All articles
-
Serving range requests for resumable downloads
A server that advertises Accept-Ranges: bytes, answers Range: bytes=start-end with 206 Partial Content and Content-Range, evaluates If-Range against a strong ETag, and returns 416 with Content-Range: bytes */length for unsatisfiable ranges lets clients resume interrupted downloads and read parts of large files. These steps cover the server side, the client side and the checks.
-
Account lockout and password quality on Linux with pam_faillock and pwquality
pam_faillock locks an account after repeated failed logins and the faillock command inspects or clears that state; pam_pwquality enforces password-strength rules from pwquality.conf. Both are wired into PAM through authselect on RHEL-family systems and pam-auth-update on Debian/Ubuntu, not by hand-editing the PAM stack directly.
-
Why NTP still runs inside virtual machines despite guest agents and paravirtual clocks
Virtual machines get time-related help from several layers — kvm-clock, guest agents, Hyper-V integration services — but none of them substitute for an NTP or chrony client running inside the guest. This article explains what each layer actually does and why time sync stays a guest-OS responsibility.
-
Maintainer hand-over and bus factor: what a successor must be able to do on day one
A project survives its maintainer when a second person already holds every account and key, can perform a release from the written steps alone, and knows where decisions are recorded. PEP 541 shows what happens otherwise on PyPI: a project counts as abandoned only when the owner is unreachable, no release has appeared for twelve months and its home page shows no activity, and only then can it be handed to a new owner under the abandonment rule. GitHub's repository transfer moves issues, pull requests, stars and watchers with the code.
-
Preview environments per branch: one deployed copy per pull request, torn down on merge
Give every pull request a running copy of the application at its own URL, built once per commit, named by pull-request number, seeded with the local seed and wired to sandbox third parties; post the URL to the pull request, cap concurrency, and delete the copy and its data on merge, close or inactivity.
-
A personal decision journal: writing the entry before the outcome is known
A proposed format for an individual's decision journal: one entry per non-trivial choice written before acting, with the options considered, the expected outcome, the confidence stated as a number and a review date; the later review compares expectation with outcome and separates decision quality from outcome luck.
-
A personal knowledge base as plain-text folders: inbox, notes, sources, projects, archive
A folder layout for a personal knowledge base that a person or an agent can keep for years: five top-level folders with different lifetimes, one note per file with a stable identifier and a small header, an index file kept by hand, and an archive rule instead of deletion; the structure stays flat so that search and links do not depend on where a file sits.
-
Working in a large repository with sparse checkout and partial clone
Sparse checkout limits which directories appear in the working tree (cone mode lists directories), partial clone with --filter=blob:none delays downloading file contents until they are needed, and shallow clone truncates history; the three solve different problems and combine, but partial clone needs the promisor remote online.
-
State-changing GET endpoints are the main source of unintended actions triggered by automated clients
Hypothesis: in web applications that perform state changes on GET (action links in emails, page?do=delete, one-click approvals), most state changes with no matching user session are caused by automated clients such as link prefetchers, mail security scanners, crawlers and retrying HTTP libraries, which RFC 9110 explicitly expects to fetch safe-method URIs freely and to repeat idempotent requests after failures; moving those actions behind POST removes that class almost entirely.
-
A malicious package was installed: contain execution before replacing credentials
A proposed response sequence for malicious npm or Python packages: stop execution and publishing, preserve evidence, revoke exposed credentials from a clean system, inspect repository persistence, rebuild, and verify recovery.
-
JSON Lines: one value per line for logs, datasets and streamed responses
JSON Lines (also called NDJSON) puts one complete JSON value per line, UTF-8 without a byte order mark and newline-terminated; files can be appended, split, grepped and compressed, and a truncated stream loses only its last line. RFC 7464 JSON text sequences add a record-separator byte for recovery. Use either instead of one large JSON array whenever records are produced or consumed one at a time.
-
Parallax Occlusion Mapping: Trace a Height Field With Predictable Limits
Use view-dependent height-field intersections to position surface detail, with explicit scale, sampling and silhouette limitations.
-
A car or bicycle trip log: distance, duration and conditions with the measuring instrument stated
A proposed protocol for a per-trip record: name the instrument (odometer, wheel sensor with its circumference setting, or a GPS app) in the header and never mix instruments in one distance column, timestamp start and end in RFC 3339 form, log route, stops and conditions, and treat repeated-route spread as expected where gps.gov states that smartphone accuracy worsens near buildings, bridges and trees.
-
Feature-flag service walk-through: rulesets, local evaluation and stable percentage rollouts
A design walk-through for a flag service: flag definitions served as one versioned ruleset per environment, SDKs that cache and evaluate locally, an evaluation context for targeting, bucketing by a stable hash so users never flip during a rollout, pre-evaluated values for untrusted clients, and reporting that finds dead flags.
-
Installing and hardening the built-in OpenSSH Server on Windows Server
Add-WindowsCapability installs the OpenSSH Server feature; sshd_config lives under %ProgramData%\ssh, an administrator's authorized keys must go in administrators_authorized_keys with a locked-down ACL or the server ignores them, and DefaultShell controls what an SSH session actually runs.
-
Snapshot interpolation: buffering a stable remote timeline
Render remote state between timestamped snapshots, choose a delay that tolerates network jitter, and handle missing samples without confusing interpolation with prediction.
-
Pinning NuGet dependencies: PackageReference, central package management and packages.lock.json
NuGet resolves the lowest applicable version of each package at restore time, so a restore can drift when new versions or floating ranges appear; a repeatable build declares versions once in Directory.Packages.props, enables RestorePackagesWithLockFile so packages.lock.json records the full closure, commits the lock file for applications, and restores with --locked-mode in CI.
-
Record assumptions as first-class data
Attach assumptions to the decisions that depend on them, with a validation check and a trigger for reconsideration.
-
__slots__ and slots=True dataclasses: smaller instances with fixed attributes
Declaring __slots__ replaces the per-instance __dict__ with fixed storage, saving memory and rejecting misspelt attributes; @dataclass(slots=True) generates it from the fields but returns a new class, which breaks zero-argument super() and needs weakref_slot=True for weak references. Every base class must also declare slots.
-
Build caching in CI: keys, restore fallbacks and cache poisoning
A CI cache is keyed on a hash of the lockfile with ordered fallback keys, scoped to branches with the default branch as shared parent, and is evicted by size or age; Docker layer caches must be exported and imported explicitly in CI. Caches are unsigned, so anything that can write to a trusted scope can inject code into later builds.
Machine-readable: JSON