모든 문서
-
Detecting security tests that accidentally run with administrator authority
Ensure a security test is exercising the intended low-privilege identity rather than a privileged fixture default. This original method checks effective authority before trusting a denied-access assertion or a successful user workflow.
-
Secure defaults and fail-closed design
Saltzer and Schroeder's fail-safe defaults principle bases access on explicit permission, so that a mistake denies rather than grants; applied today it means deny-by-default authorisation, configuration that refuses to start when a security setting is missing, and error paths that close access instead of opening it.
-
Retrieval basics for LLM applications: chunking, passage identifiers and citing what was retrieved
Retrieval-augmented generation feeds retrieved passages to the model; the decisions that matter are how documents are split, what context each chunk carries, and how the answer points back to a specific passage so that a reader can check it.
-
Runbooks für den Betrieb: Anleitungen, die eine Fremde nachts ausführen kann
Ein Runbook pro Dienst beantwortet in dieser Reihenfolge: Was tut der Dienst, woran erkennt man in einer Minute, ob er gesund ist, welche bekannten Störungen gibt es mit Symptom, Diagnosebefehl und Gegenmassnahme, welche Handlungen sind sicher, welche gefährlich, und wer ist wann zu eskalieren; geprüft wird es von jemandem, der es nicht geschrieben hat.
-
Mapping a code-review claim to the exact changed behavior it supports
Build a compact review map that prevents unrelated passing checks from being used as evidence for a newly changed behavior.
-
Finding listening ports and the process behind them with ss
ss -tulpn lists every listening TCP/UDP socket with the owning process, and the bind address tells you whether the exposure is local-only, network-wide or dual-stack. Reading that address correctly is the difference between a service you meant to expose and one you did not.
-
Service accounts across OS families: least privilege for an agent's own background services
Every OS offers a way to run a service without a normal login and without a hand-managed password: Linux system users with a nologin shell or systemd's DynamicUser=, Windows virtual accounts and group managed service accounts (gMSA), and macOS daemon users. Picking the narrowest one matters for anything an agent installs to run unattended.
-
Canonicalize URLs without changing meaning
Use an application-defined comparison key while retaining the exact request URL when normalization might alter routing or signatures.
-
Zugriffsrechte nach dem Minimalprinzip vergeben
Jede Identität – Mensch, Dienst, Agent – erhält nur die Rechte, die ihre normale Aufgabe braucht, und nur so lange, wie sie sie braucht: eigene Datenbankrolle je Dienst mit GRANT auf das Nötige, Prozesse ohne root und mit einzelnen Capabilities statt Allmacht, zeitlich begrenzte Erhöhung für Menschen, regelmässige Entrümpelung.
-
Distributed locks and leader leases: expiry, fencing tokens and what a lock cannot promise
A distributed lock is a lease that expires; a process paused by garbage collection, CPU contention or a delayed network can keep acting after its lease has passed to someone else. Only a monotonically increasing fencing token checked by the protected resource makes such a lock safe for correctness, and a lock used merely to avoid duplicate work needs less.
-
Speculative fan-out: asking a decision model every question in one request and deciding in code
Because TypeSafe evaluates all questions of a request in parallel against one state, the documented pattern is to send every question a workflow might need, including ones that only matter on some branches, in a single call and let code ignore the irrelevant answers; the vendor's cookbook reports one batched request as 12.2x cheaper and 10.0x faster than sequential calls on its own example.
-
Verifying GitHub webhook signatures: X-Hub-Signature-256, timing-safe comparison and delivery IDs
GitHub signs every webhook delivery with HMAC-SHA256 over the raw request body and sends it as sha256=<hex digest> in the X-Hub-Signature-256 header. A receiver must recompute that digest from the exact bytes received, compare it with a constant-time function, and use X-GitHub-Delivery to recognise redelivered events; the older X-Hub-Signature (HMAC-SHA1) is kept only for compatibility.
-
Supporting several release lines: which fixes go where
A support policy is a table of release lines with a status each (feature, bugfix, security-only, end of life) and a rule for which fix classes are backported to which lines. Python maintains a series with bugfix releases for two years and security-only releases for three more; Django backports critical fixes to the last feature release and security and data-loss fixes to the last two plus long-term-support lines; Rust supports only the most recent stable. A small project should publish the table and default to the narrowest promise it can keep.
-
Keep an evidence ledger for multi-source answers
Map each material claim to a source section, version and uncertainty so contradictions remain visible during synthesis.
-
Aus einem Fehler einen Regressionstest machen
Vor der Korrektur wird der Fehler als automatischer Test nachgestellt, der aus dem gemeldeten Grund fehlschlägt; die Korrektur macht ihn grün, und der Test bleibt als Wächter. Mit pytest lässt sich der eine Test isoliert wiederholen (`--lf`), und ein aufgeschobener Fehler wird als `xfail(strict=True)` dokumentiert, damit ein stilles Verschwinden auffällt.
-
Indoor line-drying time tracks the gap between room temperature and dew point more closely than relative humidity alone
Hypothesis: the National Weather Service describes the dew point as the temperature to which air must be cooled to reach 100 % relative humidity and notes that relative humidity can be misleading because the same figure means different moisture at different temperatures; the proposal is that, for similar wet loads weighed at intervals on the same indoor rack, the time to a stable mass is ordered better across days by the difference between room temperature and dew point than by relative humidity, in a within-household comparison; no result is claimed.
-
Testdaten mit Buildern aufbauen: gültige Vorgaben, benannte Abweichungen
Ein Testdaten-Builder liefert für jede Entität ein gültiges Standardobjekt und lässt den Test nur die Felder setzen, auf die seine Aussage ankommt. So liest man im Test, was zählt, und eine neue Pflichtspalte ändert eine Stelle statt hundert Tests. Das Vorgehen grenzt sich von geteilten Fixtures und der Object Mother ab, deren enge Kopplung Martin Fowler beschreibt.
-
Switching system-wide crypto policies on RHEL with update-crypto-policies
RHEL's system-wide crypto policy sets the default algorithms and protocol versions OpenSSL, GnuTLS, NSS, libkrb5 and OpenSSH offer, changeable in one command instead of editing every application's config. This methodology covers showing, setting and testing a policy, and why already-running services need a restart to pick it up.
-
Solaris Zones: what the global zone controls and how kernel zones differ from non-global zones
The global zone administers every non-global zone; zoneadm/zonecfg subcommands other than listing and help require the global zone and specific authorization. A kernel zone runs its own separate kernel and update level, unlike a non-global zone which shares the global zone's kernel.
-
Unreal Lumen: choose tracing and quality around the scene you must render
Evaluate Lumen’s dynamic indirect lighting and reflections through tracing representation, scene structure, scalability and repeatable visual tests.
기계 판독 가능: JSON