Все статьи
-
Предотвращение межсайтового скриптинга с помощью кодирования при выводе
Экранируйте данные для конкретного контекста вставки: HTML-текста, атрибута, JavaScript, URL или CSS. Используйте шаблонизатор с экранированием по умолчанию, не собирайте HTML конкатенацией строк и дополняйте защиту строгой CSP.
-
Notification service walk-through: channels, preferences, delivery attempts and retries
A design walk-through for a multi-channel notification service: an ingest API with an idempotency key, a router that expands one notification into per-channel deliveries after checking preferences, per-channel queues and retry schedules, callback handling for invalid tokens, and what to defer.
-
Version range syntax across npm, Cargo, pip, Composer, Go modules, Maven, NuGet and Bundler
The caret and tilde operators do not mean the same thing everywhere, Go modules have no ranges at all, and a bare version number is an inclusive minimum in NuGet but only a soft suggestion in Maven.
-
Встроенная проверка HTML-форм: required, pattern, type и Constraint Validation API
HTML проверяет элементы формы до отправки без скриптов: required, minlength, min/max, pattern и типизированные поля задают ограничения, браузер блокирует отправку и показывает сообщение, CSS позволяет оформлять :user-invalid, а Constraint Validation API предоставляет то же состояние скриптам. Это слой удобства, а не безопасности; сервер проверяет данные повторно.
-
Kerberos on Windows: klist, klist purge, and setspn -L/-Q for SPN problems
Windows exposes cached Kerberos tickets through klist and service principal names through setspn. Duplicate SPNs and clock skew between a client and a domain controller are the two failures that most often turn into confusing 'cannot authenticate' errors rather than a clear Kerberos message.
-
TypeScript narrowing: unions, unknown and any
TypeScript shrinks a union type inside a branch after typeof, instanceof, in, equality and truthiness checks or a user-defined type predicate; discriminated unions plus a never check give exhaustiveness. unknown accepts any value but forbids using it until narrowed, whereas any switches checking off.
-
Which observability signals should a JVM or .NET service emit by default, and at what overhead?
Open question: both runtimes ship built-in telemetry (Flight Recorder and GC logging on the JVM; EventPipe counters and dotnet-trace on .NET) and both have OpenTelemetry auto-instrumentation, but there is little shared evidence on which of these should be always-on in production, what they cost, and which ones actually shortened incidents.
-
UEFI boot entries and Secure Boot state on Linux and Windows
efibootmgr and bcdedit /enum firmware both read and rewrite the UEFI boot-entry list that decides what the firmware tries to start and in what order, while mokutil --sb-state and Confirm-SecureBootUEFI report whether Secure Boot is currently enforced — separate from, and a precondition for, shim/MOK trust of a third-party kernel module.
-
Tags and releases: lightweight versus annotated tags and how they travel
A lightweight tag is only a name for a commit; an annotated tag is an object with tagger, date, message and optional signature, which is why git describe ignores lightweight tags by default and why releases should use annotated or signed tags; tags are not pushed with branches unless --follow-tags or --tags is used, and a published tag should never be moved.
-
Managing PostgreSQL extensions: installing, versioning, updating and dumping them
An extension packages SQL objects and often a shared library under one name with a control file and versioned scripts; CREATE EXTENSION installs it per database, ALTER EXTENSION UPDATE applies the author's update scripts, and pg_dump emits only the CREATE EXTENSION line. Keep the installed files, the catalog version and the loaded library in step, especially across package upgrades and pg_upgrade.
-
Logging from admin scripts: logger and systemd-cat on Linux, Write-EventLog/New-WinEvent and Start-Transcript on Windows
Every platform has a way to put an admin script's output where a human or another tool will find it later, distinct from writing to stdout: logger(1) or systemd-cat into the system log on Linux, the Windows Event Log via Write-EventLog (Windows PowerShell 5.1 only) or New-WinEvent, and Start-Transcript for a raw session capture. None of them should ever receive a secret.
-
Cisco Secure Email Gateway и SD-WAN Manager: проверка исправлений и сохранение свидетельств компрометации
Ведите отдельные записи об устранении уязвимостей почтового сканера и SD-WAN Manager. Проверяйте, что исправления действительно установлены, сохраняйте свидетельства перед восстановлением, меняющим состояние системы, и следуйте процедуре расследования для конкретного продукта.
-
Technical debt as a metaphor and as a decision
Technical debt describes the future cost of a shortcut; the metaphor is useful when the debt is deliberate and tracked, and misleading when it excuses careless work or is used to describe every imperfection.
-
Log sampling for high-volume events: keep every error, sample the repetitive lines
Sampling drops a fraction of similar log events on purpose; the useful forms are one-in-N, burst-then-rate per period, per-level rules that leave warnings and errors untouched, and pipeline sampling keyed on a request ID so a whole request is kept or dropped together, with the applied rate written into the surviving events.
-
Local users and groups done right: useradd, system accounts, password aging and the usermod -aG trap
useradd -m -s creates an interactive user with a home directory and shell; --system with a nologin shell is the right shape for a service account. usermod -G without -a replaces a user's supplementary groups instead of adding to them — one of the most commonly reported local-account mistakes.
-
Configuring network interfaces with netplan on Ubuntu, and testing changes without losing the connection
Netplan renders YAML under /etc/netplan into networkd or NetworkManager configuration; `netplan try` applies a change and automatically reverts it if nobody confirms within a timeout, which is the safe way to change network settings on a remote host. Debian's ifupdown /etc/network/interfaces is the older, still-supported contrast.
-
Имена идентификаторов, раскрывающие замысел кода
Выбирайте имена, которые на языке предметной области говорят, что представляет собой объект или что он делает; длина имени должна соответствовать области его использования. Избегайте кодирования свойств в именах, сокращений и ложных указаний на тип, а по мере уточнения понимания переименовывайте.
-
PUBLIC, PRIVATE и INTERFACE в CMake: исправление области зависимости без глобальных флагов
Выбирайте область зависимости по контракту потребляющей цели и проверяйте её минимальным внешним потребителем.
-
Short-link services with sequential identifiers receive more enumeration requests than services with random identifiers
Hypothesis: a URL shortener whose keys are a counter encoded in base62 lets anyone walk every link, whereas random fixed-length keys make most guesses miss; the proposal is that sequential services see a higher share of requests for existing keys from clients that never received the link, and that the share of 404 responses does not distinguish the two.
-
Why an unattended script fails silently on macOS: TCC permissions for files, Accessibility and Automation
macOS mediates access to files outside an app's container, keyboard/screen control, and cross-app Apple Events through TCC, keyed to the code identity of the calling binary rather than the Unix user — so root does not bypass it, and a rebuilt unsigned or ad-hoc-signed tool starts the grant process over.
Машиночитаемо: JSON