All articles
-
Floating-point numbers: why 0.1 + 0.2 is not 0.3
Binary floating point represents most decimal fractions approximately, so arithmetic accumulates rounding error; compare with tolerances, sum carefully, use integers or decimal types for money and counts, and print with enough digits to round-trip.
-
Calling the TypeSafe API from an agent: request shape, errors, retries and version pinning
The documented contract an agent needs to call Jev without a chat layer: POST /v1/systemone with a Bearer key, a state, a model name and a map of typed questions; answers keyed like the questions plus a usage block; 401, 422, 429 and 529 with exponential backoff; aliases that move and versioned IDs that do not; SDK defaults for retries and the agent skill for coding agents.
-
Designing an operations dashboard: one question per panel, one screen per audience
Start from the questions a responder must answer, give each question one panel, order panels from general to specific, normalise units and axes, use template variables instead of copies, link every paging alert to the dashboard it needs, and keep the dashboard definition in version control.
-
Dry-run modes for agent actions: showing the plan before the change
Give every tool that changes state a mode that computes and returns the concrete plan (which objects, which fields, how many) without applying it, validate the plan on the server side where the system allows it, require the plan to be produced and reviewed before the real call, and compare the real result against it afterwards.
-
Ephemeral databases in containers for integration tests
Start the real database engine in a throwaway container per test run, keep its data on memory, apply migrations once to a template database and copy it per test file; tests then exercise the real planner, constraints and isolation behaviour instead of an in-memory substitute.
-
Graceful shutdown: handling SIGTERM in services
Container runtimes send SIGTERM and wait a grace period before SIGKILL; a service should stop accepting new work, finish or hand back in-flight work, close connections, and exit within the period. Ignoring the signal turns every deploy into an outage.
-
Forms that declare native HTML constraints produce fewer server-side validation rejections per submission than forms validated only in custom JavaScript
Hypothesis: the browser blocks interactive submission of a form whose native constraints (required, pattern, type, min and max) fail, while MDN notes that calling submit() bypasses this and novalidate disables it; the proposal is that forms carrying native constraints that mirror the server rules reach the server with fewer rejections per submission than forms whose checks live only in custom scripts, because the native checks keep working when the script fails to load or errors; a proposed A/B test, with no result claimed.
-
Upsert, row limits and identifier quoting across PostgreSQL, MySQL, SQLite and SQL Server
PostgreSQL's ON CONFLICT, MySQL's ON DUPLICATE KEY UPDATE, SQLite's PostgreSQL-style ON CONFLICT and SQL Server's MERGE are three families of upsert syntax, LIMIT/OFFSET has at least three shapes, and a quoted identifier means double quotes, backticks or square brackets depending on the engine.
-
find and xargs exit codes: find's coarse 0/>0 versus xargs's 123-127 ladder
find only promises 0 for full success and any value above 0 for an error, deliberately without finer detail, while xargs defines a specific ladder for how the invoked command failed: 123 for an ordinary non-zero exit, 124 for exit 255, 125 for killed-by-signal, 126 for not-invocable, and 127 for not-found. Piping find into xargs means checking two different exit-code philosophies in one pipeline.
-
Teaching back as a comprehension check: explain it to a named reader, then compare with the source
Writing or saying an explanation for a specific, less-informed reader exposes gaps that rereading hides; an experiment reported in 2014 found that merely expecting to teach a passage produced more complete and better organised recall than expecting a test, and the written explanation can be checked sentence by sentence against the source.
-
Where credentials sit on a developer machine that an agent process can read
An agent running as the user can read what the user can read: environment variables, CLI credential files, container registry logins, SSH keys, shell history and browser-adjacent stores. Knowing these locations lets an operator decide what to keep out of the agent's reach and what to rotate after an incident.
-
Dependency confusion: when a public package shadows a private one
If a build resolves package names across a private index and a public one, an attacker who publishes the private name publicly with a higher version can get their code installed; pip's documentation calls --extra-index-url for private packages unsafe for exactly this reason. Defences are namespaces bound to one registry, a single proxying index, hash pinning and claiming names.
-
Loading YAML safely
Full YAML loaders can instantiate arbitrary objects from tagged nodes; always use a safe loader, pin the YAML version semantics, and validate the result against a schema before use.
-
Glob pattern dialects: what * and ** mean in .gitignore, .dockerignore, bash, Python and GitHub Actions
The same star and double-star characters mean different things depending on where the pattern is evaluated: a slash-less .gitignore pattern matches at every depth while the same line in .dockerignore only matches at the context root, bash's globstar recursion is opt-in, and Python's fnmatch is not even path-aware.
-
The Link header and link relation types
RFC 8288 lets any HTTP response carry typed links in a Link header: <target>; rel="relation" plus optional anchor, hreflang, type, title and media parameters. Relation names come from the IANA registry (next, prev, canonical, alternate, describedby, preload) or are absolute URIs for private extensions. It is how non-HTML responses point to their neighbours and how 103 Early Hints tells a browser what to fetch early.
-
Adding a third-party APT repository the current way: deb822 .sources files and Signed-By keyrings
apt-key is deprecated; the supported way to add a signed third-party repository is a keyring file under /etc/apt/keyrings referenced by a Signed-By option, written either in classic one-line form or the newer deb822 .sources format that both Debian 12/13 and current Ubuntu releases parse.
-
Reviewing command wrappers with an argument-recording substitute
Check how a coding agent’s command wrapper turns user-controlled values into executable intent. This original method substitutes a harmless argument recorder for the real program and examines the boundary directly.
-
Planning an in-place major upgrade of RHEL with Leapp
Leapp upgrades RHEL 8 to 9, or 9 to 10, in place, but only after every upgrade-blocking finding in its preupgrade report is resolved. This methodology covers running the assessment, recording answers to its prompts, and why a backup comes before the actual upgrade step.
-
GPU-Driven Indirect Rendering: Building Draw Workloads on the Device
Use GPU visibility results to generate indirect draws, with explicit buffer capacity, counter resets, synchronization and a CPU reference for validation.
-
A small swap area with low swappiness reduces OOM kills of the primary service on memory-tight servers
Hypothesis: on single-purpose servers whose working set nearly fills RAM, a modest swap area combined with a low vm.swappiness lets the kernel page out cold anonymous memory during short spikes, so the primary service is OOM-killed less often than on the same host without swap, at the cost of occasional latency.
Machine-readable: JSON