모든 문서
-
OpenSSH의 양자 내성 기본값과 비양자 내성 키 교환 경고
선택된 키 교환을 확인해 OpenSSH 경고의 원인을 추적하고, 양쪽 피어에 실제 적용되는 설정을 점검하며, 호스트 인증을 약화하지 않고 하이브리드 협상을 복원합니다.
-
Handling a data subject request as an engineering process: export and delete
Treat a person's request for a copy or deletion of their data as a job: verified intake, one exporter per store in the data map producing a manifest, delivery through an expiring authenticated download, deletion through the pipeline, exemptions listed with reason codes, and a synthetic-subject test on a fixed cadence; which requests must be honoured and when is not addressed.
-
Agent memory design: what to persist, what to summarise and what to forget
An agent's memory has three tiers: the context window, a task scratchpad and a durable store across sessions; decide per item which tier it belongs to, keep durable memory small and reviewable, and delete what is no longer true.
-
ES module builds with declared side effects shrink consumer bundles more than CommonJS builds
Hypothesis: for a library of many independent functions, a consumer that imports a few of them gets a smaller bundle when the library ships ES modules with a sideEffects declaration than when it ships CommonJS, because tree shaking depends on static import/export structure; a fixture-based comparison is proposed.
-
Idempotente Operationen und sichere Wiederholungen entwerfen
Eine Operation ist idempotent, wenn ihre mehrfache Ausführung dieselbe Wirkung hat wie eine einzelne; RFC 9110 legt das für HTTP-Methoden fest, und ein Idempotency-Key-Header überträgt die Eigenschaft auf POST. Schlüssel samt Fingerabdruck und Ergebnis speichern, Konflikte mit 409 und 422 melden, Schlüssel nach dokumentierter Frist löschen.
-
journald forwarding and remote collection: ForwardToSyslog, systemd-journal-upload/-remote, and rate limits
journald can hand its entries to a local syslog daemon with ForwardToSyslog=, or ship them directly over HTTPS with systemd-journal-upload to a systemd-journal-remote listener that writes its own journal files. Both paths are subject to journald's own per-service rate limiting, which drops excess messages once a burst threshold is crossed and records only a count of what it dropped.
-
Docstrings that tools and readers can use
PEP 257 defines where docstrings go and how they are formatted; a consistent style (Google or NumPy) with a one-line summary, argument and return descriptions and raised exceptions makes them usable by readers, editors and documentation generators.
-
Reading and writing macOS preferences: defaults, plutil, and why cfprefsd hides a direct edit
defaults and plutil read and write preference domains without hand-parsing plist syntax, but a cache daemon, cfprefsd (one per user plus one for the system), mediates every read and write an app makes — so editing the plist file on disk directly often has no visible effect until the cache is invalidated.
-
Server-sent events versus WebSockets
Server-sent events stream text events from server to client over plain HTTP with automatic reconnection and last-event IDs; WebSockets provide a bidirectional binary-capable channel with its own protocol. Choose SSE for one-way updates and WebSockets when the client must send frequently.
-
Cloud instance metadata endpoints: why IMDSv2 tokens and a hop limit of 1 blunt SSRF
Cloud VMs expose a link-local metadata service that can return temporary credentials for the instance's role. A server-side request forgery bug or an agent's fetch tool can reach it. On AWS, requiring IMDSv2 session tokens and keeping the PUT response hop limit at 1 removes the simplest paths.
-
Procedural generation with reproducible random streams
Keep world seeds, subsystem streams, draw order, and generator versions explicit so procedural content remains reproducible as generation becomes parallel or evolves.
-
SSH's "Host key verification failed" and "REMOTE HOST IDENTIFICATION HAS CHANGED" warnings
OpenSSH refuses to connect and prints 'Host key verification failed' or the larger 'WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!' banner when the server's key does not match what is stored in known_hosts. The article explains why a rebuilt server and an actual attack produce the identical message, and how to tell them apart before running ssh-keygen -R.
-
Making a recipe substitution experiment comparable
A proposed protocol for documenting an ingredient substitution: fix everything except the substituted ingredient, record quantities by mass, describe the equipment and timings, and separate measured observations from preference judgements; no cooking result is asserted.
-
Utility AI: make action scores comparable and decisions stable
Separate action eligibility from preference, inspect response curves and score combinations, and use explicit switching rules to prevent indecisive behavior.
-
Sizing a JVM inside a container: heap percentage, non-heap memory and CPU count
The JVM reads cgroup limits by default (UseContainerSupport) and sizes the heap as a percentage of the container's memory, not the host's; heap is only part of the footprint, so set MaxRAMPercentage to leave room for metaspace, thread stacks, direct buffers and code cache, check the CPU count the JVM sees, and verify with -Xlog:os+container and native memory tracking before trusting a limit.
-
Choosing a Godot renderer with target-device evidence
Compare Forward+, Mobile and Compatibility against required effects, actual export targets and measured scene behaviour before committing to a rendering path.
-
Keeping CI and local checks identical: one entry point, pinned tools, same container
A check that passes locally should pass in CI and vice versa: define every check once as a named task, pin the toolchain in a committed manifest that both the bootstrap and the pipeline install from, run CI in the same container image as the dev environment, fix locale and timezone, and treat any CI-only failure as a parity bug to eliminate before fixing the symptom.
-
Administering a headless RHEL host through the Cockpit web console
Cockpit gives a browser-based admin session to a RHEL server with no desktop GUI, socket-activated so it only starts on first connection. This methodology covers enabling it, opening the firewall with its own named service, and what it is actually useful for on a server.
-
Web components: custom elements, shadow DOM and where the encapsulation ends
Custom elements register a class under a hyphenated tag name with lifecycle callbacks; shadow DOM gives it a scoped subtree whose styles do not leak either way; templates and declarative shadow roots supply markup. Every cross-boundary concern, from styling through parts and custom properties to form participation via ElementInternals and label association, must be opened deliberately.
-
Inventorying a home library or toolbox: identifiers, locations and a check cycle
Keeping a home inventory of books or tools as a plain table: a stable identifier per item (the ISBN for books, a self-assigned code for tools), location codes with a legend, condition in a fixed vocabulary, lending fields and a periodic walk that marks what is missing instead of deleting it; no valuation or insurance advice is given.
기계 판독 가능: JSON