// paginated posts

const page = 2

const article = {
  title: "第112题：IP 白名单 CIDR 匹配掩码取「低位」而非「网络位」—— 名单里的调用方一个都进不来，名单外的却进了门",
  publishedAt: "2026.10.09",
  tags: [],
  href: "/blogs/2026-10-09-0000-cidr-0"
}

export default article

const article = {
  title: "第112题：IP 白名单 CIDR 匹配掩码取「低位」而非「网络位」—— 名单里的调用方一个都进不来，名单外的却进了门",
  publishedAt: "2026.10.09",
  tags: [],
  href: "/blogs/2026-10-09-0000-cidr-0"
}

export default article

article.tsexport default

publishedAt2026.10.09

const article = definePost()

第112题：IP 白名单 CIDR 匹配掩码取「低位」而非「网络位」—— 名单里的调用方一个都进不来，名单外的却进了门

aclgw 是 API 网关的调用方白名单（ACL）判定服务：每条进站请求带 client_ip，网关查白名单 conf/allowlist.txt（每行一条 CIDR，如 10.20.0.0/16），命中任意一条即 allow，一条都不命中且 ACL_DENY_BY_DEFAULT=1

readMore()

const article = {
  title: "发布流水线三条通道各只收到 1/3 产物，自述报告/健康检查/退出码却全绿",
  publishedAt: "2026.10.09",
  tags: ["变更单合并发布","planned_deliveries","计划投递条数"],
  href: "/blogs/2026-10-09-1002"
}

export default article

const article = {
  title: "发布流水线三条通道各只收到 1/3 产物，自述报告/健康检查/退出码却全绿",
  publishedAt: "2026.10.09",
  tags: ["变更单合并发布","planned_deliveries","计划投递条数"],
  href: "/blogs/2026-10-09-1002"
}

export default article

article.tsexport default

publishedAt2026.10.09

const article = definePost()

发布流水线三条通道各只收到 1/3 产物，自述报告/健康检查/退出码却全绿

mergectl 是变更单的合并发布流水线：一张变更单有 3 个条目，发布时要把每一个条目投递到三条外部通道 docs / site / report。部署契约 conf/mergectl.env（只读）写得很明白：契约页 docs/publish-contract.md 定义：

变更单合并发布planned_deliveries计划投递条数

readMore()

const article = {
  title: "Unix 域套接字作业代理授权判定被套接字文件权限绑架：拿 os.stat",
  publishedAt: "2026.10.09",
  tags: ["unix domain socket 权限绕过","SO_PEERCRED 主组","getpeereid"],
  href: "/blogs/2026-10-09-1600-unixso-peercred-bind-0"
}

export default article

const article = {
  title: "Unix 域套接字作业代理授权判定被套接字文件权限绑架：拿 os.stat",
  publishedAt: "2026.10.09",
  tags: ["unix domain socket 权限绕过","SO_PEERCRED 主组","getpeereid"],
  href: "/blogs/2026-10-09-1600-unixso-peercred-bind-0"
}

export default article

article.tsexport default

publishedAt2026.10.09

const article = definePost()

Unix 域套接字作业代理授权判定被套接字文件权限绑架：拿 os.stat

brokerd 是内网构建机上的本地作业代理：客户端通过 Unix 域套接字（AF_UNIX + SOCK_STREAM）连上来提交编译/打包作业。谁能用它

unix domain socket 权限绕过SO_PEERCRED 主组getpeereid

readMore()

const article = {
  title: "AI日报 2026-10-09",
  publishedAt: "2026.10.09",
  tags: ["朕喜技术","科技资讯","人工智能"],
  href: "/blogs/ai-daily-2026-10-09"
}

export default article

const article = {
  title: "AI日报 2026-10-09",
  publishedAt: "2026.10.09",
  tags: ["朕喜技术","科技资讯","人工智能"],
  href: "/blogs/ai-daily-2026-10-09"
}

export default article

article.tsexport default

publishedAt2026.10.09

const article = definePost()

AI日报 2026-10-09

今日看点：正行创新发布零售物理智能24/7服务方案，具身智能加速进入开放商业场景；Vidu Q4预览版以0.09元/秒价格降低视频生成门槛；联想YOGA Pro 15搭载NVIDIA RTX Spark N1X开启盲约；Manus获超5亿美元融资并重启北京团队；PaperBenchX基准揭示AI论文复现率仅13.98%

朕喜技术科技资讯人工智能

readMore()

const article = {
  title: "sign_ts 把「秒」当「毫秒」生成导致签名窗口判定恒不成立，投递全被拒收却报「全部成功」",
  publishedAt: "2026.10.08",
  tags: [],
  href: "/blogs/2026-10-08-0000-sign-ts"
}

export default article

const article = {
  title: "sign_ts 把「秒」当「毫秒」生成导致签名窗口判定恒不成立，投递全被拒收却报「全部成功」",
  publishedAt: "2026.10.08",
  tags: [],
  href: "/blogs/2026-10-08-0000-sign-ts"
}

export default article

article.tsexport default

publishedAt2026.10.08

const article = definePost()

sign_ts 把「秒」当「毫秒」生成导致签名窗口判定恒不成立，投递全被拒收却报「全部成功」

「变更单通知网关」notifyd 把审批通过的变更单事件投递给下游接收方（/events）。接收方对每个请求做**签名窗口校验**：请求体里的 sign_ts 必须是 **unix 秒**，与自己当前时钟的差值超过契约容差就 **拒收（401）**。

readMore()

const article = {
  title: "归档刷写「6 条记录全部交付成功」而归档一段都没落地",
  publishedAt: "2026.10.08",
  tags: ["`fsync 顺序`","`记账 mtime 晚于数据`","`崩溃一致性`"],
  href: "/blogs/2026-10-08-1600-fsync-mtime-0"
}

export default article

const article = {
  title: "归档刷写「6 条记录全部交付成功」而归档一段都没落地",
  publishedAt: "2026.10.08",
  tags: ["`fsync 顺序`","`记账 mtime 晚于数据`","`崩溃一致性`"],
  href: "/blogs/2026-10-08-1600-fsync-mtime-0"
}

export default article

article.tsexport default

publishedAt2026.10.08

const article = definePost()

归档刷写「6 条记录全部交付成功」而归档一段都没落地

spoolerd 是日志归档刷写服务：每来一条记录，追加进一个归档分段（outbox/seg-NNNNNN.ndjson），并在旁边写一份**记账文件**（outbox/seg-NNNNNN.ndjson.ack.json），记录这一段的 sha256 与字节数。下游（备份 / 校验 / 计费）

`fsync 顺序``记账 mtime 晚于数据``崩溃一致性`

readMore()

const article = {
  title: "AI日报 2026-10-08",
  publishedAt: "2026.10.08",
  tags: ["朕喜技术","科技资讯","人工智能"],
  href: "/blogs/ai-daily-2026-10-08"
}

export default article

const article = {
  title: "AI日报 2026-10-08",
  publishedAt: "2026.10.08",
  tags: ["朕喜技术","科技资讯","人工智能"],
  href: "/blogs/ai-daily-2026-10-08"
}

export default article

article.tsexport default

publishedAt2026.10.08

const article = definePost()

AI日报 2026-10-08

今日看点：2026年诺贝尔化学奖授予不对称有机合成领域两位学者，表彰其非线性效应与自催化发现；AI影视公司Utopai Studios的视频模型Utopai X在盲测榜单中位列全球第二；Meshy成为a16z消费级AI应用月收入榜唯一AI 3D公司；开发者社区集中吐槽AI编程助手表达退化问题。

朕喜技术科技资讯人工智能

readMore()

const article = {
  title: "Redis Streams 消费者组 XCLAIM min-idle-time 把「毫秒当秒」",
  publishedAt: "2026.10.07",
  tags: [],
  href: "/blogs/2026-10-07-0000-redis-streams-xclaim"
}

export default article

const article = {
  title: "Redis Streams 消费者组 XCLAIM min-idle-time 把「毫秒当秒」",
  publishedAt: "2026.10.07",
  tags: [],
  href: "/blogs/2026-10-07-0000-redis-streams-xclaim"
}

export default article

article.tsexport default

publishedAt2026.10.07

const article = definePost()

Redis Streams 消费者组 XCLAIM min-idle-time 把「毫秒当秒」

订单事件走 Redis Stream pending:orders，消费者组 order-workers 由多个 worker 共同消费。某个实例 worker-dead 崩溃了，它手上还有 3 条消息没 ACK。这 3 条消息躺在消费者组的 PEL（Pending Entries List）里

readMore()

const article = {
  title: "AI日报 2026-10-07",
  publishedAt: "2026.10.07",
  tags: ["朕喜技术","科技资讯","人工智能"],
  href: "/blogs/ai-daily-2026-10-07"
}

export default article

const article = {
  title: "AI日报 2026-10-07",
  publishedAt: "2026.10.07",
  tags: ["朕喜技术","科技资讯","人工智能"],
  href: "/blogs/ai-daily-2026-10-07"
}

export default article

article.tsexport default

publishedAt2026.10.07

const article = definePost()

AI日报 2026-10-07

陶哲轩在SAIR演讲中公开呼吁AI减速，担忧数学研究生态遭破坏；诺贝尔物理学奖授予IceCube中微子天文台主导者Francis Halzen；OpenAI启动Codex“疯狂28天”计划首日仅宣布推理提速50%，同时推进ChatGPT广告测试引发争议。

朕喜技术科技资讯人工智能

readMore()

const article = {
  title: "审计日志哈希链「一条都没改过」却报 11 条断链：prev 写的是哈希，校验方却拿序号去比",
  publishedAt: "2026.10.06",
  tags: ["审计日志","append-only 账本","哈希链 hash chain"],
  href: "/blogs/2026-10-06-0000-prev"
}

export default article

const article = {
  title: "审计日志哈希链「一条都没改过」却报 11 条断链：prev 写的是哈希，校验方却拿序号去比",
  publishedAt: "2026.10.06",
  tags: ["审计日志","append-only 账本","哈希链 hash chain"],
  href: "/blogs/2026-10-06-0000-prev"
}

export default article

article.tsexport default

publishedAt2026.10.06

const article = definePost()

审计日志哈希链「一条都没改过」却报 11 条断链：prev 写的是哈希，校验方却拿序号去比

一套**审计写入链路**（auditd）按 append-only 方式逐条追加事件到账本文件，每条记录带一个 prev 字段（链式指针），写满一本就轮转（rotation），轮转时把链头摘要「封存」进 chain-seals.json。另有一个**外部独立校验器**（app/verifier.py

审计日志append-only 账本哈希链 hash chain

readMore()

// showing 11-20 of 281 posts