All articles
-
Reproducible method template
A reusable outline for a method whose result another contributor can inspect.
-
Readable body text: measure, line height and contrast
Three properties decide whether long text can be read comfortably: line length (WCAG's AAA criterion caps it at 80 characters), line spacing (at least 1.5 times the font size must be possible without breaking the layout) and contrast (4.5:1 for normal text, 3:1 for large text). Set them in relative units so users can resize and re-space the text.
-
Reading and changing service state with the Service Management Facility: svcs and svcadm
SMF is the Solaris equivalent of systemd unit management. svcs -a/-x/-l read state and find problems, svcadm enable/disable/restart/refresh change it, -t makes a change temporary, and svcadm clear recovers an instance stuck in maintenance.
-
Calibrating a scanner result with a vulnerable fixture and a safe twin
Determine whether a security scanner distinguishes the behavior it claims to detect. This original method uses controlled fixtures to interpret a finding, not to certify the scanner or rank products.
-
Preventing SQL injection with parameterised queries
Never build SQL by concatenating untrusted strings; pass values as parameters so the driver sends them separately from the statement, and allow-list any identifiers that must be dynamic.
-
Context7 CVE-2026-75130: hosted remediation and untrusted custom rules
Context7 reports that the Custom Rules vulnerability was fixed on its servers in February 2026. Its October clarification disputes a client-version interpretation of the CVE; documentation responses still require separation from agent authority.
-
ES modules versus CommonJS in Node.js
CommonJS uses synchronous require and module.exports; ES modules use static import/export, top-level await and import.meta. Node decides per file by extension and the nearest package.json type field; ES modules need full file extensions and lack __dirname and require, which have documented replacements.
-
Managing secrets outside the repository
Credentials belong in protected configuration injected at runtime, never in source control, images or logs; rotate them on a schedule and on suspicion, and give each service its own.
-
Regex flavors: BRE/ERE, PCRE2, RE2, JavaScript, Python and .NET side by side
The characters + ? | ( ) { } switch between literal and special depending on whether a tool speaks POSIX BRE or ERE, and lookaround and backreferences are supported by some engines and deliberately rejected by RE2 to guarantee linear-time matching, while named groups come in three spellings that engines accept in different combinations.
-
Hallucinated and look-alike package names: checking a dependency before an agent installs it
Code-generating models sometimes name packages that do not exist; an attacker can register such a name, and typosquatters register near-misses of popular ones. Before installing, an agent should confirm the package exists, is the intended project and is not newly registered under a confusable name.
-
Administering snap packages on Ubuntu: updates, holds, confinement and safe removal
snapd refreshes installed snaps automatically several times a day; an administrator controls that with snap refresh --hold or the system-wide refresh.timer/refresh.hold options, checks confinement level before trusting a snap with broad access, and can remove one with a 31-day recovery snapshot kept by default.
-
Reviewing code written by an AI agent
A proposed review protocol for generated changes: compare the diff with the request, confirm every API and dependency exists, verify test claims by running and breaking the tests, read tests before implementation, hunt for swallowed errors, and record what was checked.
-
Writing up a small repair with explicit uncertainty
A proposed structure for a non-hazardous repair report: symptom, checks with expected and observed results, the change made, whether the symptom disappeared, and what remains unproven; avoids claiming an untested fix is safe.
-
z/OS orientation: address spaces, datasets, catalogs, JES2, and what SSH into USS can see
z/OS organizes work into address spaces rather than a flat process table, stores data in cataloged datasets rather than a single filesystem tree, and queues batch work through JES2; an SSH session into z/OS UNIX System Services (USS) is one more address space with its own view, not a window onto the whole system.
-
JavaScript text offsets: distinguish UTF-16 units, code points and visible characters
Name the offset unit at every editor or API boundary and convert deliberately before slicing text.
-
Accept-Language negotiation and its limits
Accept-Language carries a weighted list of language ranges (da, en-gb;q=0.8, en;q=0.7); the server matches it against the languages it has using RFC 4647 filtering or lookup, answers with Content-Language and Vary: Accept-Language, and must fall back sensibly when the header is absent (Googlebot sends none) or wrong (a device locale is not a reader's choice). Use it for the first guess, not as the only selector.
-
Hyper-V from PowerShell: virtual machines, checkpoints, and why a checkpoint is not a backup
Get-VM and the shape of a New-VM call, the difference between Standard and Production checkpoints, Export-VM for moving a VM, integration services, and the -ExposeVirtualizationExtensions switch that turns on nested virtualization.
-
"Too many open files" (EMFILE) and the file-descriptor limit
EMFILE, reported as 'Too many open files', means a process hit its own limit on simultaneously open file descriptors, documented as RLIMIT_NOFILE. The article shows how to tell a real descriptor leak from a limit that is simply too low, and how to raise it at the shell, PAM and systemd-unit level.
-
Label shift: detecting and correcting changing class proportions
Estimate changing class priors only under an explicit label-shift assumption, check identifiability and distinguish prior estimation from calibrated posterior correction.
-
Checking an operating system's support lifecycle before automating against it
Automating patch, upgrade or compliance workflows against a host that has already passed end-of-life produces false confidence: no more security fixes are coming regardless of what the automation reports. This methodology lists where each major vendor publishes lifecycle dates and how to fold an EOL check into a pre-flight step.
Machine-readable: JSON