全部文章
-
OpenSSH 的后量子默认设置与非后量子密钥交换警告
根据实际选中的密钥交换算法追查 OpenSSH 警告，检查双方的生效配置，并在不削弱主机身份验证的前提下恢复混合算法协商。
-
Handling a data subject request as an engineering process: export and delete
Treat a person's request for a copy or deletion of their data as a job: verified intake, one exporter per store in the data map producing a manifest, delivery through an expiring authenticated download, deletion through the pipeline, exemptions listed with reason codes, and a synthetic-subject test on a fixed cadence; which requests must be honoured and when is not addressed.
-
设计智能体记忆：保留什么、概括什么、忘记什么
智能体记忆分为三个层次：上下文窗口、任务工作笔记和跨会话持久存储。应逐项决定归属层次，让持久记忆保持精简、可审查，并删除不再真实的内容。
-
ES module builds with declared side effects shrink consumer bundles more than CommonJS builds
Hypothesis: for a library of many independent functions, a consumer that imports a few of them gets a smaller bundle when the library ships ES modules with a sideEffects declaration than when it ships CommonJS, because tree shaking depends on static import/export structure; a fixture-based comparison is proposed.
-
Idempotente Operationen und sichere Wiederholungen entwerfen
Eine Operation ist idempotent, wenn ihre mehrfache Ausführung dieselbe Wirkung hat wie eine einzelne; RFC 9110 legt das für HTTP-Methoden fest, und ein Idempotency-Key-Header überträgt die Eigenschaft auf POST. Schlüssel samt Fingerabdruck und Ergebnis speichern, Konflikte mit 409 und 422 melden, Schlüssel nach dokumentierter Frist löschen.
-
journald forwarding and remote collection: ForwardToSyslog, systemd-journal-upload/-remote, and rate limits
journald can hand its entries to a local syslog daemon with ForwardToSyslog=, or ship them directly over HTTPS with systemd-journal-upload to a systemd-journal-remote listener that writes its own journal files. Both paths are subject to journald's own per-service rate limiting, which drops excess messages once a burst threshold is crossed and records only a count of what it dropped.
-
让工具和读者都能有效使用的文档字符串
PEP 257 规定了文档字符串的位置和格式；采用一致的风格（Google 或 NumPy），包含单行概述、参数与返回值说明以及抛出的异常，便能让读者、编辑器和文档生成器有效使用它们。
-
Reading and writing macOS preferences: defaults, plutil, and why cfprefsd hides a direct edit
defaults and plutil read and write preference domains without hand-parsing plist syntax, but a cache daemon, cfprefsd (one per user plus one for the system), mediates every read and write an app makes — so editing the plist file on disk directly often has no visible effect until the cache is invalidated.
-
Server-Sent Events 与 WebSocket 的比较
Server-Sent Events 通过普通 HTTP 将文本事件从服务器持续发送给客户端，并支持自动重连和最后事件标识；WebSocket 则使用自己的协议，提供支持二进制数据的双向通道。单向更新可选择 SSE，客户端需要频繁发送数据时可选择 WebSocket。
-
云实例元数据端点：为什么 IMDSv2 令牌和 1 跳限制能减弱 SSRF 攻击
云虚拟机暴露链路本地元数据服务，该服务可以返回实例角色的临时凭证。服务端请求伪造漏洞或智能体的抓取工具都可能访问它。在 AWS 上，强制要求 IMDSv2 会话令牌，并将 PUT 响应跳数限制保持为 1，可以消除最简单的攻击路径。
-
Procedural generation with reproducible random streams
Keep world seeds, subsystem streams, draw order, and generator versions explicit so procedural content remains reproducible as generation becomes parallel or evolves.
-
SSH's "Host key verification failed" and "REMOTE HOST IDENTIFICATION HAS CHANGED" warnings
OpenSSH refuses to connect and prints 'Host key verification failed' or the larger 'WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!' banner when the server's key does not match what is stored in known_hosts. The article explains why a rebuilt server and an actual attack produce the identical message, and how to tell them apart before running ssh-keygen -R.
-
Making a recipe substitution experiment comparable
A proposed protocol for documenting an ingredient substitution: fix everything except the substituted ingredient, record quantities by mass, describe the equipment and timings, and separate measured observations from preference judgements; no cooking result is asserted.
-
Utility AI: make action scores comparable and decisions stable
Separate action eligibility from preference, inspect response curves and score combinations, and use explicit switching rules to prevent indecisive behavior.
-
Sizing a JVM inside a container: heap percentage, non-heap memory and CPU count
The JVM reads cgroup limits by default (UseContainerSupport) and sizes the heap as a percentage of the container's memory, not the host's; heap is only part of the footprint, so set MaxRAMPercentage to leave room for metaspace, thread stacks, direct buffers and code cache, check the CPU count the JVM sees, and verify with -Xlog:os+container and native memory tracking before trusting a limit.
-
Choosing a Godot renderer with target-device evidence
Compare Forward+, Mobile and Compatibility against required effects, actual export targets and measured scene behaviour before committing to a rendering path.
-
Keeping CI and local checks identical: one entry point, pinned tools, same container
A check that passes locally should pass in CI and vice versa: define every check once as a named task, pin the toolchain in a committed manifest that both the bootstrap and the pipeline install from, run CI in the same container image as the dev environment, fix locale and timezone, and treat any CI-only failure as a parity bug to eliminate before fixing the symptom.
-
通过 Cockpit Web 控制台管理无图形界面的 RHEL 主机
Cockpit 为没有桌面图形界面的 RHEL 服务器提供基于浏览器的管理会话，并通过套接字激活，仅在首次连接时启动。本方法介绍如何启用它、使用其命名服务开放防火墙访问，以及它在服务器上实际适合完成哪些任务。
-
Web Components：自定义元素、Shadow DOM 与封装的边界
自定义元素用带连字符的标签名注册类，并提供生命周期回调；Shadow DOM 给予它作用域受限的子树，样式不会向任一方向泄漏；模板和声明式影子根提供标记。所有跨边界交互，从通过 parts 和自定义属性设置样式，到通过 ElementInternals 参与表单及关联标签，都必须有意开放。
-
盘点家庭藏书或工具：标识符、位置及核查周期
以普通表格维护家庭藏书或工具清单：为每件物品设置稳定标识符（图书用 ISBN，工具用自编代码），使用带说明的位置代码，以固定词汇记录状态，设置借出字段，并定期巡查，将缺失物品标记出来而非删除；本文不提供估值或保险建议。
机器可读： JSON