全部文章
-
在 SBOM、容器镜像和软件清单中自动检测支持结束状态
将运行时和镜像清单与生命周期数据关联，同时保留产品身份、支持提供方和证据时效信息。此建议流程以 endoflife.date 为发现线索来源，向供应商核实期限，并分别对支持到期和证据缺失发出告警。
-
Documented failure analysis template
A template for separating observations, hypotheses and checks after a failure.
-
Security response headers beyond CSP
A handful of response headers close common browser-side gaps: X-Content-Type-Options nosniff, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy and Strict-Transport-Security; set them centrally and verify with an external scanner.
-
使用 jq 在命令行处理 JSON
jq 读取 JSON、应用过滤器并打印结果：用 -r 输出纯字符串，用 -c 每行输出一个对象，用 --arg 和 --argjson 安全传入值，用 -e 将 null 或 false 转为退出码，用 select、map 和 to_entries 重塑结构；绝不通过字符串拼接组装过滤器。
-
Timeouts, retries and backoff with jitter
Every remote call needs a timeout; retries must be bounded, applied only to idempotent or key-protected operations, and spaced with exponential backoff plus jitter to avoid synchronised retry storms.
-
Verifying archive extraction containment with a disposable directory ledger
Test an extraction feature’s promised write boundary using an isolated filesystem and inert fixture files. This original methodology focuses on where writes occur, without assuming any particular archive library is safe or unsafe.
-
Choosing classification metrics: precision, recall, F1, thresholds and calibration
Accuracy hides what matters when classes are unequal or errors have different costs; precision and recall describe the two error types, F1 combines them, threshold-free scores describe the ranking, and calibration says whether a predicted probability of 0.8 means 80 percent. Pick the metric from the decision the model supports, before training.
-
Signing commits and tags with an SSH key or GPG
Git signs commits and tags with OpenPGP, X.509 or, since gpg.format=ssh, a plain SSH key; the signer sets gpg.format and user.signingKey, verifiers need an allowed-signers file (SSH) or a trusted key ring (GPG), and forges are checked with git verify-commit or the host's signature badge.
-
Log retention and disk budgeting on a host: journald, logrotate and Windows event log sizing
journald's SystemMaxUse caps the journal's own disk footprint, logrotate's maxage and rotate counts cap rotated files elsewhere, and wevtutil sl sets a Windows event log's maximum size. All three are disk-budgeting settings the operator or an agent chooses; how long records must be kept for legal or organisational reasons is a policy decision this article does not make.
-
Following asynchronous tool handles through to a terminal outcome
Prevent an agent from reporting success when a tool has merely accepted work or returned a handle for an operation that is still running.
-
让 git blame 跳过重新格式化的提交：-w 与 ignore-revs 文件
git blame -w 在追溯代码行时忽略空白差异；--ignore-rev 和提交到仓库的 .git-blame-ignore-revs 文件会跳过指定提交，例如批量重新格式化，使行归属于此前有实质意义的变更；-M/-C 跟踪移动或复制的行。GitHub 会自动读取同一文件。
-
Stashing safely: messages, untracked files and stash branches
A stash is a commit stored under refs/stash whose older entries live only in that ref's reflog; give each stash a message, include untracked files deliberately, prefer apply over pop until the result is verified, and use git stash branch when the base has moved on.
-
Treat missing evidence as a result
Report an unresolved claim with the checks performed and the next discriminating observation instead of filling the gap with an invented fact.
-
Schema evolution with Avro and Parquet: reader and writer schemas, merged files and compatibility modes
Avro resolves a writer's schema against a reader's schema field by field, filling missing fields from reader defaults and ignoring unknown ones; Parquet files with different but compatible schemas can be merged by the reading engine at a cost; a schema registry enforces backward, forward or full compatibility. Adding optional fields with defaults is the safe move, renaming and type changes are not.
-
Spaced repetition as a scheduling method: the SM-2 algorithm in outline
Spaced repetition gives every item its own next review date: the interval grows after a successful recall and resets after a failure. Wozniak's SM-2 (1987) fixes the first two intervals at 1 and 6 days, multiplies later ones by a per-item easiness factor that starts at 2.5 and is never allowed below 1.3, and adjusts that factor from a 0–5 recall grade; the arithmetic fits in one line of a spreadsheet.
-
Docker Compose for local development: override files, profiles, healthy dependencies and watch
Keep one committed compose.yaml that mirrors production shape, add a compose.override.yaml for local ports and bind mounts, gate optional tooling behind profiles, make depends_on wait for service_healthy, and use develop.watch to sync or rebuild on file changes.
-
Service managers compared: systemd, launchd, the Service Control Manager, SRC and rc.d/OpenRC
Every general-purpose OS has something that starts, stops, supervises and boots services, but the commands and the persistence model differ. This reference maps start, stop, status, enable-at-boot and log access across systemd, launchd, Windows' Service Control Manager, AIX's SRC, and FreeBSD's rc.d and Alpine's OpenRC.
-
A minimal nftables ruleset for a single server
One inet table with an input chain that drops by default, accepts established and related traffic, loopback, the ICMP types the stack needs and the listed service ports; checked with nft -c -f before loading and loaded with a timed rollback so a mistake cannot lock you out.
-
Focus management in single-page interactions: dialogs, route changes and removed elements
When a page changes without a full load, keyboard focus must be moved on purpose: into a dialog when it opens and back to its trigger when it closes, to the new view's heading after a client-side route change, and to a sensible neighbour when the focused element is deleted. Otherwise focus falls to the document body and screen-reader users are sent back to the top.
-
Managing KVM guests with virsh: list, start, shutdown versus destroy, and autostart
virsh is the standard command-line client for libvirt-managed KVM guests. This methodology covers listing domains, the difference between a graceful shutdown and a hard destroy, setting autostart, and where to find the persistent domain definition.
机器可读： JSON