모든 문서
-
SBOM, 컨테이너 이미지, 소프트웨어 자산 목록 전반의 지원 종료 탐지 자동화
제품 식별 정보, 지원 제공자, 근거의 최신성을 유지하면서 런타임 및 이미지 자산 목록을 수명 주기 데이터와 연결합니다. 제안하는 워크플로는 endoflife.date를 탐색용 피드로 활용하고 공급업체를 통해 기한을 확인하며, 지원 만료와 근거 누락을 구분해 알립니다.
-
Documented failure analysis template
A template for separating observations, hypotheses and checks after a failure.
-
Security response headers beyond CSP
A handful of response headers close common browser-side gaps: X-Content-Type-Options nosniff, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy and Strict-Transport-Security; set them centrally and verify with an external scanner.
-
Working with JSON on the command line with jq
jq reads JSON, applies a filter and prints the result: use -r for plain strings, -c for one object per line, --arg and --argjson to pass values in safely, -e to turn null or false into an exit code, and select, map and to_entries to reshape; never assemble filters by string concatenation.
-
Timeouts, retries and backoff with jitter
Every remote call needs a timeout; retries must be bounded, applied only to idempotent or key-protected operations, and spaced with exponential backoff plus jitter to avoid synchronised retry storms.
-
Verifying archive extraction containment with a disposable directory ledger
Test an extraction feature’s promised write boundary using an isolated filesystem and inert fixture files. This original methodology focuses on where writes occur, without assuming any particular archive library is safe or unsafe.
-
Choosing classification metrics: precision, recall, F1, thresholds and calibration
Accuracy hides what matters when classes are unequal or errors have different costs; precision and recall describe the two error types, F1 combines them, threshold-free scores describe the ranking, and calibration says whether a predicted probability of 0.8 means 80 percent. Pick the metric from the decision the model supports, before training.
-
Signing commits and tags with an SSH key or GPG
Git signs commits and tags with OpenPGP, X.509 or, since gpg.format=ssh, a plain SSH key; the signer sets gpg.format and user.signingKey, verifiers need an allowed-signers file (SSH) or a trusted key ring (GPG), and forges are checked with git verify-commit or the host's signature badge.
-
Log retention and disk budgeting on a host: journald, logrotate and Windows event log sizing
journald's SystemMaxUse caps the journal's own disk footprint, logrotate's maxage and rotate counts cap rotated files elsewhere, and wevtutil sl sets a Windows event log's maximum size. All three are disk-budgeting settings the operator or an agent chooses; how long records must be kept for legal or organisational reasons is a policy decision this article does not make.
-
Following asynchronous tool handles through to a terminal outcome
Prevent an agent from reporting success when a tool has merely accepted work or returned a handle for an operation that is still running.
-
Keeping reformatting commits out of git blame: -w and ignore-revs files
git blame -w ignores whitespace when tracing lines, --ignore-rev and a committed .git-blame-ignore-revs file skip named commits such as mass reformattings so lines are attributed to the previous meaningful change, and -M/-C follow moved or copied lines; GitHub reads the same file automatically.
-
Stashing safely: messages, untracked files and stash branches
A stash is a commit stored under refs/stash whose older entries live only in that ref's reflog; give each stash a message, include untracked files deliberately, prefer apply over pop until the result is verified, and use git stash branch when the base has moved on.
-
Treat missing evidence as a result
Report an unresolved claim with the checks performed and the next discriminating observation instead of filling the gap with an invented fact.
-
Schema evolution with Avro and Parquet: reader and writer schemas, merged files and compatibility modes
Avro resolves a writer's schema against a reader's schema field by field, filling missing fields from reader defaults and ignoring unknown ones; Parquet files with different but compatible schemas can be merged by the reading engine at a cost; a schema registry enforces backward, forward or full compatibility. Adding optional fields with defaults is the safe move, renaming and type changes are not.
-
Spaced repetition as a scheduling method: the SM-2 algorithm in outline
Spaced repetition gives every item its own next review date: the interval grows after a successful recall and resets after a failure. Wozniak's SM-2 (1987) fixes the first two intervals at 1 and 6 days, multiplies later ones by a per-item easiness factor that starts at 2.5 and is never allowed below 1.3, and adjusts that factor from a 0–5 recall grade; the arithmetic fits in one line of a spreadsheet.
-
Docker Compose for local development: override files, profiles, healthy dependencies and watch
Keep one committed compose.yaml that mirrors production shape, add a compose.override.yaml for local ports and bind mounts, gate optional tooling behind profiles, make depends_on wait for service_healthy, and use develop.watch to sync or rebuild on file changes.
-
Service managers compared: systemd, launchd, the Service Control Manager, SRC and rc.d/OpenRC
Every general-purpose OS has something that starts, stops, supervises and boots services, but the commands and the persistence model differ. This reference maps start, stop, status, enable-at-boot and log access across systemd, launchd, Windows' Service Control Manager, AIX's SRC, and FreeBSD's rc.d and Alpine's OpenRC.
-
A minimal nftables ruleset for a single server
One inet table with an input chain that drops by default, accepts established and related traffic, loopback, the ICMP types the stack needs and the listed service ports; checked with nft -c -f before loading and loaded with a timed rollback so a mistake cannot lock you out.
-
Focus management in single-page interactions: dialogs, route changes and removed elements
When a page changes without a full load, keyboard focus must be moved on purpose: into a dialog when it opens and back to its trigger when it closes, to the new view's heading after a client-side route change, and to a sensible neighbour when the focused element is deleted. Otherwise focus falls to the document body and screen-reader users are sent back to the top.
-
Managing KVM guests with virsh: list, start, shutdown versus destroy, and autostart
virsh is the standard command-line client for libvirt-managed KVM guests. This methodology covers listing domains, the difference between a graceful shutdown and a hard destroy, setting autostart, and where to find the persistent domain definition.
기계 판독 가능: JSON