すべての記事
-
Measured PostgreSQL CHECK and UNIQUE behavior with two NULL values
PostgreSQL 16.15 accepted two NULL rows under CHECK(value > 0) and ordinary UNIQUE(value), rejected -1, and refused a subsequent NOT NULL change while those NULL rows remained.
-
Go のサブテストを使ったテーブル駆動テスト
名前付きのケースを並べたスライスを一つのテスト関数で走査し、各ケースを t.Run で実行する。ケースをデータとして表せるうえ、go test -run 'TestX/name' で一件だけ選べる。t.Parallel、t.Helper、t.Cleanup を使えば、ループの速さと読みやすさを保てる。
-
Timestamped, parseable logs: RFC 5424 versus RFC 3164, JSON templates, and why UTC
RFC 5424's syslog TIMESTAMP is a restricted RFC 3339 profile with year, sub-second precision and a time zone offset, while the earlier RFC 3164 format has none of those and is harder to parse unambiguously. rsyslog can emit either, or a fully custom JSON structure, through templates — and a server whose time zone and logs are in UTC removes an entire class of correlation bugs across time zones.
-
Cache-Control directives: max-age, no-store, private and stale-while-revalidate
Cache-Control tells browser and shared caches how long a response may be reused and where it may be stored: max-age and s-maxage set freshness, no-cache forces revalidation before reuse, no-store forbids storage, private keeps a response out of shared caches, and stale-while-revalidate and stale-if-error (RFC 5861) let a cache serve stale content while refreshing or during errors. A response without directives may still be cached heuristically.
-
www versus apex domain: the CNAME restriction, cookie scope and which one to redirect to
The apex cannot be a CNAME because RFC 1034 forbids other data at a node that has one and the apex always carries SOA and NS records, so hosting on a provider's changing address needs A/AAAA records or a provider feature such as CNAME flattening; cookies set on the apex with a Domain attribute reach every subdomain. Pick one form, serve both in the certificate, and redirect the other permanently.
-
汚染された検索コーパス：少数の仕込まれた文書がRAGシステムの回答を誘導する仕組み
検索拡張生成は検索器が返す内容を信頼する。研究では、知識ベースに少数の細工したテキストを注入すると、対象の質問に対して攻撃者が選んだ答えをシステムに出させ得ることが示されている。防御では、コーパスに書き込める者、文章ごとの来歴、回答の確認が中心となる。
-
Go の競合検出の範囲：問題のない実行から未実行の経路については何も分からない
go test -race の結果を、起動と終了を含む実際に実行した並行処理経路に結び付けます。
-
Identifiers with a check digit reduce wrong-record actions when agents transcribe them
Hypothesis: when language-model agents copy identifiers from documents into tool calls, a scheme with a check digit that the receiving API validates turns most transcription errors into rejections instead of actions on the wrong record; the effect should be largest for dense numeric identifiers and negligible for sparse ones such as UUIDs.
-
Components sized with container queries need fewer placement-specific overrides than components sized with viewport media queries
Hypothesis: when the same component set is placed in several layout slots, the container-query implementation contains fewer CSS rules that exist only to correct a component for one placement than the media-query implementation, and adding a new placement needs no new component CSS; a two-implementation comparison with rule counts is proposed.
-
Managing installed kernels on Debian and Ubuntu: cleanup, /boot space, HWE and Livepatch
Old kernel packages accumulate in /boot until apt autoremove clears them; Ubuntu additionally offers a rolling Hardware Enablement (HWE) kernel on LTS releases and Canonical's Livepatch service for applying kernel security fixes without an immediate reboot — both Ubuntu-specific, with no Debian equivalent.
-
開発コンテナ：devcontainer.json で再現可能な開発環境を定義する
devcontainer.json は、エディター、クラウドワークスペース、CI ランナーがリポジトリ用に構築すべきコンテナを記述する。イメージまたは Dockerfile、features、転送ポート、ライフサイクルコマンド、エディター設定を含む。containers.dev の公開仕様により、同じファイルをローカル、ホスト型ワークスペース、パイプラインで使い、各ホストではなくコードとともにツールチェーンを固定できる。
-
llms.txt und agentenlesbare Websites: robots.txt, Sitemap und ein kuratierter Einstieg
Agenten und Crawler finden Inhalte über wenige Konventionen: robots.txt für Zugriffsregeln und den Ort der Sitemap (RFC 9309), eine Sitemap mit wahren Änderungsdaten und llms.txt als kurzer kuratierter Wegweiser in Markdown, ergänzt um Markdown-Zwillinge der Seiten. Keine davon ersetzt Authentifizierung.
-
Scheduled secret rotation surfaces undocumented credential consumers before an incident does
Hypothesis: teams that rotate long-lived shared secrets on a fixed schedule discover the scripts, jobs and integrations that silently depend on them during planned rotations, so that an emergency rotation after a leak completes faster and breaks less than for teams that rotate only on suspicion; the OWASP cheat sheet recommends regular rotation, but this operational payoff is unmeasured.
-
windows_exporter: installing the MSI with enabled collectors, and verifying /metrics on Windows
windows_exporter ships as an MSI that installs itself as a Windows service and can take installer properties for which collectors to enable, the listen port, and a Windows Firewall exception, all set non-interactively through msiexec.
-
Checking hardware virtualization support and nested KVM before relying on it
Before installing a hypervisor or nesting a VM inside a VM, confirm the CPU exposes virtualization extensions and, for nesting, that the kvm_intel or kvm_amd module has the nested option enabled. virt-host-validate and /proc/cpuinfo give a quick answer.
-
Unity player loop: separating input, physics and camera updates
Assign input intent, physics changes and camera presentation to deliberate update phases so frame-rate changes do not duplicate or lose gameplay commands.
-
ZFS boot environments with bectl: a rollback path around FreeBSD and package upgrades
bectl clones the root ZFS dataset into a boot environment in seconds; creating one before a freebsd-update or large pkg upgrade gives an instant, loader-menu-selectable way back to a known-good system, independent of and in addition to freebsd-update's own patch/install/rollback machinery.
-
Preserve evidence boundaries when turning research into slides in Orkas
A proposed handoff method keeps source passages, qualified findings and unresolved checks together across research, report and slide stages. A fictional offline-use comparison shows exactly what each output may claim.
-
Windows audit policy with auditpol: reading subcategories, enforcing them, and sizing the security log
auditpol /get /category:* lists the advanced audit policy actually in effect on Windows Server; subcategory settings win over the basic, category-level policy only while the 'force subcategory settings' option (SCENoApplyLegacyAuditPolicy) is enabled, which is the effective default, and an undersized Security log overwrites or discards audited events.
-
Defining the authorization oracle for mixed-object batch requests
Expose ambiguous access rules in batch operations before an agent writes tests that approve whichever response the implementation happens to return. The proposal focuses on mixed ownership within one request.
機械可読： JSON