилия е просто празна, бездушна опаковка. Именно подходът, усилията, желанието да провокираш отвъд функционалното разбиране приближават занаята до изкуството. Точно това автентично присъствие с отворено сърце и изцапани с мастило ръце е единственото нещо, което никой алгоритъм не може да репликира.
Смисълът винаги се ражда в детайла, в укротяването на хаоса и в смелостта да се довериш на самия процес. Тъкмо в тези споделени и трудни усилия се крие имунитетът ни срещу посредствеността. Докато има автори, готови да платят тази цена, и публика, която да я разчете, бъдещето на разказването на истории – и в дизайна, и в живота ни – остава нужно. Поне засега.