All articles

Software Engineering / 17 Sep 2026 / 6 min read

Linux epoll Edge Triggering Reports Readiness Transitions, Not Work Units

Linux epoll Edge Triggering Reports Readiness Transitions, Not Work Units With EPOLLET, an epoll interest does not behave like a queue containing one event for each byte, packet, connection, or application message. It reports changes in readiness state. Once a file descriptor is ready, additional work can accumulate without producing another edge that an application may rely on. The handler therefore has to consume available work until the nonblocking operation reports that progress would block.

Software Engineering Linux

Software Engineering / 17 Sep 2026 / 8 min read

Linux Direct I/O Makes Alignment Part of the File Interface

Opening a regular file with O_DIRECT can make the address of a user-space buffer, the file offset, and the transfer length observable parts of the file interface. A read() or write() that is otherwise valid may fail with EINVAL when one of those values violates the direct-I/O constraints for that file. On some combinations of filesystem and kernel behavior, a misaligned operation can instead use buffered I/O. That boundary is easy to miss because ordinary buffered file I/O largely hides physical transfer geometry. The page cache and filesystem can accept an application buffer at an arbitrary address and mediate the transfer internally. Direct I/O reduces that mediation, so constraints that normally remain below the system-call boundary can become requirements on application memory and request shape.

Software Engineering Linux

Software Engineering / 17 Sep 2026 / 8 min read

Linux copy_file_range Separates Copy Semantics From Copy Implementation

Linux copy_file_range Separates Copy Semantics From Copy Implementation A successful copy_file_range() call reports a byte count, not a promise about the physical path those bytes took. Linux can satisfy the request through filesystem-specific acceleration, an in-kernel transfer path, or another implementation permitted by the active filesystem interfaces. The application receives a range-copy operation with defined offset and return-value semantics; it does not receive a guarantee that storage blocks were physically duplicated.

Software Engineering Linux

Artificial Intelligence / 17 Sep 2026 / 6 min read

Limit Parameter Drift with Elastic Weight Consolidation

Fine-tuning a neural network on a new task can move parameters away from values that supported an earlier task. The new objective has no inherent reason to preserve those earlier behaviors when the earlier data is absent from the update. Elastic weight consolidation, commonly abbreviated EWC, adds a parameter-space constraint intended to reduce that drift. The constraint is selective rather than uniform. Parameters estimated to be more consequential for the earlier task receive a larger penalty for moving, while parameters assigned lower importance can change more freely. That distinction is the central mechanism; EWC is not simply weight decay around zero.

Artificial Intelligence Neural Networks

Cybersecurity / 17 Sep 2026 / 7 min read

Landlock Rulesets Restrict Future Path Access, Not Open File Authority

Landlock Rulesets Restrict Future Path Access, Not Open File Authority A process opens a writable configuration file, installs a restrictive Landlock ruleset, and then continues running code that should have access only to a small working directory. The later policy can block a fresh attempt to open that configuration path, yet the descriptor obtained before confinement remains usable. The filesystem view has narrowed, but authority already materialized as an open file has not vanished.

Cybersecurity Linux Security

Cybersecurity / 17 Sep 2026 / 6 min read

Landlock Rulesets Add Process-Local Filesystem Denial Boundaries

A service starts with ordinary filesystem access inherited from its credentials, loads configuration, opens several resources, then begins processing data that may be hostile. Changing UID or entering a container can alter the surrounding authority model, but neither action by itself expresses a narrow rule such as “from this point onward, new reads are limited to these hierarchies and writes are limited to that directory.” Linux Landlock provides a process-controlled restriction layer for this boundary. A process creates a ruleset, adds object rules, and enforces the ruleset on itself. The resulting Landlock domain is stacked with existing discretionary access control and other Linux Security Module decisions. Landlock can remove access that those mechanisms would otherwise permit; it does not grant access they deny.

Cybersecurity Linux Security

Tech / 17 Sep 2026 / 7 min read

IOMMU Remaps Device DMA Addresses for Memory Isolation

Direct memory access lets a device move data between itself and system memory without making the CPU copy every byte. Network adapters, storage controllers, GPUs, and other high-throughput devices rely on DMA to keep data moving efficiently. That capability also creates a protection problem. A device that can issue unrestricted memory transactions could read or overwrite physical pages belonging to the kernel, another process, or another virtual machine. An input-output memory management unit, commonly called an IOMMU, places address translation and access control between DMA-capable devices and physical memory.

IOMMU DMA

Software Engineering / 17 Sep 2026 / 8 min read

io_uring Shared Rings Make Memory Ordering Part of the ABI

An io_uring queue is shared memory with two independent execution domains changing its state. User space prepares submission entries and advances queue metadata; the kernel consumes those submissions and later publishes completion entries. The ring layout removes a copy boundary, but it also makes memory visibility part of the interface contract. A plain source-level assignment to a queue tail is not sufficient as a portable model of publication. The entry data must become visible before the tail value that makes the entry eligible for consumption. On the completion side, user space must observe the kernel’s publication of a completion before reading fields from that completion. The ordering relation is part of correctness, not merely an optimization detail.

Software Engineering Linux

Software Engineering / 17 Sep 2026 / 4 min read

io_uring Multishot Accept Keeps One Request Active Across Connections

A Linux io_uring multishot accept request can produce several completion queue entries from one submission queue entry. The kernel keeps the accept operation active after a successful completion when the CQE carries IORING_CQE_F_MORE, so a server does not need to submit a fresh accept SQE for every connection. This changes the lifetime contract between submission and completion. A normal oneshot request is finished after its CQE. A multishot accept can remain in flight across many accepted connections, and the CQE flags determine whether that request still exists.

Software Engineering Linux

Software Engineering / 17 Sep 2026 / 4 min read

inotify Rename Cookies Correlate Move Events Without Making Them Atomic

A Linux rename() observed through inotify can produce two records carrying the same nonzero cookie: IN_MOVED_FROM for the old directory entry and IN_MOVED_TO for the new one. The cookie correlates those records, but it does not turn them into one atomic queue item. That boundary matters for software maintaining a pathname index, synchronizing directory state, or converting filesystem notifications into higher-level change records. A rename is one filesystem operation while its inotify representation can be a pair whose delivery has weaker grouping properties.

Software Engineering Linux

Cybersecurity / 17 Sep 2026 / 8 min read

HTTP Request Smuggling Begins at a Message-Framing Disagreement

HTTP Request Smuggling Begins at a Message-Framing Disagreement A reverse proxy can validate an HTTP request, route it to an approved application, and still deliver a different request sequence from the one it believed it accepted. The failure does not require the proxy to ignore authentication or the origin to execute malformed syntax. It can arise when the two HTTP processors disagree about the byte at which one request ends and the next begins.

Cybersecurity HTTP

Cybersecurity / 17 Sep 2026 / 7 min read

fs-verity Makes File Data Integrity a Read-Time Property

A host may need to keep independently updated executables, packages, models, or data on a writable filesystem while still detecting modification of file contents after an artifact has been accepted. A one-time userspace hash can identify the bytes at one moment, but it does not make later reads depend on that measurement. The file may be opened again, pages may be evicted and reloaded, and storage below the page cache may return different data.

Cybersecurity Linux Security

Software Engineering / 17 Sep 2026 / 8 min read

File-Backed Mappings Can Outlive the File Size They Assume

A process can retain a valid virtual memory mapping after another actor has shortened the mapped file. The address range still exists in the process, but the backing object may no longer contain every page that range once represented. On POSIX systems, an access to a whole mapped page beyond the new end can deliver SIGBUS rather than behaving like an ordinary failed file read. That boundary makes file-backed mmap() different from copying bytes into private heap storage. A pointer into a mapping is not proof that the corresponding file extent still exists. The virtual address, mapping lifetime, file identity, and current file size are related state, but they are not one indivisible object.

Software Engineering POSIX

Cybersecurity / 17 Sep 2026 / 8 min read

Fetch Metadata Exposes Browser Request Context at the Server Boundary

Fetch Metadata Exposes Browser Request Context at the Server Boundary A state-changing endpoint can receive two HTTP requests with the same method, path, cookies, and body while the browser reached them through very different contexts. One may come from the application’s own document. The other may have been triggered by a foreign site through a form, image load, navigation, or another browser mechanism that permits a request without granting the initiating page access to the response.

Cybersecurity Browser Security

Cybersecurity / 17 Sep 2026 / 5 min read

execveat Binds Program Execution to an Open File Reference

A launcher selects an executable from a directory, checks attributes or content, and then starts it. If selection and execution each resolve the pathname independently, a rename, symlink change, or directory replacement between those operations can make the executed object differ from the object that was checked. Linux execveat() can move that boundary from a second pathname lookup to an already acquired file reference. With AT_EMPTY_PATH, an empty pathname tells the kernel to execute the object referred to by dirfd. That descriptor may have been opened with O_PATH. The execution decision still passes through normal kernel permission and executable-format checks, but object selection no longer depends on resolving the original pathname again.

Cybersecurity Linux Security

Software Engineering / 17 Sep 2026 / 5 min read

eventfd Counter Coalesces Notifications Before Read

A Linux eventfd can receive several writes before any consumer runs, yet the descriptor does not retain those writes as separate messages. Each accepted write adds its unsigned 64-bit value to a kernel-maintained counter. Without EFD_SEMAPHORE, one successful read returns the current counter and resets it to zero. That behavior makes eventfd a counter-backed notification primitive rather than a message queue. Readiness indicates that the counter is nonzero; it does not preserve the number, ordering, or boundaries of individual write operations.

Software Engineering Linux

Artificial Intelligence / 17 Sep 2026 / 5 min read

Evaluate Probabilistic Classifiers with the Brier Score

Two classifiers can produce the same predicted labels and the same accuracy while assigning very different probabilities to those labels. A system that emits 0.51 for every correct binary decision is not making the same probabilistic claim as one that emits 0.99, even though thresholded accuracy may treat them identically. The Brier score keeps that distinction visible. It measures squared error between predicted probabilities and observed outcomes, so both the selected class and the probability assigned to each outcome affect the result. This makes it useful when downstream code consumes probabilities for ranking, thresholds, abstention, or expected-cost decisions.

Artificial Intelligence Model Evaluation

Software Engineering / 17 Sep 2026 / 5 min read

EPOLLET Reports Readiness Transitions, Not Buffer Drainage

With EPOLLET, a file descriptor can still contain unread data after its readiness event has already been consumed. A later epoll_wait() is not required to report that descriptor again merely because the old readable state persists. That behavior is the central boundary of edge-triggered epoll: notification tracks changes in readiness, while the underlying I/O object retains its own state independently. Readiness state and event delivery are separate An epoll instance maintains an interest list and a ready list. Registration through epoll_ctl() defines which open file descriptions matter and which event classes are relevant. epoll_wait() returns entries that have reached the ready list.

Software Engineering Linux

Software Engineering / 17 Sep 2026 / 9 min read

Epoll Edge Triggering Turns Readiness Into a Drain Obligation

An edge-triggered epoll registration can stop producing notifications while unread bytes still remain in a socket or pipe. The descriptor is still usable for I/O, but the event loop has already consumed the notification associated with the readiness transition. If the handler reads only part of the available data and returns to epoll_wait(), no fresh transition is required to occur, so the pending bytes can remain untouched indefinitely. This behavior makes EPOLLET more than a notification preference. It changes the contract between the kernel’s ready list and application state. A level-triggered loop can repeatedly receive a descriptor while the requested I/O condition remains true. An edge-triggered loop must preserve enough local state to treat a delivered event as an obligation to exhaust the currently available nonblocking I/O, normally until an operation reports EAGAIN.

Software Engineering Linux

Cybersecurity / 17 Sep 2026 / 8 min read

Encrypted ClientHello Separates Public Routing From Private TLS Identity

Encrypted ClientHello Separates Public Routing From Private TLS Identity TLS 1.3 encrypts most handshake messages, yet a conventional connection still exposes the initial ClientHello. That message can contain Server Name Indication, allowing an on-path observer to associate a connection with a requested hostname before application traffic is protected. Encrypted ClientHello, standardized in RFC 9849, changes that boundary. The client constructs a private ClientHelloInner containing the service-specific parameters and wraps it inside a public ClientHelloOuter. The outer message remains usable by the client-facing infrastructure, while sensitive inner fields are protected with Hybrid Public Key Encryption.

Cybersecurity TLS

Linux / 17 Sep 2026 / 4 min read

Duplicated File Descriptors Share an Open File Description

Two file descriptor numbers can move the same file offset. On Linux, this occurs when both descriptors refer to one open file description, as happens after dup() and across inherited descriptors after fork(). The distinction matters because a file descriptor is a process-visible integer, while the open file description is the kernel object that carries state for an open instance of a file. Treating those layers as interchangeable can produce offset interference, status-flag changes that cross descriptor boundaries, and surprising behavior after process creation.

Linux File Descriptors

Cybersecurity / 17 Sep 2026 / 7 min read

DNS Rebinding Preserves Web Origin While Changing Network Destination

DNS Rebinding Preserves Web Origin While Changing Network Destination A browser can load active content from a public server, keep that content in the same web origin, and later send requests bearing the same hostname to a private address. No origin tuple has changed. The network destination has. That mismatch is the core of DNS rebinding. Web origins are principally identified by scheme, host, and port, while DNS maps a hostname to network addresses outside that tuple. When a name controlled by an attacker resolves differently over time, origin checks and network-location checks can describe two distinct security boundaries.

Cybersecurity Browser Security

Cybersecurity / 17 Sep 2026 / 8 min read

CSP Strict Dynamic Moves Script Trust From Host Lists to Nonce-Bearing Roots

CSP Strict Dynamic Moves Script Trust From Host Lists to Nonce-Bearing Roots A production page can have a restrictive script-src policy and still depend on a bootstrap script that creates additional script elements at runtime. A host allowlist handles that architecture by naming every permitted script origin. The list then becomes coupled to deployment topology: moving a dependency to another host can require a policy change, while admitting a broad host can authorize more executable content than the application intended.

Cybersecurity Browser Security

Artificial Intelligence / 17 Sep 2026 / 6 min read

Conformal Prediction Sets Need Exchangeable Calibration Data

A classifier that emits 0.93 for one class does not automatically provide a statistical statement that the class is correct with probability 0.93. Conformal prediction takes a different route: it uses held-out labeled examples to construct a set of candidate labels with a target marginal coverage level. For split conformal classification, the base model can remain fixed. The guarantee comes from ranking a test example’s conformity or nonconformity score against scores computed on an exchangeable calibration sample. That assumption is the part that gives the coverage statement its scope.

Artificial Intelligence Conformal Prediction