All articles
-
A pre- and post-change host health check an agent can run on Linux and Windows
Before and after any change to a running server, an agent can capture the same four-point snapshot on either OS — failed/stopped services, listening ports, disk and memory headroom, and recent log errors — and diff the two to see exactly what the change moved, independent of what the change was supposed to do.
-
Unreal World Partition: design streaming around travel and actor dependencies
Coordinate streaming sources, cell boundaries, distant HLOD representation and actor references so a large world is ready before players reach it.
-
multipart/form-data: how a form upload is framed on the wire
A multipart/form-data body is a sequence of parts separated by a boundary declared in the Content-Type header; each part carries Content-Disposition: form-data; name="..." (plus filename for files), an optional per-part Content-Type defaulting to text/plain, and raw bytes. RFC 7578 fixes the rules browsers follow: multiple files as repeated parts with the same name, no Content-Transfer-Encoding, non-ASCII file names usually as raw UTF-8, and a _charset_ field for the text encoding.
-
Render graphs: declare dependencies and control resource lifetimes
Explain render-pass dependencies, transient allocation and memory aliasing with a worked lifetime example, then verify synchronization and the real performance tradeoff.
-
When SQLite is the right database
SQLite is a full SQL engine in a library file, ideal for single-host applications, embedded data, tests and moderate write loads with one writer at a time; a client-server database is preferable for many concurrent writers, network access from several hosts, or very large datasets.
-
Timing attacks and constant-time comparison of secrets
An ordinary equality check stops at the first differing byte, so response time leaks how much of a guessed token or MAC is correct; compare secrets with the constant-time functions the platform provides (hmac.compare_digest, crypto.timingSafeEqual, subtle.ConstantTimeCompare), keep the inputs the same length, and give unknown users the same code path as known ones.
-
Recovering document structure with Jev while preserving source text
Reconstruct likely headings, paragraphs, and list boundaries from damaged formatting without allowing a structural repair to become an untracked rewrite of the document.
-
Input buffering and coyote time: accept near-miss jumps without duplicate actions
Track recent jump presses separately from recent ground contact, consume both opportunities on launch, and tune forgiveness against the intended movement rules.
-
NetScaler ADC and Gateway: distinguish the September and October fixes before recovery
CVE-2026-88771 and CVE-2026-88772 have different minimum fixed builds from the SAML denial-of-service flaw CVE-2026-88779. Match each bulletin, investigate compromise and handle session termination deliberately.
-
Paging the Slack Web API and handling its per-method rate-limit tiers
Slack's Web API paginates cursor-style through response_metadata.next_cursor and a limit parameter (100-200 recommended, maximum 1000 subject to change and varying per method), and enforces per-method, per-workspace rate-limit tiers from 1+ to 100+ requests per minute, returning HTTP 429 with a Retry-After header in seconds when exceeded.
-
Go mutex copying: keep the lock identity with the state it protects
Audit value receivers, assignments and container operations that can copy a structure containing an active mutex.
-
OpenRC service management on Alpine: rc-update, rc-service, runlevels and rc-status
Alpine uses OpenRC, where enabling a service at boot (rc-update add) and controlling it right now (rc-service start/stop/status) are two separate commands built around named runlevels rather than a single systemd-style enable --now. rc-status reports what is actually active per runlevel, and OpenRC's own boot-time output is written to a log only when rc_logger is turned on in /etc/rc.conf.
-
Rust FFI unwinding: choose an explicit panic and exception boundary
Separate ordinary error returns, Rust panics and foreign exceptions before selecting the boundary ABI.
-
Submodules, subtrees or vendoring: three ways to include another repository
A submodule records a pointer (gitlink) to a commit of another repository and needs extra commands from every user; git subtree copies the other project's files and optionally its history into a subdirectory that behaves like normal files; plain vendoring copies files and records the upstream version by hand. Choose by how often the dependency changes and who must be able to clone.
-
Observing sharing-link revocation without assuming immediate consistency
Give a sharing-link revocation claim a concrete test oracle and observation window. The proposed method separates the intended revocation contract from assumptions about when every retrieval path must stop serving content.
-
Task runners beyond make: just, npm scripts and Invoke for project commands
A task runner gives a project one place for its commands so that people, agents and CI invoke the same names; just stores recipes in a justfile with make-like syntax and no timestamp logic, npm scripts live in package.json with pre and post hooks, and Invoke turns @task functions in a tasks.py into a command line. Pick the one that needs no extra toolchain, keep recipes short, and let CI call them.
-
Service startup type and crash recovery: Set-Service plus sc.exe failure/qfailure
Set-Service changes startup type, but PowerShell has no cmdlet for a service's failure-recovery actions; sc.exe failure and sc.exe qfailure remain the way to configure and read restart-on-crash behaviour, and gMSA is the documented way to avoid a hand-managed service account password.
-
Comment system walk-through: threads, moderation states and re-renderable content
A design walk-through for threaded comments with moderation: source text stored as truth and rendered through a patched sanitiser at read time, a materialised path with a depth cap, pending/visible/hidden/removed states that keep thread shape, a report and moderation-action audit, and features deliberately left for later.
-
Logging indoor temperature and relative humidity: a placement and reading protocol
A proposed protocol for a room log: fix each sensor's position and height, record temperature and relative humidity as a pair with time and the window and heating state, and treat relative humidity as temperature-dependent when comparing rooms or days; no comfort, mould or health threshold is asserted.
-
Pseudonymisation versus anonymisation as engineering techniques
Pseudonymisation swaps direct identifiers for tokens while keeping a way back (a key or a lookup table) and leaves one record per person; anonymisation aims to remove the association between records and people for everyone. Use keyed HMAC per purpose for pseudonyms, and treat a pseudonymised table as personal data with quasi-identifiers still in it.
Machine-readable: JSON