All articles
-
Authoring reliable metallic-roughness PBR materials
Build material inputs that distinguish exposed metal from dielectric coatings, preserve colour meaning, and remain testable under changing light.
-
Brute-force mitigation with fail2ban: jails, backends, status, and unbanning your own address
fail2ban watches logs for repeated authentication failures and bans the source with a firewall action; configuration belongs in jail.local overrides rather than the packaged jail.conf, and ignoreip is what keeps a management address from banning itself.
-
Rust Pin: preserve the pointee address without freezing the pointer variable
Diagnose pinning errors by identifying the address-sensitive value and the operation that could move it.
-
Zero-downtime database changes: expand and contract
Change a schema in three separately deployable steps: expand (add the new column or table, keep the old one), migrate (write to both and backfill in small batches), contract (remove the old structure once all code uses the new one). Avoid long locks by never rewriting a table in a single statement and by capping every lock wait with lock_timeout.
-
Reproducibility of a machine-learning experiment: seeds, environment, data and the limits of determinism
Rerunning an experiment and getting the same number requires fixed random states passed explicitly, pinned library versions, an identified dataset and split, and awareness that GPU kernels and library releases can still change results; the protocol makes runs repeatable where possible and documents where they are not.
-
Canary behavior changes before rollout
Expose a bounded cohort to a new behavior, compare it with a baseline and stop using predeclared failure conditions.
-
An explicit 'none of these' option in every closed decision lowers an agent's wrong-action rate more than raising the confidence threshold does
For an agent that routes or classifies with a closed set of options and acts on the result, this hypothesis predicts that adding an explicit abstain option to the option set removes more wrong actions per blocked correct action than tightening a confidence threshold on the same question without such an option.
-
Red-teaming an agent workflow before it gets real permissions
Attack the agent the way content and users will: indirect prompt injection through every input it reads, tool-argument manipulation, exfiltration through tool calls and budget exhaustion; run scripted probes plus manual attempts, record what the agent did, and fix the boundary, not only the prompt.
-
Client-server clock synchronization: estimate time without hiding uncertainty
Use timestamp exchanges to estimate server-time offset, account for asymmetric delay and drift, and keep clock corrections distinct from simulation and presentation policies.
-
Checking and repairing filesystems: fsck, xfs_repair and btrfs check on an unmounted filesystem
ext4, XFS and Btrfs each ship their own checker with different safety rules: e2fsck and xfs_repair must run on an unmounted filesystem (xfs_repair has a -n dry-run mode), while btrfs check defaults to read-only and warns strongly against --repair. Exit codes and dry-run output, not intuition, decide whether a repair is needed.
-
Test data without production personal data
Give development, CI and staging realistic data by generating it: classify columns, write seeded generators that pass the application's validators, produce volume with generate_series, copy only distributions from production, mark generated records recognisably, and remove the shortcut of dumping production.
-
SDF and MSDF Text: Preserve Glyph Edges Across Display Sizes
Decode distance-field glyphs with the correct range and channel interpretation, preserve atlas margins, and keep text shaping separate from glyph rendering.
-
Cost allocation tags: a tagging standard that survives the billing export
Cloud bills can be grouped only by tags that exist on the resource, are activated for billing, and are spelled consistently; define a short mandatory key set, enforce it at creation with policy, apply it through infrastructure code, and reconcile untagged spend every month.
-
Building resilient storage on a standalone server with Storage Spaces, and replacing a failed disk
New-StoragePool grouping physical disks, New-VirtualDisk with Mirror or Parity resiliency, watching health with Get-PhysicalDisk and Get-StorageJob, and the documented sequence for swapping a failed disk without losing the pool.
-
How much test coverage is enough for a small service?
Open question: for a service of a few thousand lines with a database and an HTTP API, what coverage level and test mix has been observed to keep defect rates acceptable without slowing change?
-
Structured extraction from documents with JSON Schema, validation and bounded retries
Define the target record as a JSON Schema with additionalProperties false, ask the model for exactly that shape, validate every response with a real validator, retry a bounded number of times with the validation error in the prompt, and route what still fails to a person instead of guessing.
-
Onboarding documentation: the path from a fresh machine to a merged change
Onboarding documentation is one numbered path that takes a newcomer, human or agent, from nothing installed to a merged change using only what is written down; each newcomer fixes what tripped them, and the path carries an owner and a freshness date.
-
Access to the Docker socket is root on the host: what mounting it into a container really grants
Whoever can talk to the Docker daemon can start a container that mounts the host's root file system with full access. Mounting /var/run/docker.sock into a container, adding a user to the docker group or exposing the API over TCP is therefore equivalent to granting root.
-
Locale-aware interfaces: Intl plural rules, dates and right-to-left layout
Format numbers, dates and relative times with the browser's Intl objects instead of string arithmetic, pick plural forms by Intl.PluralRules categories rather than n == 1, lay out with CSS logical properties so a dir=rtl document mirrors itself, and leave room for text that expands when translated.
-
Prioritising October 2026 Patch Tuesday by exploitation evidence and affected assets
A proposed patch-triage protocol turns a large release into an asset-level queue. Confirmed exploitation, exposure and business consequences guide urgency; EPSS assists where exploitation evidence is absent.
Machine-readable: JSON