全部文章
-
使用 Jev 选择来源片段，避免悄然改写值
将语义选择与值的复制分开，让智能体在识别所请求值的同时，保留该值所依据的确切证据。
-
After moving a JVM service to virtual threads, what changed in throughput, memory and pinning incidents, and what had to be rewritten?
Open question: JEP 444 states that pinning does not make an application incorrect but might hinder its scalability, and JEP 491, delivered in JDK 24, removes pinning for synchronized blocks; for services that switched request handling to virtual threads, what did the change do to throughput and memory, which pinning or pool-exhaustion incidents occurred, and which code and libraries had to change?
-
用 60 秒初看缓慢的 Linux 服务器：命令顺序与每行回答的问题
按固定顺序运行十条标准命令，从 uptime 到 top，其中若干来自可能需要先安装的 sysstat 包；每条分别回答一个有关 CPU、内存、磁盘或网络的问题。在打开任何日志文件或重启任何东西之前先执行这一轮。
-
CPU profiling with perf: perf top, perf record -g, perf report, and perf_event_paranoid
perf top gives an immediate live profile; perf record -g saves a call-graph profile to disk for perf report to read later. The kernel's perf_event_paranoid setting controls what an unprivileged user can do, and symbol resolution needs matching debug information for every frame in the stack.
-
测量通勤时间：从门到门的计时规程
一项为重复行程计时的拟议规程：固定起点和终点，在两处记录带 UTC 偏移的 RFC 3339 时间戳，可选记录分段边界，并设置条件栏（星期、路线变体、天气、异常情况），让变化可以归因而非依赖记忆；本文不推荐任何路线。
-
System One models and Jev: typed decisions with calibrated probabilities instead of generated text
Jev (TypeSafe AI, early access since September 2026) is a model that answers typed questions about a supplied state with probability distributions and a confidence value rather than generated text; what the vendor documents about its primitives, limits, pricing and training, and what that leaves open.
-
Sicherheits-Antwortheader jenseits der Content Security Policy
Wenige Antwortheader schliessen verbreitete Lücken im Browser, ohne dass die Anwendung angefasst wird: X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy und Strict-Transport-Security; X-Frame-Options ist durch frame-ancestors abgelöst, X-XSS-Protection wird auf 0 gesetzt. Zentral am Proxy setzen, für jede Antwort, und nach jedem Deployment prüfen.
-
Java virtual threads in outline: what changes and what does not
JEP 444 (JDK 21) adds virtual threads: cheap threads scheduled by the JDK onto a small pool of carrier platform threads, which unmount while blocked on most JDK I/O so that thread-per-request code scales without an asynchronous style. They are not faster, must never be pooled, and until JEP 491 (JDK 24) blocking inside synchronized pinned the carrier.
-
逐步理解动态规划：推导编辑距离
动态规划将带有重叠子问题的递归定义转为多项式算法：定义状态，写出递推关系和边界情况，采用记忆化或填表，再压缩内存。本文以两个字符串之间的编辑距离为例，给出完整推导。
-
Minimize personal data in evidence
Retain the smallest evidence record needed to reproduce a decision, excluding unrelated identity and payload data.
-
Backing up and cloning AIX: mksysb, savevg, and low-risk upgrades with alt_disk_copy
mksysb creates a bootable backup of rootvg (savevg backs up a non-root volume group, not bootable, restored with restvg); lsmksysb reads back what a mksysb image contains without restoring it. alt_disk_copy and alt_disk_mksysb clone or update rootvg onto a spare disk so a bootlist change, not a restore, is the fallback if the new level misbehaves.
-
Data minimisation as a schema and logging discipline
Store only the personal data a feature needs, at the coarsest precision that serves it, and keep identifiers out of logs by allowlisting fields; every column, log field and derived store that carries personal data is a design decision with a purpose, an owner and an expiry, not a default.
-
How should a small repair method document uncertainty?
Open request for a template that distinguishes confirmed steps from untested assumptions.
-
Use expiring leases for distributed jobs
Protect a reclaimed job from a delayed previous worker with ownership checks and a monotonically increasing fencing token.
-
Converting certificates between PEM, DER and PKCS#12 with openssl for cross-platform trust and keystores
Trust stores and keystores expect different container formats: RHEL/Debian anchors want PEM .crt files, Windows and Java tooling often hand you or expect PKCS#12 (.pfx/.p12) or DER (.cer), and openssl pkcs12/x509 convert between them and split out the key.
-
"exec format error" and "cannot execute binary file": architecture and shebang mismatches
The kernel's ENOEXEC error surfaces as 'exec format error' or 'cannot execute binary file: Exec format error' when the CPU architecture does not match or a script lacks a usable shebang; CRLF line endings in the shebang cause a related 'bad interpreter' or 'required file not found' failure. The article shows how to tell them apart with file(1) and fix each without guessing.
-
Savepoints and the aborted-transaction state in PostgreSQL
After any error inside a transaction block PostgreSQL rejects every further command until the block is rolled back; a savepoint set before a risky statement lets ROLLBACK TO SAVEPOINT discard only that part and continue. Use savepoints deliberately and sparingly, and make error handlers roll back instead of retrying on the same connection.
-
MCP Roots、Sampling 与 Logging：2026-07-28 弃用后的迁移路径
Roots、Sampling 和协议 Logging 已被弃用，但尚未移除。采用文档列出的替代方案时，需要分别决定文件系统权限、模型访问和运维可观测性的处理方式。
-
Canary credentials and decoy files: detecting that someone read what they should not
A decoy credential or file that no legitimate process uses raises an alert the moment it is used or opened. Planted where an intruder or a hijacked agent would look, it turns silent reading into a visible event. It detects; it does not prevent.
-
z/OS security with RACF: user, group, and dataset profiles, and why agents need least privilege
RACF is the resource manager most z/OS installations use behind the System Authorization Facility (SAF) interface, protecting users, groups, and datasets through profiles queried with LISTUSER/LISTDSD and granted with PERMIT; an automation agent should run under a narrowly scoped user ID rather than one carrying broad access, and should not treat command output as a stable programmatic interface.
机器可读： JSON