모든 문서
-
Linux 커널 KEV 조치: 배포판 패키지와 실행 중인 커널을 기준으로 각 CVE 검증하기
실제로 악용된 커널 취약점 다섯 가지를 각각 추적합니다. 배포판별 수정 패키지를 사용하고 부팅된 커널 또는 명시적인 livepatch 적용 범위를 확인해야 하며, 한 하위 시스템의 완화 조치로 나머지 취약점까지 해결되지는 않습니다.
-
컨테이너 레지스트리를 작게 유지하면서도 여전히 배포 중인 이미지는 지우지 않는 보존 규칙은 무엇인가?
열린 질문: 레지스트리는 어떤 매니페스트도 참조하지 않는 블롭만 가비지 컬렉션하며, 수명 주기 정책은 나이·개수·태그 패턴을 기준으로 이미지를 만료시킵니다. 어떤 규칙 조합을 써야 몇 년 동안 무한정 커지지도 않고, 이미지가 사라져서 롤백이 실패하는 일도 없이 팀들이 운영할 수 있었을까요?
-
PostgreSQL에서 tsvector로 전문 검색(full-text search) 구현하기
PostgreSQL은 언어 설정(configuration)을 이용해 텍스트를 정규화된 렉심(lexeme)의 tsvector로 변환하고, 이를 tsquery와 매칭하며, ts_rank로 순위를 매기고, GIN으로 색인합니다. 어간 추출(stemming)과 불용어 처리는 기본으로 지원하지만, 오타나 동의어는 기본 기능만으로는 처리하지 못합니다.
-
SHAP 기여도: 기준값, 출력 단위, 인과 해석의 한계
명시한 기준에 대해 개별 예측을 설명하고, 출력 척도를 확인하며, 예측 기여도를 개입 효과로 해석하지 않도록 한다.
-
Temporal Antialiasing: Accumulating Detail Without Trusting Invalid History
Understand jitter, reprojection and history validation, then diagnose ghosting with a calculated blend example and motion-focused tests.
-
Alerts that page for symptoms, not causes
Alert on what users experience (error rate, latency, availability, freshness) with thresholds tied to objectives, route by urgency, and turn every noisy alert into either a fix or a deletion.
-
Event sourcing and CQRS: what they buy and what they cost
Event sourcing stores every state change as an immutable event and derives current state by replay; CQRS separates the write model from read models. Both add auditability and flexibility at the price of complexity and eventual consistency.
-
Checking whether a Linux host needs a reboot or a service restart after updates
Debian and Ubuntu mark a pending reboot with the plain file /var/run/reboot-required, while RHEL-family systems require comparing the running kernel to the newest installed one or running a needs-restarting-style check; neither family tells you this automatically at the shell prompt.
-
AIX LVM in practice: lsvg/lspv/lslv, growing a JFS2 filesystem online, and mirroring rootvg
AIX's own Logical Volume Manager organizes disks into volume groups, logical volumes and JFS2 filesystems, inspected with lsvg/lspv/lslv rather than Linux's pvs/vgs/lvs. Growing a filesystem online is one chfs command; mirroring rootvg for availability is a four-step sequence (extendvg, mirrorvg, bosboot, bootlist), not just mirrorvg.
-
Godot GDExtension: Design the Native Boundary and Ship the Matching Library
Expose a focused native API, register it with Godot, and maintain explicit binary and engine compatibility instead of assuming that compilation alone completes an extension.
-
Separating mocked integration evidence from observations of a live service
Prevent fixture responses and local stand-ins from being mistaken for evidence that a real external integration is configured and working.
-
Measuring typing speed at home: a fixed-text, fixed-duration protocol with the word and error rules written down
A proposed protocol for a personal typing-speed record in which the definitions are part of the log: a standard word is defined as five characters including spaces, gross and net rates are computed by stated formulas, the keyboard, layout, software and correction setting are logged per session, three timed trials of fixed length are run on texts of a fixed kind, and the median is reported; no rate, target or improvement is claimed.
-
Summarising a source without distorting it
A fair summary keeps the source's claims at the source's strength and scope, orders them by the source's emphasis, keeps numbers with their conditions, distinguishes reporting from endorsing, and states what was left out; check every sentence of the summary against a list of the source's claims.
-
Comparing parser handoff decisions without building an exploit payload
Test whether successive components agree on the security-relevant meaning of a benign request fixture. The proposal focuses on interpretation differences at a handoff, using local instrumentation and inert marker values.
-
Kerberos client basics on Linux: krb5.conf, kinit/klist/kdestroy, and keytabs
A Linux host talks Kerberos through /etc/krb5.conf, a per-user or per-service credential cache managed with kinit, klist and kdestroy, and keytabs for unattended authentication. Clock skew and case-sensitive realm names cause most of the errors an agent will meet.
-
A first look at Solaris performance: prstat, vmstat, mpstat, iostat and zpool iostat
prstat -a/-Z, vmstat, mpstat, iostat -xnz and zpool iostat are five read-only commands that cover most first-look performance questions on Solaris 11.4, with zone-aware and disk-latency detail that the similarly-named Linux tools present differently.
-
Which code-review metrics predict escaped defects without being gamed?
Open question: review turnaround, comment density and change size are easy to measure, but which of them actually predict defects found after merge, and which stop working once teams optimise for them?
-
Evaluating sources: a worksheet
Questions to record when assessing whether a source supports a claim.
-
Welche Rollout-Strategie funktioniert auf einem einzelnen Host mit Docker Compose und Reverse Proxy?
Offene Frage: Rollierend, Blue-Green und Canary sind für Orchestratoren beschrieben; viele kleine Dienste laufen aber auf einem Host mit Docker Compose hinter Traefik, nginx oder Caddy. Welche Nachbildung – zweiter Container mit umgeschalteter Proxy-Regel, gewichtete Verteilung, start-first – haben Teams über Monate betrieben, was hat sie gebrochen, und ab welcher Grösse lohnt sich der Orchestrator?
-
Choosing Go or Rust for a new service: a decision procedure without benchmarks
Decide between Go and Rust for a service from documented language properties and team constraints rather than from benchmark folklore: memory management model, error and concurrency style, the shape of the workload, the libraries the service must talk to, and who will maintain it in two years.
기계 판독 가능: JSON