全部文章
-
用范围和明确的置信程度估算工作
用范围给出估算（最佳情况、预期情况、最坏情况），并说明实际值落在该范围内的置信程度；范围宽度应依据以往可比工作的实际结果，而不是当前计划，并在固定节点修订。单一数字会掩盖决策所依赖的不确定性。
-
用于本地开发的模拟服务器：像真实依赖一样响应的替身
模拟服务器代替不想在本地运行的依赖响应 HTTP 请求，使用按请求匹配并返回预设响应的桩。桩应通过生成或录制获得，而不是手写；应包含失败场景，并记住模拟本身无法为真实集成提供任何证明。
-
配置 unattended-upgrades，在 Debian 和 Ubuntu 上自动安装安全补丁
unattended-upgrades 通过定时器应用软件包更新，使用两个文件：20auto-upgrades（是否更新及频率）和 50unattended-upgrades（使用哪些来源及是否重启）。在生产环境启用之前用 --dry-run --debug 测试，可避免意外重启或只完成一半的升级。
-
用 git worktree 并行工作，避免反复 stash 与切换
git worktree add 创建连接到同一仓库的第二个工作目录，让紧急修复、评审或代理任务在各自分支中进行，而不干扰当前检出。一条分支同一时间只能在一个工作树中检出；移除工作树应使用 git worktree remove，而不是 rm。
-
Smaller change sets are reviewed faster and with fewer defects
A testable hypothesis: keeping change sets small (roughly under a few hundred changed lines) shortens review time and reduces defects that escape review, with a proposed measurement.
-
Scanning a Linux host against a baseline with OpenSCAP
oscap xccdf eval runs a SCAP Security Guide profile against a live host or an offline image and writes a human-readable report; reviewing the generated remediation script before running it is what keeps an automated scan from becoming an automated outage.
-
Use a token bucket for tool calls
Implement bounded bursts with an explicit token refill equation, atomic consumption and a separate limit on in-flight requests.
-
macOS startup options for administrators: Recovery, Startup Security Utility and Disk Utility First Aid
macOS Recovery (reached differently on Apple silicon and Intel Macs), the Startup Security Utility, Safe Mode and Disk Utility's First Aid together cover most non-destructive recovery on a Mac an administrator physically controls; System Integrity Protection limits what even an administrator process can change outside these paths.
-
Deduplication strategies for records: exact rows, keep-latest by key and bounded windows
Decide first what counts as a duplicate: identical rows, several versions of one key, or messages redelivered within a window. Exact duplicates fall to DISTINCT; versions need a keep-latest rule with an explicit ordering; redelivery is deduplicated on an idempotency key within a bounded time or state window, as message queues and stream engines do.
-
HTTP 负载均衡器后的 MCP 2026-07-28：路由与安全的缓存范围
请求头让路由无需解析 JSON，MCP 缓存提示则规定哪些结果可缓存。仍需验证请求头、隔离授权上下文，并使用理解 MCP 的缓存；通用的 POST 响应缓存不能替代这些机制。
-
Layout-matching skeleton screens beat spinners on perceived wait only for short loads
Hypothesis: a skeleton placeholder that reproduces the final layout is judged faster than a centred spinner when the content arrives within a few seconds, because the layout is stable and the eye has somewhere to go; for longer waits the advantage disappears or reverses, because a skeleton gives no sign of progress and no reassurance that anything is happening.
-
为文档和文件命名，让它们便于排序、搜索和长期使用
文件命名约定确定名称的组成部分及顺序、一个分隔符、可移植字符集、可按文本排序的 ISO 风格日期、补前导零的序号和明确版本；每个文件夹记录一次，并且绝不依赖字母大小写或空格。
-
OAuth 2.0 authorization code flow with PKCE for public clients
A public client (single-page app, native or CLI app) cannot keep a client secret, so it binds each authorization request to a one-off code verifier: it sends the SHA-256 hash as code_challenge, and the token endpoint releases tokens only to whoever presents the matching verifier. RFC 9700 makes PKCE mandatory for public clients and advises against the implicit grant.
-
标识列、序列，以及自动生成的 ID 为何会有缺号
标识列是 PostgreSQL 为数据行自动编号的标准方式。编号来自在事务控制之外分配值的序列，因此回滚、崩溃、缓存以及 ON CONFLICT 插入都会留下缺号。缺号是正常现象；连续无缺号的编号需要独立且串行化的计数器。
-
When do documentation teams delete a page instead of updating it, and what happened to its readers and links afterwards?
Open question: outdated pages are usually rewritten, rarely removed; MDN describes the 410 Gone status as signalling that a resource is no longer available and that the condition is likely permanent, yet most deleted pages become redirects or 404s; which deletion criteria have teams used, and what did traffic, search results and inbound links do afterwards?
-
设计可供智能体安全使用的 MCP 工具
Model Context Protocol 工具应具有明确而单一的用途、带类型的输入输出模式、如只读或破坏性操作等真实注解、有界结果，以及说明原因的错误信息。描述应保存在代码中，而不是用户可编辑的内容里。
-
A street lamp census on a fixed walking route: numbered lamps, lit or unlit per pass, and the walk's timing on the same row
A proposed record-only protocol for a repeated evening walk on a fixed route on which every street lamp is identified once, by the number on its pole where present (which the OpenStreetMap wiki documents as the ref tag on highway=street_lamp nodes) or by a sketch position, and recorded per pass as lit, unlit, flickering, obscured or not assessed, with the pass time, the sky condition and the walk's duration; no safety or lighting-quality judgement is made.
-
"version `GLIBC_2.xx' not found" and how to diagnose a glibc mismatch
A dynamically linked binary that references a newer glibc symbol version than the runtime provides fails to load with 'version `GLIBC_2.xx' not found'. The article shows how to read the mismatch with ldd, objdump and readelf, and orders the fixes from matching the base image to static or musl builds.
-
Rollout-Strategien: rollierend, Blue-Green und Canary
Ein rollierender Rollout tauscht Instanzen schrittweise innerhalb der Grenzen maxSurge und maxUnavailable; Blue-Green betreibt den neuen Stack vollständig neben dem alten und schaltet den Verkehr auf einmal um; Canary gibt einem kleinen Anteil echter Anfragen die neue Version und erhöht ihn nach Messwerten. Die Wahl hängt von freier Kapazität, gewünschter Rückschaltzeit und davon ab, ob zwei Versionen gleichzeitig laufen dürfen.
-
ThreadSanitizer 分诊：找回缺失的同步契约
阅读两条冲突的访问路径，修复将它们联系起来的所有权或同步规则。
机器可读： JSON