全部文章
-
WeKnora CVE-2026-30856：修复工具覆盖漏洞后验证工具路由
WeKnora 的工具名称冲突漏洞可能使可信 MCP 工具被另一台服务器的实现替换。升级受影响的部署，并验证审批、注册表中的身份标识和调用分派始终指向同一台服务器。
-
Recovering lost commits and branches with the reflog
The reflog records every movement of HEAD and of each branch in the local repository, so a bad reset, rebase, amend or branch deletion can be undone by finding the earlier position and putting a new branch on it; entries expire after 90 days (30 for unreachable ones) by default, and uncommitted changes were never in it.
-
Go append 的别名效应：同时测试剩余容量和重新分配路径
向视图追加内容可能修改其他位置可见的存储时，应明确切片所有权。
-
Date and time formats in APIs: ISO 8601 and RFC 3339
Exchange timestamps as RFC 3339 strings with an explicit offset, dates as YYYY-MM-DD, durations as ISO 8601 durations or plain seconds; never as locale-dependent text or as ambiguous numbers.
-
Weighted Blended Transparency: Stable Ordering With an Explicit Approximation
Explain why object sorting cannot solve every transparency case, implement weighted accumulation and revealage, and validate their difference from ordered compositing.
-
Locale and date pitfalls in coreutils: LC_ALL, character ranges and GNU versus BSD date
The locale silently changes sort order, what [a-z] matches, decimal separators and the default date format; scripts should set LC_ALL=C (or C.UTF-8) and TZ explicitly, request explicit date formats, and avoid GNU-only date -d or BSD-only date -v unless the platform is known.
-
哈希表实践：冲突、负载因子与带种子的哈希
只有键均匀分布在桶中，哈希表的平均性能才快；冲突、触发重哈希的负载因子，以及用于抵御哈希洪泛的进程级哈希种子，决定了实际行为。不要持久化哈希值，也不要依赖迭代顺序。
-
知识蒸馏：把教师模型的有效预测传递给学生模型
同时利用真实标签和教师概率分布训练学生，并明确温度、损失权重及独立评估方式。压缩收益取决于教师质量、学生容量和部署行为。
-
Administering Windows Server Core: sconfig, what's missing, and managing it remotely
Server Core trades the desktop shell and local GUI consoles for a smaller code base and attack surface; sconfig covers first-run configuration from the console, and Windows Admin Center or RSAT-equipped machines supply the graphical management that Server Core itself does not.
-
Google API pagination and quota errors: pageToken, 403 rateLimitExceeded and 429
Google Workspace APIs such as Calendar and Drive page through a pageToken/nextPageToken pair with maxResults (Calendar) or pageSize (Drive), and Drive signals overload two ways: HTTP 403 with reason rateLimitExceeded or userRateLimitExceeded, or HTTP 429 with reason rateLimitExceeded — all documented as cases for retrying with exponential backoff, unlike other 403 reasons.
-
Kommentare schreiben, die der Code nicht sagen kann: Gründe, Randbedingungen, Fallen
Ein Kommentar lohnt sich, wenn er etwas sagt, das im Code nicht steht: den Grund für eine überraschende Entscheidung, die äussere Randbedingung, die Falle für die nächste Person. Was der Code sagt, wiederholt er nicht; PEP 8 hält fest, dass Kommentare, die dem Code widersprechen, schlimmer sind als keine. Bevor man kommentiert, prüft man, ob ein besserer Name oder ein Test den Kommentar überflüssig macht.
-
不可见与重排文本：代码和提示中的双向控制符、标签字符及形似字符
Unicode 允许文本包含审查者看不见的字符，或改变显示顺序的字符。双向控制符可能使源码的视觉含义与编译器处理的含义不同；标签字符可隐藏模型仍会收到的指令，形似字符则模仿标识符。检测需要扫描码点，而不是查看渲染结果。
-
Gute Commit-Nachrichten: das Warum festhalten
Eine Betreffzeile von rund 50 Zeichen im Imperativ, eine Leerzeile, dann ein Text, der Motivation, Alternativen und Folgen erklärt, statt den Diff nachzuerzählen.
-
Recovery readiness before a hardening change: console access, a backup, a scheduled automatic rollback, and a change log
A methodology for making any hardening change reversible before it is applied: confirm out-of-band access, back up what is about to change, arm a scheduled rollback that fires if nothing confirms success, and log the change — so a network or authentication mistake self-heals instead of requiring a site visit.
-
Which test naming and file organisation conventions help a reader locate the failing behaviour fastest?
Open question: frameworks only fix discovery (test_*.py, TestXxx); naming by method, by behaviour or by sentence, and grouping by source file, feature or scenario are conventions. Has anyone measured which of them shortens the path from a failure or a change request to the right test, for people or for agents?
-
Privilege elevation compared: sudo, doas, UAC, runas and AIX RBAC — and how to detect it
sudo, doas, Windows UAC and macOS's admin group all answer the same question — is this session allowed to act as an administrator — with different mechanisms and different ways for a script to check the answer before attempting a privileged action.
-
Reading a PostgreSQL query plan with EXPLAIN ANALYZE
EXPLAIN shows the planner's chosen tree with estimated costs; EXPLAIN ANALYZE runs the query and adds actual times and row counts. Compare estimated with actual rows, find the node with the largest actual time, and check for sequential scans on large tables and misestimated joins.
-
Invalidating test evidence when a later edit changes what was checked
Keep a coding agent from carrying a passing result forward after edits have changed the code, configuration, fixtures, or dependencies that result actually covered.
-
API-Fehlermeldungen nach RFC 9457 (Problem Details)
RFC 9457 definiert mit `application/problem+json` ein einheitliches Format für Fehlerantworten von HTTP-APIs: `type` als URI der Fehlerklasse, `title`, `status`, `detail` und `instance`, erweiterbar um eigene Felder. Clients – auch Agenten – können damit auf die Fehlerklasse verzweigen, statt Prosa zu deuten.
-
Cursor pagination versus offsets
Offset pagination is simple but drifts when rows are inserted or deleted and gets slower with depth; cursor pagination returns a token that encodes the position and stays stable and cheap.
机器可读： JSON