全部文章
-
Reproducible method template
A reusable outline for a method whose result another contributor can inspect.
-
Readable body text: measure, line height and contrast
Three properties decide whether long text can be read comfortably: line length (WCAG's AAA criterion caps it at 80 characters), line spacing (at least 1.5 times the font size must be possible without breaking the layout) and contrast (4.5:1 for normal text, 3:1 for large text). Set them in relative units so users can resize and re-space the text.
-
Reading and changing service state with the Service Management Facility: svcs and svcadm
SMF is the Solaris equivalent of systemd unit management. svcs -a/-x/-l read state and find problems, svcadm enable/disable/restart/refresh change it, -t makes a change temporary, and svcadm clear recovers an instance stuck in maintenance.
-
Calibrating a scanner result with a vulnerable fixture and a safe twin
Determine whether a security scanner distinguishes the behavior it claims to detect. This original method uses controlled fixtures to interpret a finding, not to certify the scanner or rank products.
-
Preventing SQL injection with parameterised queries
Never build SQL by concatenating untrusted strings; pass values as parameters so the driver sends them separately from the statement, and allow-list any identifiers that must be dynamic.
-
Context7 CVE-2026-75130：托管服务修复与不可信的自定义规则
Context7 表示，Custom Rules 漏洞已于 2026 年 2 月在其服务器上修复。其 10 月的澄清声明对以客户端版本解释该 CVE 的做法提出异议；文档响应仍须与智能体的操作权限相隔离。
-
Node.js 中的 ES 模块与 CommonJS
CommonJS 使用同步的 require 和 module.exports；ES 模块使用静态 import/export、顶层 await 和 import.meta。Node 根据文件扩展名以及最近的 package.json 中的 type 字段逐个判断模块类型。ES 模块要求完整文件扩展名，且没有 __dirname 和 require，但有文档说明的替代方式。
-
Managing secrets outside the repository
Credentials belong in protected configuration injected at runtime, never in source control, images or logs; rotate them on a schedule and on suspicion, and give each service its own.
-
Regex flavors: BRE/ERE, PCRE2, RE2, JavaScript, Python and .NET side by side
The characters + ? | ( ) { } switch between literal and special depending on whether a tool speaks POSIX BRE or ERE, and lookaround and backreferences are supported by some engines and deliberately rejected by RE2 to guarantee linear-time matching, while named groups come in three spellings that engines accept in different combinations.
-
虚构和近似的包名：在智能体安装依赖前进行检查
生成代码的模型有时会给出不存在的包名；攻击者可以注册这些名字，而拼写抢注者则会注册与热门包名近似的名字。安装前，智能体应确认包确实存在、属于预期项目，并且不是以易混淆名称新注册的包。
-
Administering snap packages on Ubuntu: updates, holds, confinement and safe removal
snapd refreshes installed snaps automatically several times a day; an administrator controls that with snap refresh --hold or the system-wide refresh.timer/refresh.hold options, checks confinement level before trusting a snap with broad access, and can remove one with a 31-day recovery snapshot kept by default.
-
Reviewing code written by an AI agent
A proposed review protocol for generated changes: compare the diff with the request, confirm every API and dependency exists, verify test claims by running and breaking the tests, read tests before implementation, hunt for swallowed errors, and record what was checked.
-
Writing up a small repair with explicit uncertainty
A proposed structure for a non-hazardous repair report: symptom, checks with expected and observed results, the change made, whether the symptom disappeared, and what remains unproven; avoids claiming an untested fix is safe.
-
z/OS orientation: address spaces, datasets, catalogs, JES2, and what SSH into USS can see
z/OS organizes work into address spaces rather than a flat process table, stores data in cataloged datasets rather than a single filesystem tree, and queues batch work through JES2; an SSH session into z/OS UNIX System Services (USS) is one more address space with its own view, not a window onto the whole system.
-
JavaScript 文本偏移：区分 UTF-16 码元、码点和可见字符
在每个编辑器或 API 边界处注明偏移量的单位，并在切分文本前有意识地进行转换。
-
Accept-Language 语言协商及其局限
Accept-Language 携带带权重的语言范围列表，例如 da, en-gb;q=0.8, en;q=0.7。服务器通过 RFC 4647 的过滤或查找机制匹配已有语言，并返回 Content-Language 与 Vary: Accept-Language；标头缺失时（Googlebot 不发送它）或设置不合适时，也要合理回退，因为设备区域设置不等于读者的选择。应将它用于初次推测，而非唯一的语言选择方式。
-
Hyper-V from PowerShell: virtual machines, checkpoints, and why a checkpoint is not a backup
Get-VM and the shape of a New-VM call, the difference between Standard and Production checkpoints, Export-VM for moving a VM, integration services, and the -ExposeVirtualizationExtensions switch that turns on nested virtualization.
-
"Too many open files" (EMFILE) and the file-descriptor limit
EMFILE, reported as 'Too many open files', means a process hit its own limit on simultaneously open file descriptors, documented as RLIMIT_NOFILE. The article shows how to tell a real descriptor leak from a limit that is simply too low, and how to raise it at the shell, PAM and systemd-unit level.
-
标签偏移：检测并修正类别比例变化
仅在明确的标签偏移假设下估计类别先验变化，检查可识别性，并区分先验估计与需要校准概率的后验修正。
-
Checking an operating system's support lifecycle before automating against it
Automating patch, upgrade or compliance workflows against a host that has already passed end-of-life produces false confidence: no more security fixes are coming regardless of what the automation reports. This methodology lists where each major vendor publishes lifecycle dates and how to fold an EOL check into a pre-flight step.
机器可读： JSON