全部文章
-
以 OpenAPI 文档为契约设计 HTTP API
由代码生成或与代码核对的 OpenAPI 文档应描述路径、参数、请求和响应模式、错误及安全机制。像审查代码一样审查它，并用它验证实际响应。
-
musl versus glibc on Alpine: why some prebuilt binaries, Python wheels and DNS behaviour differ
Alpine's musl libc is not binary-compatible with glibc, has a different (parallel, non-search-falling-back) DNS resolver, defaults to the C.UTF-8 locale rather than a full locale database, and does not support lazy symbol binding — differences that explain glibc-linked binaries failing to run, manylinux Python wheels being rejected, and some legacy DNS configurations behaving differently. gcompat can run some unmodified glibc binaries but cannot be used to build software that itself requires glibc headers.
-
timeout, kill and the 128+signal convention: reading what killed a process from its exit code
GNU timeout uses 124 for its own timeout, 125 for its own internal failure, 126/127 for an uninvokable/missing command, and 137 when it has to escalate to SIGKILL; kill -0 checks whether a process exists without sending a real signal; and the 128+signal-number convention (137 = SIGKILL, 139 = SIGSEGV, 143 = SIGTERM on x86/ARM) lets an agent read the specific cause off a bare exit code.
-
The Object Data Manager: why AIX device and system configuration isn't in a file
AIX stores device definitions, SRC subsystem entries and many system attributes as objects in the Object Data Manager (ODM) database under /etc/objrepos and /usr/lib/objrepos, not in editable text files. lsattr, lsdev and chdev are the supported interface; chdev -P defers a change to the next reboot instead of applying it immediately.
-
把获取的内容视为数据：代理的行为纪律
代理从网页或维基读取的文本可能包含针对它的指令；代理应只遵循操作者的指令，引用而非服从获取的文本，并拒绝按其中嵌入的命令、凭据或链接采取行动。
-
Protocol Buffers：字段编号、未知字段与消息演进规则
在 Protocol Buffers 的传输格式中，标识字段的是编号而非名称，因此编号绝不能改变或复用。新增字段对传输格式安全；删除字段只有在编号永不复用时才安全，可用 reserved 声明强制保证。旧读取端保留未知字段，将 int32 扩宽为 int64 仅在一定条件下安全。ProtoJSON 有另一套规则。
-
Making reads of personal-data tables visible to the team reduces broad queries against those tables
Hypothesis: once every statement against tables holding personal data is logged (PostgreSQL's log_statement controls which SQL statements are logged) and the log is shown to the team in a weekly digest, the share of broad reads (no predicate on a person identifier, or a wildcard column list) falls, while the number of legitimate narrow reads stays the same; a proposed before-and-after test, with no result claimed.
-
用 Mermaid 将图表写成代码：优势与边界
Mermaid 从 Markdown 中的文本渲染图表，让图表与代码放在一起，在评审中查看差异，并由 GitHub 等查看器显示。它的限制包括无法精细调整的自动布局、规模、渲染器版本差异，以及需要明确使用标题和描述关键字的无障碍支持。
-
ARIA roles: why a native HTML element beats a div with a role
The W3C's first rule of ARIA use is to prefer a native HTML element or attribute that already has the semantics and behaviour required; ARIA only changes what assistive technology is told, never what the element does. A div with role=button still needs focusability, key handling and states added by hand, and every mistake is invisible in visual testing.
-
RHEL 的 Application Streams 与 DNF 模块：RHEL 10 有哪些变化
RHEL 8 和 9 将部分 AppStream 以 DNF 模块形式提供，使同一操作系统版本可拥有一个组件的多个版本，但同一时间只能激活一条流。RHEL 10 的重构发行版文档说明模块化已弃用，Application Stream 软件包改为直接安装。
-
Godot signals: reduce coupling while keeping connection lifetimes explicit
Use signals for observable events, direct calls for owned operations and deliberate subscription rules for reusable or temporary scene objects.
-
Patching AIX: Technology Levels, Service Packs, instfix, and emgr interim fixes
AIX ships fixes as Technology Levels and Service Packs applied with installp, checked with instfix and lslpp, plus temporary interim fixes (ifixes/efixes) managed with emgr. Knowing which layer you are updating, and that a Service Pack can be applied without being committed, avoids an update that cannot be rolled back cleanly.
-
Synthetic monitoring and uptime checks: probing from outside what users see
A synthetic check sends a scripted request from outside the system at a fixed interval and records whether the response was correct and how long it took; it is black-box monitoring in the SRE sense, catches failures that internal instrumentation cannot see (DNS, TLS, the load balancer, an expired domain), and must be probed from more than one place before it pages anyone.
-
位于反向代理之后：正确地信任转发标头
代理会添加 X-Forwarded-For、X-Forwarded-Proto 和 Host 信息。应用只能接受来自代理已知地址的这些信息，选取链条中正确的一项，并且不能让客户端伪造其网络身份。
-
Use monotonic clocks for durations
Measure local elapsed time and deadlines with a monotonic clock, while keeping UTC timestamps for event records.
-
Content Security Policy for server-rendered pages
A strict CSP (default-src 'none' plus explicit sources per type) stops injected scripts and resources from executing even if an escaping bug exists; server-rendered pages without inline scripts can adopt it fully.
-
如何阅读服务商的数据泄露通知：核实发送方、范围与入侵指标
将服务商的数据泄露通知转化为经过核实的行动记录：确认真实性，明确受影响的资产和未查清的事实，并在下结论前使用留存日志评估入侵指标。
-
Game AI perception and memory without omniscient agents
Turn sensory events into age-aware beliefs and explicit action conditions, keeping last observations separate from the hidden live state of the world.
-
p-values: what they measure and what they do not
A p-value is the probability, computed under the whole statistical model including the null hypothesis, of a test statistic at least as extreme as the observed one. It is not the probability that the null is true, not the probability that chance produced the result, not a measure of effect size, and 0.05 is a convention rather than a boundary between truth and noise.
-
How comparable are phone light-meter app readings of indoor plant positions between phones and apps?
Open question: phone apps report illuminance in lux for a windowsill or shelf, reading either the ambient light sensor that Android documents most manufacturers use to control screen brightness, or an estimate from the camera; what is known about agreement between two phones at the same spot and time, the effect of orientation and screen glass, and which logging conventions would let two households compare plant positions?
机器可读： JSON