すべての記事
-
SBOM・コンテナイメージ・ソフトウェア台帳を横断したサポート終了検出の自動化
製品の識別情報、サポート提供元、根拠の鮮度を保ちつつ、ランタイムとイメージの台帳をライフサイクル情報に関連付ける。このワークフロー案は endoflife.date を調査の手掛かりとなる情報源として使い、ベンダーで期限を確認し、サポート終了と根拠不足を別々に通知する。
-
Documented failure analysis template
A template for separating observations, hypotheses and checks after a failure.
-
Security response headers beyond CSP
A handful of response headers close common browser-side gaps: X-Content-Type-Options nosniff, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy and Strict-Transport-Security; set them centrally and verify with an external scanner.
-
jq を使ってコマンドラインで JSON を扱う
jq は JSON を読み、フィルターを適用し、結果を表示する。通常の文字列には -r、1行1オブジェクトには -c、値を安全に渡すには --arg と --argjson、null や false を終了コードにするには -e、構造を変えるには select、map、to_entries を使う。文字列連結でフィルターを組み立ててはならない。
-
Timeouts, retries and backoff with jitter
Every remote call needs a timeout; retries must be bounded, applied only to idempotent or key-protected operations, and spaced with exponential backoff plus jitter to avoid synchronised retry storms.
-
Verifying archive extraction containment with a disposable directory ledger
Test an extraction feature’s promised write boundary using an isolated filesystem and inert fixture files. This original methodology focuses on where writes occur, without assuming any particular archive library is safe or unsafe.
-
Choosing classification metrics: precision, recall, F1, thresholds and calibration
Accuracy hides what matters when classes are unequal or errors have different costs; precision and recall describe the two error types, F1 combines them, threshold-free scores describe the ranking, and calibration says whether a predicted probability of 0.8 means 80 percent. Pick the metric from the decision the model supports, before training.
-
Signing commits and tags with an SSH key or GPG
Git signs commits and tags with OpenPGP, X.509 or, since gpg.format=ssh, a plain SSH key; the signer sets gpg.format and user.signingKey, verifiers need an allowed-signers file (SSH) or a trusted key ring (GPG), and forges are checked with git verify-commit or the host's signature badge.
-
Log retention and disk budgeting on a host: journald, logrotate and Windows event log sizing
journald's SystemMaxUse caps the journal's own disk footprint, logrotate's maxage and rotate counts cap rotated files elsewhere, and wevtutil sl sets a Windows event log's maximum size. All three are disk-budgeting settings the operator or an agent chooses; how long records must be kept for legal or organisational reasons is a policy decision this article does not make.
-
Following asynchronous tool handles through to a terminal outcome
Prevent an agent from reporting success when a tool has merely accepted work or returned a handle for an operation that is still running.
-
整形コミットを git blame から除外する：-w と ignore-revs ファイル
git blame -w は行をたどる際に空白の差を無視する。--ignore-rev とコミット済みの .git-blame-ignore-revs ファイルは、一括整形などの指定コミットを飛ばし、行をそれ以前の意味のある変更に帰属させる。-M/-C は移動・コピーされた行を追跡し、GitHub は同じファイルを自動で読む。
-
Stashing safely: messages, untracked files and stash branches
A stash is a commit stored under refs/stash whose older entries live only in that ref's reflog; give each stash a message, include untracked files deliberately, prefer apply over pop until the result is verified, and use git stash branch when the base has moved on.
-
Treat missing evidence as a result
Report an unresolved claim with the checks performed and the next discriminating observation instead of filling the gap with an invented fact.
-
Schema evolution with Avro and Parquet: reader and writer schemas, merged files and compatibility modes
Avro resolves a writer's schema against a reader's schema field by field, filling missing fields from reader defaults and ignoring unknown ones; Parquet files with different but compatible schemas can be merged by the reading engine at a cost; a schema registry enforces backward, forward or full compatibility. Adding optional fields with defaults is the safe move, renaming and type changes are not.
-
Spaced repetition as a scheduling method: the SM-2 algorithm in outline
Spaced repetition gives every item its own next review date: the interval grows after a successful recall and resets after a failure. Wozniak's SM-2 (1987) fixes the first two intervals at 1 and 6 days, multiplies later ones by a per-item easiness factor that starts at 2.5 and is never allowed below 1.3, and adjusts that factor from a 0–5 recall grade; the arithmetic fits in one line of a spreadsheet.
-
Docker Compose for local development: override files, profiles, healthy dependencies and watch
Keep one committed compose.yaml that mirrors production shape, add a compose.override.yaml for local ports and bind mounts, gate optional tooling behind profiles, make depends_on wait for service_healthy, and use develop.watch to sync or rebuild on file changes.
-
Service managers compared: systemd, launchd, the Service Control Manager, SRC and rc.d/OpenRC
Every general-purpose OS has something that starts, stops, supervises and boots services, but the commands and the persistence model differ. This reference maps start, stop, status, enable-at-boot and log access across systemd, launchd, Windows' Service Control Manager, AIX's SRC, and FreeBSD's rc.d and Alpine's OpenRC.
-
A minimal nftables ruleset for a single server
One inet table with an input chain that drops by default, accepts established and related traffic, loopback, the ICMP types the stack needs and the listed service ports; checked with nft -c -f before loading and loaded with a timed rollback so a mistake cannot lock you out.
-
Focus management in single-page interactions: dialogs, route changes and removed elements
When a page changes without a full load, keyboard focus must be moved on purpose: into a dialog when it opens and back to its trigger when it closes, to the new view's heading after a client-side route change, and to a sensible neighbour when the focused element is deleted. Otherwise focus falls to the document body and screen-reader users are sent back to the top.
-
Managing KVM guests with virsh: list, start, shutdown versus destroy, and autostart
virsh is the standard command-line client for libvirt-managed KVM guests. This methodology covers listing domains, the difference between a graceful shutdown and a hard destroy, setting autostart, and where to find the persistent domain definition.
機械可読： JSON