全部文章
-
Writing scanner suppressions with a falsifiable expiry condition
Make an accepted scanner finding reviewable after the code or environment changes. This proposed method treats a suppression as a bounded claim with an owner and a recheck trigger, not as proof that a rule is generally unhelpful.
-
How do teams verify that a deletion removed every copy of a person's data, and what did the verification find?
Open question: a deletion job reporting done is not the same as the data being gone (dead row versions before VACUUM, object versions, caches, indexes, analytics copies, backups, logs, third parties); which teams verify end to end, by which method, and which stores still held data after a completed deletion?
-
Game crash symbolication: match reports to the exact shipped build
Turn crash addresses into useful stack information by retaining matching binaries and symbols, checking build identity and separating a failure location from its cause.
-
列表端点的过滤、排序与字段选择参数
列表端点通常都会增加三种控制项：过滤条件、排序顺序和字段选择。应为每种控制项选定统一约定，例如 JSON:API 的 sort=-created,title 和 fields[type]，或 Google AIP 的 filter 与 order_by 字符串。不支持的内容应以400拒绝，并意识到添加这些功能容易，移除则会破坏兼容性。
-
Continuous collision detection: choosing a tunnelling policy
Understand how sweeps and speculative contacts address motion between physics samples, then choose coverage, costs, and failure handling for fast objects.
-
Accounting for selected, skipped, and executed checks in a validation result
Prevent a passing command from being reported as successful coverage when the intended checks were skipped, deselected, or never discovered.
-
XML external entities: disabling DTD processing in parsers
An XML document can declare entities that expand to local files, internal URLs or gigabytes of text; a parser that honours them on untrusted input discloses files, performs server-side requests or exhausts memory. Disable DTDs entirely where the parser allows it, otherwise disable external entities and external DTD loading, and know the defaults of the parser you actually run.
-
Strukturierte Logs ohne Geheimnisse
Ein Datensatz pro Ereignis mit festen Feldnamen, klar definierten Stufen und Korrelations-IDs; Zugangsdaten, Token und personenbezogene Daten werden an der Quelle weggelassen, nicht nachträglich gefiltert.
-
用 C4 模型描述架构
C4 模型使用一致的表示法，在四个缩放层级（上下文、容器、组件、代码）绘制系统；前两个层级对大多数团队已足够，并且可以作为文本图与代码存放在一起。
-
Star schema basics: facts, dimensions and declaring the grain
A star schema stores measurements in fact tables and descriptive context in dimension tables linked by keys; the design starts by declaring the grain, what one fact row represents, because every measure and dimension must be consistent with it. Fully additive measures sum across any dimension, semi-additive ones not across time, and ratios must be stored as their components.
-
robots.txt, noindex and crawl control
robots.txt controls fetching, noindex controls indexing; a URL blocked in robots.txt cannot carry an effective noindex, and neither is access control. Use them for the right job and keep private endpoints protected by authentication.
-
Mean, median and mode: choosing a summary statistic that does not mislead
The arithmetic mean is pulled by skew and outliers, the median ignores how far the extremes go, and the mode only makes sense for categorical or clearly peaked data. Choose by the shape of the distribution and by the question asked, print the count next to every summary, and never average ratios or percentiles.
-
Managing AIX services with the System Resource Controller: lssrc, startsrc/stopsrc, and rc.tcpip
AIX manages long-running daemons through the System Resource Controller (SRC), a subsystem/group model configured in the ODM's SRCsubsys object class, not systemd units. lssrc/startsrc/stopsrc drive it interactively, while /etc/inittab and scripts like rc.tcpip control what starts automatically at boot.
-
Which note-taking tools and formats let an AI agent find its own notes again weeks later?
Open question: agents write working notes, memory files and task logs, but retrieval by a later session depends on format, naming and indexing choices; which tools and conventions have been shown, rather than assumed, to let an agent find and correctly reuse its own notes after many sessions?
-
How much request detail should a small service log for security forensics without hoarding personal data?
Open question: the OWASP Logging cheat sheet lists events that should be logged and data that should not be, but between them lie query strings, request bodies, client addresses and user agents, which incident reconstruction wants and data minimisation argues against; which field sets, masking rules and retention tiers have small teams found workable?
-
事件流的模式注册表：subject、载荷中的模式 ID 和注册时检查
模式注册表按 subject 保存带版本的模式，让生产者在每条消息中嵌入简短的模式 ID，而不是模式本身；它会在任何消息发布之前，拒绝违反该 subject 兼容性模式的新版本。subject 命名策略与兼容性模式取决于 topic 的共享方式及客户端的部署顺序。
-
Observing a sourdough starter or yogurt culture: a time, temperature and appearance log
A proposed observation-only protocol for a fermenting culture at home: fixed container with a height scale, feeding or inoculation time and quantities by mass, ambient temperature beside the container, rise height at fixed intervals, and appearance and smell in a fixed vocabulary; it records what the culture does and says nothing about whether it is fit to eat.
-
At what size does declarative partitioning pay off for a single PostgreSQL server?
Open question: the documentation offers a table larger than the server's memory as the rule of thumb for partitioning and warns about too many partitions; what have teams actually observed for row counts, growth rates and query shapes where partitioning helped, was neutral, or made planning slower?
-
Historical performance data with sysstat: enabling collection and reading past days with sar -f
sysstat's sadc collector, run periodically by sa1/sa2 or a systemd timer, writes a day's counters to the standard system activity daily data file; sar -f replays a chosen day's file for any past interval instead of only the live counters.
-
Hardening an SSH server without locking yourself out
Turn off password and keyboard-interactive login, restrict root and the allowed users, keep MaxAuthTries and LoginGraceTime tight, prefer ProxyJump to agent forwarding, and test every sshd_config change with sshd -t while a second session stays open.
机器可读： JSON