https://yyago.top/blog Yyago 开发者工具箱的技术文章（中英双语）。 zh-CN https://yyago.top/blog/spring-boot-4-2-0-m2-released https://yyago.top/blog/spring-boot-4-2-0-m2-released Spring Boot 4.2.0-M2 于 2026 年 9 月 25 日发布，含 141 项改动。本文梳理 LDAP 的 SSL Bundle 支持、OpenTelemetry 语义约定与 OTLP 统一配置，以及从 4.1 升级要处理的 Tomcat 属性迁移、Janino 移除和 Micrometer 约定改名。 Thu, 01 Oct 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/spring-boot-4-2-0-m2-released https://yyago.top/en/blog/spring-boot-4-2-0-m2-released Spring Boot 4.2.0-M2, released on September 25, 2026, ships 141 changes. This article covers SSL bundle support for LDAP, OpenTelemetry semantic conventions and unified OTLP configuration, plus the Tomcat property moves, Janino removal and Micrometer convention renames you need to handle when upgrading from 4.1. Thu, 01 Oct 2026 00:00:00 GMT en https://yyago.top/blog/spring-framework-7-0-9-released https://yyago.top/blog/spring-framework-7-0-9-released Spring Framework 7.0.9 于 2026 年 8 月 20 日发布，是 7.0.x 的收尾版本。本文解读 SpEL 编译默认关闭的原因与应对、Forwarded 与 X-Forwarded-* 二选一的影响，以及内存泄漏与高并发稳定性的修复。 Thu, 01 Oct 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/spring-framework-7-0-9-released https://yyago.top/en/blog/spring-framework-7-0-9-released Spring Framework 7.0.9, released on August 20, 2026, closes out the 7.0.x line. This article explains why SpEL compilation is now disabled by default and what to do about it, why you must now choose between Forwarded and X-Forwarded-*, and which memory-leak and concurrency fixes landed. Thu, 01 Oct 2026 00:00:00 GMT en https://yyago.top/blog/jev-decision-model-explained https://yyago.top/blog/jev-decision-model-explained Jev 不生成文字，只把「判断」变成软件能直接用的结构化结果。用大白话讲清它是什么、为什么会出现、能拿来做什么，以及哪些场景不该用它。 Fri, 25 Sep 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/jev-decision-model-explained https://yyago.top/en/blog/jev-decision-model-explained Jev generates no text: it turns decisions into structured values software can use directly. What it is, why it appeared, and when not to use it. Fri, 25 Sep 2026 00:00:00 GMT en https://yyago.top/blog/java-27-whats-new https://yyago.top/blog/java-27-whats-new Java 27（2026-09-15 GA，JSR 402）带来 9 个 JEP：G1 全环境默认、紧凑对象头、后量子 TLS、惰性常量与基本类型模式匹配等。逐项拆解新特性、废弃与移除项，以及升级时的兼容性注意。 Fri, 25 Sep 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/java-27-whats-new https://yyago.top/en/blog/java-27-whats-new Java 27 (GA 2026-09-15, JSR 402) ships nine JEPs: G1 as the default GC everywhere, compact object headers, post-quantum TLS, lazy constants and primitive pattern matching. A developer-focused breakdown with migration notes. Fri, 25 Sep 2026 00:00:00 GMT en https://yyago.top/blog/local-llm-vs-cloud-api-tradeoffs https://yyago.top/blog/local-llm-vs-cloud-api-tradeoffs 没有普遍最优解，只有与场景匹配的解。按隐私、能力、成本、运维四个维度对比，并给出混合方案的落地路径。 Thu, 24 Sep 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/local-llm-vs-cloud-api-tradeoffs https://yyago.top/en/blog/local-llm-vs-cloud-api-tradeoffs There is no universally best option, only a scenario-matched one. Compare privacy, capability, cost and ops, plus a practical hybrid path. Thu, 24 Sep 2026 00:00:00 GMT en https://yyago.top/blog/rag-and-context-window-basics https://yyago.top/blog/rag-and-context-window-basics 模型不知道你的内部文档，也不了解最近发生的事。讲清检索增强的最小流程、上下文窗口的取舍与五个常见坑。 Thu, 24 Sep 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/rag-and-context-window-basics https://yyago.top/en/blog/rag-and-context-window-basics A model does not know your internal docs or recent events. The minimal RAG pipeline, context-window trade-offs, and five common pitfalls. Thu, 24 Sep 2026 00:00:00 GMT en https://yyago.top/blog/structured-prompts-and-output-constraints https://yyago.top/blog/structured-prompts-and-output-constraints 同一句话换个模型结果就变？问题往往出在需求没有被约束。讲清角色、任务、上下文、约束、输出格式五模块与少样本技巧。 Wed, 23 Sep 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/structured-prompts-and-output-constraints https://yyago.top/en/blog/structured-prompts-and-output-constraints Same prompt, different result? The requirement was never constrained. Five prompt modules, few-shot examples, and hard output rules. Wed, 23 Sep 2026 00:00:00 GMT en https://yyago.top/blog/ai-hallucination-verification-checklist https://yyago.top/blog/ai-hallucination-verification-checklist 幻觉无法被提示词彻底消除。讲清四类高发场景与六步校验清单，让模型负责候选、让工具与人负责确认。 Wed, 23 Sep 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/ai-hallucination-verification-checklist https://yyago.top/en/blog/ai-hallucination-verification-checklist Hallucination cannot be prompted away. Four high-risk scenarios and a six-step checklist: models propose, tools and humans confirm. Wed, 23 Sep 2026 00:00:00 GMT en https://yyago.top/blog/ai-pair-programming-workflow https://yyago.top/blog/ai-pair-programming-workflow 复制粘贴就算用上 AI 了？讲清把大模型变成结对伙伴的四步流程：给足上下文、拆解任务、要求依据、逐条验证。 Wed, 16 Sep 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/ai-pair-programming-workflow https://yyago.top/en/blog/ai-pair-programming-workflow Copy-pasting is not "using AI". A four-step workflow for turning an LLM into a pair programmer: context, decomposition, evidence, verification. Wed, 16 Sep 2026 00:00:00 GMT en https://yyago.top/blog/api-idempotency-retry-and-timeouts https://yyago.top/blog/api-idempotency-retry-and-timeouts 重试把一次抖动放大成雪崩，多半是因为缺了幂等与预算。讲清三层超时、该重试哪些错误、指数退避抖动与幂等键设计。 Wed, 16 Sep 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/api-idempotency-retry-and-timeouts https://yyago.top/en/blog/api-idempotency-retry-and-timeouts Retries turn a blip into an avalanche when idempotency and budgets are missing. Three timeout layers, retryable errors, jittered backoff, idempotency keys. Wed, 16 Sep 2026 00:00:00 GMT en https://yyago.top/blog/datacenter-ip-route-analysis https://yyago.top/blog/datacenter-ip-route-analysis 同是海外机房，体验却差很多。看懂 traceroute 里的 ASN，就能判断走的是 CN2、163、9929 还是 CMI 线路。 Wed, 09 Sep 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/datacenter-ip-route-analysis https://yyago.top/en/blog/datacenter-ip-route-analysis Not all datacenter routes perform the same. Reading the ASNs in a traceroute tells you whether traffic uses CN2, 163, 9929 or CMI. Wed, 09 Sep 2026 00:00:00 GMT en https://yyago.top/blog/git-everyday-and-recovery https://yyago.top/blog/git-everyday-and-recovery 提交错分支、误删分支、改动被覆盖怎么办？讲清 reflog 的恢复思路、日常高频命令与团队协作的三条底线。 Wed, 09 Sep 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/git-everyday-and-recovery https://yyago.top/en/blog/git-everyday-and-recovery Wrong branch, deleted branch, overwritten work? Recovery through reflog, everyday commands, and three rules for teams. Wed, 09 Sep 2026 00:00:00 GMT en https://yyago.top/blog/number-base-conversion https://yyago.top/blog/number-base-conversion “按权展开”一句话讲透进制转换，看懂 #FF5733 这类颜色代码的进制本质，附大数与浮点转换的常见坑。 Wed, 02 Sep 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/number-base-conversion https://yyago.top/en/blog/number-base-conversion Positional notation explains every base conversion in one idea, and why #FF5733 is just hex. Big-number and float pitfalls included. Wed, 02 Sep 2026 00:00:00 GMT en https://yyago.top/blog/http-status-codes-and-caching https://yyago.top/blog/http-status-codes-and-caching 401 与 403 有什么区别？301 和 308 呢？讲清状态码易混点、四种缓存头，以及静态资源/HTML/API 各自的缓存策略。 Wed, 02 Sep 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/http-status-codes-and-caching https://yyago.top/en/blog/http-status-codes-and-caching 401 vs 403? 301 vs 308? Status code confusions, four caching headers, and ready-to-use strategies for assets, HTML and APIs. Wed, 02 Sep 2026 00:00:00 GMT en https://yyago.top/blog/image-watermark-protect https://yyago.top/blog/image-watermark-protect 水印不只是防搬运：署名、溯源、品牌曝光都靠它。讲清水印样式怎么选，以及上传前的隐私清理。 Wed, 26 Aug 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/image-watermark-protect https://yyago.top/en/blog/image-watermark-protect Watermarks do more than stop reposting: attribution, tracing and branding. Choosing a style and cleaning privacy data before upload. Wed, 26 Aug 2026 00:00:00 GMT en https://yyago.top/blog/regex-practical-recipes https://yyago.top/blog/regex-practical-recipes 从邮箱、手机号到日志去重的可复用配方，讲清贪婪与懒惰、分组、环视与灾难性回溯，以及什么时候不该用正则。 Wed, 26 Aug 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/regex-practical-recipes https://yyago.top/en/blog/regex-practical-recipes Reusable recipes for emails, phone numbers and log dedup, plus greedy vs lazy, groups, lookaround, catastrophic backtracking, and when not to use regex. Wed, 26 Aug 2026 00:00:00 GMT en https://yyago.top/blog/unix-timestamp-and-timezones https://yyago.top/blog/unix-timestamp-and-timezones 10 位还是 13 位？时间戳为什么不随时区变？讲清 Unix 时间戳的原理、常见格式差异与时区转换的坑。 Wed, 19 Aug 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/unix-timestamp-and-timezones https://yyago.top/en/blog/unix-timestamp-and-timezones Ten digits or thirteen? Why timestamps never change with timezones? How Unix time works and where conversions go wrong. Wed, 19 Aug 2026 00:00:00 GMT en https://yyago.top/blog/utf8-and-mojibake-root-causes https://yyago.top/blog/utf8-and-mojibake-root-causes 乱码不是数据丢了，而是字节被按错误的规则解读。讲清字符集/编码/字节序的区别、常见乱码形态与四步排查法。 Wed, 19 Aug 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/utf8-and-mojibake-root-causes https://yyago.top/en/blog/utf8-and-mojibake-root-causes Mojibake is not lost data, it is bytes read with the wrong rule. Character sets vs encodings vs byte order, common symptoms, and a four-step fix. Wed, 19 Aug 2026 00:00:00 GMT en https://yyago.top/blog/url-encoding-when-and-why https://yyago.top/blog/url-encoding-when-and-why 为什么空格会变成 %20 或加号？encodeURI 与 encodeURIComponent 差在哪？讲清 URL 编码的时机与乱码根源。 Wed, 12 Aug 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/url-encoding-when-and-why https://yyago.top/en/blog/url-encoding-when-and-why Why does a space become %20 or a plus sign? The difference between encodeURI and encodeURIComponent, and the root of mojibake. Wed, 12 Aug 2026 00:00:00 GMT en https://yyago.top/blog/verify-file-integrity-sha256 https://yyago.top/blog/verify-file-integrity-sha256 下载安装包或镜像后，三步校验 SHA-256，确认文件没有损坏、也没有被篡改，以及最常见的比对误区。 Wed, 05 Aug 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/verify-file-integrity-sha256 https://yyago.top/en/blog/verify-file-integrity-sha256 Three steps to verify the SHA-256 checksum of a downloaded file, plus the most common comparison mistakes. Wed, 05 Aug 2026 00:00:00 GMT en https://yyago.top/blog/json-format-and-validate https://yyago.top/blog/json-format-and-validate 尾逗号、单引号、注释、键没加引号，JSON 校验失败的高频原因一次讲清，并附快速排查思路。 Wed, 29 Jul 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/json-format-and-validate https://yyago.top/en/blog/json-format-and-validate Trailing commas, single quotes, comments, unquoted keys, the usual reasons JSON validation fails, plus a fast debugging routine. Wed, 29 Jul 2026 00:00:00 GMT en https://yyago.top/blog/strong-password-length-over-complexity https://yyago.top/blog/strong-password-length-over-complexity 加符号不一定更强。决定密码强度的是熵，而熵主要由“长度 × 字符集”决定。附实用的密码原则与常见误区。 Wed, 22 Jul 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/strong-password-length-over-complexity https://yyago.top/en/blog/strong-password-length-over-complexity Adding symbols is not always stronger. Password strength is about entropy, and length matters most. Practical rules and myths. Wed, 22 Jul 2026 00:00:00 GMT en https://yyago.top/blog/cron-expression-guide https://yyago.top/blog/cron-expression-guide 分 时 日 月 周，还是 秒 分 时 日 月 周？“日”和“周”同时指定会发生什么？讲清 Cron 的格式差异与高频错误。 Wed, 15 Jul 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/cron-expression-guide https://yyago.top/en/blog/cron-expression-guide Five fields or six? What happens when day-of-month and day-of-week are both set? Cron formats and frequent mistakes. Wed, 15 Jul 2026 00:00:00 GMT en https://yyago.top/blog/base64-vs-encryption https://yyago.top/blog/base64-vs-encryption 把密码 Base64 一下就安全了？这是最常见的误解之一。一文讲清编码、加密、哈希的本质区别与适用场景。 Wed, 08 Jul 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/base64-vs-encryption https://yyago.top/en/blog/base64-vs-encryption Encoding your password with Base64 does not make it safe. The real difference between encoding, encryption and hashing. Wed, 08 Jul 2026 00:00:00 GMT en https://yyago.top/blog/what-your-ip-reveals https://yyago.top/blog/what-your-ip-reveals IP 能定位到你家门口吗？能查到姓名吗？讲清 IP 查询的真实能力边界，以及常见的隐私误解与应对。 Wed, 01 Jul 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/what-your-ip-reveals https://yyago.top/en/blog/what-your-ip-reveals Can an IP locate your doorstep or reveal your name? The real limits of IP lookups, plus common privacy misconceptions. Wed, 01 Jul 2026 00:00:00 GMT en https://yyago.top/blog/improve-ocr-accuracy https://yyago.top/blog/improve-ocr-accuracy 识别率低不一定是引擎不行：分辨率、倾斜、对比度、语言包都会显著影响结果。附可立即执行的优化清单。 Wed, 24 Jun 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/improve-ocr-accuracy https://yyago.top/en/blog/improve-ocr-accuracy Poor accuracy is rarely the engine alone: resolution, skew, contrast and language packs all matter. A checklist you can apply today. Wed, 24 Jun 2026 00:00:00 GMT en https://yyago.top/blog/jwt-structure-and-pitfalls https://yyago.top/blog/jwt-structure-and-pitfalls JWT 不是加密的：任何拿到它的人都能读出载荷。讲清三段结构、签名与加密的区别，以及绝对不该放什么。 Wed, 17 Jun 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/jwt-structure-and-pitfalls https://yyago.top/en/blog/jwt-structure-and-pitfalls A JWT is not encrypted: anyone holding it can read the payload. Its three segments, signing vs encryption, and what never to put inside. Wed, 17 Jun 2026 00:00:00 GMT en https://yyago.top/blog/https-tls-handshake-explained https://yyago.top/blog/https-tls-handshake-explained 一次 HTTPS 连接背后有三种密码学分工：非对称交换密钥、对称加密数据、哈希校验完整性。逐段拆解握手流程。 Wed, 10 Jun 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/https-tls-handshake-explained https://yyago.top/en/blog/https-tls-handshake-explained Three kinds of crypto work together in every HTTPS connection: asymmetric key exchange, symmetric encryption, hashing. Step by step. Wed, 10 Jun 2026 00:00:00 GMT en https://yyago.top/blog/rsa-vs-ecc-asymmetric-choices https://yyago.top/blog/rsa-vs-ecc-asymmetric-choices 非对称加密不用于加密大文件。讲清密钥长度对照、RSA 与 ECC 的取舍，以及加密与签名的分工。 Wed, 03 Jun 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/rsa-vs-ecc-asymmetric-choices https://yyago.top/en/blog/rsa-vs-ecc-asymmetric-choices Asymmetric crypto is not for bulk data. Key-size equivalents, RSA vs ECC trade-offs, and the split between encryption and signing. Wed, 03 Jun 2026 00:00:00 GMT en https://yyago.top/blog/aes-modes-iv-authenticated-encryption https://yyago.top/blog/aes-modes-iv-authenticated-encryption AES 本身只是分组算法，选错模式或复用 IV 会让加密形同虚设。讲清 GCM、CBC 的差别与正确用法。 Wed, 27 May 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/aes-modes-iv-authenticated-encryption https://yyago.top/en/blog/aes-modes-iv-authenticated-encryption AES is just a block cipher: the wrong mode or a reused IV breaks it. How GCM and CBC differ, and how to use them correctly. Wed, 27 May 2026 00:00:00 GMT en https://yyago.top/blog/password-storage-salting-and-slow-hashing https://yyago.top/blog/password-storage-salting-and-slow-hashing 用 SHA-256 存密码为什么还不够？加盐解决什么、慢哈希解决什么，以及 bcrypt / Argon2 参数怎么选。 Wed, 20 May 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/password-storage-salting-and-slow-hashing https://yyago.top/en/blog/password-storage-salting-and-slow-hashing Why SHA-256 is not enough for password storage: what salting fixes, what slow hashing fixes, and how to size bcrypt/Argon2. Wed, 20 May 2026 00:00:00 GMT en https://yyago.top/blog/uuid-versions-and-when-not-to-use https://yyago.top/blog/uuid-versions-and-when-not-to-use UUID 不等于随机字符串。v1/v4/v7 的时间性与泄漏风险不同，用作主键时的性能差异也很大。 Wed, 13 May 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/uuid-versions-and-when-not-to-use https://yyago.top/en/blog/uuid-versions-and-when-not-to-use A UUID is not just a random string. v1, v4 and v7 differ in time semantics, information leakage and index performance. Wed, 13 May 2026 00:00:00 GMT en https://yyago.top/blog/color-formats-accessibility https://yyago.top/blog/color-formats-accessibility 同一个颜色为什么有三种写法？什么时候该用 HSL，什么时候必须看对比度？附 WCAG 对比度速查与实操建议。 Wed, 06 May 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/color-formats-accessibility https://yyago.top/en/blog/color-formats-accessibility Why does one colour have three notations? When HSL helps most, when contrast matters, plus a WCAG cheat sheet. Wed, 06 May 2026 00:00:00 GMT en https://yyago.top/blog/browser-local-processing-privacy https://yyago.top/blog/browser-local-processing-privacy 把文件传给网站，和让浏览器自己算，安全边界完全不同。讲清两种架构的风险差异与判断方法。 Wed, 29 Apr 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/browser-local-processing-privacy https://yyago.top/en/blog/browser-local-processing-privacy Uploading a file to a server and computing it in your browser have very different security boundaries. Comparing both architectures. Wed, 29 Apr 2026 00:00:00 GMT en https://yyago.top/blog/testing-pyramid-basics https://yyago.top/blog/testing-pyramid-basics 为什么大量 UI 端到端测试又慢又脆。讲清单元 / 集成 / 端到端的比例，以及该把力气花在哪。 Wed, 22 Apr 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/testing-pyramid-basics https://yyago.top/en/blog/testing-pyramid-basics Why piles of UI end-to-end tests are slow and flaky. The unit / integration / e2e ratio and where to spend effort. Wed, 22 Apr 2026 00:00:00 GMT en https://yyago.top/blog/docker-image-vs-container https://yyago.top/blog/docker-image-vs-container 镜像只读、容器是运行实例。讲清分层、体积优化，以及为什么「数据要放卷里」。 Wed, 15 Apr 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/docker-image-vs-container https://yyago.top/en/blog/docker-image-vs-container An image is read-only, a container is a running instance. Layers, size optimization, and why data belongs in volumes. Wed, 15 Apr 2026 00:00:00 GMT en https://yyago.top/blog/observability-logs-metrics-traces https://yyago.top/blog/observability-logs-metrics-traces 出问题先看得见。讲清日志 / 指标 / 链路追踪各自的职责，以及如何用它们快速定位故障。 Wed, 25 Mar 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/observability-logs-metrics-traces https://yyago.top/en/blog/observability-logs-metrics-traces You cannot fix what you cannot see. The distinct roles of logs, metrics and traces, and how to pinpoint failures fast. Wed, 25 Mar 2026 00:00:00 GMT en https://yyago.top/blog/cors-explained https://yyago.top/blog/cors-explained 浏览器为什么会拦跨域请求？讲清同源策略、简单请求与预检，以及常见错误配置。 Wed, 04 Mar 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/cors-explained https://yyago.top/en/blog/cors-explained Why the browser blocks cross-origin requests. Same-origin policy, simple requests vs preflight, and common misconfigurations. Wed, 04 Mar 2026 00:00:00 GMT en https://yyago.top/blog/data-privacy-basics https://yyago.top/blog/data-privacy-basics 最小收集、该加密的不明文、可被遗忘。讲清合规不是法务的事，而是从数据建模就开始的设计。 Wed, 11 Feb 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/data-privacy-basics https://yyago.top/en/blog/data-privacy-basics Collect minimally, don't store secrets in plaintext, support erasure. Compliance is not just legal's job; it starts at data modeling. Wed, 11 Feb 2026 00:00:00 GMT en https://yyago.top/blog/api-versioning-strategies https://yyago.top/blog/api-versioning-strategies 改了接口怎么不坑老用户？对比 URL / 请求头 / 媒体类型三种版本策略，以及弃用与迁移的节奏。 Wed, 21 Jan 2026 00:00:00 GMT zh-CN https://yyago.top/en/blog/api-versioning-strategies https://yyago.top/en/blog/api-versioning-strategies How to change an API without breaking old clients. URL vs header vs media-type versioning, plus deprecation and migration cadence. Wed, 21 Jan 2026 00:00:00 GMT en https://yyago.top/blog/regex-catastrophic-backtracking https://yyago.top/blog/regex-catastrophic-backtracking 某些正则遇到特定输入会指数级变慢。讲清嵌套量词为何危险、如何识别与规避，以及超时兜底。 Wed, 31 Dec 2025 00:00:00 GMT zh-CN https://yyago.top/en/blog/regex-catastrophic-backtracking https://yyago.top/en/blog/regex-catastrophic-backtracking Some patterns explode exponentially on certain input. Why nested quantifiers are dangerous, how to spot and avoid them, plus a timeout fallback. Wed, 31 Dec 2025 00:00:00 GMT en https://yyago.top/blog/uuid-and-random-identifiers https://yyago.top/blog/uuid-and-random-identifiers UUID v4 随机、v1 带时间。讲清它适合作主键的优缺点，以及为什么它「不唯一」不等于「可预测」。 Wed, 10 Dec 2025 00:00:00 GMT zh-CN https://yyago.top/en/blog/uuid-and-random-identifiers https://yyago.top/en/blog/uuid-and-random-identifiers UUID v4 is random, v1 carries time. Pros and cons as a primary key, and why "not unique" is not the same as "guessable". Wed, 10 Dec 2025 00:00:00 GMT en https://yyago.top/blog/color-models-rgb-hex-hsl https://yyago.top/blog/color-models-rgb-hex-hsl 三种颜色表示各管什么用。讲清 HEX 只是 RGB 的十六进制写法，HSL 为什么更适合调色，以及透明度怎么表示。 Wed, 19 Nov 2025 00:00:00 GMT zh-CN https://yyago.top/en/blog/color-models-rgb-hex-hsl https://yyago.top/en/blog/color-models-rgb-hex-hsl What each color model is for. HEX is just RGB in hex, why HSL is better for tweaking, and how alpha is represented. Wed, 19 Nov 2025 00:00:00 GMT en https://yyago.top/blog/understanding-cidr-and-subnets https://yyago.top/blog/understanding-cidr-and-subnets 斜杠后面的数字是什么意思？讲清子网掩码、私有地址段，以及怎么判断两个 IP 是否同网段。 Wed, 29 Oct 2025 00:00:00 GMT zh-CN https://yyago.top/en/blog/understanding-cidr-and-subnets https://yyago.top/en/blog/understanding-cidr-and-subnets What the number after the slash means: subnet masks, private ranges, and how to tell if two IPs are on the same network. Wed, 29 Oct 2025 00:00:00 GMT en https://yyago.top/blog/cache-invalidation-basics https://yyago.top/blog/cache-invalidation-basics 缓存能扛流量，也能制造脏数据。讲清缓存键设计、TTL 策略、穿透/击穿/雪崩三种坑。 Wed, 08 Oct 2025 00:00:00 GMT zh-CN https://yyago.top/en/blog/cache-invalidation-basics https://yyago.top/en/blog/cache-invalidation-basics Caches absorb load but also serve stale data. Cache-key design, TTL strategy, and the three failure modes: penetration, stampede, avalanche. Wed, 08 Oct 2025 00:00:00 GMT en https://yyago.top/blog/sql-injection-still-matters https://yyago.top/blog/sql-injection-still-matters 拼接 SQL 是最高频的入侵入口。讲清注入原理、参数化查询为什么有效，以及 ORM 和转义的边界。 Wed, 17 Sep 2025 00:00:00 GMT zh-CN https://yyago.top/en/blog/sql-injection-still-matters https://yyago.top/en/blog/sql-injection-still-matters String-built SQL is the most common breach entry. How injection works, why parameterized queries win, and the limits of ORMs and escaping. Wed, 17 Sep 2025 00:00:00 GMT en https://yyago.top/blog/base64-when-and-when-not https://yyago.top/blog/base64-when-and-when-not 把二进制塞进文本通道时才用 Base64。讲清它不保密、体积会变大，以及常见的误用场景。 Wed, 27 Aug 2025 00:00:00 GMT zh-CN https://yyago.top/en/blog/base64-when-and-when-not https://yyago.top/en/blog/base64-when-and-when-not Use Base64 only to put binary into a text channel. It is not secret, it grows the size, and here is where it is misused. Wed, 27 Aug 2025 00:00:00 GMT en https://yyago.top/blog/password-hashing-and-salting https://yyago.top/blog/password-hashing-and-salting MD5 / SHA 不适合存密码。讲清加盐、bcrypt / Argon2 的慢哈希思路，以及「忘记密码」和「泄露后」该做什么。 Wed, 06 Aug 2025 00:00:00 GMT zh-CN https://yyago.top/en/blog/password-hashing-and-salting https://yyago.top/en/blog/password-hashing-and-salting MD5 / SHA are wrong for password storage. Salting and slow hashes like bcrypt / Argon2, plus what to do on a leak. Wed, 06 Aug 2025 00:00:00 GMT en https://yyago.top/blog/json-schema-validation-basics https://yyago.top/blog/json-schema-validation-basics 入参不校验，bug 和注入都从这儿进。讲清 JSON Schema 能做什么、required/类型/格式的边界，以及它在哪一层最合适。 Wed, 16 Jul 2025 00:00:00 GMT zh-CN https://yyago.top/en/blog/json-schema-validation-basics https://yyago.top/en/blog/json-schema-validation-basics Unvalidated input is where bugs and injection enter. What JSON Schema can and cannot do, plus where in the stack to apply it. Wed, 16 Jul 2025 00:00:00 GMT en https://yyago.top/blog/understanding-https-and-tls-basics https://yyago.top/blog/understanding-https-and-tls-basics HTTPS 不是新协议，而是 HTTP 加 TLS。讲清证书验证的三件事、常见误解，以及为什么内网也该上 HTTPS。 Wed, 25 Jun 2025 00:00:00 GMT zh-CN https://yyago.top/en/blog/understanding-https-and-tls-basics https://yyago.top/en/blog/understanding-https-and-tls-basics HTTPS is HTTP plus TLS, not a new protocol. What certificate validation checks, common myths, and why internal traffic needs it too. Wed, 25 Jun 2025 00:00:00 GMT en https://yyago.top/blog/ai-code-review-checklist https://yyago.top/blog/ai-code-review-checklist 让评审有用而不是凑数：给足上下文、限定输出格式、区分确定的问题与猜测，以及私有代码的隐私边界。 Wed, 11 Jun 2025 00:00:00 GMT zh-CN https://yyago.top/en/blog/ai-code-review-checklist https://yyago.top/en/blog/ai-code-review-checklist Make review useful, not noise: give context, constrain output, separate facts from guesses, and respect the privacy line for private code. Wed, 11 Jun 2025 00:00:00 GMT en https://yyago.top/blog/prompt-injection-and-untrusted-input https://yyago.top/blog/prompt-injection-and-untrusted-input 当模型会读取网页、邮件、文档，攻击者就能在内容里下指令。直接注入与间接注入的区别，以及工程上的防御清单。 Wed, 21 May 2025 00:00:00 GMT zh-CN https://yyago.top/en/blog/prompt-injection-and-untrusted-input https://yyago.top/en/blog/prompt-injection-and-untrusted-input When a model reads web pages, email and documents, attackers can plant instructions inside them. Direct vs indirect injection, plus a defence checklist. Wed, 21 May 2025 00:00:00 GMT en https://yyago.top/blog/backup-321-and-restore-drill https://yyago.top/blog/backup-321-and-restore-drill 备份不是终点，能恢复才是。讲清 3-2-1、RPO/RTO、校验与恢复演练，以及最常见的备份失败。 Wed, 30 Apr 2025 00:00:00 GMT zh-CN https://yyago.top/en/blog/backup-321-and-restore-drill https://yyago.top/en/blog/backup-321-and-restore-drill Backup is not the goal; recovery is. The 3-2-1 rule, RPO/RTO, verification and restore drills, plus the most common failures. Wed, 30 Apr 2025 00:00:00 GMT en https://yyago.top/blog/rate-limiting-algorithms-compared https://yyago.top/blog/rate-limiting-algorithms-compared 四种限流算法的边界问题与适用场景，以及分布式计数、429 与重试退避的配合要点。 Wed, 09 Apr 2025 00:00:00 GMT zh-CN https://yyago.top/en/blog/rate-limiting-algorithms-compared https://yyago.top/en/blog/rate-limiting-algorithms-compared Edge cases and trade-offs of four rate-limit algorithms, plus distributed counting, 429s and retry backoff. Wed, 09 Apr 2025 00:00:00 GMT en https://yyago.top/blog/http-security-headers-checklist https://yyago.top/blog/http-security-headers-checklist HSTS、CSP、X-Content-Type-Options 这些响应头到底管什么？一份可直接照着配的上线清单。 Wed, 19 Mar 2025 00:00:00 GMT zh-CN https://yyago.top/en/blog/http-security-headers-checklist https://yyago.top/en/blog/http-security-headers-checklist What HSTS, CSP and X-Content-Type-Options actually protect, plus a launch-day checklist you can copy. Wed, 19 Mar 2025 00:00:00 GMT en https://yyago.top/blog/image-formats-and-compression-choice https://yyago.top/blog/image-formats-and-compression-choice 照片、截图、图标、动图分别该用什么格式？讲清有损/无损、透明、动画的差异，以及压缩质量怎么设。 Wed, 26 Feb 2025 00:00:00 GMT zh-CN https://yyago.top/en/blog/image-formats-and-compression-choice https://yyago.top/en/blog/image-formats-and-compression-choice Photos, screenshots, icons and animations each want a different format. Lossy vs lossless, transparency, animation, and where to set quality. Wed, 26 Feb 2025 00:00:00 GMT en https://yyago.top/blog/totp-two-factor-basics https://yyago.top/blog/totp-two-factor-basics 6 位动态码为什么有用？它防的是密码泄露，而不是钓鱼。讲清 TOTP 原理、三种 2FA 强度与正确使用姿势。 Wed, 05 Feb 2025 00:00:00 GMT zh-CN https://yyago.top/en/blog/totp-two-factor-basics https://yyago.top/en/blog/totp-two-factor-basics Why a 6-digit code helps, and what it does not. TOTP internals, three tiers of 2FA strength, and how to use them well. Wed, 05 Feb 2025 00:00:00 GMT en https://yyago.top/blog/unicode-normalization-and-string-compare https://yyago.top/blog/unicode-normalization-and-string-compare 同一字符有多种写法，直接比较必然出错。讲清 NFC/NFD/NFKC 的区别，以及存储、比较与哈希时的正确做法。 Wed, 15 Jan 2025 00:00:00 GMT zh-CN https://yyago.top/en/blog/unicode-normalization-and-string-compare https://yyago.top/en/blog/unicode-normalization-and-string-compare The same character has several representations, so naive comparison fails. NFC, NFD and NFKC explained, plus correct storage, comparison and hashing. Wed, 15 Jan 2025 00:00:00 GMT en https://yyago.top/blog/semantic-versioning-in-practice https://yyago.top/blog/semantic-versioning-in-practice 什么时候该升 MAJOR？^ 与 ~ 差在哪？讲清版本号语义、0.x 阶段规则与依赖声明中的四个常见坑。 Wed, 25 Dec 2024 00:00:00 GMT zh-CN https://yyago.top/en/blog/semantic-versioning-in-practice https://yyago.top/en/blog/semantic-versioning-in-practice When does a change deserve a MAJOR bump? What is the difference between ^ and ~? Version semantics, the 0.x rules, and four dependency traps. Wed, 25 Dec 2024 00:00:00 GMT en https://yyago.top/blog/shell-scripting-essentials https://yyago.top/blog/shell-scripting-essentials set -euo pipefail 为什么是标配？$var 与 "$var" 差在哪？讲清可维护脚本的写法与最容易出事的四个地方。 Wed, 18 Dec 2024 00:00:00 GMT zh-CN https://yyago.top/en/blog/shell-scripting-essentials https://yyago.top/en/blog/shell-scripting-essentials Why set -euo pipefail is standard, how $var differs from "$var", and the four places scripts most often break. Wed, 18 Dec 2024 00:00:00 GMT en https://yyago.top/blog/ssh-keys-and-config-practices https://yyago.top/blog/ssh-keys-and-config-practices 为什么推荐 ed25519？~/.ssh/config 怎么写最省事？讲清密钥部署、多主机别名与四个常见坑。 Wed, 11 Dec 2024 00:00:00 GMT zh-CN https://yyago.top/en/blog/ssh-keys-and-config-practices https://yyago.top/en/blog/ssh-keys-and-config-practices Why ed25519? How to write a useful ~/.ssh/config? Key deployment, host aliases, and four common pitfalls. Wed, 11 Dec 2024 00:00:00 GMT en https://yyago.top/blog/linux-file-permissions-basics https://yyago.top/blog/linux-file-permissions-basics 755、644、600 分别代表什么？目录的执行位为什么特殊？讲清三组身份、数字表示法与五个高频错误。 Wed, 04 Dec 2024 00:00:00 GMT zh-CN https://yyago.top/en/blog/linux-file-permissions-basics https://yyago.top/en/blog/linux-file-permissions-basics What do 755, 644 and 600 mean? Why is the execute bit special on directories? Three identity groups, octal notation, and five frequent mistakes. Wed, 04 Dec 2024 00:00:00 GMT en https://yyago.top/blog/concurrency-models-compared https://yyago.top/blog/concurrency-models-compared CPU 密集还是 IO 密集？要不要强隔离？用四个维度对比四种并发模型，并给出选择顺序与常见坑。 Wed, 27 Nov 2024 00:00:00 GMT zh-CN https://yyago.top/en/blog/concurrency-models-compared https://yyago.top/en/blog/concurrency-models-compared CPU-bound or IO-bound? Need isolation? Compare four concurrency models across key dimensions, with a selection order and common traps. Wed, 27 Nov 2024 00:00:00 GMT en https://yyago.top/blog/tcp-vs-udp-choose https://yyago.top/blog/tcp-vs-udp-choose 要不要重传、要不要保序、能不能容忍抖动？用五个维度对比 TCP 与 UDP，并讲清在 UDP 上自建可靠性需要补什么。 Wed, 20 Nov 2024 00:00:00 GMT zh-CN https://yyago.top/en/blog/tcp-vs-udp-choose https://yyago.top/en/blog/tcp-vs-udp-choose Retransmit or not? Ordering? Jitter tolerance? Compare TCP and UDP across five dimensions, and what you must rebuild on top of UDP. Wed, 20 Nov 2024 00:00:00 GMT en https://yyago.top/blog/dns-resolution-basics https://yyago.top/blog/dns-resolution-basics A、AAAA、CNAME、MX、TXT 各自解决什么问题？解析经过哪几级缓存？TTL 该怎么设？附常用排查命令与三个高频坑。 Wed, 13 Nov 2024 00:00:00 GMT zh-CN https://yyago.top/en/blog/dns-resolution-basics https://yyago.top/en/blog/dns-resolution-basics What A, AAAA, CNAME, MX and TXT each do, the cache chain a lookup walks, how to pick TTLs, plus debug commands and three common traps. Wed, 13 Nov 2024 00:00:00 GMT en https://yyago.top/blog/http-request-lifecycle https://yyago.top/blog/http-request-lifecycle 从输入网址到页面呈现，请求经历了 URL 解析、DNS、连接、发送、处理、响应与子资源加载。逐段拆解耗时来源与排障顺序。 Wed, 06 Nov 2024 00:00:00 GMT zh-CN https://yyago.top/en/blog/http-request-lifecycle https://yyago.top/en/blog/http-request-lifecycle From typing a URL to a rendered page: parsing, DNS, connecting, sending, processing, responding, sub-resources, plus where time goes and how to debug. Wed, 06 Nov 2024 00:00:00 GMT en https://yyago.top/blog/cert-chain-and-trust-anchor https://yyago.top/blog/cert-chain-and-trust-anchor 单张服务器证书不够，还要让浏览器顺着链找到它信任的根。讲清证书链、中间证书、信任锚与常见部署错误。 Wed, 09 Oct 2024 00:00:00 GMT zh-CN https://yyago.top/en/blog/cert-chain-and-trust-anchor https://yyago.top/en/blog/cert-chain-and-trust-anchor One server certificate is not enough: the browser must follow the chain to a root it trusts. Chains, intermediate certs, trust anchors and common mistakes. Wed, 09 Oct 2024 00:00:00 GMT en https://yyago.top/blog/gray-release-blue-green https://yyago.top/blog/gray-release-blue-green 别一次性把新版本推给所有人。讲清灰度按比例放量、蓝绿秒级切换，以及出问题如何快速回滚。 Wed, 18 Sep 2024 00:00:00 GMT zh-CN https://yyago.top/en/blog/gray-release-blue-green https://yyago.top/en/blog/gray-release-blue-green Do not push the new version to everyone at once. Canary by percentage, blue-green instant switch, and how to roll back fast. Wed, 18 Sep 2024 00:00:00 GMT en https://yyago.top/blog/websocket-vs-polling https://yyago.top/blog/websocket-vs-polling 轮询浪费请求，长轮询半实时，WebSocket 双向长连。讲清各自适用，以及心跳保活与断线重连。 Wed, 28 Aug 2024 00:00:00 GMT zh-CN https://yyago.top/en/blog/websocket-vs-polling https://yyago.top/en/blog/websocket-vs-polling Polling wastes requests, long-polling is semi-real-time, WebSocket is a bidirectional long connection. When each fits, plus heartbeat and reconnect. Wed, 28 Aug 2024 00:00:00 GMT en https://yyago.top/blog/cdn-how-it-works https://yyago.top/blog/cdn-how-it-works 用户请求被调度到最近的边缘节点。讲清 DNS 调度、缓存命中与回源、刷新与预热，以及什么内容适合上 CDN。 Wed, 07 Aug 2024 00:00:00 GMT zh-CN https://yyago.top/en/blog/cdn-how-it-works https://yyago.top/en/blog/cdn-how-it-works Requests are routed to the nearest edge node. DNS-based routing, cache hits versus origin fetch, purge and prefetch, and what belongs on a CDN. Wed, 07 Aug 2024 00:00:00 GMT en https://yyago.top/blog/forward-reverse-proxy https://yyago.top/blog/forward-reverse-proxy 正向代理代表客户端出门，反向代理代表服务端接客。讲清两者位置、用途，以及反向代理在网关里的角色。 Wed, 17 Jul 2024 00:00:00 GMT zh-CN https://yyago.top/en/blog/forward-reverse-proxy https://yyago.top/en/blog/forward-reverse-proxy A forward proxy represents the client going out; a reverse proxy represents the server facing users. Position, use, and the gateway role. Wed, 17 Jul 2024 00:00:00 GMT en https://yyago.top/blog/http2-http3-improvements https://yyago.top/blog/http2-http3-improvements 队头阻塞、多路复用、头部压缩。讲清 HTTP/2 的改进，以及 HTTP/3 为何改用 QUIC 跑在 UDP 上。 Wed, 26 Jun 2024 00:00:00 GMT zh-CN https://yyago.top/en/blog/http2-http3-improvements https://yyago.top/en/blog/http2-http3-improvements Head-of-line blocking, multiplexing, header compression. HTTP/2 gains, and why HTTP/3 moves to QUIC over UDP. Wed, 26 Jun 2024 00:00:00 GMT en https://yyago.top/blog/circuit-breaker-and-degrade https://yyago.top/blog/circuit-breaker-and-degrade 下游超时时一直重试只会雪崩。讲清熔断三状态、半开探测，以及降级返回兜底而非硬等。 Wed, 05 Jun 2024 00:00:00 GMT zh-CN https://yyago.top/en/blog/circuit-breaker-and-degrade https://yyago.top/en/blog/circuit-breaker-and-degrade Endless retries on a slow downstream only cause an avalanche. The three breaker states, half-open probing, and serving a fallback instead of blocking. Wed, 05 Jun 2024 00:00:00 GMT en https://yyago.top/blog/message-queue-basics https://yyago.top/blog/message-queue-basics 生产者把任务丢进队列就返回，消费者慢慢处理。讲清异步、削峰填谷、解耦，以及重复消费与顺序的注意点。 Wed, 15 May 2024 00:00:00 GMT zh-CN https://yyago.top/en/blog/message-queue-basics https://yyago.top/en/blog/message-queue-basics The producer drops a task in the queue and returns; the consumer handles it later. Async, peak buffering, decoupling, plus duplicate and ordering caveats. Wed, 15 May 2024 00:00:00 GMT en https://yyago.top/blog/database-index-why-fast https://yyago.top/blog/database-index-why-fast 没有索引只能全表扫。讲清 B+ 树索引、回表、最左前缀，以及索引不是越多越好的权衡。 Wed, 24 Apr 2024 00:00:00 GMT zh-CN https://yyago.top/en/blog/database-index-why-fast https://yyago.top/en/blog/database-index-why-fast Without an index the database scans the whole table. B+tree indexes, the return-to-table step, leftmost prefix, and why more indexes are not always better. Wed, 24 Apr 2024 00:00:00 GMT en https://yyago.top/blog/process-thread-coroutine https://yyago.top/blog/process-thread-coroutine 进程隔离、线程共享内存、协程用户态调度。讲清各自的成本、切换开销，以及为什么高并发服务偏爱协程或异步。 Wed, 03 Apr 2024 00:00:00 GMT zh-CN https://yyago.top/en/blog/process-thread-coroutine https://yyago.top/en/blog/process-thread-coroutine Processes isolate, threads share memory, coroutines schedule in user space. Their costs, switching overhead, and when to favour coroutines or async. Wed, 03 Apr 2024 00:00:00 GMT en https://yyago.top/blog/oauth2-authorization-code https://yyago.top/blog/oauth2-authorization-code 为什么「用微信登录」不会把密码交给第三方。讲清授权码流程、access token 与 refresh token，以及 PKCE 的作用。 Wed, 13 Mar 2024 00:00:00 GMT zh-CN https://yyago.top/en/blog/oauth2-authorization-code https://yyago.top/en/blog/oauth2-authorization-code Why "log in with WeChat" never gives your password to the app. The authorization-code flow, access vs refresh tokens, and what PKCE adds. Wed, 13 Mar 2024 00:00:00 GMT en https://yyago.top/blog/cookie-vs-session https://yyago.top/blog/cookie-vs-session Cookie 存在浏览器、Session 存在服务端。讲清登录态怎么靠两者配合、JWT 为何常被误当 Session，以及安全标记。 Wed, 21 Feb 2024 00:00:00 GMT zh-CN https://yyago.top/en/blog/cookie-vs-session https://yyago.top/en/blog/cookie-vs-session Cookies live in the browser, sessions on the server. How login state relies on both, why JWT is mistaken for a session, and the security flags. Wed, 21 Feb 2024 00:00:00 GMT en https://yyago.top/blog/get-vs-post-when https://yyago.top/blog/get-vs-post-when GET 可被缓存、留在历史、有长度限制；POST 放 body、不被缓存。讲清语义、幂等与安全的边界，以及幂等为何重要。 Wed, 31 Jan 2024 00:00:00 GMT zh-CN https://yyago.top/en/blog/get-vs-post-when https://yyago.top/en/blog/get-vs-post-when GET can be cached, sits in history, has length limits; POST carries a body and is not cached. Semantics, safety, idempotency, and when it matters. Wed, 31 Jan 2024 00:00:00 GMT en https://yyago.top/blog/rest-api-design-basics https://yyago.top/blog/rest-api-design-basics 把事物当资源、用 HTTP 方法表示动作。讲清资源化、状态码、分页与版本，以及把动词塞进路径的反模式。 Wed, 10 Jan 2024 00:00:00 GMT zh-CN https://yyago.top/en/blog/rest-api-design-basics https://yyago.top/en/blog/rest-api-design-basics Treat things as resources and HTTP methods as actions. Resources, status codes, pagination, versioning, and the verb-in-path anti-pattern. Wed, 10 Jan 2024 00:00:00 GMT en