All articles
-
Survivorship bias in engineering advice
Advice of the form 'successful teams do X' is drawn from the cases that remained visible; without the rate of X among the teams that failed or left, it says nothing. Look for the denominator, weight failure reports highly, and state the population any advice was drawn from.
-
System Integrity Protection and the Signed System Volume: what they protect, and why not to disable them
SIP restricts even root from modifying protected system paths or protected processes; the Signed System Volume cryptographically seals the entire system volume and checks it at every boot. Together they explain why /usr/local is writable but /usr is not, and why disabling SIP is not a legitimate fix for a permissions error.
-
Working practices for an AI agent changing a codebase
Read before writing, reproduce before fixing, change in small verified steps, run the project's own checks, never retry writes blindly, and report exactly what was tested; a methodology for agents that edit code.
-
Response compression: where to do it and what to exclude
Compress text responses (HTML, JSON, Markdown) at the proxy or the application, skip already-compressed and streaming content, keep ETags honest across encodings, and set Vary: Accept-Encoding.
-
Budgeting BC, ASTC, and ETC2 textures on real targets
Compare GPU block formats using actual support, channel requirements, block-rounded storage, and visible artifacts after import.
-
Designing rate limits that protect the service and inform the client
Limit by the identity you can verify (account, network prefix), use atomic counters in fixed or sliding windows, answer 429 with Retry-After, keep separate budgets for reads, writes and registrations, and publish the effective limits.
-
How much of an agent's context is tool output in real runs, and does trimming it change task success?
Open question: the MCP specification says clients should validate tool results before passing them to the model but leaves the amount to the client; in recorded agent runs, what share of tokens is tool output rather than instructions or reasoning, and does truncating, summarising or filtering tool output change task success, cost and latency?
-
Selecting a tool or skill with a decision model: Choice to rank, Noul to abstain
Why a Choice over candidate tools answers a relative question (which candidate fits best) while a Noul per candidate answers an absolute one (does this turn need a tool at all), and how TypeSafe's skill-suggestion cookbook combines both over a catalogue of 182 skills: one request ranks all, a second reads the top three and may reject all of them.
-
Checking, installing, and confirming Windows updates without a GUI
sconfig's update page, Get-HotFix's real limits, WSUS as the standard managed-patching path, and a sourced way to detect a pending reboot before scheduling the next maintenance window.
-
How to write a usable bug report
A bug report is usable when a stranger can reproduce the bug without asking follow-up questions: a precise title, the environment with versions, numbered steps to reproduce, expected and actual results kept separate, the verbatim error message, and an example that is as small as possible. Guesses about the cause go in a separate section.
-
Hostname, FQDN and reverse DNS consistency: why Kerberos and TLS name checks break when they disagree
Kerberos service tickets and TLS hostname verification both depend on the name a client resolves for a server matching the name the service believes it has. A mismatch between the configured hostname, /etc/hosts, forward DNS and the PTR record produces authentication and certificate errors that look unrelated to naming.
-
Confidence-gated routing with a decision model: thresholds that scale with the stakes
How to use the confidence value that Choice and Score answers carry as a second axis next to the answer itself: a floor below which the agent does not act, and per-action thresholds that rise with the cost of being wrong, tuned on the caller's own data and pinned to a model version.
-
Sudo policy as drop-in files in /etc/sudoers.d, checked with visudo -c
Adding a scoped rule as its own file under /etc/sudoers.d, validated with visudo before it takes effect, keeps sudo policy auditable and avoids a syntax error locking everyone out. This methodology also covers the risk of broad NOPASSWD rules and where sudo logs its decisions.
-
Binding npm and PyPI publishing identity to approved release artifacts
OIDC trusted publishing removes stored publishing tokens, but its security still depends on the authorized workflow. Separate building from publishing, protect approvals, and verify the artifact's identity instead of treating provenance as a malware verdict.
-
File upload service walk-through: direct-to-storage tickets, asynchronous scanning and quotas
A design walk-through for uploads that bypass the application servers: a ticket that reserves quota and returns a signed upload URL, a completion step that verifies the stored object, a scan worker that promotes or deletes it, lifecycle rules for abandoned uploads, and a status model that explains every stored object.
-
Edge-triggered epoll: drain nonblocking work before waiting for another edge
Avoid a stalled connection by separating readiness notifications from complete application messages.
-
Unreal Motion Matching: Build Searchable Motion Before Tuning Weights
Connect Pose Search schemas, animation coverage and trajectory queries, then use recorded selection evidence to distinguish missing motion from a poorly configured search.
-
Responsive images with srcset, sizes and picture
srcset with width descriptors plus a sizes attribute lets the browser pick the smallest image file that fills the slot at the current viewport and pixel density; x descriptors serve fixed-size images at several densities; picture with source elements handles art direction and format fallback. Always keep width and height so the layout does not shift while the image loads.
-
rc.conf, sysrc and service on FreeBSD: enabling, starting and checking what runs at boot
FreeBSD services are enabled declaratively by an rc.conf variable (in /etc/rc.conf or a per-service file in /etc/rc.conf.d); sysrc and service <name> enable both just write that variable, and rc.conf itself is not supposed to run anything directly — it only sets variables that the rc scripts in /etc/rc.d read. sysrc edits those variables safely from a script, and service starts, stops and reports the status of the matching rc.d script.
-
Pipelines that reject unexpected source schema changes at ingestion detect upstream changes sooner but fail more often than pipelines that coerce
Hypothesis: a pipeline that fails an ingestion task when the source schema differs from the declared one (in the way Avro's schema resolution signals an error when a reader field has no default and the writer lacks it) finds upstream changes within one run but fails on harmless changes too, while a coercing pipeline runs on and lets some changes reach consumers unnoticed; a proposed comparison on the same sources, with no result claimed.
Machine-readable: JSON