全部文章
-
Idempotent webhook handling: delivery IDs, provider retry schedules and responding fast
Every major webhook provider can deliver the same event more than once and expects the receiver to deduplicate using a provider-specific identifier — X-GitHub-Delivery, the Stripe event id, Slack's event_id with X-Slack-Retry-Num, or the Standard Webhooks webhook-id. Retry schedules differ sharply: GitHub does not auto-retry at all (manual or API redelivery reuses the delivery ID), Stripe retries for up to three days in live mode, and Slack retries three times within about six minutes.
-
How do maintainers of small projects actually spend their hours, and what shifted the split away from writing code?
Open question: the Open Source Guides observe that maintainers of widely used projects end up coding less and responding to issues more, and recommend documentation, saying no, sharing the load and automation as remedies; what is missing is measured time per activity for small projects, and evidence about which of those remedies changed the split.
-
用 Jev 为代码评审分配关注优先级，不让阻断项被平均掉
使用独立的评审维度安排人工关注的优先级，同时保留强制检查；加权分数绝不能凌驾于这些检查之上。
-
Decommissioning a server safely: removing it from every system that still trusts it
Decommissioning is not just powering a machine off: DNS, monitoring, backup jobs, the inventory record, and any directory computer object all keep trusting or expecting a server unless someone explicitly removes it, and the storage itself needs a sanitization method that actually matches the media type before reuse or disposal.
-
The ip command as a read-first diagnostic tool before touching network configuration
ip addr, ip route and ip neigh show the kernel's current network state directly, faster than any configuration file. The same command can also change that state at runtime, but a runtime change made with ip is not persisted anywhere and disappears on reboot or interface restart.
-
PAN-OS CVE-2026-0322：核实各维护版本线的修复并恢复管理平面
PAN-OS 防火墙和 Panorama 的管理接口存在需通过身份验证才能利用的漏洞。应核对完整的维护版本号，限制管理访问，并在怀疑遭入侵时采用厂商针对硬件或虚拟设备的恢复流程。
-
Navigation meshes, path corridors, and local avoidance
Keep route planning, clearance, local steering, and physical movement separate so agents can navigate narrow passages and react to changing obstacles coherently.
-
Monitoring a deployed model for drift: inputs, outputs and delayed labels
A model's offline score stops being true the moment the input distribution, the label distribution or the relationship between them changes; monitor feature and prediction distributions against a training reference, log served features to detect training-serving skew, and join delayed labels back to compute the real metric with a lag.
-
JSON number pitfalls: integers beyond 2^53, NaN and Infinity, and exact decimals
RFC 8259 leaves number precision to implementations and forbids NaN and Infinity; I-JSON (RFC 7493) recommends staying within IEEE 754 binary64 and encoding anything larger, such as 64-bit integers, as strings. Python's json module emits NaN by default and JavaScript's JSON.stringify turns it into null, so interoperable JSON needs explicit numeric contracts per field.
-
SMS pitfalls: GSM-7 versus UCS-2 encoding and message segments
An SMS carries 140 bytes: 160 GSM-7 characters or 70 UCS-2 characters. One character outside GSM-7 (a curly quote, an emoji) switches the whole message to UCS-2; longer messages are split into segments of 153 or 67 characters that providers typically bill separately. Count segments before sending and normalise punctuation.
-
Keeping lighting calculations linear while using sRGB textures
Trace colour values from texture storage through shading to display encoding, and distinguish colour maps from numerical data.
-
Measuring a room and drawing its floor plan to scale: raw-measurement sketch first, drawing second
A proposed protocol that separates measuring from drawing: a rough sketch receives every raw reading (walls at a stated height, diagonals, openings with their distances from the nearest corner), the instrument and its resolution are logged, closure differences between opposite walls are written down, and only then is the plan drawn at a stated scale on grid paper or in a drawing tool; no dimension is asserted as accurate beyond the recorded closure.
-
Running an SSH bastion host: ProxyJump on the client, and restricting what the jump host may forward
A bastion host should relay ProxyJump connections to internal hosts without acting as a general TCP relay. This methodology sets ProxyJump on the client, restricts AllowTcpForwarding and PermitOpen on the bastion, and scopes exceptions with a Match block instead of a global allowance.
-
Redact secrets before writing logs
Log an allowlisted diagnostic record rather than raw tool requests, and verify redaction at every output sink.
-
NAT：地址转换的工作方式与入站连接失败的原因
NAT 重写出站数据包的源地址和端口，并保留映射，使回复能够路由回来；未经请求的入站数据包则没有机制将其路由到私有主机。映射会因空闲而过期，打洞只适用于某些 NAT 行为，而运营商级 NAT 又增加了一层用户无法配置的转换。
-
prefers-reduced-motion: which animation to reduce and how
The prefers-reduced-motion media feature reports whether the user has asked the operating system for less motion; its values are no-preference and reduce. Honour it by replacing large movement (parallax, zooms, slides, autoplaying motion) with fades or instant changes, while keeping small state transitions that carry meaning, and apply the same rule to script-driven animation.
-
使用 Deprecation 和 Sunset 头弃用 API 端点
直接在响应中宣布生命周期结束：Deprecation 头（RFC 9745）将资源标记为已弃用，Sunset 头（RFC 8594）说明何时停止工作，指向文档的 Link 则解释替代方案；同时记录仍在调用的客户端。
-
Do generic login and reset messages measurably reduce account takeover, given that breach corpora already reveal which addresses exist?
Open question: guidance asks for indistinguishable responses for existing and non-existing accounts, at a real usability cost; has any service measured whether credential-stuffing or targeted phishing against it fell after closing enumeration, when attackers already hold email lists from breaches of other sites?
-
Logs, Metriken und Traces: welches Signal welche Frage beantwortet
Metriken sagen, dass seit 14:02 etwas schiefgeht, Traces zeigen, in welchem Aufruf welcher Anfrage die Zeit verloren geht, Logs liefern den Fehlertext eines Einzelfalls. OpenTelemetry definiert alle drei Signale samt Trace-Kennung im Logdatensatz, damit sie sich verbinden lassen; wer die Frage zuerst wählt, sammelt weniger und findet mehr.
-
CMake 交叉编译探测：区分编译、链接和运行
确定每项探测必须由哪台机器编译、链接或执行，以诊断工具链检查。
机器可读： JSON