全部文章
-
Python 子进程管道：在无限期等待之前排空两个流
避免等待因某个被捕获的输出管道已满而无法退出的子进程。
-
自行车轮胎气压与磨损日志：压力表读数和目视检查
一份定期、仅作观察的自行车轮胎日志：使用同一压力表并按其显示单位记录气压，逐字抄录胎侧印制的范围，保存带日期的目视笔记和标记位置的照片。bar、psi 与 kPa 之间按 NIST 系数换算；本文不提供充气、保养或安全建议。
-
Collations in PostgreSQL: libc, ICU and the builtin provider, and why a library upgrade can corrupt an index
A collation decides how text sorts and compares; PostgreSQL takes it from a provider (libc, ICU, or the builtin C and C.UTF-8 code-point orderings), fixes the default per database at creation, and allows overrides per column or expression. Language collations from libc or ICU change when the library changes, which invalidates B-tree indexes on text, so choose the provider deliberately and reindex after operating-system or ICU upgrades.
-
Exit codes as a contract between scripts and the agent that calls them
An agent that runs a script and moves on based on its exit code needs that code to mean what the shell's own conventions say it means: 0 for success, small positive numbers for the script's own defined failures, 126/127 for a command that could not be run at all, and 128+n for death by signal — and it needs pipefail or PIPESTATUS to see the real code through a pipeline.
-
What share of a small site's requests come from crawlers and automated agents, and which classification method held up over a year?
Open question: RFC 9309 has crawlers identify themselves by a product token in the robots.txt group they honour, but many automated clients do not declare themselves; for small sites with access logs, what share of requests came from declared crawlers, undeclared bots and language-model agents, how was that share measured, and did the method still work a year later?
-
Reading Linux memory pressure: free, swap, the OOM killer and OOMScoreAdjust
The 'available' column in free, not 'free', is the number that indicates real headroom, and a process killed under memory pressure leaves a record in the kernel log or journal, not a silent disappearance. This article explains what to read and how to bias which process the OOM killer picks.
-
Bootstrapping NTP, DNS and DHCP after a full network outage: a dependency-ordered restart
Proposed methodology: after an outage that took down NTP, DNS and DHCP together, bring time up first, then DNS, then DHCP, because certificate and Kerberos checks need correct time, most services locate each other by name, and DHCP may depend on both, with the caveat that an NTP server using upstream hostnames itself needs DNS.
-
Which pre-commit hooks survive a year in a team repository, and which get removed or routinely bypassed?
Open question: Git's pre-commit hook can be bypassed with --no-verify, so a local hook only helps while contributors keep it; which hook types (formatters, linters, secret scanners, test subsets) have stayed in use for a year or more in team repositories, which were removed or moved to CI, and how often were they bypassed?
-
在信任边界验证输入
在每项输入进入系统的位置进行验证：先检查语法（类型、长度、格式），再根据业务规则检查语义。优先使用允许列表，拒绝无效输入而不是清洗它，绝不要依赖客户端验证。
-
A decluttering inventory protocol: counting, photographing and recording decisions per zone
A proposed documentation protocol for clearing a defined zone at home: photograph it from a marked position, count items by class before and after, record one decision category per item or group with the date and the time spent, and re-count at 30 and 90 days so that what came back or arrived is visible; no advice on what to keep is given.
-
使用 Kickstart 文件构建无人值守的 RHEL 安装
Kickstart 文件以单行命令结合 %pre 和 %post 脚本片段，驱动 RHEL、Rocky Linux 或 AlmaLinux 安装，无需交互提示。本方法介绍使用前验证文件、启动时传入文件，以及如何避免把秘密放进通常无需认证即可获取的文件。
-
瑞士网络攻击报告与 CRA：运营者和产品制造商的不同义务
瑞士关键基础设施报告制度针对适用范围内运营者遭遇的、符合规定条件的网络攻击。CRA 则针对向欧盟市场供应产品的制造商，包括瑞士制造商；早期报告期限相近，并不意味着接收机构或报告触发条件可以互换。
-
Building conservative frustum and occlusion culling
Reduce invisible rendering work while accounting for bounding volumes, delayed query results, camera cuts, and the cost of visibility tests.
-
位操作基础：正确使用标志、掩码与移位
标志是二的幂，通过 OR 组合、AND 检查、AND NOT 清除；掩码和移位用于提取字段。陷阱包括运算符优先级、有符号右移、JavaScript 固定的 32 位转换，以及 Python 无界整数。应为每个标志命名，并为每次检查加括号。
-
Querying LDAP and Active Directory from Linux with ldapsearch without a password on the command line
ldapsearch supports a simple bind with a bound DN and password, or a SASL/GSSAPI bind using an existing Kerberos ticket, plus paged results and StartTLS/LDAPS for an encrypted connection. The -y and -W flags exist specifically so a password never has to appear as a plain command-line argument.
-
窗口函数：聚合而不合并行
窗口函数通过 OVER、PARTITION BY 和 ORDER BY，对与当前行相关的一组行计算一个值，同时保留每一条输入行。这样便能在一次处理中表达累计总计、排名、每组前 N 项以及与前一行的比较；窗口框架子句决定函数能看到哪些行。
-
Kernel panics and crash data on Linux: the previous boot's journal, pstore and netconsole
After a Linux kernel panic and reboot, journalctl -b -1 -k reads the previous boot's kernel messages if the journal persisted; pstore (for example ramoops, where configured) preserves a panic record across a reboot even when the journal did not; netconsole sends kernel messages to another machine over the network in real time. kdump captures a full memory dump and is covered elsewhere.
-
Naming, tagging and recording a new server: a methodology for hostnames and inventory
A server that is provisioned but never named consistently, tagged with its owner and purpose, and recorded in an inventory is effectively undocumented infrastructure the moment the person who built it moves on; this methodology sets the hostname on Linux and Windows and defines what a minimal inventory record must contain.
-
Pip's "error: externally-managed-environment" and PEP 668
Pip refuses a global 'pip install' with 'error: externally-managed-environment' when the distro has marked its system Python as managed under PEP 668. The article covers what the EXTERNALLY-MANAGED marker means, the venv/pipx/apt fixes in order, and why --break-system-packages is a last resort, not a default.
-
Git hooks for fast local checks
Client-side hooks such as pre-commit run formatters and quick linters before a commit exists; they save review time but must stay fast, must not be the only gate, and are not versioned by Git itself.
机器可读： JSON