모든 문서
-
SSH known_hosts and host key verification for automation: ssh-keyscan plus an out-of-band check
Automation that connects over SSH still needs to verify the server's host key; ssh-keyscan alone only harvests a key without proving it is genuine. StrictHostKeyChecking=accept-new, HashKnownHosts and SSHFP records each address a different part of doing this safely without an interactive prompt.
-
Checking configuration profiles and MDM enrollment status from Terminal with profiles
profiles lists installed configuration profiles and reports MDM enrollment status; some settings, such as bootstrap token escrow or enforced update deferral, can only be set by a device management service in the first place, not from a local Terminal session.
-
ssh and scp exit codes: 255 is ssh's own failure, anything else is the remote command's
ssh passes through the exit status of the remote command it ran, reserving 255 for a failure of ssh itself (connection refused, authentication failure, host key mismatch) and for a remote command killed by a signal. scp documents only a plain 0-success/nonzero-failure split, so distinguishing local transport trouble from a remote error requires ssh's stderr text, not scp's own code.
-
Exporting host metrics with Prometheus node_exporter: collectors, the textfile collector, and firewalling the port
node_exporter turns kernel and OS-level counters into Prometheus metrics on port 9100, with most collectors enabled by default and a Textfile Collector for feeding in numbers a script computed. Run it as an unprivileged systemd service and restrict the port to Prometheus's address, since /metrics is unauthenticated by default.
-
Handling class imbalance: metrics first, then weights, thresholds and resampling inside the pipeline
When one class is rare, accuracy is uninformative and a model can ignore the minority entirely; fix evaluation first (stratified splits, per-class metrics, balanced accuracy), then use class weights or a tuned threshold, and apply resampling such as SMOTE only to the training fold inside the cross-validated pipeline.
-
gRPC basics: protobuf contracts, streaming and where it fits
gRPC calls methods defined in a .proto file, with Protocol Buffers as interface definition and wire format; it offers unary and streaming calls, deadlines, metadata and a fixed status-code set over HTTP/2. It fits service-to-service and mobile backends; browsers need gRPC-Web and public integrators usually expect JSON over HTTP.
-
양자 내성 서명과 공개 TLS 인증서: 각각의 도입 준비 상태 확인하기
ML-DSA와 SLH-DSA는 표준화된 서명 알고리즘이지만, 공개 TLS 인증서를 발급하려면 인증서 프로파일, 프로토콜 통합, 신뢰 정책의 허용 여부도 충족해야 합니다.
-
Zero-downtime schema changes with expand and contract
Change a schema in three deployable steps: expand (add the new column or table, keep the old), migrate (dual-write and backfill in batches), contract (remove the old after all code uses the new); avoid long locks by not rewriting tables in one statement.
-
Triaging a full Linux disk: df, du, deleted-but-open files and the journal
A full filesystem can be full on space or on inodes, and space held by a deleted-but-still-open file will not show up in du. This methodology walks the checks in order — df -h, df -i, du -x, lsof +L1, and journald vacuuming — before anything is deleted.
-
MCP 2026-07-28: 무상태 코어와 호환성 경계
7월 개정판은 초기화 핸드셰이크와 전송 세션을 제거하고 요청별 메타데이터와 다중 왕복 상호작용을 추가하며 확장과 사용 중단 예고 절차를 공식화합니다. 탐색 기능은 서버가 반드시 구현해야 하지만 클라이언트의 호출은 선택 사항입니다.
-
At what point do teams replace a PostgreSQL queue table with a message broker, and what triggered the move?
Open question: the PostgreSQL documentation sanctions SKIP LOCKED for multiple consumers on a queue-like table, and design walk-throughs recommend starting there; which triggers (queue age, lock contention, table bloat, fan-out needs, operational load) have actually caused a switch to a broker, at what volumes, and how many systems never switched?
-
Installing macOS updates unattended from the command line with softwareupdate
softwareupdate lists, installs and restarts for updates without the graphical System Settings pane, but --fetch-full-installer needs volume-owner authentication on Apple silicon and a managed deferral policy can hide updates from --list entirely. This methodology covers both.
-
Qualifying a negative repository search before declaring code absent
Audit the scope of a search that returned no matches before concluding that a symbol, configuration, or behavior does not exist in the project.
-
Collision broad phase and narrow phase: candidates versus contacts
Build a collision pipeline that distinguishes conservative spatial candidates from geometric contacts, with clear filtering, ownership, and profiling boundaries.
-
Mass versus volume in cooking: which cup is meant, and how to record the conversion actually used
A cup, tablespoon or teaspoon is a volume whose definition differs between the US customary units listed by NIST and the rounded values used on US nutrition labels, and the mass it holds depends on the ingredient and how it was filled; a household that converts between mass and volume records the definition it used and its own weighed values so that a recipe can be reproduced.
-
Acceptance criteria per work item that can be turned into tests
Write each work item's acceptance criteria as concrete examples with a starting state, an action and an observable outcome, using Gherkin's Given/When/Then structure or an equivalent, with the boundary cases named; criteria that cannot be executed or checked by someone other than the author are not criteria.
-
Compilation databases: reproduce the failing translation unit before changing headers
Use the real compile command and working directory to distinguish source defects from editor configuration errors.
-
Deprecating a function in a library: warn, document the replacement, remove on schedule
A library deprecation has four parts: a replacement that exists first, a runtime warning plus a documentation note naming the version and the replacement, a changelog entry, and a removal release fixed in advance by policy. PEP 387 requires a deprecation period of at least two years under Python's annual cadence and describes a documentation-only soft deprecation; Django removes shims no earlier than two feature releases after the warning.
-
Latency percentiles: why the average describes no real request
Latency distributions are skewed, so the mean sits between a fast majority and a slow tail and matches no actual request; p50, p99 and the maximum describe what users meet. Record histograms rather than pre-computed quantiles so percentiles can be aggregated across instances and recomputed for any window.
-
Hardening GitHub Actions workflows: SHA-pinned actions, least-privilege tokens and untrusted inputs
Pin third-party actions to a full-length commit SHA, set the GITHUB_TOKEN to read-only by default and widen it per job, never interpolate untrusted event fields into run scripts, and treat pull_request_target and workflow_run as privileged triggers.
기계 판독 가능: JSON