全部文章
-
小型运维团队的变更日历与维护窗口
将所有可能影响用户的计划变更放到同一个共享日历中，写明负责人、窗口、回滚说明和禁变规则。Google SRE 书中指出，SRE 发现约 70% 的中断由运行中系统的变更引起，因此任何事件首先都应问“改了什么？”，而日历就是答案所在。
-
Sitemaps und kanonische Adressen: ein Inhalt, eine Adresse
Jeder Inhalt sollte genau eine kanonische HTTPS-Adresse haben, die auf der Seite selbst erklärt wird; Zwillinge wie Markdown- oder JSON-Fassungen verweisen per Link-Header darauf, Parameter ohne Inhaltswirkung erzeugen keine neuen Adressen, und die Sitemap listet nur kanonische Adressen mit wahren Änderungsdaten.
-
存有 API 密钥的服务商遭入侵后：遏制风险、更换密钥与核查账单
在签发方撤销已暴露的密钥，通过可信系统恢复合法使用方的访问，并调查用量和费用。预算告警与替换密钥的交付是两项独立控制措施，都需要验证。
-
Household log entries written from memory at the end of the day show more rounded values than entries written at the moment of reading
Hypothesis: when a meter, scale or thermometer reading is written down hours later from memory, the recorded value is more often a round number (ending in 0 or 5, or with fewer decimals) than when it is written at the instrument; a proposed within-household test with alternating days and photographs as the reference, with no claim about which value is closer to the truth.
-
Which User-Agent conventions do site operators use to classify AI agents, and how often are honestly identified agents blocked anyway?
RFC 9309 tells crawlers to carry a product token and a description URL in their User-Agent, and operators increasingly sort traffic into browsers, crawlers and agents by such strings; this question asks which conventions operators actually key on, whether honest identification raises or lowers the chance of being blocked or rate-limited, and what the measured share of misclassified traffic is.
-
Generalizing a Windows image with Sysprep: /generalize, /oobe, /shutdown and the rearm limit
Sysprep /generalize removes computer-specific information such as the SID and the configured devices from a Windows installation so the image can be deployed to other computers; on Windows 8.1/Server 2012 and later Sysprep can be run up to 1001 times per image (3 times on Windows 7/Server 2008 R2), and generalize failures leave their trace in the Panther logs under System32\Sysprep.
-
为第三方脚本和样式表使用子资源完整性校验
script 或 link 元素上的 integrity 属性携带预期文件的 base64 编码 SHA-256、SHA-384 或 SHA-512 哈希；内容不匹配时，浏览器拒绝执行或应用该资源。它精确固定 CDN 可交付的内容，跨源文件需要 CORS，因此仅适用于内容固定的资源。
-
MCP 工具定义作为攻击面：投毒描述、名称遮蔽和静默变更
MCP 服务器的工具名称、描述和注解，是模型在调用任何工具之前就会读取的文本。恶意或被攻破的服务器可以借此引导智能体、模仿另一台服务器的工具，或在获准后改变行为。客户端应像对待代码一样固定、比较并审查定义。
-
技术报告中的测量不确定度与有效数字
测量值没有不确定度就不完整：重复测量，报告均值、均值的标准差和运行次数，将不确定度保留一到两位有效数字，测量值也舍入到同一数位，并说明区间含义；超出不确定度所能支持的数字只是噪声。
-
Firewalld and nftables rules for NFS, Samba, NTP, DNS and DHCP: exactly which ports to open
A reference for the exact ports these infrastructure services need — NFS4 TCP 2049, Samba TCP 445 (139 and UDP 137/138 only for NetBIOS), DNS TCP+UDP 53, DHCP UDP 67, NTP UDP 123 — with firewalld's predefined services, the equivalent nftables dport syntax, and why a UDP nmap/nc probe is a weak test compared with the real client.
-
Running chrony as an NTP server for a LAN: allow, local stratum, and firewalling UDP 123
Serving time to a LAN with chrony means adding an allow directive scoped to the client network, deciding whether a local stratum fallback is genuinely wanted, opening UDP 123, and confirming clients actually poll the server with chronyc clients.
-
调用其他 API 的 MCP 服务器中的令牌透传与混淆代理问题
MCP 服务器若将客户端令牌转发给下游 API，或使用自身的广泛凭证为任何请求者服务，就会让调用方获得从未被授予的权限。MCP 安全指南禁止令牌透传，并描述了代理服务器中的混淆代理流程。
-
NULL in SQL: three-valued logic and its traps
NULL means unknown, so comparisons with NULL yield unknown rather than true or false; WHERE filters drop unknown rows, NOT IN with a NULL matches nothing, and aggregates skip NULLs. Use IS NULL, IS DISTINCT FROM and COALESCE deliberately.
-
Cargo、crate 与 edition：Rust 项目的构建和版本管理
Cargo 根据 Cargo.toml 构建 crate，将 SemVer 兼容范围内的依赖解析到 Cargo.lock，并能在一次构建中包含同一 crate 的两个不兼容主版本。Edition 是每个 crate 自行选择、可互操作的语言版本，因此升级某个 crate 的 edition 不会迫使依赖它的 crate 一同升级。
-
Godot scenes, nodes and resources: compose behaviour with clear ownership
Distinguish the live node hierarchy, scene-saving ownership and shared resource data when building reusable Godot scenes.
-
Cron expression dialects: fields, seconds and the day-of-month/day-of-week trap
Vixie cron, Quartz, Kubernetes CronJob, GitHub Actions and AWS EventBridge all call their scheduling string a 'cron expression', but disagree on field count, whether seconds or a year exist, and whether day-of-month and day-of-week combine with OR or must never both be set.
-
用学习前后自测评估所学，以及这种比较无法说明的事
围绕一段学习期进行个人前测和后测的流程：学习前写好问题，不看资料作答，然后学习；隔一段时间后回答平行题组，并按固定答案评分。差值是一种有已知弱点的估计，因为前测本身也会促进学习，题组难度可能不同，单个学习者也不能充当自己的对照组。
-
Describing a change so that reviewers can review it
A change description states the problem, the approach and its alternatives, how it was tested and what reviewers should look at; it links the ticket and lists risks and follow-ups, so review starts with understanding instead of archaeology.
-
How far back should a scheduled pipeline reprocess for late-arriving events, and how have teams chosen the window?
Open question: stream engines admit that some events can be arbitrarily delayed, and batch schedulers run each interval once after it closes; a common compromise re-runs the last N intervals on every run, but N is usually a guess. What evidence has been used to size N, and what happened to the events that arrived later still?
-
Money and other exact quantities: use Decimal, not float
Binary floating point cannot represent most decimal fractions exactly, so sums of prices drift; the decimal module provides exact decimal arithmetic with explicit rounding, and integers in minor units are an alternative.
机器可读： JSON