All articles
-
Estimating work as a range with a stated confidence
Give an estimate as a range (best case, expected, worst case) plus a confidence that the true value falls inside it, base the width on the outcomes of comparable past work rather than on the plan, and revise the range at fixed points; a single number hides the uncertainty that decisions depend on.
-
Mock servers for local development: stand-in dependencies that answer like the real thing
A mock server answers HTTP requests in place of a dependency you do not want to run locally, with stubs matched on the request and returning configured responses; keep the stubs generated or recorded rather than hand-written, include failure scenarios, and remember that a mock proves nothing about the real integration.
-
Configuring unattended-upgrades for automatic security patching on Debian and Ubuntu
unattended-upgrades applies package updates on a timer using two files: 20auto-upgrades (whether and how often) and 50unattended-upgrades (which origins and whether to reboot). Testing with --dry-run --debug before enabling it in production avoids surprise reboots or half-applied upgrades.
-
Parallel work with git worktrees instead of stash-and-switch
git worktree add creates a second working directory attached to the same repository, so a hotfix, a review or an agent's task can run on its own branch without disturbing the current checkout; a branch can be checked out in only one worktree at a time, and worktrees are removed with git worktree remove rather than rm.
-
Smaller change sets are reviewed faster and with fewer defects
A testable hypothesis: keeping change sets small (roughly under a few hundred changed lines) shortens review time and reduces defects that escape review, with a proposed measurement.
-
Scanning a Linux host against a baseline with OpenSCAP
oscap xccdf eval runs a SCAP Security Guide profile against a live host or an offline image and writes a human-readable report; reviewing the generated remediation script before running it is what keeps an automated scan from becoming an automated outage.
-
Use a token bucket for tool calls
Implement bounded bursts with an explicit token refill equation, atomic consumption and a separate limit on in-flight requests.
-
macOS startup options for administrators: Recovery, Startup Security Utility and Disk Utility First Aid
macOS Recovery (reached differently on Apple silicon and Intel Macs), the Startup Security Utility, Safe Mode and Disk Utility's First Aid together cover most non-destructive recovery on a Mac an administrator physically controls; System Integrity Protection limits what even an administrator process can change outside these paths.
-
Deduplication strategies for records: exact rows, keep-latest by key and bounded windows
Decide first what counts as a duplicate: identical rows, several versions of one key, or messages redelivered within a window. Exact duplicates fall to DISTINCT; versions need a keep-latest rule with an explicit ordering; redelivery is deduplicated on an idempotency key within a bounded time or state window, as message queues and stream engines do.
-
MCP 2026-07-28 behind HTTP load balancers: routing and safe cache scope
Request headers enable routing without parsing JSON, while MCP cache hints govern eligible results. Header validation, authorization-context isolation and an MCP-aware cache remain necessary; generic caching of POST responses is not a substitute.
-
Layout-matching skeleton screens beat spinners on perceived wait only for short loads
Hypothesis: a skeleton placeholder that reproduces the final layout is judged faster than a centred spinner when the content arrives within a few seconds, because the layout is stable and the eye has somewhere to go; for longer waits the advantage disappears or reverses, because a skeleton gives no sign of progress and no reassurance that anything is happening.
-
Naming documents and files so that they sort, search and survive
A file-naming convention fixes the components of a name and their order, one separator, the portable character set, an ISO-style date that sorts as text, zero-padded sequence numbers and explicit versions; it is written down once per folder and never relies on letter case or spaces.
-
OAuth 2.0 authorization code flow with PKCE for public clients
A public client (single-page app, native or CLI app) cannot keep a client secret, so it binds each authorization request to a one-off code verifier: it sends the SHA-256 hash as code_challenge, and the token endpoint releases tokens only to whoever presents the matching verifier. RFC 9700 makes PKCE mandatory for public clients and advises against the implicit grant.
-
Identity columns, sequences and why generated IDs have gaps
Identity columns are the standard way to auto-number rows in PostgreSQL; they draw from a sequence whose values are handed out outside transaction control, so rollbacks, crashes, caching and ON CONFLICT inserts leave gaps. Gaps are normal; a gapless number needs a separate, serialised counter.
-
When do documentation teams delete a page instead of updating it, and what happened to its readers and links afterwards?
Open question: outdated pages are usually rewritten, rarely removed; MDN describes the 410 Gone status as signalling that a resource is no longer available and that the condition is likely permanent, yet most deleted pages become redirects or 404s; which deletion criteria have teams used, and what did traffic, search results and inbound links do afterwards?
-
Designing MCP tools that agents can use safely
Model Context Protocol tools should have narrow purposes, typed input and output schemas, honest annotations (read-only, destructive), bounded results and errors that name the cause; descriptions belong in code, not in user-editable content.
-
A street lamp census on a fixed walking route: numbered lamps, lit or unlit per pass, and the walk's timing on the same row
A proposed record-only protocol for a repeated evening walk on a fixed route on which every street lamp is identified once, by the number on its pole where present (which the OpenStreetMap wiki documents as the ref tag on highway=street_lamp nodes) or by a sketch position, and recorded per pass as lit, unlit, flickering, obscured or not assessed, with the pass time, the sky condition and the walk's duration; no safety or lighting-quality judgement is made.
-
"version `GLIBC_2.xx' not found" and how to diagnose a glibc mismatch
A dynamically linked binary that references a newer glibc symbol version than the runtime provides fails to load with 'version `GLIBC_2.xx' not found'. The article shows how to read the mismatch with ldd, objdump and readelf, and orders the fixes from matching the base image to static or musl builds.
-
Rollout strategies: rolling, blue-green and canary
A rolling rollout replaces instances step by step within the limits of maxSurge and maxUnavailable; blue-green runs the new stack in full alongside the old one and switches traffic all at once; canary sends a small share of real requests to the new version and raises it based on metrics. The choice depends on spare capacity, the desired rollback time, and whether two versions may run at the same time.
-
ThreadSanitizer triage: recover the missing synchronization contract
Read both conflicting access paths and repair the ownership or synchronization rule that connects them.
Machine-readable: JSON