모든 문서
-
Survivorship bias in engineering advice
Advice of the form 'successful teams do X' is drawn from the cases that remained visible; without the rate of X among the teams that failed or left, it says nothing. Look for the denominator, weight failure reports highly, and state the population any advice was drawn from.
-
System Integrity Protection and the Signed System Volume: what they protect, and why not to disable them
SIP restricts even root from modifying protected system paths or protected processes; the Signed System Volume cryptographically seals the entire system volume and checks it at every boot. Together they explain why /usr/local is writable but /usr is not, and why disabling SIP is not a legitimate fix for a permissions error.
-
Working practices for an AI agent changing a codebase
Read before writing, reproduce before fixing, change in small verified steps, run the project's own checks, never retry writes blindly, and report exactly what was tested; a methodology for agents that edit code.
-
Response compression: where to do it and what to exclude
Compress text responses (HTML, JSON, Markdown) at the proxy or the application, skip already-compressed and streaming content, keep ETags honest across encodings, and set Vary: Accept-Encoding.
-
Budgeting BC, ASTC, and ETC2 textures on real targets
Compare GPU block formats using actual support, channel requirements, block-rounded storage, and visible artifacts after import.
-
Designing rate limits that protect the service and inform the client
Limit by the identity you can verify (account, network prefix), use atomic counters in fixed or sliding windows, answer 429 with Retry-After, keep separate budgets for reads, writes and registrations, and publish the effective limits.
-
How much of an agent's context is tool output in real runs, and does trimming it change task success?
Open question: the MCP specification says clients should validate tool results before passing them to the model but leaves the amount to the client; in recorded agent runs, what share of tokens is tool output rather than instructions or reasoning, and does truncating, summarising or filtering tool output change task success, cost and latency?
-
Selecting a tool or skill with a decision model: Choice to rank, Noul to abstain
Why a Choice over candidate tools answers a relative question (which candidate fits best) while a Noul per candidate answers an absolute one (does this turn need a tool at all), and how TypeSafe's skill-suggestion cookbook combines both over a catalogue of 182 skills: one request ranks all, a second reads the top three and may reject all of them.
-
Checking, installing, and confirming Windows updates without a GUI
sconfig's update page, Get-HotFix's real limits, WSUS as the standard managed-patching path, and a sourced way to detect a pending reboot before scheduling the next maintenance window.
-
Einen brauchbaren Fehlerbericht schreiben
Ein Fehlerbericht ist brauchbar, wenn eine fremde Person den Fehler ohne Rückfrage nachstellen kann: eine präzise Überschrift, Umgebung mit Versionen, nummerierte Schritte zum Nachstellen, erwartetes und tatsächliches Ergebnis getrennt, die wörtliche Fehlermeldung und ein möglichst kleines Beispiel. Vermutungen zur Ursache stehen in einem eigenen Abschnitt.
-
Hostname, FQDN and reverse DNS consistency: why Kerberos and TLS name checks break when they disagree
Kerberos service tickets and TLS hostname verification both depend on the name a client resolves for a server matching the name the service believes it has. A mismatch between the configured hostname, /etc/hosts, forward DNS and the PTR record produces authentication and certificate errors that look unrelated to naming.
-
Confidence-gated routing with a decision model: thresholds that scale with the stakes
How to use the confidence value that Choice and Score answers carry as a second axis next to the answer itself: a floor below which the agent does not act, and per-action thresholds that rise with the cost of being wrong, tuned on the caller's own data and pinned to a model version.
-
Sudo policy as drop-in files in /etc/sudoers.d, checked with visudo -c
Adding a scoped rule as its own file under /etc/sudoers.d, validated with visudo before it takes effect, keeps sudo policy auditable and avoids a syntax error locking everyone out. This methodology also covers the risk of broad NOPASSWD rules and where sudo logs its decisions.
-
npm·PyPI 게시 신원을 승인된 릴리스 아티팩트에 연결하기
OIDC trusted publishing은 저장된 게시 토큰을 없애지만, 보안은 여전히 권한을 부여받은 워크플로에 달려 있습니다. 빌드와 게시를 분리하고 승인 절차를 보호하며, 출처 증명을 악성 코드 판정으로 받아들이는 대신 아티팩트의 신원을 검증해야 합니다.
-
File upload service walk-through: direct-to-storage tickets, asynchronous scanning and quotas
A design walk-through for uploads that bypass the application servers: a ticket that reserves quota and returns a signed upload URL, a completion step that verifies the stored object, a scan worker that promotes or deletes it, lifecycle rules for abandoned uploads, and a status model that explains every stored object.
-
Edge-triggered epoll: drain nonblocking work before waiting for another edge
Avoid a stalled connection by separating readiness notifications from complete application messages.
-
Unreal Motion Matching: Build Searchable Motion Before Tuning Weights
Connect Pose Search schemas, animation coverage and trajectory queries, then use recorded selection evidence to distinguish missing motion from a poorly configured search.
-
Responsive images with srcset, sizes and picture
srcset with width descriptors plus a sizes attribute lets the browser pick the smallest image file that fills the slot at the current viewport and pixel density; x descriptors serve fixed-size images at several densities; picture with source elements handles art direction and format fallback. Always keep width and height so the layout does not shift while the image loads.
-
rc.conf, sysrc and service on FreeBSD: enabling, starting and checking what runs at boot
FreeBSD services are enabled declaratively by an rc.conf variable (in /etc/rc.conf or a per-service file in /etc/rc.conf.d); sysrc and service <name> enable both just write that variable, and rc.conf itself is not supposed to run anything directly — it only sets variables that the rc scripts in /etc/rc.d read. sysrc edits those variables safely from a script, and service starts, stops and reports the status of the matching rc.d script.
-
Pipelines that reject unexpected source schema changes at ingestion detect upstream changes sooner but fail more often than pipelines that coerce
Hypothesis: a pipeline that fails an ingestion task when the source schema differs from the declared one (in the way Avro's schema resolution signals an error when a reader field has no default and the writer lacks it) finds upstream changes within one run but fails on harmless changes too, while a coercing pipeline runs on and lets some changes reach consumers unnoticed; a proposed comparison on the same sources, with no result claimed.
기계 판독 가능: JSON