모든 문서
-
Preventing account enumeration in login, registration and reset forms
Any difference between the response for an existing account and a non-existing one (message text, HTTP status, redirect, timing) lets an attacker build a list of valid users to attack. Return the same generic message and status, do the same work on both paths, move the distinguishing information into an email, and throttle so the residual differences cannot be sampled at scale.
-
SLIs for queues and batch jobs: age of the oldest message, freshness, coverage and last success
Request-driven services measure availability and latency; queues and batch jobs need different indicators: how old the oldest unprocessed item is, what proportion of data is fresher than a threshold, what proportion of scheduled runs completed within their window, and when the job last succeeded. This methodology derives them from the pipeline SLIs in the SRE workbook.
-
Checking a served TLS certificate chain and its expiry from the command line with openssl
openssl s_client with -servername and -showcerts prints the certificates a server actually sends, which the manual describes as not a verified chain; openssl x509 reads subject, issuer, SANs and the notAfter date of each one, and openssl verify -untrusted rebuilds the chain against a trust store. Check every hostname, and IPv4 and IPv6 separately.
-
Schema conventions for a new PostgreSQL database: names, identifiers, timestamps and text
Decide a handful of conventions before the first migration: lower-case snake_case names that never need quoting, one id strategy applied everywhere, timestamptz for every point in time with created_at on every table, text instead of varchar(n), and explicit NOT NULL and foreign keys; write them down so every later migration follows them.
-
When should a team split a monolith into services?
Open question: which observable signals (deployment coupling, team boundaries, scaling needs, incident patterns) have preceded successful extractions of services from a monolith, and which extractions were later reversed?
-
혼합 정밀도 학습: autocast, 손실 스케일링, 수치적 한계
혼합 정밀도는 연산마다 적절한 부동소수점 형식을 선택한다. Autocast와 손실 스케일링은 서로 다른 문제를 해결하므로, 성능 개선은 수치 검증과 대상 하드웨어에서의 측정으로 확인해야 한다.
-
Screening tool results and retrieved passages with a decision model before they reach the agent's context
A protocol for putting a fast typed classifier between an agent and its inputs: score each retrieved passage or tool result for relevance, contradiction and hidden instructions in one request, drop or flag in code, and verify quoted citations against their source, while treating the screen as a filter that adversarial text can still move.
-
Generic functions and decorators with TypeVar, ParamSpec and the PEP 695 syntax
A type variable links the types of parameters and return values; PEP 695 brackets (def f[T](...)) replace manual TypeVar declarations, bounds and constraints have different semantics, and ParamSpec lets a decorator preserve the signature of the function it wraps instead of erasing it to Callable[..., Any].
-
Convert timestamps to UTC at the boundary
Reject ambiguous timestamps, convert aware instants to UTC and preserve the original timezone when local scheduling semantics matter.
-
A parcel delivery time log: order, dispatch, tracking and door timestamps on one row, with the carrier's scan and the observed arrival kept apart
A proposed record-only protocol for logging each parcel's timeline as timestamps in the RFC 3339 Internet Date/Time Format with UTC offsets, taken from the order confirmation, the dispatch notice, the carrier's tracking events and the household's own note of the arrival, with the carrier, service, delivery place and each attempt recorded; the carrier's delivered scan and the observed arrival are separate columns, and no carrier comparison or delivery-time claim is made.
-
Querying the systemd journal with journalctl: unit, boot, priority, time range and JSON output
journalctl can filter the systemd journal by unit, boot, priority and time range and emit machine-readable output, but only if the journal is configured to persist across reboots. This methodology covers precise queries, persistent storage, and the size caps in journald.conf.
-
Null versus absent fields in JSON APIs
A missing field, a field set to null and a field with an empty value are three different statements, and an API should say which it distinguishes: RFC 7396 merge patch uses null to mean remove, ProtoJSON treats null as unset and does not emit it, and Google's JSON style guide drops empty or null properties unless there is a semantic reason to keep them.
-
Embeddings as a data type: fixed-length vectors, a distance function and what a column of them needs
An embedding is a fixed-length float vector produced by a specific model, meaningful only under the distance that model was trained for and only next to vectors from the same model version; storing it requires the dimension, the model identifier and the distance to be recorded, and querying it means nearest-neighbour search, exact or approximate.
-
Binary search pitfalls: midpoint overflow and off-by-one boundaries
Binary search is short and famously easy to get wrong: the midpoint (low + high) / 2 overflows fixed-width integers, inclusive and exclusive bounds get mixed, and duplicates raise the question of which index to return. Use a library or the monotone-predicate form with half-open intervals, and test the edges.
-
Verifying Stripe webhook signatures: Stripe-Signature, timestamp tolerance and secret rotation
Stripe sends a Stripe-Signature header shaped like t=<timestamp>,v1=<hex signature>, computed as HMAC-SHA256 over the string "{timestamp}.{raw body}" keyed with the whole whsec_ endpoint secret. Stripe's libraries reject signatures whose timestamp is more than five minutes (300 seconds) old by default, and while a rolled secret is kept alive (up to 24 hours) the header carries one v1 value per active secret.
-
Checking whether a database migration rehearsal represents the target state
Assess whether an isolated migration test exercised the schema and data conditions that matter for the intended deployment, rather than only proving the migration works on an empty database.
-
Writing shell scripts that fail safely
Use set -euo pipefail, quote every expansion, prefer [[ ]] and arrays, check tools with ShellCheck, and avoid parsing ls; a script that stops on the first error is easier to trust than one that continues.
-
Identifying an unknown Linux host before changing anything on it
Before an agent or operator changes configuration on a Linux machine it did not build, it should establish the distribution, kernel, virtualization or container status, init system, package manager and mandatory access control state — each with one cheap, non-destructive command.
-
CDN cache keys and purging: what identifies a cached object and how to invalidate it
A cache stores responses under a key built at minimum from method and target URI, extended by request headers named in Vary; CDNs add scheme, host and query string and let you customise the key at the cost of sharding. Purging by URL only hits objects whose key matches exactly, so tag responses (for example Fastly's Surrogate-Key header) to purge groups reliably.
-
Checkpointing a long agent task: progress files, idempotent steps and resumption
How an agent working through a multi-step task should record progress so that a crash, a context reset or a hand-over resumes at the last completed step without repeating side effects: a plan with numbered steps, a progress file updated after each step with evidence, idempotency keys for external writes, and a resumption procedure that verifies state before continuing.
기계 판독 가능: JSON