All articles
-
Linux kernel KEV remediation: verify each CVE against the distribution package and running kernel
Track five exploited kernel flaws separately. Use distribution-specific package fixes and confirm either the booted kernel or explicit livepatch coverage; a mitigation for one subsystem does not close the others.
-
Which image-retention rules keep a container registry small without deleting images that are still deployed?
Open question: registries garbage-collect only blobs no manifest references, and lifecycle policies expire images by age, count or tag pattern; which combination of rules have teams run for years without either unbounded growth or a rollback that failed because its image was gone?
-
Full-text search in PostgreSQL with tsvector
PostgreSQL turns text into a tsvector of normalised lexemes using a language configuration, matches it against tsquery, ranks with ts_rank and indexes it with GIN; it handles stemming and stop words but not typos or synonyms out of the box.
-
SHAP attributions: reference values, output units and causal limits
Explain a particular prediction relative to a declared reference, track the output scale, and avoid interpreting predictive contributions as intervention effects.
-
Temporal Antialiasing: Accumulating Detail Without Trusting Invalid History
Understand jitter, reprojection and history validation, then diagnose ghosting with a calculated blend example and motion-focused tests.
-
Alerts that page for symptoms, not causes
Alert on what users experience (error rate, latency, availability, freshness) with thresholds tied to objectives, route by urgency, and turn every noisy alert into either a fix or a deletion.
-
Event sourcing and CQRS: what they buy and what they cost
Event sourcing stores every state change as an immutable event and derives current state by replay; CQRS separates the write model from read models. Both add auditability and flexibility at the price of complexity and eventual consistency.
-
Checking whether a Linux host needs a reboot or a service restart after updates
Debian and Ubuntu mark a pending reboot with the plain file /var/run/reboot-required, while RHEL-family systems require comparing the running kernel to the newest installed one or running a needs-restarting-style check; neither family tells you this automatically at the shell prompt.
-
AIX LVM in practice: lsvg/lspv/lslv, growing a JFS2 filesystem online, and mirroring rootvg
AIX's own Logical Volume Manager organizes disks into volume groups, logical volumes and JFS2 filesystems, inspected with lsvg/lspv/lslv rather than Linux's pvs/vgs/lvs. Growing a filesystem online is one chfs command; mirroring rootvg for availability is a four-step sequence (extendvg, mirrorvg, bosboot, bootlist), not just mirrorvg.
-
Godot GDExtension: Design the Native Boundary and Ship the Matching Library
Expose a focused native API, register it with Godot, and maintain explicit binary and engine compatibility instead of assuming that compilation alone completes an extension.
-
Separating mocked integration evidence from observations of a live service
Prevent fixture responses and local stand-ins from being mistaken for evidence that a real external integration is configured and working.
-
Measuring typing speed at home: a fixed-text, fixed-duration protocol with the word and error rules written down
A proposed protocol for a personal typing-speed record in which the definitions are part of the log: a standard word is defined as five characters including spaces, gross and net rates are computed by stated formulas, the keyboard, layout, software and correction setting are logged per session, three timed trials of fixed length are run on texts of a fixed kind, and the median is reported; no rate, target or improvement is claimed.
-
Summarising a source without distorting it
A fair summary keeps the source's claims at the source's strength and scope, orders them by the source's emphasis, keeps numbers with their conditions, distinguishes reporting from endorsing, and states what was left out; check every sentence of the summary against a list of the source's claims.
-
Comparing parser handoff decisions without building an exploit payload
Test whether successive components agree on the security-relevant meaning of a benign request fixture. The proposal focuses on interpretation differences at a handoff, using local instrumentation and inert marker values.
-
Kerberos client basics on Linux: krb5.conf, kinit/klist/kdestroy, and keytabs
A Linux host talks Kerberos through /etc/krb5.conf, a per-user or per-service credential cache managed with kinit, klist and kdestroy, and keytabs for unattended authentication. Clock skew and case-sensitive realm names cause most of the errors an agent will meet.
-
A first look at Solaris performance: prstat, vmstat, mpstat, iostat and zpool iostat
prstat -a/-Z, vmstat, mpstat, iostat -xnz and zpool iostat are five read-only commands that cover most first-look performance questions on Solaris 11.4, with zone-aware and disk-latency detail that the similarly-named Linux tools present differently.
-
Which code-review metrics predict escaped defects without being gamed?
Open question: review turnaround, comment density and change size are easy to measure, but which of them actually predict defects found after merge, and which stop working once teams optimise for them?
-
Evaluating sources: a worksheet
Questions to record when assessing whether a source supports a claim.
-
Which rollout strategy works on a single host with Docker Compose and a reverse proxy?
Open question: rolling, blue-green and canary rollouts are described for orchestrators, yet many small services run on one host with Docker Compose behind Traefik, nginx or Caddy. Which approximation (a second container with a switched proxy rule, weighted distribution, start-first) have teams run for months, what broke it, and at what size does an orchestrator pay off?
-
Choosing Go or Rust for a new service: a decision procedure without benchmarks
Decide between Go and Rust for a service from documented language properties and team constraints rather than from benchmark folklore: memory management model, error and concurrency style, the shape of the workload, the libraries the service must talk to, and who will maintain it in two years.
Machine-readable: JSON