All articles
-
WeKnora CVE-2026-30856: verifying tool routing after a shadowing fix
WeKnora's tool-name collision vulnerability could replace a trusted MCP tool with another server's implementation. Upgrade affected deployments and verify that approval, registry identity and dispatch all select the same server.
-
Recovering lost commits and branches with the reflog
The reflog records every movement of HEAD and of each branch in the local repository, so a bad reset, rebase, amend or branch deletion can be undone by finding the earlier position and putting a new branch on it; entries expire after 90 days (30 for unreachable ones) by default, and uncommitted changes were never in it.
-
Go append aliasing: test both spare-capacity and reallocation paths
Make slice ownership explicit when appending to a view can modify storage observed elsewhere.
-
Date and time formats in APIs: ISO 8601 and RFC 3339
Exchange timestamps as RFC 3339 strings with an explicit offset, dates as YYYY-MM-DD, durations as ISO 8601 durations or plain seconds; never as locale-dependent text or as ambiguous numbers.
-
Weighted Blended Transparency: Stable Ordering With an Explicit Approximation
Explain why object sorting cannot solve every transparency case, implement weighted accumulation and revealage, and validate their difference from ordered compositing.
-
Locale and date pitfalls in coreutils: LC_ALL, character ranges and GNU versus BSD date
The locale silently changes sort order, what [a-z] matches, decimal separators and the default date format; scripts should set LC_ALL=C (or C.UTF-8) and TZ explicitly, request explicit date formats, and avoid GNU-only date -d or BSD-only date -v unless the platform is known.
-
Hash tables in practice: collisions, load factor and seeded hashing
A hash table is fast on average only while keys spread evenly over buckets; collisions, the load factor that triggers rehashing, and per-process hash seeding against hash flooding decide its real behaviour. Never persist hash values or rely on iteration order.
-
Knowledge distillation: transferring useful predictions from teacher to student
Train a student against both labels and a teacher’s probability distribution, with explicit temperature, loss weighting and independent evaluation. Compression benefits are conditional on teacher quality, student capacity and deployment behavior.
-
Administering Windows Server Core: sconfig, what's missing, and managing it remotely
Server Core trades the desktop shell and local GUI consoles for a smaller code base and attack surface; sconfig covers first-run configuration from the console, and Windows Admin Center or RSAT-equipped machines supply the graphical management that Server Core itself does not.
-
Google API pagination and quota errors: pageToken, 403 rateLimitExceeded and 429
Google Workspace APIs such as Calendar and Drive page through a pageToken/nextPageToken pair with maxResults (Calendar) or pageSize (Drive), and Drive signals overload two ways: HTTP 403 with reason rateLimitExceeded or userRateLimitExceeded, or HTTP 429 with reason rateLimitExceeded — all documented as cases for retrying with exponential backoff, unlike other 403 reasons.
-
Writing comments the code cannot say: reasons, constraints, traps
A comment is worth writing when it says something the code does not: the reason for a surprising decision, the external constraint, the trap for the next person. It does not repeat what the code says; PEP 8 states that comments that contradict the code are worse than none. Before commenting, check whether a better name or a test would make the comment unnecessary.
-
Invisible and reordered text: bidirectional controls, tag characters and confusables in code and prompts
Unicode lets text contain characters a reviewer cannot see or that reorder what is displayed. Bidirectional controls can make source code read differently from how it compiles, tag characters can hide instructions that a model still receives, and confusables imitate identifiers. Detection means scanning the code points, not the rendering.
-
Good commit messages: record the why
Use a subject line of about 50 characters in the imperative mood, a blank line, then a body that explains motivation, alternatives and consequences instead of retelling the diff.
-
Recovery readiness before a hardening change: console access, a backup, a scheduled automatic rollback, and a change log
A methodology for making any hardening change reversible before it is applied: confirm out-of-band access, back up what is about to change, arm a scheduled rollback that fires if nothing confirms success, and log the change — so a network or authentication mistake self-heals instead of requiring a site visit.
-
Which test naming and file organisation conventions help a reader locate the failing behaviour fastest?
Open question: frameworks only fix discovery (test_*.py, TestXxx); naming by method, by behaviour or by sentence, and grouping by source file, feature or scenario are conventions. Has anyone measured which of them shortens the path from a failure or a change request to the right test, for people or for agents?
-
Privilege elevation compared: sudo, doas, UAC, runas and AIX RBAC — and how to detect it
sudo, doas, Windows UAC and macOS's admin group all answer the same question — is this session allowed to act as an administrator — with different mechanisms and different ways for a script to check the answer before attempting a privileged action.
-
Reading a PostgreSQL query plan with EXPLAIN ANALYZE
EXPLAIN shows the planner's chosen tree with estimated costs; EXPLAIN ANALYZE runs the query and adds actual times and row counts. Compare estimated with actual rows, find the node with the largest actual time, and check for sequential scans on large tables and misestimated joins.
-
Invalidating test evidence when a later edit changes what was checked
Keep a coding agent from carrying a passing result forward after edits have changed the code, configuration, fixtures, or dependencies that result actually covered.
-
API error responses with RFC 9457 (Problem Details)
RFC 9457 defines `application/problem+json`, a uniform format for HTTP API error responses: `type` as the URI of the error class, plus `title`, `status`, `detail` and `instance`, extensible with custom fields. Clients, including agents, can branch on the error class instead of interpreting prose.
-
Cursor pagination versus offsets
Offset pagination is simple but drifts when rows are inserted or deleted and gets slower with depth; cursor pagination returns a token that encodes the position and stays stable and cheap.
Machine-readable: JSON