AI

Критическое обновление безопасности PHP

graker — Wed, 21 Oct 2026 08:55:00 +0000

Today at 14:00 UTC (5 p.m. Moscow time) a critical PHP security update is coming out: https://www.php.net/archive/2026.php#2026-10-20-1

The update is so monstrously critical that no details are disclosed, so that nobody hacks absolutely everyone in advance.

So get your consoles ready, open your Docker configs and off we go, updating everything one by one.

But if vulnerabilities and updates keep pouring in like this, sooner or later we will really have to let robots loose on production and let them handle it themselves. Otherwise how is one supposed to keep up with all this?

Claude Code и технические инструкции

graker — Tue, 13 Oct 2026 08:50:00 +0000

After the «redesign for 600» updating Docturist has become much easier. Yesterday we shipped the integration with the Ferma fiscal data operator, which had been ready even before the redesign, but we did not get to switch it on. Now we have, and even the merge went almost without conflicts. Life is getting better :hat:

By the way, during integrations and deployments like these it has turned out to be very useful to involve neural networks in preparing the accompanying materials. I would never trust an AI to write my own articles: robot ears stick out of every sentence afterwards. But preparing an article like «How to use the feature from this commit» is a piece of cake. The text is technical, written precisely, and needs no literary flourishes. Here, for example, is a manual on issuing receipts: I hardly edited it by hand.

What is more, monsieur Claude can connect to Chrome and Playwright, so making screenshots can be handed over to the robots completely too.

As for the manual, Claude did not just make all the screenshots (although he did). When we finished and rolled out the new design, it suddenly™ turned out that screenshots of the service and even videos are elements of the design itself. Except the design is new now, while the screenshots and videos are old. Besides, the project blog already had several manuals from before the redesign. And of course they all became outdated overnight too.

I really did not want to reshoot all of that by hand, so I dumped it on Claude right away. And here is what he did:

Wrote a manifest listing the screenshots from different sections of the site: which pages to take them from and under which accounts.
Wrote a script that takes all or some of the screenshots from the manifest, logging in with the right account and opening the right pages.
He even wrote a script for the video, which records several pieces from different sections separately and then glues them into a complete intro.
If a screenshot needs an error that is hard to reproduce (say, a rare error from the fiscal data operator), he simply draws it by manipulating the DOM, about ten times faster than I would have figured out how. And if there is not enough test data, he generates it on the fly, or also inserts it into the DOM.
Now, if I decide to change the look of some page a little, or rearrange blocks, I just rerun the script* and immediately have a set of updated screenshots.
And if I add a new section or feature, Claude takes the screenshots and adds them to the manifest as well.

Highly recommended, if you are not doing this yet.

*actually I do not rerun the script, I am too lazy. I tell Claude to reshoot the pages I need, and he reruns it himself.

PR на шиссот!

graker — Wed, 07 Oct 2026 18:30:00 +0000

The other day a PR of 610 files was finally defeated and merged! The result is a complete redesign of Docturist. The public part (the landing page and the blog) got a bit of it too, but first of all it is the whole inside: all the pages, forms and dialogs of the CRM itself.

This is one more example of how you can get carried away solving tasks with a neural network. Initially the idea was much more modest. The dashboard, also known as the desktop, also known as the home page inside the system, was made rather simple. This is what it looked like:

Of course, the travel agents reported that they did not use the widgets on this desktop at all. Only the links, to jump straight to the section they need. And I wanted it to be rather a quick access to important sections and information. So that some things could be done without leaving the dashboard at all.

That is what Claude Design and I took on. We rethought the contents of the dashboard to make it convenient and actually used, not just a place for links like the desktop in Win95. And the «before» above turned into a new «after»:

Now there are all kinds of metrics, and most importantly a smarter bookings feed. You can look at the latest bookings by date, or at the ones that need particular attention.

I did not hold back Claude's design impulses, so on top of that I got a new style at once. The previous style was built on the Color Admin theme, which I bought specially back in 2018. The theme has of course aged somewhat since then and lost some of its relevance.

Anyway, once there is a new look, you do not want to leave the other pages in the old one. And so, page by page, component by component, first with Claude Design and then with Claude Code, we brought the whole service to the new styles. And since just redrawing things is boring, we also rethought, improved and remade the components on the pages along the way.

That is how we got a PR of 610 files. Which of course wore me out with reviewing and testing. In the nutshell, the points of my talk (in Russian) on this topic still hold. You have to test, structure, decompose. But not looking at the generated code, as Robert Martin advises, does not work out for me just yet: I checked every screen, inspected the changes, the tests, the front end, and in each part I found something that was not done quite right, or did not work, or caused some new problems.

But in the end I checked everything, tried it by hand and shipped it. So now Docturist has not only a new, rethought, modern design, but also all kinds of usability bits, including:

— Docturist remembers and shows right away the set of tour operators the agent works with most often, no need to search through autocomplete every time.
— / or Ctrl+F immediately starts a search across all data (pressing Ctrl+F again starts the browser's native search).
— Booking documents can be generated and signed right from a popup on the desktop, without having to open the booking.
— The calendar works better on mobile devices (the mobile calendar is simply made anew).
— The profile page is finally split into 5 sections by the topics of the settings.

I am happy with the result, and now updates can be rolled out more often again, without reviewing such huge PRs. Overall the redesign took about a month and a half. Next up are the integration with an online cash register service (already done) and a dark theme (also done). Let's go!

Docturist, a smart planner for travel agents

Антропики всех забанят?

graker — Fri, 02 Oct 2026 05:14:00 +0000

For the last few days, reports of fierce bans from Anthropic have been popping up everywhere. Some authors report annoying bans in their channels. In several themed communities many people share how they got banned alive. On Habr they write that the whole of Hong Kong is being banned for using VPNs, and we in Russia are getting caught too. Someone from Yandex even complained they had to switch to ~~GigaChat~~ Codex.

Numerous reviews also say that a new claude.ai account now requires showing your passport and social security number and handing in biomaterials. So, dear friends, maybe neural networks will not replace us after all: we will not pass on skull shape.

On the one hand, take that, robots! I have not forgotten how to code by myself yet. On the other hand, I would like another month of vibe coding my little new video game at night…

I am holding on so far, though: since August I have been hearing from different people that they are getting banned. And I myself forget to turn on the VPN every other time, keep discussing Russia's traffic filtering boxes with Claude, make it install the Ministry of Digital Development certificates and parse resources that do not work from abroad. But apparently the robots will start suspecting something soon.

By the way, my current subscription runs out on Monday, so I will be squeezing every last drop out of it all weekend!

P.S. So how is everyone coping, colleagues? Codex, Cursor? GigaChat? 一个鲜为人知的中国神经网络? Human-hand-coding?

Нейроотладка

graker — Mon, 07 Sep 2026 22:05:00 +0000

Neural networks keep mercilessly replacing us. This time, in investigations and debugging.

Given: an editor lost a bit of content. Clicked something and everything was gone. Never happened before, and here we go again.

— Hey Claude, here are cleaned-up database dumps from several sites, an editor was doing something on the master, and content disappeared on several sites. Find where it went and figure out what the editor clicked. Just be careful, it is three gigs.
— Avec plaisir. And I will not parse the dumps, don't you worry.

He looks at the content synchronization logic. Spins up mysql containers in Docker on his own, loads the dumps. Unwinds the page revisions across the tables. 15 minutes later he writes a report: right here, on such-and-such date and time, the editor unsubscribed from the content and everything was gone. Here he restored the subscriptions, but it was too late, ha-ha-ha. And here is what to configure so that it is never too late again. But that is for another time, for now, sorry, the content cannot be brought back. Thank you, you are welcome, write again.

And how could this be automated even further? Let him into production, perhaps, and into Jira, so that he explains it to the editor himself? Some people, I know, already do, but we are still scared to let him into production. And not every project allows it anyway.

And what comes next at all? What did they do in Frank Herbert's books to completely ban all these computers?

upd: Humans in leather are still needed after all.

A thorough study of the report revealed several problems that the AI decided not to explain and that, in principle, cannot be explained by the report's findings. I dug deeper myself into places the neural network could not reach and found a bug in a third-party SaaS service used in the project.

I think Claude would have found it too, but who would let him in there.

I feel mighty. Take that, robots!

Доклад на ZelDevMeetup

graker — Tue, 11 Aug 2026 10:20:00 +0000

Yesterday the stars aligned just right and I managed to give a talk at the Zeldev meetup.

The talk is called «Robots write the code, but we answer for it» — based on my April article. I originally planned to give it in May, but this turned out even better — over these months I've added a few new ideas.

In my opinion it went quite well, I haven't lost the skill over a decade. Thanks everyone, especially the organizers for the opportunity!

The slides are attached below the fold, they're in a progressive HTML format, so you can view them right in the frame. I made the deck in Claude Design (where else would you make a presentation about neural networks?), which is probably why clicking back and forth through the slides works a bit oddly, not quite like in PowerPoint or Impress.

There's no video recording.

RTS Дачники против слизней

graker — Tue, 04 Aug 2026 09:20:00 +0000

As part of preparing for my talk, here's an example of vibe code, so to speak. I came up with a few small ideas and tossed them not even into Claude Code, but just into a Claude chat to discuss — and it went ahead and built a game demo in 15 minutes. We polished it just a tiny bit, and here I am sharing the result.

It's an RTS/base defense game: gardeners (played by my usual characters) have to defend a greenhouse from slugs attacking in waves. Stock up on cucumbers, buy units, squash slugs while the greenhouse is still standing. Of course, it's only a prototype, Claude made the characters out of emoji, and there isn't much variety either. But — tweak the balance a little, add map generation, buildings, art, sounds, and…

Even so, here's what you can do with an agent in, I repeat, just 15 minutes.

It's all written in JavaScript, Claude demoed it to me right in the chat. A little over 800 lines of code — and that's including all the texts and lines, HTML and styles. Plus the game logic, and even a pathfinding algorithm that leads the slugs to the greenhouse (flow field).

You can play it right below the fold.

Unleash my inner speaker

graker — Mon, 03 Aug 2026 10:40:00 +0000

Time to unleash my inner speaker. I'll be giving a talk at the https://zeldev.ru/agentikus meetup in a week. The talk is based on my April theses, so to speak — almost half a year has passed, and I have things to add.

The last time I gave a public talk was probably around 2015. So I'll have to prepare: I'll be drawing the slides with pebbles in my mouth like Demosthenes. Hopefully it'll turn out interesting.

Нейросети и анализ кода

graker — Wed, 22 Jul 2026 09:15:00 +0000

Yesterday I was estimating a group of ~40 tickets. All of them were created from an AI code analysis report on a large Drupal project. The project is about 10 years old, the codebase has evolved all this time, 20 subdomains, integrations, APIs, content synchronization — all in all, a cool project.

The report is structured, the neural network checked the project for all four horsemen of the apocalypse: Vulnerabilities, Bugs, Slowness and Dirty Code. Originally the report produced many more tasks, but I slapped won't fix on about 30% of them right away. There were glitches and misunderstandings of the context. But 40 tickets still remained.

Most of them are also tasks of the very lowest priority, like

a custom module doesn't declare a dependency on something like paragraphs;
somewhere in the code a brazen programmer called \Drupal::service() instead of using dependency injection;
somewhere deprecated Drupal versions haven't been removed from the supported versions, and so on.

There were also a few more serious issues:

a couple of N+1 problems;
several XSS vulnerabilities (only accessible to admins, but still);
several places lacking checks for whether a key exists in an array (spamming the log with warnings);
and even one timing oracle vulnerability.

Yes, dirty code is a sign of dirty thoughts :) Yes, it would be nice to clean it all up. But apart from 3–4 issues, it adds up to more than a hundred hours of work in total, and the payoff is slightly cleaner code, tidied-up legacy, a bit less tech debt and fewer warning/debug entries in the log. It's nice, of course, when the client doesn't mind such a spring cleaning. And all honor and glory to the account managers who can convince the client of the need for such cleaning when its value to the end user is roughly zero.

And these reports still leave a strange feeling. They do find something. But so far these reports bring much more fuss than benefit.

Код пишут роботы, но отвечать за него нам

graker — Wed, 08 Apr 2026 08:20:00 +0000

Lately I've been using generative neural networks in agent mode more and more in development; for simplicity, let's call it vibe coding, like everyone does. Why not? These days every toaster and its grandmother is vibe coding and telling everyone how great it has become. And in terms of opening up development to those who couldn't develop before, it really is great, by the way.

But those who could develop on their own before still look at the subject from a slightly different angle. So I decided to let my thoughts wander a bit, grumble, be a bit of a bore and reflect not on how to set up Codex or an MCP server, or how to unleash Claude Code on KWork. But on the effects, on the inevitable changes that neural networks have brought, are bringing and will bring into our daily work — into software development by living human people.

First, let's briefly define our place in space and time relative to the very phenomenon of neural networks (here and below — in software development). It's too late to discuss whether they are needed, whether they help, whether we should use them. That question is off the table. If you somehow haven't started yet, you should. The cat looks at the clock and says: it's time!