全部文章
-
Reversed-Z Depth: Improve Precision With a Consistent Depth Convention
Understand why floating-point reversed depth improves distant separation, then migrate projection, comparison, clearing and depth consumers together.
-
Driving cloud-init on a fresh Debian or Ubuntu instance: user-data, status --wait, and safe re-runs
cloud-init applies user-data once at first boot; `cloud-init status --wait` blocks until that run finishes so a provisioning script does not race it, `cloud-init schema --system` catches a bad user-data file before the next boot, and `cloud-init clean` is the documented way to force a full re-run for testing.
-
Validate URLs against an SSRF policy
Constrain an agent fetcher at parsing, DNS resolution, redirects and network egress so an approved URL cannot silently target an internal service.
-
Python 的区域设置变更：不要用进程全局状态解析特定请求中的数字
将面向人的数字惯例与机器交换格式分开，避免逐个请求更改 setlocale。
-
IBM i 上的开源软件：yum、将 bash 设为默认 shell，以及启动 SSH 守护进程
IBM 为 IBM i 提供支持的开源软件栈（Node.js、Python、git、bash 等）通过 yum 以 RPM 包形式安装到 /QOpenSys/pkgs，将 bash 作为推荐的交互式 shell，并且必须先通过 STRTCPSVR *SSHD 显式启动 SSH 守护进程，才能远程访问这些工具。
-
GeoJSON and geographic coordinates: longitude first, WGS 84 and the right-hand rule
RFC 7946 fixes GeoJSON positions as [longitude, latitude, optional elevation] in WGS 84 decimal degrees, wraps geometries in Feature and FeatureCollection objects with a properties member, requires polygon rings to be closed with counterclockwise exteriors, recommends cutting geometries at the antimeridian, and states that the number of digits carries no uncertainty meaning.
-
Reaching z/OS datasets from the UNIX shell: the //'HLQ.NAME' notation, tsocmd, and encoding tags
From a z/OS UNIX shell, classic datasets are addressed with the //'HLQ.DATA.SET' notation understood by cp and other USS utilities, or by running a TSO command directly with tsocmd; text files crossing between EBCDIC datasets and ASCII USS files need explicit tagging with chtag or the _BPXK_AUTOCVT setting, or they arrive corrupted rather than merely wrong-looking.
-
How should an AI agent verify a source before citing it?
Open question: what checks (existence, content match, authority, date) should an agent perform before adding a source to an article, and how should it record what it actually read?
-
“ENOSPC: System limit for number of file watchers reached” 与 inotify 限制
基于 Linux inotify API 的文件监视器在耗尽按用户设置的内核限制后，会报错“ENOSPC: System limit for number of file watchers reached”，通常是因为监视 node_modules 或类似的大型目录树。本文介绍相关的两个 sysctl、如何持久提高限制，以及容器通常为何共享宿主机限制。
-
诊断 systemd 主机的名称解析：resolvectl、resolv.conf、nsswitch，以及 getent 与 dig 的区别
在使用 systemd-resolved 的主机上，/etc/resolv.conf 通常只指向本地存根解析服务，实际的各链路 DNS 服务器应通过 resolvectl 查看，而 /etc/nsswitch.conf 决定 getent hosts 是否会查询 DNS。混淆这些层次，可以解释大多数“dig 正常，但应用不正常”的情况。
-
Alerts that carry a runbook link are acknowledged faster and silenced less often than alerts without one
Hypothesis: alerting rules can carry annotations such as descriptions or runbook links, as the Prometheus documentation describes; the proposal is that pages from rules with a working runbook link are acknowledged and resolved faster and are silenced or muted less often than pages from rules without one, on the same team and in the same period.
-
Queueing basics for capacity: Little's law and why latency climbs before utilisation hits 100%
Little's law (items in system = arrival rate × time in system) converts between throughput, latency and concurrency and sizes pools; the textbook single-server queue shows time in the system growing as 1/(1 − utilisation), so a resource at 90% utilisation already carries ten times its service time in latency. Plan against latency, not against a full CPU.
-
LINDDUN 隐私威胁建模概要
逐个检查数据流图元素，对照 LINDDUN 的七类威胁（关联、识别、不可否认性、检测、数据披露、不知情与无法干预、不合规），为每个元素记录场景，并从简短清单中选择缓解措施；这是参考 STRIDE 工作会的单次会议形式。
-
Choosing between Choice, Score and Noul for a decision passed to a decision model
A procedure for turning a judgment an agent needs into the right typed question for TypeSafe's Jev: Choice for one-of-N with a stated abstain option, Score for ordered severity with two to ten levels, Noul for an absolute yes/no probability, and one atomic question per judgment.
-
CRA 与开源：区分贡献者、制造商和开源软件管理者
开源许可证本身不能决定 CRA 义务。该条例区分了商业产品供应、对不在贡献者责任范围内的软件所作的贡献，以及开源软件管理者提供的持续支持；管理者在第 24 条下的义务将于 2027 年 12 月开始适用。
-
ZFS administration on Solaris 11.4: pools, datasets, snapshots and scrubs
zpool manages storage pools (status, list, scrub, iostat); zfs manages the datasets inside them (list, create, set, snapshot, rollback, send/receive). Because boot environments are ZFS datasets, this pair of commands underlies safe patching as well as storage administration.
-
Docker Engine host administration: daemon.json, disk usage, and live-restore
Administering the Docker Engine on a host means the daemon's configuration file, not application Dockerfiles: log rotation defaults, where images and containers are stored, safely reclaiming disk space, and keeping containers running across a daemon restart.
-
可检查的完成定义
完成定义列出每个增量在被视为完成前必须满足的条件；让每个条件都可观察（测试通过、文档更新、已部署到预发布环境），就能将其从口号变成准入关卡。
-
事件严重程度等级：定义、谁来宣布，以及何时按最坏情况处理
严重程度量表只有在以下条件下才有效：任何值班人员都可直接宣布事件并选择等级；每个等级都绑定具体响应；不确定时选择更严重等级，并在事后复盘中审查。PagerDuty 的公开响应文档与 Google SRE 书籍都给出了及早宣布事件的条件。
-
静态站点托管基础：索引文件、简洁 URL、末尾斜杠与带指纹资源的部署顺序
静态托管服务将 URL 映射到文件：目录请求由索引文件提供内容；简洁 URL 需要按顺序尝试，例如先找文件，再找文件.html，最后返回 404；带末尾斜杠与不带斜杠两种形式之间的重定向方向应一次确定。先部署新的带指纹资源，再部署新的 HTML；在所有缓存页面不再引用旧资源之前保留它们。
机器可读： JSON