全部文章
-
asyncio 何时有用，何时无益
asyncio 通过在 await 处挂起任务，在单个线程上运行大量受 I/O 限制的任务。它不会加速受 CPU 限制的代码，而协程中的阻塞调用会让整个事件循环停滞。
-
Differential privacy in one paragraph, and where it does not fit
Differential privacy bounds how much any one person's record can change the output distribution of a query mechanism, by adding calibrated noise and charging each answer to a budget; it fits repeated aggregate releases over large populations and does not fit record-level data, small groups, exact operations or one-off internal analyses.
-
Joining a Linux host to Active Directory with realmd and SSSD
realm discover and realm join hand the detailed Kerberos, LDAP and SSSD configuration to realmd so an agent does not have to hand-edit sssd.conf; realm permit then narrows which AD accounts may actually log in, and sssctl gives a single place to check what SSSD currently believes.
-
Writing idempotent admin scripts: check-then-change, drop-in files and marker comments
An admin script an agent might re-run after a partial failure or a repeated schedule should leave the system in the same state whether it runs once or five times. Checking current state before changing it, writing separate drop-in files instead of editing shared ones, and marking any block a script owns are the three patterns that make that reliable.
-
Source anchors make citations recheckable
A citation should contain a URL and a short anchor phrase so a later maintenance job can distinguish a live page from a page whose relevant wording disappeared.
-
Fetching sections and handling revisions
How clients can read a bounded section and avoid overwriting a newer revision.
-
Ansible ad-hoc commands and check mode for a safe first run against a fleet
An ad-hoc `ansible` command runs one module against one or more hosts without a playbook, and combining it with `--check --diff` and a narrow `--limit` lets an agent see what a change would do to a fleet before it does it.
-
Web Vitals：LCP、INP 和 CLS 分别测量什么
Core Web Vitals 是三个真实用户指标：Largest Contentful Paint（最大可见元素的渲染时间，目标 2.5 秒）、Interaction to Next Paint（最长交互延迟，目标 200 毫秒）和 Cumulative Layout Shift（意外位移，目标 0.1）。每项都按页面加载的第 75 百分位评估。
-
为遭漏洞利用的边缘设备打补丁后：证据保全、恢复及重新上线检查
本文提出一套运维流程，用于调查曾暴露于已遭利用漏洞的边缘设备：保全证据，记录是否需要按厂商指引重建，更换已暴露的信任材料，并将恢复验证与补丁安装验证分开进行。
-
Design rollback before rollout
Write a recovery decision tree before deployment, distinguishing reversible configuration changes from data migrations that need compensation.
-
通过 PowerShell 安装 Windows Server 角色和功能，避免积累待重启状态
Get-WindowsFeature 和 Install-WindowsFeature -IncludeManagementTools 用于发现和安装；当本地组件存储缺少文件时，-Source 指向按需功能介质；返回对象会告诉调用方是否仍需重启。
-
Managing Active Directory users and groups from PowerShell without scanning the whole directory
Get-ADUser with -Filter and -Properties, New-ADUser with a SecureString password, Add-ADGroupMember, and Search-ADAccount/Unlock-ADAccount for lockouts — plus why -Filter * is a trap in a directory with tens of thousands of objects.
-
A grocery price log with the unit price computed from the pack: barcode identity, pack quantity, shelf price and promotion flag per observation
A proposed record-only protocol for logging grocery prices in which each observation carries the product's barcode number as its identity, the pack quantity as printed, the shelf price and any promotion or loyalty condition, and a unit price computed by the household in a stated unit, following the definition in EU Directive 98/6/EC of the unit price as the final price per kilogramme, litre, metre, square metre or cubic metre; a changed pack size becomes a new product row, and no purchasing advice or inflation figure is given.
-
不可信输出中的终端转义序列：为什么原始字节不应直接进入终端或日志查看器
打印到终端的文本可能含有控制序列，用于移动光标、隐藏行、更改窗口标题，或在某些终端中创建可点击链接。工具、日志或文件产生的不可信输出应在显示前经过无害化处理，这既适用于人工操作员，也适用于读取终端捕获内容的智能体。
-
事务隔离级别的实际应用
读已提交、可重复读和可串行化在并发性与一致性之间作出权衡；了解各级别允许哪些异常，才能决定何时需要显式加锁或重试。
-
Tracing a configuration value from declaration to effective runtime behavior
Explain why editing a configuration file did or did not change application behavior by tracing the value through its actual loading and override path.
-
Running a command as another user from a script: sudo -u, runuser, su -c, and PowerShell's -Credential
sudo -u, runuser and su -c all run a command with a substitute user and group ID but differ in whether they need the target's password, whether they load a login environment, and who is allowed to invoke them; PowerShell's Start-Process and remoting cmdlets take a -Credential object instead, and none of these should ever receive a password through a pipe or a command-line argument.
-
Unreal Material Instances: Inheritance and Runtime Parameter Ownership
Design a parameterized parent material, create authored variants, and give changing objects the correct dynamic instance without confusing overrides with independent material graphs.
-
Abstaining as an agent: when not acting is the correct output
An agent's output space should include a deliberate 'not decided' for every automated action: what abstention is, why a classifier or agent without one converts every unclear case into a wrong action, and how to build abstention in through explicit options, floors on confidence, stakes-dependent thresholds and a route for what was abstained from.
-
Privacy review checklist for a feature
Ten questions a reviewer answers before a feature ships: inventory of new personal data, minimisation decisions, retention job, access and access logging, export and deletion coverage, preference purposes, third-party flows, a short LINDDUN pass, test data, and a recorded result; engineering properties only, no legal assessment.
机器可读： JSON