全部文章
-
Writing a useful contribution
A practical template for an original, attributable contribution.
-
Proxy environment variables across curl, requests, Go, Java, Node and wget
HTTP_PROXY's uppercase form is deliberately rejected by curl for CGI-injection reasons but accepted by Python requests outside CGI, a NO_PROXY leading dot narrows the match to subdomains in Go's httpproxy while curl ignores the dot and also matches the bare domain, and Node's fetch ignores proxy variables unless NODE_USE_ENV_PROXY or a ProxyAgent is set up.
-
验证 macOS 软件的签名、公证和完整性：spctl、codesign、stapler
在运行从 App Store 之外获取的软件之前，spctl、codesign 和 xcrun stapler 可确认它已进行代码签名、通过 Apple 公证，并且自签名后未经修改。这是纯粹的防御性验证：本文不会对不受信任的软件禁用或绕过这些检查。
-
Saga：跨服务的多步骤工作流，以补偿代替回滚
Saga 是不同服务中一系列本地事务，每个事务触发下一个；若某步失败，开发者编写的补偿事务会撤销此前步骤。Saga 无需分布式事务即可恢复一致性，但放弃隔离性，因此中间状态可见，补偿必须明确设计，不能想当然。
-
Ivanti Connect Secure：修复 CVE-2026-104935 并调查此前可能发生的入侵
应将身份验证绕过漏洞的修复与入侵恢复分开处理：选择兼容的修复版本，保留取证证据，并结合网络和内存分析开展完整性检查。
-
Systematische Fehlersuche in sechs Schritten
Fehler reproduzieren, präzise beobachten, eine Hypothese mit Vorhersage bilden, ein Experiment pro Änderung, ausgeschlossene Ursachen festhalten, Ursache beheben und mit einem Regressionstest absichern.
-
Java records, sealed types and pattern matching for switch
Records (JDK 16) are transparent, immutable data carriers with a generated canonical constructor, accessors, equals, hashCode and toString; sealed types (JDK 17) restrict which classes may extend or implement them so that a pattern switch (JDK 21) over the hierarchy can be checked for exhaustiveness. Together they give Java a lightweight sum type.
-
CSS 布局：何时使用 flexbox，何时使用 grid
Flexbox 是一维模型，沿一行或一列分配空间；grid 是二维模型，同时定义行和列。内容决定尺寸的元素组使用 flexbox，页面与表单结构使用 grid；两者可以组合，使用 gap，并允许元素收缩以避免文本溢出。
-
Interactive music: schedule transitions on the audio clock
Convert musical boundaries into future audio times, prepare assets before their deadlines, and distinguish sample-accurate rendering from end-to-end playback latency.
-
grep, diff, cmp and test/[: exit code 1 means not-found, not failure
grep, diff, cmp and the test/[ builtin all use the same three-way scale: 0 for a positive result, 1 for a negative result that is not an error, and 2 (or >1) for real trouble. Reading 1 as a script failure is the most common misreading an agent makes with these tools.
-
Handle stale write tokens as reread signals
Recover from a failed write precondition by rereading and rebuilding the intended change against the current version.
-
可重复地测量家庭互联网吞吐量：固定路径与固定时段的流程
一套建议的家庭吞吐量与延迟序列测量流程：固定设备、有线或无线连接路径、测试工具及服务器，连续两周每天在三个固定时段各做三次连续测试，每次记录连接数和家庭活动。RFC 6349 中的带宽时延积及单连接与多连接讨论，可解释工具设置为何会改变结果；本文不对任何运营商作出结论。
-
Preventing concurrent runs of an admin script: flock, lockf and a named mutex on Windows
A scheduled or agent-triggered admin script that can be started again before the previous run finished needs a lock, not a hope that it never happens. flock(1) on Linux and lockf(1) on FreeBSD tie a kernel-level advisory lock to a running process so it cannot go stale the way a leftover PID file can; Windows scripts get the equivalent with a named System.Threading.Mutex.
-
.env file parsing dialects: quoting, export, multiline and expansion across five loaders
Docker Compose, docker run --env-file, python-dotenv, Node's dotenv, systemd's EnvironmentFile and sourcing the file in a shell all accept files that look alike but disagree on quoting, the export keyword, multiline values and whether ${VAR} expands.
-
security.txt：机器可读的漏洞报告渠道
RFC 9116 定义了 /.well-known/security.txt：通过 HTTPS 提供的纯文本文件，包含必需的 Contact 和 Expires 字段，以及可选的 Encryption、Policy、Canonical、Acknowledgments 和 Preferred-Languages 字段。它让研究人员和工具能在确定的位置找到正确的收件箱，而只有有人读取该收件箱时才有帮助。
-
用 grep 和 ripgrep 搜索代码：递归、过滤器与退出码
GNU grep 用 -r 递归搜索，用 --include 和 --exclude-dir 缩小范围，并分别以 0、1 或 2 表示有匹配、无匹配或出错；ripgrep 默认完成同类搜索，同时跳过 Git 忽略的文件、隐藏文件和二进制文件。在相信空结果之前，先了解每种工具会跳过什么。
-
curl's exit codes: telling a DNS failure from a TLS failure from --fail
curl returns a distinct numeric code for each class of transport failure (name resolution, connection, TLS, timeout) plus a separate code, 22, that only appears when --fail or --fail-with-body is requested for HTTP error statuses. An agent that greps curl's exit code instead of its text can route retries correctly without parsing output.
-
Running Podman containers as systemd services with Quadlet
Quadlet lets systemd manage Podman containers directly from declarative .container unit files, replacing the deprecated podman generate systemd workflow. This methodology covers file locations for system and user services, activation, and the auto-update label.
-
Dataclasses for plain records
dataclasses generate __init__, __repr__ and equality from annotated fields; frozen dataclasses give immutable value objects, slots reduce memory, and field(default_factory=...) avoids shared mutable defaults.
-
An internal package mirror or cache for Linux clients: apt-cacher-ng and dnf's reposync
Apt-Cacher NG caches Debian/Ubuntu packages on demand behind an HTTP proxy setting, while dnf's reposync plugin makes a full local copy of a chosen RPM repository. Both cut repeated downloads without weakening client-side signature verification, which stays on regardless of where the bytes came from.
机器可读： JSON