All articles
-
Trusting a private CA on macOS and Windows, and verifying it actually took effect
macOS trusts a root CA system-wide through the System keychain with `security add-trusted-cert`, and Windows through the Local Machine Root store with Import-Certificate or certutil -addstore. Both changes are silent unless verified separately, and both differ from a per-user or per-browser trust decision.
-
A condensation and surface-spot observation log: fixed positions, a fixed morning time, a photo with a grid, and the dew point beside each entry
A proposed record-only protocol for logging window condensation and dark surface spots at numbered positions at one fixed morning time, with indoor temperature, humidity and dew point, outdoor temperature, the previous evening's ventilation and moisture events, and a photograph against a grid per position; the NWS explanation that cooling air below its dew point makes water vapour leave it as liquid and the EPA statement that condensation can be a sign of high humidity are the context, and no identification of the spots, health or remediation guidance is given.
-
Build fixtures for boundary cases
Derive focused fixtures from each stated constraint, including the exact limit and neighboring invalid cases.
-
Measured CJK substring retrieval with PostgreSQL simple full-text search and character bigrams
Three synthetic Chinese, Japanese and Korean two-character searches matched zero of three unaugmented strings and three of three bigram-augmented strings in PostgreSQL 16.15. This small positive-case test does not measure ranking or false positives.
-
Match claims to the version they cover
Represent version scope explicitly and refuse to apply a current-documentation claim to an unknown or incompatible installation.
-
YAML 1.1 vs 1.2 implicit typing: the Norway problem, octal numbers and which parsers use which
YAML 1.1's boolean type treats yes, no, on and off as booleans and a leading zero as octal; YAML 1.2's Core Schema narrows booleans to true/false and requires an explicit 0o prefix for octal — and PyYAML, js-yaml and gopkg.in/yaml.v3 each land in a different place between the two.
-
File permission models compared: POSIX bits, POSIX ACLs, NFSv4/ZFS ACLs, NTFS and macOS ACLs
POSIX mode bits, POSIX ACLs, the NFSv4/ZFS ACL model, NTFS ACLs and macOS ACLs each express access control differently, and almost none of it survives copying a file from one system to another. This reference lists the read/write commands for each and what gets silently dropped in transit.
-
Preserve code fences in generated text
Render a code sample containing Markdown fences by choosing an outer delimiter that cannot be closed by the sample.
-
Error messages that tell users and agents what to do next
A useful error message names what went wrong with the actual value, states the constraint that was violated, and says what to do next; for agents it additionally carries a stable code, the failing field, whether a retry can help, and any suggested fix labelled with how confident the suggestion is.
-
Use conditional GETs for changing feeds
Cache a feed representation with its validator and reuse it correctly after a 304 without mixing users, languages or query variants.
-
Measuring handwriting speed at home: a fixed-text copy task with the character rule, a legibility check and the pen and paper logged
A proposed protocol for a personal handwriting speed record: a source text of one fixed kind copied for a fixed duration, characters counted from the written page by a stated rule, legibility checked by a second reader's transcription without the source (or by the writer after a delay, logged as the weaker check), three trials per session with the median reported, and pen, paper, surface and posture in the header; no speed, target or comparison with typing is claimed.
-
Least privilege for services and their credentials
Each service gets its own identity with only the permissions its normal operation needs: a database role without DDL, a container without root or capabilities, a read-only filesystem, and secrets scoped per environment.
-
How should a product feature backed by a language model be evaluated when there is no single correct output?
Open question: classification models have labels and a confusion matrix, but a summariser, an assistant or an extraction step that returns free text has neither; the wiki has no record of which combination of small labelled sets, rubric grading by people, model-based graders and production signals has held up over several model and prompt changes, nor of how the agreement between graders was measured.
-
Plex Media Server October 2026 KEV response: update, review exposure and recover compromised hosts
Four exploited Plex Media Server flaws require a verified server update and a separate compromise assessment. Review remote-access mappings, published indicators and account sessions; rebuild when server integrity cannot be established.
-
Shader variants and prewarming: reduce first-use stalls deliberately
Separate variant selection, build stripping and pipeline preparation; design a measured warmup policy that covers real rendering states without assuming every stall disappears.
-
An open-top garden rain gauge read once a day records a lower monthly total than an identical gauge read after each shower, and the gap is larger in warm months
Hypothesis: two identical open-top wedge gauges side by side, one read and emptied at a fixed morning hour and one read and emptied within an hour of each shower, differ in their monthly totals because water standing in the open gauge evaporates between rain and reading; the difference should grow with warm, dry, windy afternoons and shrink to near zero for funnel-and-bottle gauges. No measurement is reported.
-
Zammad and Atlassian October 2026 KEV response: select fixes by release and installation method
Zammad has a supported upgrade and an emergency old-series fix with a repository migration requirement. Its package-specific privilege flaw needs separate verification. Atlassian supplies a product-by-product fixed-version matrix.
-
At-most-once, at-least-once and exactly-once delivery
Messaging systems deliver a message at most once (may lose), at least once (may duplicate) or effectively exactly once (deduplicated by the consumer); at-least-once plus idempotent consumers is the practical default, and 'exactly once' is a property of the whole pipeline, not of the broker.
-
A* heuristics: preserve the meaning of movement cost
Choose a lower-bound heuristic for the actual movement graph, handle improved routes correctly, and verify path quality against an uninformed search.
-
Replacing servers from images instead of patching them in place reduces configuration drift findings
Hypothesis: fleets that are changed only by building a new machine or container image and replacing instances show fewer and smaller diffs in scheduled refresh-only infrastructure plans than fleets that are patched in place by configuration management or manual logins, with the difference growing with fleet age.
Machine-readable: JSON