All articles
-
Selecting source spans with Jev without silently rewriting values
Separate semantic selection from value copying so an agent can identify a requested value while preserving the exact evidence from which it came.
-
After moving a JVM service to virtual threads, what changed in throughput, memory and pinning incidents, and what had to be rewritten?
Open question: JEP 444 states that pinning does not make an application incorrect but might hinder its scalability, and JEP 491, delivered in JDK 24, removes pinning for synchronized blocks; for services that switched request handling to virtual threads, what did the change do to throughput and memory, which pinning or pool-exhaustion incidents occurred, and which code and libraries had to change?
-
A 60-second first look at a slow Linux server: the command order and what each line answers
A fixed sequence of ten standard commands — uptime through top, several from the sysstat package that may need installing first — each answering one question about CPU, memory, disk and network, run before opening a single log file or restarting anything.
-
CPU profiling with perf: perf top, perf record -g, perf report, and perf_event_paranoid
perf top gives an immediate live profile; perf record -g saves a call-graph profile to disk for perf report to read later. The kernel's perf_event_paranoid setting controls what an unprivileged user can do, and symbol resolution needs matching debug information for every frame in the stack.
-
Measuring your commute: a door-to-door timing protocol
A proposed protocol for timing a repeated journey: fixed start and end points, RFC 3339 timestamps with UTC offset at each, optional segment boundaries, and a conditions column (weekday, route variant, weather, disruption), so that variation can be attributed rather than remembered; no route is recommended.
-
System One models and Jev: typed decisions with calibrated probabilities instead of generated text
Jev (TypeSafe AI, early access since September 2026) is a model that answers typed questions about a supplied state with probability distributions and a confidence value rather than generated text; what the vendor documents about its primitives, limits, pricing and training, and what that leaves open.
-
Sicherheits-Antwortheader jenseits der Content Security Policy
Wenige Antwortheader schliessen verbreitete Lücken im Browser, ohne dass die Anwendung angefasst wird: X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy und Strict-Transport-Security; X-Frame-Options ist durch frame-ancestors abgelöst, X-XSS-Protection wird auf 0 gesetzt. Zentral am Proxy setzen, für jede Antwort, und nach jedem Deployment prüfen.
-
Java virtual threads in outline: what changes and what does not
JEP 444 (JDK 21) adds virtual threads: cheap threads scheduled by the JDK onto a small pool of carrier platform threads, which unmount while blocked on most JDK I/O so that thread-per-request code scales without an asynchronous style. They are not faster, must never be pooled, and until JEP 491 (JDK 24) blocking inside synchronized pinned the carrier.
-
Dynamic programming step by step: deriving edit distance
Dynamic programming turns a recursive definition with overlapping subproblems into a polynomial algorithm: define the state, write the recurrence and base cases, memoise or fill a table, then cut memory. Edit distance between two strings is derived in full as the worked example.
-
Minimize personal data in evidence
Retain the smallest evidence record needed to reproduce a decision, excluding unrelated identity and payload data.
-
Backing up and cloning AIX: mksysb, savevg, and low-risk upgrades with alt_disk_copy
mksysb creates a bootable backup of rootvg (savevg backs up a non-root volume group, not bootable, restored with restvg); lsmksysb reads back what a mksysb image contains without restoring it. alt_disk_copy and alt_disk_mksysb clone or update rootvg onto a spare disk so a bootlist change, not a restore, is the fallback if the new level misbehaves.
-
Data minimisation as a schema and logging discipline
Store only the personal data a feature needs, at the coarsest precision that serves it, and keep identifiers out of logs by allowlisting fields; every column, log field and derived store that carries personal data is a design decision with a purpose, an owner and an expiry, not a default.
-
How should a small repair method document uncertainty?
Open request for a template that distinguishes confirmed steps from untested assumptions.
-
Use expiring leases for distributed jobs
Protect a reclaimed job from a delayed previous worker with ownership checks and a monotonically increasing fencing token.
-
Converting certificates between PEM, DER and PKCS#12 with openssl for cross-platform trust and keystores
Trust stores and keystores expect different container formats: RHEL/Debian anchors want PEM .crt files, Windows and Java tooling often hand you or expect PKCS#12 (.pfx/.p12) or DER (.cer), and openssl pkcs12/x509 convert between them and split out the key.
-
"exec format error" and "cannot execute binary file": architecture and shebang mismatches
The kernel's ENOEXEC error surfaces as 'exec format error' or 'cannot execute binary file: Exec format error' when the CPU architecture does not match or a script lacks a usable shebang; CRLF line endings in the shebang cause a related 'bad interpreter' or 'required file not found' failure. The article shows how to tell them apart with file(1) and fix each without guessing.
-
Savepoints and the aborted-transaction state in PostgreSQL
After any error inside a transaction block PostgreSQL rejects every further command until the block is rolled back; a savepoint set before a risky statement lets ROLLBACK TO SAVEPOINT discard only that part and continue. Use savepoints deliberately and sparingly, and make error handlers roll back instead of retrying on the same connection.
-
MCP Roots, Sampling and Logging: migration paths after 2026-07-28 deprecation
Roots, Sampling and protocol Logging are deprecated, not removed. Their documented replacements require separate decisions about filesystem permissions, model access and operational observability.
-
Canary credentials and decoy files: detecting that someone read what they should not
A decoy credential or file that no legitimate process uses raises an alert the moment it is used or opened. Planted where an intruder or a hijacked agent would look, it turns silent reading into a visible event. It detects; it does not prevent.
-
z/OS security with RACF: user, group, and dataset profiles, and why agents need least privilege
RACF is the resource manager most z/OS installations use behind the System Authorization Facility (SAF) interface, protecting users, groups, and datasets through profiles queried with LISTUSER/LISTDSD and granted with PERMIT; an automation agent should run under a narrowly scoped user ID rather than one carrying broad access, and should not treat command output as a stable programmatic interface.
Machine-readable: JSON