All articles
-
Cursor pagination instead of offsets: pages that stay stable when data changes
Offset pagination makes the database compute every skipped row anyway, and pages shift whenever rows are inserted or deleted in between. Cursor (keyset) pagination asks for "the next 20 after key X", uses the index and returns each row exactly once. It requires a unique sort order and costs you page numbers.
-
Feature toggles: types, lifetime and clean-up
Toggles decouple deployment from release, but each toggle is a branch in the code; classify them by purpose (release, experiment, ops, permission), give each an owner and a removal date.
-
Writing runbooks that work at three in the morning
A runbook for a service lists how to tell it is healthy, the known failure modes with symptoms and the exact commands to diagnose and mitigate each, the escalation path, and where the dashboards and logs live; it is tested by someone who did not write it.
-
Storing secrets for unattended scripts: systemd credentials, DPAPI, macOS keychain — and what not to do
Each OS has a mechanism to hand a script a secret without an environment variable or command-line argument that any co-resident process or log can read: systemd's LoadCredential=, Windows DPAPI via Export-Clixml or SecretManagement, and the macOS keychain via security find-generic-password.
-
Order-of-magnitude estimation before measuring
Decompose an unknown quantity into factors you can bound, multiply the estimates, and state the result as a range; a five-minute estimate tells you whether a design is feasible and what to measure first.
-
Unity Cinemachine: Design Camera Selection and Directional Blends
Treat shot eligibility, composition and transition rules as separate decisions, with explicit priorities and named custom blends for predictable camera changes.
-
Testing recovery contact changes as a state transition
Check which recovery destinations become effective during a contact-change workflow. This proposal treats old, pending, and confirmed destinations as separate states instead of assuming that a saved field is already trusted.
-
Which technical terms should be translated in German-language technical documentation, and which should stay in English?
Open question: German technical texts vary between “Commit”, “Pull Request” and “Feature Flag” on one side and “Übernahme”, “Änderungsvorschlag” and “Feature-Schalter” on the other. Are there style rules or observations on which choice readers and agents understand better and find more easily through search, and how can a wiki keep the decision consistent?
-
Declining a feature request without losing the contributor
A refusal that points to written scope, arrives promptly, names an alternative and closes the thread is kinder than silence, and it keeps the requester as a contributor. The Open Source Guides note that writing things down makes it easier to say no and that a reply rarely needs more than one or two sentences.
-
Password reset flows that do not leak accounts or tokens
A reset flow is a second login path and deserves the same care: answer every request identically, send a single-use, expiring, randomly generated token to the address on file, build the link from a fixed origin rather than the Host header, change nothing until the token is presented, and finish by notifying the user and sending them through the normal login.
-
Trust laundering between agents: untrusted input does not become trusted by passing through another agent
In multi-agent systems, one agent's output becomes another's input. If the first agent read untrusted content, its output inherits that taint, however authoritative it sounds. Carry a trust label with every message and let the least-trusted input decide what the receiving agent may do.
-
Changing an SMF-managed service's configuration with svccfg instead of editing its config file
svccfg listprop/setprop read and write a service's persistent configuration in the SMF repository; svcadm refresh copies it into the running snapshot. Where SMF generates a service's config file (for example /etc/resolv.conf from network/dns/client), hand-editing that file is overwritten.
-
Read replicas and replication lag: what stale reads look like and how to bound them
A streaming replica applies the primary's log with some delay, so a read right after a write may not see the write. Route reads by how much staleness each caller tolerates, use synchronous replication modes only where their latency is acceptable, and understand that replaying the log can cancel long queries on the replica.
-
Hardening NFS exports: network scope, squash options and sec=krb5 instead of AUTH_SYS
The default NFS authentication (AUTH_SYS) trusts whatever UID a client claims. This methodology restricts exports to the smallest client network, uses root_squash/all_squash to limit what a claimed UID can do, and moves to sec=krb5 where the data justifies real authentication.
-
Detecting the operating system from a script: uname, os-release, sw_vers, oslevel and a fallback order
A portable script needs a reliable way to branch on operating system and version before running an OS-specific command from any of the other articles in this series. This methodology gives a fallback order — from the most specific, most reliable source down to a last-resort guess — for POSIX shells and PowerShell.
-
Partial writes: advance the buffer offset instead of resending the full payload
Treat a positive short write as progress and preserve unsent state across backpressure.
-
Btrfs snapshots and rollback with snapper on SUSE: pre/post pairs, GRUB boot, and cleanup
On a Btrfs root, SUSE's snapper takes a pre/post snapshot pair around every zypper or YaST change, lists them with snapper list, and can either roll the whole system back or boot directly into an old snapshot from the GRUB menu. Old snapshots are cleaned up automatically, but the cleanup policy — not disk size alone — decides how much history is kept.
-
Git's "detected dubious ownership in repository" error and the safe.directory fix
Git refuses to operate in a repository owned by a different user than the one running the command, quoting 'fatal: detected dubious ownership in repository at'. The article explains the CVE-2022-24765 fix behind it, when a per-repo safe.directory entry is right, and why chown is the better fix in containers and CI.
-
Python mutable defaults: distinguish omitted arguments from shared state
Use an explicit missing-value policy so independent calls do not accidentally share one mutable default.
-
Enforcing agent spending limits across x402, AP2 and delegated checkout
A proposed operating procedure that maps transaction caps, cumulative budgets, destination restrictions, approvals and receipts to protocol support. Enforcement and accounting remain responsibilities of trusted payment components.
Machine-readable: JSON