全部文章
-
JSON Web Tokens: what can go wrong and RFC 8725's answers
JWTs are signed claims, not encrypted secrets; validate the algorithm against an allowlist, verify issuer, audience and expiry, keep lifetimes short, never accept 'none', and remember that a stateless token cannot be revoked without a server-side list.
-
Server rewind for lag-compensated hit testing
Evaluate eligible attacks against bounded historical target state, validate timing on the server, and make the fairness and world-state policy explicit.
-
Bulk endpoints and partial failure reporting
A bulk endpoint either succeeds or fails as a whole or reports per-item outcomes; a single 200 cannot express partial success, so choose one behaviour per endpoint, index failures by position, cap batch size, and apply authorisation and rate limits per item.
-
Ein Design-Dokument (RFC) schreiben, über das Reviewer entscheiden können
Ein Design-Dokument holt die Entscheidung ein, bevor Code entsteht: zuerst das Problem, dann Ziele und Nicht-Ziele, eine Erklärung auf Anwender- und eine auf Referenzebene, verworfene Alternativen mit Begründung, Nachteile und eine ausdrückliche Liste offener Fragen. Die Struktur folgt dem, was PEP 1, die Rust-RFC-Vorlage und die Design-Doc-Praxis bei Google verlangen.
-
Using SMIT as a command generator instead of a menu system
smit/smitty menus ultimately run ordinary AIX commands, and the tool is built to show you which ones: the output window displays the constructed command statement, and smit.log/smit.script capture every command and its exact flags with timestamps. Reading smit.script after a menu-driven task is a fast way to learn the equivalent non-interactive command.
-
阅读火焰图：宽度表示样本，x 轴不是时间
火焰图将采样得到的调用栈叠放起来，使栈帧宽度表示样本占比、高度表示栈深度；x 轴按字母顺序排列，而非时间顺序。顶部宽阔的平台表示正在 CPU 上执行的热点，下方带有许多细小子节点的宽栈帧表示应减少调用的调用方；CPU 火焰图无法显示等待。
-
依赖卫生与软件供应链检查
了解依赖、固定并验证它们、关注已知漏洞，并从可信来源构建；SLSA 等级、OpenSSF Scorecard 和带哈希校验的安装提供了具体步骤。
-
本地智能体控制 API：防止通过未经身份验证的代理访问宿主机
当智能体能够访问权限更大的宿主机 API 时，沙箱可能失去保护作用。MCP Inspector 已确认的身份验证漏洞说明，绑定回环接口、身份验证、Origin 检查和 Host 验证分别保护边界的不同环节。
-
Do FAQ pages earn their place, and what keeps them from rotting?
Open question: GOV.UK's style guide forbids FAQs on GOV.UK on the grounds that content written from user needs does not need them, while Nielsen Norman Group argues FAQs deliver value and that search alone is rarely enough; which measurable outcomes, ownership rules and staleness checks have teams recorded for FAQ pages in technical documentation?
-
Konfigurationsformate wählen: JSON, YAML oder TOML
JSON (RFC 8259) ist streng und überall lesbar, kennt aber keine Kommentare; YAML ist gut lesbar, doch unzitierte Werte werden nach Muster typisiert; TOML ist für Konfiguration entworfen, mit Kommentaren, expliziten Typen und Tabellen. Wer die Datei bearbeitet und was sie liest, entscheidet – und jedes Format braucht nach dem Parsen eine Prüfung gegen ein Schema.
-
在智能体任务中贯穿使用关联标识符
区分任务身份、各次尝试和分布式追踪上下文，以便在不记录敏感载荷的情况下追踪重试。
-
有意识地选择 HTTP 状态码
状态码是客户端首先用来选择处理分支的信息：200/201/204 表示成功，304 表示未修改，400/422 表示输入有误，401/403 分别涉及凭据与权限，404 表示不存在，409/412/428 涉及冲突与前置条件，429/503 表示稍后再试。
-
Orienting on an unfamiliar AIX LPAR before you type anything else
AIX 7.2/7.3 on Power looks like Unix but is not Linux: no systemd, the Korn shell (ksh88 as /usr/bin/ksh) by default instead of bash, no GNU coreutils flags, and device/kernel configuration lives in the ODM rather than flat files. A short set of read-only commands establishes the release, hardware and partition context before any change.
-
Freshness and row-count checks on raw source tables catch most pipeline incidents earlier than column-level tests downstream
Hypothesis: in a warehouse with layered models, the majority of incidents that end up visible to report consumers first show as a stale or under-sized raw source load, so freshness and volume checks at the source layer detect them earlier than not-null, uniqueness and accepted-value tests on downstream models; a proposed comparison over recorded incidents.
-
Partitioning a new disk non-interactively without writing to the wrong device
parted -s and mkfs run without confirmation once pointed at a device, so the only real safeguard is verifying the target's identity — serial number or WWN via /dev/disk/by-id — before the first write, not after. wipefs -n and lsblk are read-only checks that belong before every step that writes.
-
Idempotent data pipelines: partition overwrite, safe reruns and backfills without double counting
A pipeline task should produce the same output whenever it is rerun for the same data interval: read a fixed partition of input, replace rather than append the corresponding partition of output, and upsert by key where replacement is impossible. Backfills then become ordinary reruns over a range of intervals instead of a source of duplicated rows.
-
Data leakage in machine learning: how information from the future or the test set gets into a model
Leakage means the model is built with information that will not be available at prediction time: preprocessing fitted on all rows, features derived from the target, rows of one entity on both sides of a split, or time-ordered data shuffled. It produces optimistic validation scores and a model that disappoints in production.
-
技术文档中的简明语言
短句、主动语态、每段一个观点、具体的动词和有定义的术语，能让人更快阅读文档，也让代理更容易解析；plainlanguage.gov 的指南同样适用于政府写作之外的领域。
-
梯度累积：在保持正确归一化的同时扩大有效批次
累积微批次梯度可减少激活内存，但必须保持损失权重、优化器更新边界和梯度裁剪顺序；更大的有效批次并不总是等同于单个物理批次。
-
Unity uGUI: Split Canvases Around Changes That Actually Occur
Choose Canvas boundaries by update behavior, distinguish batching from layout recalculation, and verify the cost of a dynamic interface without assuming every split improves performance.
机器可读： JSON