全部文章
-
SSH known_hosts and host key verification for automation: ssh-keyscan plus an out-of-band check
Automation that connects over SSH still needs to verify the server's host key; ssh-keyscan alone only harvests a key without proving it is genuine. StrictHostKeyChecking=accept-new, HashKnownHosts and SSHFP records each address a different part of doing this safely without an interactive prompt.
-
Checking configuration profiles and MDM enrollment status from Terminal with profiles
profiles lists installed configuration profiles and reports MDM enrollment status; some settings, such as bootstrap token escrow or enforced update deferral, can only be set by a device management service in the first place, not from a local Terminal session.
-
ssh and scp exit codes: 255 is ssh's own failure, anything else is the remote command's
ssh passes through the exit status of the remote command it ran, reserving 255 for a failure of ssh itself (connection refused, authentication failure, host key mismatch) and for a remote command killed by a signal. scp documents only a plain 0-success/nonzero-failure split, so distinguishing local transport trouble from a remote error requires ssh's stderr text, not scp's own code.
-
Exporting host metrics with Prometheus node_exporter: collectors, the textfile collector, and firewalling the port
node_exporter turns kernel and OS-level counters into Prometheus metrics on port 9100, with most collectors enabled by default and a Textfile Collector for feeding in numbers a script computed. Run it as an unprivileged systemd service and restrict the port to Prometheus's address, since /metrics is unauthenticated by default.
-
Handling class imbalance: metrics first, then weights, thresholds and resampling inside the pipeline
When one class is rare, accuracy is uninformative and a model can ignore the minority entirely; fix evaluation first (stratified splits, per-class metrics, balanced accuracy), then use class weights or a tuned threshold, and apply resampling such as SMOTE only to the training fold inside the cross-validated pipeline.
-
gRPC 基础：protobuf 契约、流式调用与适用场景
gRPC 调用 .proto 文件定义的方法，以 Protocol Buffers 作为接口定义和传输格式；它在 HTTP/2 上提供一元与流式调用、截止期限、元数据和固定状态码集合。适合服务间通信和移动后端；浏览器需要 gRPC-Web，公开集成方则通常期望 HTTP 上的 JSON。
-
后量子签名与公开受信任的 TLS 证书：分别检查就绪情况
ML-DSA 和 SLH-DSA 已成为标准化签名算法，但公开受信任的 TLS 证书能否签发，还取决于证书配置规范、协议集成和信任策略是否接受。
-
Zero-downtime schema changes with expand and contract
Change a schema in three deployable steps: expand (add the new column or table, keep the old), migrate (dual-write and backfill in batches), contract (remove the old after all code uses the new); avoid long locks by not rewriting tables in one statement.
-
Triaging a full Linux disk: df, du, deleted-but-open files and the journal
A full filesystem can be full on space or on inodes, and space held by a deleted-but-still-open file will not show up in du. This methodology walks the checks in order — df -h, df -i, du -x, lsof +L1, and journald vacuuming — before anything is deleted.
-
MCP 2026-07-28：无状态核心及其兼容性边界
7 月修订版移除了初始化握手和传输会话，引入请求自身的元数据和多轮往返交互，并正式规定了扩展与弃用机制。服务器必须实现发现功能，但客户端可以选择是否调用。
-
At what point do teams replace a PostgreSQL queue table with a message broker, and what triggered the move?
Open question: the PostgreSQL documentation sanctions SKIP LOCKED for multiple consumers on a queue-like table, and design walk-throughs recommend starting there; which triggers (queue age, lock contention, table bloat, fan-out needs, operational load) have actually caused a switch to a broker, at what volumes, and how many systems never switched?
-
Installing macOS updates unattended from the command line with softwareupdate
softwareupdate lists, installs and restarts for updates without the graphical System Settings pane, but --fetch-full-installer needs volume-owner authentication on Apple silicon and a managed deferral policy can hide updates from --list entirely. This methodology covers both.
-
Qualifying a negative repository search before declaring code absent
Audit the scope of a search that returned no matches before concluding that a symbol, configuration, or behavior does not exist in the project.
-
Collision broad phase and narrow phase: candidates versus contacts
Build a collision pipeline that distinguishes conservative spatial candidates from geometric contacts, with clear filtering, ownership, and profiling boundaries.
-
Mass versus volume in cooking: which cup is meant, and how to record the conversion actually used
A cup, tablespoon or teaspoon is a volume whose definition differs between the US customary units listed by NIST and the rounded values used on US nutrition labels, and the mass it holds depends on the ingredient and how it was filled; a household that converts between mass and volume records the definition it used and its own weighed values so that a recipe can be reproduced.
-
为每个工作项编写可转化为测试的验收标准
将每个工作项的验收标准写成包含初始状态、动作和可观察结果的具体示例，采用 Gherkin 的 Given/When/Then 或等价结构，并列明边界情况。若除作者外的人无法执行或核验，就算不上验收标准。
-
编译数据库：修改头文件前，先复现失败的翻译单元
使用真实编译命令和工作目录，区分源代码缺陷与编辑器配置错误。
-
Deprecating a function in a library: warn, document the replacement, remove on schedule
A library deprecation has four parts: a replacement that exists first, a runtime warning plus a documentation note naming the version and the replacement, a changelog entry, and a removal release fixed in advance by policy. PEP 387 requires a deprecation period of at least two years under Python's annual cadence and describes a documentation-only soft deprecation; Django removes shims no earlier than two feature releases after the warning.
-
Latency percentiles: why the average describes no real request
Latency distributions are skewed, so the mean sits between a fast majority and a slow tail and matches no actual request; p50, p99 and the maximum describe what users meet. Record histograms rather than pre-computed quantiles so percentiles can be aggregated across instances and recomputed for any window.
-
加固 GitHub Actions 工作流：按 SHA 固定操作、最小权限令牌和不可信输入
将第三方操作固定到完整提交 SHA，默认将 GITHUB_TOKEN 设为只读，并按作业扩大权限；绝不把不可信事件字段插入 run 脚本，并将 pull_request_target 和 workflow_run 视为特权触发器。
机器可读： JSON