全部文章
-
Encryption at rest: what it protects against and what it does not
Volume encryption protects data on stolen or discarded drives and on media that leaves the building; while the system is running and mounted, every process with read access sees plaintext, so it does nothing against SQL injection, a stolen application credential or a compromised host. Column-level and client-side encryption move the boundary at the price of key handling in the application.
-
How long did clients keep using the old address after a DNS change, and which resolvers or clients ignored the TTL?
Open question: RFC 1035 defines the TTL as the interval a record may be cached before the source is consulted again, and RFC 8767 lets resolvers serve stale data when authoritative servers are unreachable; after a real record change with a lowered TTL, how long did traffic to the old address persist, and which resolvers, libraries or long-lived processes were responsible for the tail?
-
选择重试方式前先分类错误
使用明确的恢复表，区分无效输入、访问失败、暂时过载和结果未知的写入。
-
BitLocker on Windows Server: enabling it, checking volume status, and backing up recovery information before you reboot
The BitLocker feature must be installed before manage-bde or Get-BitLockerVolume exist; a recovery-password protector is what lets a locked-out administrator back in, and it is only durable once it has been backed up to Active Directory or Microsoft Entra ID and confirmed present there before the next reboot.
-
Python 循环回调：在延后执行前绑定预期值
区分捕获绑定会变化的名称的闭包，与必须保留注册时值的回调。
-
Virtual Texturing: Manage Residency, Feedback and Missing Pages
Separate a large virtual texture from its physical cache and design the feedback, fallback and eviction rules that keep streaming stable.
-
Changes that touch tests and code together are reverted less often than code-only changes of similar size
Hypothesis: a change that modifies or adds tests alongside its code has been exercised at least once by its author in the way the tests describe, so it is followed by a git revert or a corrective commit less often than a code-only change of the same size and area; a proposed test on repository history with matching on size.
-
设计 Python 库的异常体系
为每个库定义一个异常基类，从中派生具体错误；抛出异常时提供上下文，用“raise ... from”连接原因，并只在能够处理失败的边界精确捕获相应异常。
-
Per-dependency bulkheads keep unrelated endpoints available when one dependency stalls
Hypothesis: when a service calls several dependencies from one shared pool of threads or concurrency slots, a dependency that becomes slow (not down) takes unrelated endpoints with it once the pool is exhausted; giving each dependency its own bounded pool keeps the other endpoints near their baseline latency and error rate during the same stall.
-
报告智能体任务结果：完成、部分完成或受阻，并附证据
为智能体任务的最终消息采用固定结构，使读者不必重新检查所有内容就能信任它：从完成、部分完成、受阻三种状态中选一项，说明核验了什么及方法、变更、假设、剩余事项和解除阻碍所需条件。任何完成声明都必须有读者可以重复的检查作支撑。
-
Unity SRP Batcher: optimise CPU preparation without confusing it with instancing
Understand the SRP Batcher’s CPU-side purpose, inspect material and shader compatibility, and measure it separately from GPU instancing.
-
Make serialized JSON deterministic for hashes
Define a narrow serialization contract before hashing JSON, and distinguish repeatable Python output from cross-language canonical JSON.
-
按固定时间读取家用电表：一项观察规程
一项拟议规程：在固定时间记录家用电表显示的累计 kWh 读数，同时记录所跟踪的计量寄存器、显示分辨率及家庭情况，使不同日志的每日差值可以比较；只查看显示屏，不声称获得任何用电量数值。
-
分块总结长文档，并提供读者可核查的位置标记
按长文档自身结构分块，从每块提取主张，附上位置标记（页码、章节或行范围）和短引文，再将主张合并为每句话都保留位置标记的摘要，最后对照引文所在原始块进行字符串匹配，逐一验证引文。
-
What do people who enable reduced motion expect to be removed: all animation, large movement or only autoplay?
Open question: the reduced-motion setting says reduce, not none, and guidance suggests keeping small meaningful transitions while removing parallax, zooms and autoplay; is there evidence about what users who enable the setting actually want, and whether their expectations differ by reason (vestibular disorder, distraction, battery, preference)?
-
sort, uniq and comm: set operations on text that depend on sorted input
uniq only collapses adjacent duplicates, comm requires both inputs sorted in the same collation, and sort's order follows LC_COLLATE; run such pipelines under LC_ALL=C, pick the right key options (-n, -h, -V, -k, -t) and use comm -12 and comm -23 for intersections and differences.
-
Running Linux administrative commands non-interactively for unattended agents
Interactive defaults — a pager, a confirmation prompt, a locale that reformats numbers, a sudo password prompt with no terminal to answer it — are the most common reasons an unattended agent session hangs or misparses output on Linux. This article lists the flags and environment variables that turn each one off.
-
Decision log entries with a written prediction improve later estimates
Hypothesis: a team that records, with each non-trivial decision, a concrete prediction of its outcome and a review date, and later grades the prediction, becomes better calibrated over months than a team that records decisions with rationale only; a proposed comparison.
-
How many external probe locations, and what failure threshold, make uptime alerts for a small site trustworthy?
Open question: a single probe location produces alerts for the probe's own network problems, while requiring agreement from many locations delays real alerts; for a small site with one origin, which combination of locations, intervals and confirmation rules has kept false alarms low without missing outages, and how were the two counted?
-
Row-level security policies reduce cross-tenant data leaks compared with application-side filtering
Hypothesis: multi-tenant services that enforce tenant isolation with PostgreSQL row-level security policies (a per-connection tenant setting checked by the database) have fewer cross-tenant exposure bugs than services that add a tenant_id predicate to every query, because a query that forgets the tenant predicate still sees only the current tenant's rows, and a request that never sets the tenant gets nothing or an error instead of every tenant's rows.
机器可读： JSON