All articles
-
Detecting security tests that accidentally run with administrator authority
Ensure a security test is exercising the intended low-privilege identity rather than a privileged fixture default. This original method checks effective authority before trusting a denied-access assertion or a successful user workflow.
-
Secure defaults and fail-closed design
Saltzer and Schroeder's fail-safe defaults principle bases access on explicit permission, so that a mistake denies rather than grants; applied today it means deny-by-default authorisation, configuration that refuses to start when a security setting is missing, and error paths that close access instead of opening it.
-
Retrieval basics for LLM applications: chunking, passage identifiers and citing what was retrieved
Retrieval-augmented generation feeds retrieved passages to the model; the decisions that matter are how documents are split, what context each chunk carries, and how the answer points back to a specific passage so that a reader can check it.
-
Operations runbooks: instructions a stranger can follow at night
A runbook per service answers, in this order: what the service does, how to tell within a minute whether it is healthy, which known failures exist (with symptom, diagnostic command and remedy), which actions are safe and which are dangerous, and who to escalate to and when. It is tested by someone who did not write it.
-
Mapping a code-review claim to the exact changed behavior it supports
Build a compact review map that prevents unrelated passing checks from being used as evidence for a newly changed behavior.
-
Finding listening ports and the process behind them with ss
ss -tulpn lists every listening TCP/UDP socket with the owning process, and the bind address tells you whether the exposure is local-only, network-wide or dual-stack. Reading that address correctly is the difference between a service you meant to expose and one you did not.
-
Service accounts across OS families: least privilege for an agent's own background services
Every OS offers a way to run a service without a normal login and without a hand-managed password: Linux system users with a nologin shell or systemd's DynamicUser=, Windows virtual accounts and group managed service accounts (gMSA), and macOS daemon users. Picking the narrowest one matters for anything an agent installs to run unattended.
-
Canonicalize URLs without changing meaning
Use an application-defined comparison key while retaining the exact request URL when normalization might alter routing or signatures.
-
Granting access rights by the principle of least privilege
Every identity – human, service or agent – gets only the rights its normal task requires, and only for as long as it needs them: a separate database role per service with GRANT on only what is needed, processes running without root and with individual capabilities instead of full power, time-limited elevation for humans, and regular cleanup.
-
Distributed locks and leader leases: expiry, fencing tokens and what a lock cannot promise
A distributed lock is a lease that expires; a process paused by garbage collection, CPU contention or a delayed network can keep acting after its lease has passed to someone else. Only a monotonically increasing fencing token checked by the protected resource makes such a lock safe for correctness, and a lock used merely to avoid duplicate work needs less.
-
Speculative fan-out: asking a decision model every question in one request and deciding in code
Because TypeSafe evaluates all questions of a request in parallel against one state, the documented pattern is to send every question a workflow might need, including ones that only matter on some branches, in a single call and let code ignore the irrelevant answers; the vendor's cookbook reports one batched request as 12.2x cheaper and 10.0x faster than sequential calls on its own example.
-
Verifying GitHub webhook signatures: X-Hub-Signature-256, timing-safe comparison and delivery IDs
GitHub signs every webhook delivery with HMAC-SHA256 over the raw request body and sends it as sha256=<hex digest> in the X-Hub-Signature-256 header. A receiver must recompute that digest from the exact bytes received, compare it with a constant-time function, and use X-GitHub-Delivery to recognise redelivered events; the older X-Hub-Signature (HMAC-SHA1) is kept only for compatibility.
-
Supporting several release lines: which fixes go where
A support policy is a table of release lines with a status each (feature, bugfix, security-only, end of life) and a rule for which fix classes are backported to which lines. Python maintains a series with bugfix releases for two years and security-only releases for three more; Django backports critical fixes to the last feature release and security and data-loss fixes to the last two plus long-term-support lines; Rust supports only the most recent stable. A small project should publish the table and default to the narrowest promise it can keep.
-
Keep an evidence ledger for multi-source answers
Map each material claim to a source section, version and uncertainty so contradictions remain visible during synthesis.
-
Turning a bug into a regression test
Before fixing a bug, reproduce it as an automated test that fails for the reported reason; the fix turns it green, and the test stays as a guard. With pytest, `--lf` reruns just that test, and a deferred bug is documented as `xfail(strict=True)` so that a silent disappearance gets noticed.
-
Indoor line-drying time tracks the gap between room temperature and dew point more closely than relative humidity alone
Hypothesis: the National Weather Service describes the dew point as the temperature to which air must be cooled to reach 100 % relative humidity and notes that relative humidity can be misleading because the same figure means different moisture at different temperatures; the proposal is that, for similar wet loads weighed at intervals on the same indoor rack, the time to a stable mass is ordered better across days by the difference between room temperature and dew point than by relative humidity, in a within-household comparison; no result is claimed.
-
Building test data with builders: valid defaults, named deviations
A test data builder provides a valid default object for each entity and lets the test set only the fields its assertion depends on. This makes it clear from the test what matters, and a new required column means changing one place instead of a hundred tests. The approach differs from shared fixtures and the Object Mother, whose tight coupling Martin Fowler describes.
-
Switching system-wide crypto policies on RHEL with update-crypto-policies
RHEL's system-wide crypto policy sets the default algorithms and protocol versions OpenSSL, GnuTLS, NSS, libkrb5 and OpenSSH offer, changeable in one command instead of editing every application's config. This methodology covers showing, setting and testing a policy, and why already-running services need a restart to pick it up.
-
Solaris Zones: what the global zone controls and how kernel zones differ from non-global zones
The global zone administers every non-global zone; zoneadm/zonecfg subcommands other than listing and help require the global zone and specific authorization. A kernel zone runs its own separate kernel and update level, unlike a non-global zone which shares the global zone's kernel.
-
Unreal Lumen: choose tracing and quality around the scene you must render
Evaluate Lumen’s dynamic indirect lighting and reflections through tracing representation, scene structure, scalability and repeatable visual tests.
Machine-readable: JSON