すべての記事
-
WeKnora CVE-2026-30856：ツールのシャドーイング修正後に呼び出し先を検証する
WeKnoraのツール名衝突の脆弱性により、信頼できるMCPツールが別のサーバーの実装に置き換えられる可能性があった。影響を受ける環境をアップグレードし、承認、レジストリ内の識別情報、実際の呼び出しで同じサーバーが選ばれることを確認する。
-
Recovering lost commits and branches with the reflog
The reflog records every movement of HEAD and of each branch in the local repository, so a bad reset, rebase, amend or branch deletion can be undone by finding the earlier position and putting a new branch on it; entries expire after 90 days (30 for unreachable ones) by default, and uncommitted changes were never in it.
-
Go append のエイリアス：余剰容量と再割り当ての両経路をテストする
ビューへの追加が他から見える記憶領域を変更し得る場合、スライスの所有権を明示します。
-
Date and time formats in APIs: ISO 8601 and RFC 3339
Exchange timestamps as RFC 3339 strings with an explicit offset, dates as YYYY-MM-DD, durations as ISO 8601 durations or plain seconds; never as locale-dependent text or as ambiguous numbers.
-
Weighted Blended Transparency: Stable Ordering With an Explicit Approximation
Explain why object sorting cannot solve every transparency case, implement weighted accumulation and revealage, and validate their difference from ordered compositing.
-
Locale and date pitfalls in coreutils: LC_ALL, character ranges and GNU versus BSD date
The locale silently changes sort order, what [a-z] matches, decimal separators and the default date format; scripts should set LC_ALL=C (or C.UTF-8) and TZ explicitly, request explicit date formats, and avoid GNU-only date -d or BSD-only date -v unless the platform is known.
-
実用的なハッシュテーブル：衝突、負荷率、シード付きハッシュ
ハッシュテーブルが平均して速いのは、キーがバケットへ均等に分散するときだけです。衝突、再ハッシュを起こす負荷率、ハッシュ洪水攻撃を防ぐプロセスごとのシードが、実際の動作を決めます。ハッシュ値を永続化せず、反復順序にも依存しないようにします。
-
知識蒸留：教師から生徒へ有用な予測を伝える
正解ラベルと教師の確率分布を使って生徒を学習させ、温度、損失の重み、独立した評価を明示する。圧縮の効果は教師の品質、生徒の容量、配備時の挙動に依存する。
-
Administering Windows Server Core: sconfig, what's missing, and managing it remotely
Server Core trades the desktop shell and local GUI consoles for a smaller code base and attack surface; sconfig covers first-run configuration from the console, and Windows Admin Center or RSAT-equipped machines supply the graphical management that Server Core itself does not.
-
Google API pagination and quota errors: pageToken, 403 rateLimitExceeded and 429
Google Workspace APIs such as Calendar and Drive page through a pageToken/nextPageToken pair with maxResults (Calendar) or pageSize (Drive), and Drive signals overload two ways: HTTP 403 with reason rateLimitExceeded or userRateLimitExceeded, or HTTP 429 with reason rateLimitExceeded — all documented as cases for retrying with exponential backoff, unlike other 403 reasons.
-
Kommentare schreiben, die der Code nicht sagen kann: Gründe, Randbedingungen, Fallen
Ein Kommentar lohnt sich, wenn er etwas sagt, das im Code nicht steht: den Grund für eine überraschende Entscheidung, die äussere Randbedingung, die Falle für die nächste Person. Was der Code sagt, wiederholt er nicht; PEP 8 hält fest, dass Kommentare, die dem Code widersprechen, schlimmer sind als keine. Bevor man kommentiert, prüft man, ob ein besserer Name oder ein Test den Kommentar überflüssig macht.
-
不可視・並べ替えテキスト：コードとプロンプトの双方向制御文字、タグ文字、紛らわしい文字
Unicodeでは、レビュアーに見えない文字や表示順を変える文字をテキストに含められます。双方向制御文字はソースコードの見た目をコンパイル時の解釈と異なるものにでき、タグ文字はモデルに届く指示を人から隠せます。紛らわしい文字は識別子を模倣します。検出には描画結果ではなくコードポイントを調べます。
-
Gute Commit-Nachrichten: das Warum festhalten
Eine Betreffzeile von rund 50 Zeichen im Imperativ, eine Leerzeile, dann ein Text, der Motivation, Alternativen und Folgen erklärt, statt den Diff nachzuerzählen.
-
Recovery readiness before a hardening change: console access, a backup, a scheduled automatic rollback, and a change log
A methodology for making any hardening change reversible before it is applied: confirm out-of-band access, back up what is about to change, arm a scheduled rollback that fires if nothing confirms success, and log the change — so a network or authentication mistake self-heals instead of requiring a site visit.
-
Which test naming and file organisation conventions help a reader locate the failing behaviour fastest?
Open question: frameworks only fix discovery (test_*.py, TestXxx); naming by method, by behaviour or by sentence, and grouping by source file, feature or scenario are conventions. Has anyone measured which of them shortens the path from a failure or a change request to the right test, for people or for agents?
-
Privilege elevation compared: sudo, doas, UAC, runas and AIX RBAC — and how to detect it
sudo, doas, Windows UAC and macOS's admin group all answer the same question — is this session allowed to act as an administrator — with different mechanisms and different ways for a script to check the answer before attempting a privileged action.
-
Reading a PostgreSQL query plan with EXPLAIN ANALYZE
EXPLAIN shows the planner's chosen tree with estimated costs; EXPLAIN ANALYZE runs the query and adds actual times and row counts. Compare estimated with actual rows, find the node with the largest actual time, and check for sequential scans on large tables and misestimated joins.
-
Invalidating test evidence when a later edit changes what was checked
Keep a coding agent from carrying a passing result forward after edits have changed the code, configuration, fixtures, or dependencies that result actually covered.
-
API-Fehlermeldungen nach RFC 9457 (Problem Details)
RFC 9457 definiert mit `application/problem+json` ein einheitliches Format für Fehlerantworten von HTTP-APIs: `type` als URI der Fehlerklasse, `title`, `status`, `detail` und `instance`, erweiterbar um eigene Felder. Clients – auch Agenten – können damit auf die Fehlerklasse verzweigen, statt Prosa zu deuten.
-
Cursor pagination versus offsets
Offset pagination is simple but drifts when rows are inserted or deleted and gets slower with depth; cursor pagination returns a token that encodes the position and stays stable and cheap.
機械可読： JSON