Все статьи
-
Автоматическое выявление окончания поддержки по SBOM, образам контейнеров и реестрам ПО
Сопоставляйте реестры сред выполнения и образов с данными жизненного цикла, сохраняя точную идентификацию продукта, поставщика поддержки и актуальность свидетельств. Предлагаемый процесс использует endoflife.date для первичного выявления, подтверждает сроки у поставщиков и отдельно оповещает об истёкшей поддержке и недостающих свидетельствах.
-
Documented failure analysis template
A template for separating observations, hypotheses and checks after a failure.
-
Security response headers beyond CSP
A handful of response headers close common browser-side gaps: X-Content-Type-Options nosniff, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy and Strict-Transport-Security; set them centrally and verify with an external scanner.
-
Работа с JSON в командной строке с помощью jq
jq читает JSON, применяет фильтр и печатает результат: используйте -r для простых строк, -c для одного объекта на строку, --arg и --argjson для безопасной передачи значений, -e для преобразования null или false в код завершения, а select, map и to_entries — для изменения структуры. Никогда не собирайте фильтры конкатенацией строк.
-
Timeouts, retries and backoff with jitter
Every remote call needs a timeout; retries must be bounded, applied only to idempotent or key-protected operations, and spaced with exponential backoff plus jitter to avoid synchronised retry storms.
-
Verifying archive extraction containment with a disposable directory ledger
Test an extraction feature’s promised write boundary using an isolated filesystem and inert fixture files. This original methodology focuses on where writes occur, without assuming any particular archive library is safe or unsafe.
-
Choosing classification metrics: precision, recall, F1, thresholds and calibration
Accuracy hides what matters when classes are unequal or errors have different costs; precision and recall describe the two error types, F1 combines them, threshold-free scores describe the ranking, and calibration says whether a predicted probability of 0.8 means 80 percent. Pick the metric from the decision the model supports, before training.
-
Signing commits and tags with an SSH key or GPG
Git signs commits and tags with OpenPGP, X.509 or, since gpg.format=ssh, a plain SSH key; the signer sets gpg.format and user.signingKey, verifiers need an allowed-signers file (SSH) or a trusted key ring (GPG), and forges are checked with git verify-commit or the host's signature badge.
-
Log retention and disk budgeting on a host: journald, logrotate and Windows event log sizing
journald's SystemMaxUse caps the journal's own disk footprint, logrotate's maxage and rotate counts cap rotated files elsewhere, and wevtutil sl sets a Windows event log's maximum size. All three are disk-budgeting settings the operator or an agent chooses; how long records must be kept for legal or organisational reasons is a policy decision this article does not make.
-
Following asynchronous tool handles through to a terminal outcome
Prevent an agent from reporting success when a tool has merely accepted work or returned a handle for an operation that is still running.
-
Как исключить коммиты переформатирования из git blame: -w и файлы ignore-revs
git blame -w игнорирует пробельные различия при отслеживании строк; --ignore-rev и включённый в репозиторий файл .git-blame-ignore-revs пропускают заданные коммиты, например массовое переформатирование, относя строки к предыдущему содержательному изменению; -M/-C отслеживают перемещённые и скопированные строки. GitHub автоматически читает тот же файл.
-
Stashing safely: messages, untracked files and stash branches
A stash is a commit stored under refs/stash whose older entries live only in that ref's reflog; give each stash a message, include untracked files deliberately, prefer apply over pop until the result is verified, and use git stash branch when the base has moved on.
-
Treat missing evidence as a result
Report an unresolved claim with the checks performed and the next discriminating observation instead of filling the gap with an invented fact.
-
Schema evolution with Avro and Parquet: reader and writer schemas, merged files and compatibility modes
Avro resolves a writer's schema against a reader's schema field by field, filling missing fields from reader defaults and ignoring unknown ones; Parquet files with different but compatible schemas can be merged by the reading engine at a cost; a schema registry enforces backward, forward or full compatibility. Adding optional fields with defaults is the safe move, renaming and type changes are not.
-
Spaced repetition as a scheduling method: the SM-2 algorithm in outline
Spaced repetition gives every item its own next review date: the interval grows after a successful recall and resets after a failure. Wozniak's SM-2 (1987) fixes the first two intervals at 1 and 6 days, multiplies later ones by a per-item easiness factor that starts at 2.5 and is never allowed below 1.3, and adjusts that factor from a 0–5 recall grade; the arithmetic fits in one line of a spreadsheet.
-
Docker Compose for local development: override files, profiles, healthy dependencies and watch
Keep one committed compose.yaml that mirrors production shape, add a compose.override.yaml for local ports and bind mounts, gate optional tooling behind profiles, make depends_on wait for service_healthy, and use develop.watch to sync or rebuild on file changes.
-
Service managers compared: systemd, launchd, the Service Control Manager, SRC and rc.d/OpenRC
Every general-purpose OS has something that starts, stops, supervises and boots services, but the commands and the persistence model differ. This reference maps start, stop, status, enable-at-boot and log access across systemd, launchd, Windows' Service Control Manager, AIX's SRC, and FreeBSD's rc.d and Alpine's OpenRC.
-
A minimal nftables ruleset for a single server
One inet table with an input chain that drops by default, accepts established and related traffic, loopback, the ICMP types the stack needs and the listed service ports; checked with nft -c -f before loading and loaded with a timed rollback so a mistake cannot lock you out.
-
Focus management in single-page interactions: dialogs, route changes and removed elements
When a page changes without a full load, keyboard focus must be moved on purpose: into a dialog when it opens and back to its trigger when it closes, to the new view's heading after a client-side route change, and to a sensible neighbour when the focused element is deleted. Otherwise focus falls to the document body and screen-reader users are sent back to the top.
-
Managing KVM guests with virsh: list, start, shutdown versus destroy, and autostart
virsh is the standard command-line client for libvirt-managed KVM guests. This methodology covers listing domains, the difference between a graceful shutdown and a hard destroy, setting autostart, and where to find the persistent domain definition.
Машиночитаемо: JSON