All articles
-
Training, validation and test sets: what each split is for and how to cut it
A model is fitted on the training set, choices between models and hyperparameters are made on the validation set (or by cross-validation), and the test set is touched once for the final estimate; how rows are assigned to splits (random, stratified, by group, by time) decides whether the estimate says anything about production.
-
Managing FileVault from the command line: status, recovery keys, secure token and bootstrap token
fdesetup reports and changes FileVault state and recovery-key handling; sysadminctl and profiles report which accounts can unlock the disk and whether a bootstrap token is escrowed with a device management service, which matters before relying on MDM-driven account provisioning.
-
When should a service with users in every time zone schedule its maintenance window?
Open question: a maintenance window at 3 a.m. locally is midday for someone; how have small teams serving global users chosen their windows, and did traffic-minimum, staff-availability or rotating-region windows lead to fewer complaints and safer changes?
-
Readable body text: line length, line spacing and contrast
Three properties determine whether long text is comfortable to read: line length (the WCAG AAA criterion caps it at 80 characters), line spacing (it must be possible to set at least 1.5 times the font size without breaking the layout) and contrast (4.5:1 for normal text, 3:1 for large text). Set them in relative units so users can enlarge text and adjust its spacing.
-
Godot TileMapLayer: Author Tile Identity, Terrain Rules and Collision Together
Organize tile layers around their role, keep map coordinates separate from atlas identity, and prepare complete terrain and collision data before relying on automatic painting.
-
Checking a kitchen scale with coins of published mass: a repeatability, range and corner-load record
A proposed record-only protocol for a household scale: use new coins whose nominal mass the issuing mint publishes as reference masses, log readings for single coins and stacks across the scale's range, repeat placements, test the four corners and a timed hold, and keep the sheet per scale; no adjustment and no pass or fail judgement is part of it.
-
Where Solaris keeps its logs, and using fmadm/fmdump for hardware and software faults
General system messages accumulate in /var/adm/messages (what dmesg replays), each SMF instance logs its own start-method output under /var/svc/log/, and the Fault Management Architecture (fmadm, fmdump) separately diagnoses hardware and some software faults into a correlated record with a UUID.
-
Booting a rescue or live system and chrooting into an installed Linux to repair it
When a system will not boot at all, the standard recovery path is to boot an independent rescue or live medium, mount the installed root and its related filesystems, bind-mount the kernel's virtual filesystems into it, chroot in to run the installed system's own tools (grub-install, package manager, passwd), then unmount everything cleanly before rebooting.
-
HEAD and OPTIONS: what they answer and what clients use them for
HEAD is GET without the body: same status and headers (Content-Length and Vary may be omitted), cacheable, used for link checking, size probes and freshness checks. OPTIONS asks which communication options a resource or the whole server (OPTIONS *) supports, is typically answered with Allow, is not cacheable, and carries CORS preflights with Access-Control-Request-Method.
-
Verifying Slack request signatures: X-Slack-Signature, the 5-minute replay window and the 3-second rule
Slack signs requests as v0=<hex HMAC-SHA256> of the string "v0:{timestamp}:{raw body}" in the X-Slack-Signature header, paired with X-Slack-Request-Timestamp, which Slack's own example rejects once it differs from local time by more than five minutes. Slash commands and interactive payloads must additionally be acknowledged within three seconds, before any slow processing.
-
Administering DNS Server zones and records from PowerShell, then verifying with Resolve-DnsName
Get-DnsServerZone, adding A and CNAME records, listing records with Get-DnsServerResourceRecord, the scavenging/aging settings that expire stale records, and clearing the resolver cache — with every write checked from the client side, not just the server's own view.
-
IIS administration basics from PowerShell: sites, app pools, logs, and backing up the configuration
Reading sites with the IISAdministration module's Get-IISSite, recycling an application pool, where IIS writes its logs by default, and using appcmd add backup to snapshot applicationHost.config before a configuration change.
-
Unity Burst and Jobs: Design Dependencies Around Shared Native Data
Structure Burst-compatible computation as producers and consumers, declare native-container access, and complete the final dependency before the main thread reads or disposes shared memory.
-
Per-process CPU and I/O with pidstat and /proc/<pid>/io: finding what causes I/O wait
pidstat reports per-task CPU, memory and disk I/O without grepping a name out of top; reading /proc/<pid>/io directly separates logical I/O (rchar/wchar, including cache) from the physical read_bytes/write_bytes that actually reach the device.
-
Read-only maintenance mode: serving reads while writes are paused
For storage moves, failovers and long migrations, a service can keep serving reads and refuse writes with a clear message instead of going dark; PostgreSQL's default_transaction_read_only makes new transactions read-only at the database as a backstop, and HTTP 503 with Retry-After tells clients when to try again. The mode needs one switch, a user-facing message and a rehearsal.
-
Godot CharacterBody3D: grounded motion with correct velocity and physics timing
Keep velocity in distance-per-second units, integrate acceleration deliberately and use move_and_slide during physics updates with explicit grounded-state rules.
-
Maven versus Gradle: what a newcomer needs to build someone else's JVM project
Maven describes a project declaratively in pom.xml and runs fixed lifecycle phases (validate, compile, test, package, verify, install, deploy) with plugin goals bound to them; Gradle runs a graph of tasks configured by build.gradle(.kts) scripts and plugins. Both resolve transitive dependencies but with different conflict rules (Maven: nearest definition; Gradle: highest version), and both ship a wrapper script that pins the build tool version.
-
TLS verification errors across tools: unknown authority, CERTIFICATE_VERIFY_FAILED, self-signed in chain
Different TLS clients report the same underlying failure - an incomplete or untrusted certificate chain - in their own wording: 'certificate signed by unknown authority', 'CERTIFICATE_VERIFY_FAILED', 'unable to get local issuer certificate', 'self-signed certificate in certificate chain'. The article shows how to diagnose the actual chain with openssl s_client before reaching for any fix, and why -k or verify=False is never one.
-
Choosing between threads, processes and asyncio for a Python workload
Classify the hot path first: waiting on I/O suits asyncio (many connections, async libraries) or a thread pool (few blocking calls); pure-Python CPU work needs processes or a free-threaded build; native code that releases the GIL can use threads. Bound every pool, choose the process start method explicitly and write the shutdown path.
-
Installing, updating and verifying software with the Image Packaging System (pkg)
The pkg client covers search, install, update, uninstall, publisher management, and verify/fix against packaging metadata. pkg operations are boot-environment aware: changes to packages that require a reboot go into a new BE activated for the next boot, while other changes apply to the running BE, under the default policy with a backup BE when kernel-affecting content is touched.
Machine-readable: JSON