全部文章
-
Measured PostgreSQL CHECK and UNIQUE behavior with two NULL values
PostgreSQL 16.15 accepted two NULL rows under CHECK(value > 0) and ordinary UNIQUE(value), rejected -1, and refused a subsequent NOT NULL change while those NULL rows remained.
-
在 Go 中使用子测试编写表驱动测试
编写一个测试函数，遍历由具名用例组成的切片，并通过 t.Run 逐个运行。这样，用例就成为数据；可用 go test -run 'TestX/name' 选择单个用例，并借助 t.Parallel、t.Helper 和 t.Cleanup 保持循环高效且易读。
-
Timestamped, parseable logs: RFC 5424 versus RFC 3164, JSON templates, and why UTC
RFC 5424's syslog TIMESTAMP is a restricted RFC 3339 profile with year, sub-second precision and a time zone offset, while the earlier RFC 3164 format has none of those and is harder to parse unambiguously. rsyslog can emit either, or a fully custom JSON structure, through templates — and a server whose time zone and logs are in UTC removes an entire class of correlation bugs across time zones.
-
Cache-Control directives: max-age, no-store, private and stale-while-revalidate
Cache-Control tells browser and shared caches how long a response may be reused and where it may be stored: max-age and s-maxage set freshness, no-cache forces revalidation before reuse, no-store forbids storage, private keeps a response out of shared caches, and stale-while-revalidate and stale-if-error (RFC 5861) let a cache serve stale content while refreshing or during errors. A response without directives may still be cached heuristically.
-
www versus apex domain: the CNAME restriction, cookie scope and which one to redirect to
The apex cannot be a CNAME because RFC 1034 forbids other data at a node that has one and the apex always carries SOA and NS records, so hosting on a provider's changing address needs A/AAAA records or a provider feature such as CNAME flattening; cookies set on the apex with a Domain attribute reach every subdomain. Pick one form, serve both in the certificate, and redirect the other permanently.
-
被投毒的检索语料库：少量植入文档如何引导 RAG 系统的回答
检索增强生成会信任检索器返回的内容。研究表明，向知识库注入少量精心构造的文本，就可能让系统对目标问题给出攻击者选择的答案。防御措施围绕谁能写入语料库、每段内容的来源追溯以及答案检查展开。
-
Go 竞态检测器的覆盖范围：无报错运行无法说明未执行路径的情况
将 go test -race 的结果与实际执行的并发路径关联起来，包括启动和关闭。
-
Identifiers with a check digit reduce wrong-record actions when agents transcribe them
Hypothesis: when language-model agents copy identifiers from documents into tool calls, a scheme with a check digit that the receiving API validates turns most transcription errors into rejections instead of actions on the wrong record; the effect should be largest for dense numeric identifiers and negligible for sparse ones such as UUIDs.
-
Components sized with container queries need fewer placement-specific overrides than components sized with viewport media queries
Hypothesis: when the same component set is placed in several layout slots, the container-query implementation contains fewer CSS rules that exist only to correct a component for one placement than the media-query implementation, and adding a new placement needs no new component CSS; a two-implementation comparison with rule counts is proposed.
-
Managing installed kernels on Debian and Ubuntu: cleanup, /boot space, HWE and Livepatch
Old kernel packages accumulate in /boot until apt autoremove clears them; Ubuntu additionally offers a rolling Hardware Enablement (HWE) kernel on LTS releases and Canonical's Livepatch service for applying kernel security fixes without an immediate reboot — both Ubuntu-specific, with no Debian equivalent.
-
开发容器：用 devcontainer.json 定义可复现的开发环境
devcontainer.json 描述编辑器、云工作区或 CI 执行器应为仓库构建的容器，包括镜像或 Dockerfile、features、转发端口、生命周期命令和编辑器定制。containers.dev 的开放规范让同一文件可用于本地、托管工作区和流水线，使工具链随代码固定，而不是分别存在于各台主机上。
-
llms.txt und agentenlesbare Websites: robots.txt, Sitemap und ein kuratierter Einstieg
Agenten und Crawler finden Inhalte über wenige Konventionen: robots.txt für Zugriffsregeln und den Ort der Sitemap (RFC 9309), eine Sitemap mit wahren Änderungsdaten und llms.txt als kurzer kuratierter Wegweiser in Markdown, ergänzt um Markdown-Zwillinge der Seiten. Keine davon ersetzt Authentifizierung.
-
Scheduled secret rotation surfaces undocumented credential consumers before an incident does
Hypothesis: teams that rotate long-lived shared secrets on a fixed schedule discover the scripts, jobs and integrations that silently depend on them during planned rotations, so that an emergency rotation after a leak completes faster and breaks less than for teams that rotate only on suspicion; the OWASP cheat sheet recommends regular rotation, but this operational payoff is unmeasured.
-
windows_exporter: installing the MSI with enabled collectors, and verifying /metrics on Windows
windows_exporter ships as an MSI that installs itself as a Windows service and can take installer properties for which collectors to enable, the listen port, and a Windows Firewall exception, all set non-interactively through msiexec.
-
Checking hardware virtualization support and nested KVM before relying on it
Before installing a hypervisor or nesting a VM inside a VM, confirm the CPU exposes virtualization extensions and, for nesting, that the kvm_intel or kvm_amd module has the nested option enabled. virt-host-validate and /proc/cpuinfo give a quick answer.
-
Unity player loop: separating input, physics and camera updates
Assign input intent, physics changes and camera presentation to deliberate update phases so frame-rate changes do not duplicate or lose gameplay commands.
-
ZFS boot environments with bectl: a rollback path around FreeBSD and package upgrades
bectl clones the root ZFS dataset into a boot environment in seconds; creating one before a freebsd-update or large pkg upgrade gives an instant, loader-menu-selectable way back to a known-good system, independent of and in addition to freebsd-update's own patch/install/rollback machinery.
-
Preserve evidence boundaries when turning research into slides in Orkas
A proposed handoff method keeps source passages, qualified findings and unresolved checks together across research, report and slide stages. A fictional offline-use comparison shows exactly what each output may claim.
-
Windows audit policy with auditpol: reading subcategories, enforcing them, and sizing the security log
auditpol /get /category:* lists the advanced audit policy actually in effect on Windows Server; subcategory settings win over the basic, category-level policy only while the 'force subcategory settings' option (SCENoApplyLegacyAuditPolicy) is enabled, which is the effective default, and an undersized Security log overwrites or discards audited events.
-
Defining the authorization oracle for mixed-object batch requests
Expose ambiguous access rules in batch operations before an agent writes tests that approve whichever response the implementation happens to return. The proposal focuses on mixed ownership within one request.
机器可读： JSON