XiaoMo's personal site: writing, small games, and browser tools.https://www.moiu.cn/enhttps://www.moiu.cn/en/blog/mc-launcher-download-shutdown/https://www.moiu.cn/en/blog/mc-launcher-download-shutdown/On October 20, PCL and HMCL both shut down Minecraft downloads in mainland China. The confirmed timeline, the official wording, the rumor, and what it signals.Tue, 20 Oct 2026 00:00:00 GMTgamestoolshttps://www.moiu.cn/en/blog/astro-742-content-sync/https://www.moiu.cn/en/blog/astro-742-content-sync/On a 44k-entry store, the chunking step drops from about 60 seconds to well under one second with byte-identical output. The fix is not a faster algorithm, but a different way to know how wide a character is.Mon, 26 Oct 2026 00:00:00 GMTAstroperformancemetahttps://www.moiu.cn/en/blog/bun-144-fmt/https://www.moiu.cn/en/blog/bun-144-fmt/bun fmt reads your existing Prettier config and plugins, running 59.7 ms against 17.1 s on Prettier's own repository, 48 MB against 459 MB. What matters is how it proves identical output: byte comparison plus a semantic re-parse check.Mon, 26 Oct 2026 00:00:00 GMTtoolsperformancebackendhttps://www.moiu.cn/en/blog/deno-298/https://www.moiu.cn/en/blog/deno-298/This patch release has 13 fixes, half of them permission and sandbox edges, half Node-compatibility semantics. The eMudhra distrust lines up with what uv and CPython did the same week.Mon, 26 Oct 2026 00:00:00 GMTsecuritybackendtoolshttps://www.moiu.cn/en/blog/electron-45/https://www.moiu.cn/en/blog/electron-45/Three breaking changes: sandboxed preload scripts lose events/timers/url and the Buffer globals, Workers created inside iframes no longer inherit Node integration, and extension pages stop receiving preload scripts unconditionally.Mon, 26 Oct 2026 00:00:00 GMTtoolsperformancebackendhttps://www.moiu.cn/en/blog/home-assistant-2026103/https://www.moiu.cn/en/blog/home-assistant-2026103/Of roughly thirty changes, most are concrete integration bugs (Proxmox, UniFi Access, Sensibo, KNX, FRITZ!SmartHome and more); the rest are base-layer moves like Python 3.14.8, uv climbing to 0.13.5 and runners on Ubuntu 26.04.Mon, 26 Oct 2026 00:00:00 GMTbackendtoolshttps://www.moiu.cn/en/blog/llama-cpp-b11899/https://www.moiu.cn/en/blog/llama-cpp-b11899/b11899 is a nightly build whose only substantive change adds mtmd_helper_get_capabilities, reporting audio_stream, speaker reference and text generation while keeping the old API. The build number itself tells you how this project ships.Mon, 26 Oct 2026 00:00:00 GMTtoolsbackendperformancehttps://www.moiu.cn/en/blog/node-26121-security/https://www.moiu.cn/en/blog/node-26121-security/On October 21 Node released 26.12.1, 24.22.1 and 22.23.4 together, fixing 11 CVEs. The high-severity ones cluster in tls and dns input parsing, alongside two permission-model edge cases and a root store bump to NSS 3.131.1.Mon, 26 Oct 2026 00:00:00 GMTsecuritybackendvulnerabilityhttps://www.moiu.cn/en/blog/ollama-04011-speech/https://www.moiu.cn/en/blog/ollama-04011-speech/Two unrelated additions: ollama run speaks on macOS while generating, exposing an OpenAI-compatible /v1/audio/speech; and the d3 family of decision models built for classification, judgments and probability scoring.Mon, 26 Oct 2026 00:00:00 GMTtoolsbackendhttps://www.moiu.cn/en/blog/redis-8103-cluster/https://www.moiu.cn/en/blog/redis-8103-cluster/8.10.3, 8.8.4 and 8.6.8 fix the same bug: in cluster mode, propagating a PUBLISH or SPUBLISH message larger than 4GB over the cluster bus overflows a heap buffer. Narrow impact, but the trigger conditions are worth remembering.Mon, 26 Oct 2026 00:00:00 GMTsecuritybackendvulnerabilityhttps://www.moiu.cn/en/blog/ruff-0172/https://www.moiu.cn/en/blog/ruff-0172/Mostly false positives: starred type variable constraints, backslash-escaped args in pydocstyle, star elements in pylint. It also marks comment-deleting fixes unsafe and lands two performance changes.Mon, 26 Oct 2026 00:00:00 GMTtoolsperformancebackendhttps://www.moiu.cn/en/blog/traefik-3716/https://www.moiu.cn/en/blog/traefik-3716/Two things in this patch: a fix for GHSA-hrpp-p4fc-wwf8, and NTLM/Kerberos support in ForwardAuth and ingress-nginx auth-url. The latter fixes the long-standing "corporate SSO behind a gateway never authenticates" problem.Mon, 26 Oct 2026 00:00:00 GMTbackendsecuritytoolshttps://www.moiu.cn/en/blog/typescript-71-beta/https://www.moiu.cn/en/blog/typescript-71-beta/The beta has six sections: import attributes in ambient modules, source phase imports, --target es2026, new library methods, the 7.1 API (snapshots, file system, content mappers) and a few behavioral changes.Mon, 26 Oct 2026 00:00:00 GMTtoolsbackendperformancehttps://www.moiu.cn/en/blog/uv-0135-cpython/https://www.moiu.cn/en/blog/uv-0135-cpython/0.13.4 removed the eMudhra/emSign root from uv's own certificate store; 0.13.5 rebuilds managed CPython 3.11+ on python-build-standalone 20261021, with 3.15.1, 3.14.9, 3.13.17, pip 26.2.2 and certifi 2026.10.19. Run uv python upgrade afterwards.Mon, 26 Oct 2026 00:00:00 GMTbackendsecuritytoolshttps://www.moiu.cn/en/blog/vite-835/https://www.moiu.cn/en/blog/vite-835/Eight of 21 fixes carry the bundled-dev prefix — HMR propagation, error stack mapping, server.origin, import.meta.env injection — plus two chunk import map correctness fixes and a CSS percent-sign build failure.Mon, 26 Oct 2026 00:00:00 GMTperformancetoolsmetahttps://www.moiu.cn/en/blog/vue-36-rc13-vapor/https://www.moiu.cn/en/blog/vue-36-rc13-vapor/Almost everything in 3.6.0-rc.13 points at compiler-vapor, plus one change that restores the 200ms default delay for async components. The first says Vapor is still catching up on semantics; the second says defaults are API.Mon, 26 Oct 2026 00:00:00 GMTVueperformancemetahttps://www.moiu.cn/en/blog/beyondtrust-cve-2026-102764/https://www.moiu.cn/en/blog/beyondtrust-cve-2026-102764/CVE-2026-102764 is an auth bypass in BeyondTrust Remote Support up to 26.2.3, added to CISA KEV on October 16. Blast radius, patch path and what to hunt.Fri, 23 Oct 2026 00:00:00 GMTsecurityvulnerabilityhttps://www.moiu.cn/en/blog/python-315/https://www.moiu.cn/en/blog/python-315/Python 3.15.0 shipped on October 9 with 5,643 commits from 1,012 contributors. What UTF-8 defaults, lazy imports, frozendict and the JIT change for you.Fri, 23 Oct 2026 00:00:00 GMTbackendperformancetoolshttps://www.moiu.cn/en/blog/safari-tp-254/https://www.moiu.cn/en/blog/safari-tp-254/Safari Technology Preview 254 adds calc-size(), size and per-side radius shorthands, plus live pinch-to-zoom on macOS. What changes in your CSS.Fri, 23 Oct 2026 00:00:00 GMTCSSperformancehttps://www.moiu.cn/en/blog/servo-css-grid/https://www.moiu.cn/en/blog/servo-css-grid/Servo 0.6.0 ships August's 417 commits and turns CSS Grid on by default. What in the release notes actually changes how pages render.Fri, 23 Oct 2026 00:00:00 GMTCSSperformancehttps://www.moiu.cn/en/blog/zig-017/https://www.moiu.cn/en/blog/zig-017/Zig 0.17.0 shipped on October 2 after five months, 206 contributors and 925 commits: syntax breaks, stdlib renames and the build-system split.Fri, 23 Oct 2026 00:00:00 GMTperformancetoolsbackendhttps://www.moiu.cn/en/blog/cloudflare-outage/https://www.moiu.cn/en/blog/cloudflare-outage/On November 18, 2025, Cloudflare's core proxy returned 5xx for about three hours and a large share of the web went down with it. The postmortem points at an internal configuration change, not an attack — and the blast radius is the lesson.Thu, 22 Oct 2026 00:00:00 GMTperformancemetahttps://www.moiu.cn/en/blog/css-if-function/https://www.moiu.cn/en/blog/css-if-function/Chrome 137 shipped the CSS if() function, which lets any property value branch on a custom property, a media query or feature support. It does not replace media queries, but it collapses a lot of duplicated blocks.Thu, 22 Oct 2026 00:00:00 GMTCSSdesignhttps://www.moiu.cn/en/blog/mcp-inspector-cve/https://www.moiu.cn/en/blog/mcp-inspector-cve/Before 0.14.1, MCP Inspector had no authentication between its browser UI and its local proxy, so an unauthenticated request could launch MCP commands over stdio. CVSS 9.4 — and the lesson applies to every local-proxy dev tool.Thu, 22 Oct 2026 00:00:00 GMTsecurityvulnerabilityhttps://www.moiu.cn/en/blog/nodejs-24-lts/https://www.moiu.cn/en/blog/nodejs-24-lts/Node.js 24 became LTS on October 28, 2025 under the codename Krypton, supported until April 2028. V8 13.6, npm 11, a stable permission model and require(esm) by default — plus the rough edges to know before upgrading.Thu, 22 Oct 2026 00:00:00 GMTbackendtoolshttps://www.moiu.cn/en/blog/php2shell-poc/https://www.moiu.cn/en/blog/php2shell-poc/On October 21 PHP fixed CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2); a public PoC with a full lab appeared the next day. Here are the longjmp and stale-global-state root causes, a reproducible lab, the PoC, and where the PoC diverges from the advisory.Thu, 22 Oct 2026 00:00:00 GMTsecurityvulnerabilitybackendhttps://www.moiu.cn/en/blog/postgresql-18/https://www.moiu.cn/en/blog/postgresql-18/PostgreSQL 18 shipped in September 2025 with a new asynchronous I/O subsystem (up to 3x on reads), uuidv7() in core, virtual generated columns and OAuth 2.0 authentication. Here is what actually matters.Thu, 22 Oct 2026 00:00:00 GMTbackendhttps://www.moiu.cn/en/blog/react-server-components-rce/https://www.moiu.cn/en/blog/react-server-components-rce/A flaw in how React Server Components decode payloads earned a perfect 10.0 — unauthenticated remote code execution. Here is who is affected, how to check, and what to do about it.Thu, 22 Oct 2026 00:00:00 GMTsecurityvulnerabilityhttps://www.moiu.cn/en/blog/tj-actions-supply-chain/https://www.moiu.cn/en/blog/tj-actions-supply-chain/In March 2025 the version tags of tj-actions/changed-files were pointed at a malicious commit, and CI tokens were printed into workflow logs. CVE-2025-30066 is the bill for mutable tags.Thu, 22 Oct 2026 00:00:00 GMTsecurityvulnerabilityhttps://www.moiu.cn/en/blog/tls-47-day-certs/https://www.moiu.cn/en/blog/tls-47-day-certs/CA/Browser Forum ballot SC-081 caps certificate lifetimes at 200 days from March 2026, 100 days from 2027, and 47 days from 2029. Manual renewal has a deadline now.Thu, 22 Oct 2026 00:00:00 GMTsecuritybackendhttps://www.moiu.cn/en/blog/cvss-v4-reading-a-9-2/https://www.moiu.cn/en/blog/cvss-v4-reading-a-9-2/Both PHP vulnerabilities today are rated CVSS v4.0 9.2. That number is a filter, not a priority: it measures the vulnerability, not your assets, your exposure, or the cost of patching.Wed, 21 Oct 2026 00:00:00 GMTsecurityvulnerabilityhttps://www.moiu.cn/en/blog/emudhra-eight-intermediate-keys/https://www.moiu.cn/en/blog/emudhra-eight-intermediate-keys/Someone scanned the CCADB certificate corpus and found that eight eMudhra intermediate CA keys could simply be enumerated — they were generated as integers between 0 and 255. Yesterday Mozilla decided to remove trust in emSign ECC Root CA - G3.Wed, 21 Oct 2026 00:00:00 GMTsecurityvulnerabilityhttps://www.moiu.cn/en/blog/php-critical-release-2026-10-21/https://www.moiu.cn/en/blog/php-critical-release-2026-10-21/PHP posted an advance notice on 20 October: a security release on 21 October at 14:00 UTC fixes two vulnerabilities, both rated CVSS v4.0 9.2. Details come with the release, but your rollback plan can be settled now.Wed, 21 Oct 2026 00:00:00 GMTsecurityvulnerabilitybackendhttps://www.moiu.cn/en/blog/php-cves-are-not-in-php/https://www.moiu.cn/en/blog/php-cves-are-not-in-php/I pulled every PHP-related advisory NVD published between 19 and 21 October. All twelve are plugins, CMS modules and libraries. That is the more useful signal: your real inventory is not the language.Wed, 21 Oct 2026 00:00:00 GMTsecuritybackendhttps://www.moiu.cn/en/blog/self-hosting-open-source-games/https://www.moiu.cn/en/blog/self-hosting-open-source-games/I vendored ten MIT/public-domain HTML5 games into this static site — 48.4 MB in total. The work was not copying files; it was licences, size, and the fact that all of them loaded things from CDNs.Wed, 21 Oct 2026 00:00:00 GMTgamesmetaperformancehttps://www.moiu.cn/en/blog/scene-webgl-lifecycle/https://www.moiu.cn/en/blog/scene-webgl-lifecycle/Fourteen Three.js scenes on one site is not a rendering problem, it is a scheduling problem. Two gates, one SPA navigation bug, and the WebGL context I forgot to release.Tue, 20 Oct 2026 00:00:00 GMTAstroperformancehttps://www.moiu.cn/en/blog/cve-2026-99999-debian/https://www.moiu.cn/en/blog/cve-2026-99999-debian/Debian security tracker lists CVE-2026-99999 as a missing IPv4 checksum check in the Linux kernel, exploitable from a guest to the KVM host. Fixed in 6.1.190-1 (bookworm) and 6.12.113-1 (trixie).Mon, 19 Oct 2026 00:00:00 GMTvulnerabilitydebiansecurityhttps://www.moiu.cn/en/blog/deepseek-v4-1-flash-1017/https://www.moiu.cn/en/blog/deepseek-v4-1-flash-1017/I pulled the benchmark table, the performance-cost chart and the case images from DeepSeek's official changelog. The update is about doing work, not about being smarter — and the price did not change.Mon, 19 Oct 2026 00:00:00 GMTllmperformancehttps://www.moiu.cn/en/blog/klotski-as-data/https://www.moiu.cn/en/blog/klotski-as-data/Sliding puzzles are not hard because of the board, but because of "can this piece move". Flatten 4x5 into occupancy, get the check in three lines, and use BFS instead of A*.Mon, 19 Oct 2026 00:00:00 GMTalgorithmsgameshttps://www.moiu.cn/en/blog/cert-2026-llm-security-report/https://www.moiu.cn/en/blog/cert-2026-llm-security-report/2,467 white hats tested 54 LLM and agent products from 25 vendors and found 873 vulnerabilities, 608 of them LLM-specific. Prompt injection still ranks first; a hardcoded API key exposed keys for 239 models at once.Sun, 18 Oct 2026 00:00:00 GMTllmsecurityvulnerabilityhttps://www.moiu.cn/en/blog/nextjs-react-oct-2026-rce/https://www.moiu.cn/en/blog/nextjs-react-oct-2026-rce/In mid-October Next.js and React shipped three vulnerabilities: an image-processing RCE, a use cache RCE and a Server Action denial of service. The patches are out of band — do not wait for the next minor version.Sun, 18 Oct 2026 00:00:00 GMTsecurityvulnerabilitywebhttps://www.moiu.cn/en/blog/pipes-spanning-tree/https://www.moiu.cn/en/blog/pipes-spanning-tree/Random pipe orientations mostly produce unsolvable boards. Generate a spanning tree first, then rotate every cell — solvability comes from the construction, not from a check.Sun, 18 Oct 2026 00:00:00 GMTalgorithmsgameshttps://www.moiu.cn/en/blog/agent-identity-abuse-2026/https://www.moiu.cn/en/blog/agent-identity-abuse-2026/In the LLM security report, agent identity and permission abuse plus goal hijacking account for two categories. Delegation chains, memory defects and forged tool responses can give a low-privilege agent high-privilege credentials.Sat, 17 Oct 2026 00:00:00 GMTllmsecurityagentshttps://www.moiu.cn/en/blog/css-halftone/https://www.moiu.cn/en/blog/css-halftone/Print texture is not a filter. It is three measurable things: dot angle, ink offset, and opacity. Build them with gradients and masks, no images involved.Sat, 17 Oct 2026 00:00:00 GMTCSSdesignhttps://www.moiu.cn/en/blog/prompt-injection-2026/https://www.moiu.cn/en/blog/prompt-injection-2026/In the 2026 LLM security report, prompt injection remains the most common finding. It is hard to fix not because models are dumb, but because systems lack a boundary between data and instructions.Sat, 17 Oct 2026 00:00:00 GMTllmsecurityhttps://www.moiu.cn/en/blog/agent-sandbox-escape-pwnescape/https://www.moiu.cn/en/blog/agent-sandbox-escape-pwnescape/PwnEscape exploits an L2/L3 offset mismatch in virtio-net/TAP to reach the KVM host from a guest, tracked as CVE-2026-99999. It is a reminder that isolating untrusted code in a microVM assumes the host kernel has no reachable path from the guest.Fri, 16 Oct 2026 00:00:00 GMTvulnerabilityllmagentshttps://www.moiu.cn/en/blog/llm-api-key-leak-2026/https://www.moiu.cn/en/blog/llm-api-key-leak-2026/The sharpest example in the LLM security report: a product hardcoded cloud API keys for 239 models in its frontend. Key leaks are not new, but LLMs amplify them — one key is a whole fleet of models and a bill.Fri, 16 Oct 2026 00:00:00 GMTllmsecurityhttps://www.moiu.cn/en/blog/pagefind-bilingual/https://www.moiu.cn/en/blog/pagefind-bilingual/A static site has no backend, so search has to be baked in at build time. Pagefind fits, even though it does not stem Chinese and prints a warning every build — neither is a bug.Fri, 16 Oct 2026 00:00:00 GMTmetaperformancehttps://www.moiu.cn/en/blog/cdn-edge/https://www.moiu.cn/en/blog/cdn-edge/A site hosted in Virginia can serve you images from a machine in your own city. This covers the three jobs of a CDN, why cache hit ratio is the only metric that really matters, what else edge nodes do, and why CDNs fight to get into internet exchanges.Thu, 15 Oct 2026 00:00:00 GMTnetworkingperformanceCDNhttps://www.moiu.cn/en/blog/classical-ciphers/https://www.moiu.cn/en/blog/classical-ciphers/Caesar, Vigenere and Atbash all look like table lookups, but case handling, non-letter characters and key alignment each fail silently when done wrong.Thu, 15 Oct 2026 00:00:00 GMTtoolssecurityhttps://www.moiu.cn/en/blog/data-center-power/https://www.moiu.cn/en/blog/data-center-power/The thing a data center fears is not downtime, it is a blackout. This covers the full chain from the utility feed to the rack, the three UPS topologies, why a diesel generator must carry load within ten seconds, and how the PUE number gets gamed.Thu, 15 Oct 2026 00:00:00 GMTinfrastructurehardwarehttps://www.moiu.cn/en/blog/debian-dsa-6045-pdns-recursor/https://www.moiu.cn/en/blog/debian-dsa-6045-pdns-recursor/Debian issued DSA-6045-1 for pdns-recursor, fixing CVE-2026-52690 and related issues. An attacker can forge answers so the resolver marks an authoritative server as EDNS-incapable, which makes DNSSEC validation fail.Thu, 15 Oct 2026 00:00:00 GMTdebianvulnerabilitysecurityhttps://www.moiu.cn/en/blog/network-time-sync/https://www.moiu.cn/en/blog/network-time-sync/How far apart can two clocks be before things break? This covers how NTP derives an offset from four timestamps, why stratum measures distance rather than accuracy, why leap seconds are so awkward, and what happens when time gets poisoned.Thu, 15 Oct 2026 00:00:00 GMTnetworkinginfrastructurehttps://www.moiu.cn/en/blog/photolithography/https://www.moiu.cn/en/blog/photolithography/The smallest features on a modern chip are a few nanometres across, smaller than most viruses. They are not carved but printed with light. This covers the four-step cycle, the Rayleigh criterion, the multi-patterning era, and why EUV is so hard.Thu, 15 Oct 2026 00:00:00 GMTinfrastructurehardwarehttps://www.moiu.cn/en/blog/quic-http3/https://www.moiu.cn/en/blog/quic-http3/HTTP/3 is the first HTTP that does not run on TCP. This covers where TCP head-of-line blocking actually hurts, what QUIC moved into user space, how connection migration works, and what the switch costs.Thu, 15 Oct 2026 00:00:00 GMTnetworkingperformancehttps://www.moiu.cn/en/blog/undersea-cables/https://www.moiu.cn/en/blog/undersea-cables/Every overseas site you open probably travels through a glass fibre on the ocean floor. This is how submarine cables are built, how fragile they are, who lays them, and why satellites cannot replace them.Thu, 15 Oct 2026 00:00:00 GMTnetworkinginfrastructurehttps://www.moiu.cn/en/blog/data-center-cooling/https://www.moiu.cn/en/blog/data-center-cooling/AI racks have outgrown air cooling. Here is why data centers are switching cooling methods, and what air, direct-to-chip liquid and immersion cooling each cost.Wed, 14 Oct 2026 00:00:00 GMTinfrastructureperformancehttps://www.moiu.cn/en/blog/geo-manipulation-ai-search/https://www.moiu.cn/en/blog/geo-manipulation-ai-search/When DeepSeek opened its search API it mentioned filtering SEO spam, GEO manipulation and low-quality AIGC. GEO optimizes the probability of being cited by a model, not a page rank. Here is how it works and why it is hard to defend.Wed, 14 Oct 2026 00:00:00 GMTllmsecurityhttps://www.moiu.cn/en/blog/satellite-internet/https://www.moiu.cn/en/blog/satellite-internet/Starlink has passed eleven thousand satellites in orbit. LEO constellations cut latency to tens of milliseconds, and bring orbital debris, astronomy and capacity economics along with them.Tue, 13 Oct 2026 00:00:00 GMTnetworkinginfrastructurehttps://www.moiu.cn/en/blog/astro-7-upgrade/https://www.moiu.cn/en/blog/astro-7-upgrade/Astro 7 moved the compiler and the Markdown pipeline to Rust and switched the bundler to Rolldown. The upgrade was quick; the failures it surfaced afterwards were not.Mon, 12 Oct 2026 00:00:00 GMTAstroperformancemetahttps://www.moiu.cn/en/blog/css-functions-and-conditionals/https://www.moiu.cn/en/blog/css-functions-and-conditionals/Two new pieces of CSS — custom functions and inline conditionals — remove the copy-paste that every component accumulates. Neither is Baseline yet, but both are worth reading early.Mon, 12 Oct 2026 00:00:00 GMTCSSdesignhttps://www.moiu.cn/en/blog/http-query-method/https://www.moiu.cn/en/blog/http-query-method/GET cannot carry a body and POST cannot be retried safely, so query endpoints have been stuck between two wrong options for twenty years. The IETF QUERY draft adds a third: safe, idempotent, and able to carry content.Mon, 12 Oct 2026 00:00:00 GMTbackendmetahttps://www.moiu.cn/en/blog/internet-exchange/https://www.moiu.cn/en/blog/internet-exchange/Your packets leave your home line, cross a few networks, and change hands at an exchange point. Here is what an IXP is, how peering differs from transit, and why exchanges set bandwidth prices.Mon, 12 Oct 2026 00:00:00 GMTnetworkinginfrastructurehttps://www.moiu.cn/en/blog/no-guess-minesweeper/https://www.moiu.cn/en/blog/no-guess-minesweeper/The worst part of Minesweeper is not hitting a mine, it is hitting one that could only be avoided by luck. Here is how a generator guarantees the whole board is deducible.Mon, 12 Oct 2026 00:00:00 GMTalgorithmsgameshttps://www.moiu.cn/en/blog/post-quantum-tls/https://www.moiu.cn/en/blog/post-quantum-tls/Browsers and CDNs now negotiate hybrid key exchange like X25519MLKEM768 by default, which closes the harvest-now-decrypt-later gap. The signature half is still open.Mon, 12 Oct 2026 00:00:00 GMTsecuritybackendhttps://www.moiu.cn/en/blog/text-box-trim/https://www.moiu.cn/en/blog/text-box-trim/Line boxes are always taller than the glyphs, so that half-leading above a heading used to be fixed with negative margins. text-box-trim does it properly.Mon, 12 Oct 2026 00:00:00 GMTCSSdesignhttps://www.moiu.cn/en/blog/doe-v-github-dmca-1202/https://www.moiu.cn/en/blog/doe-v-github-dmca-1202/On 16 September 2026 the Ninth Circuit affirmed dismissal of the Section 1202 DMCA claims in Doe v. GitHub, holding that generative AI outputs are not copies under that section.Sun, 11 Oct 2026 00:00:00 GMTsecuritytoolshttps://www.moiu.cn/en/blog/mcp-stateless-core/https://www.moiu.cn/en/blog/mcp-stateless-core/The new MCP revision removes the initialize handshake and the Mcp-Session-Id header, and turns cross-call state into explicit server-minted handles. What changed, why, and what it means for an existing server implementation.Sun, 11 Oct 2026 00:00:00 GMTbackendsecurityhttps://www.moiu.cn/en/blog/node-26-lts/https://www.moiu.cn/en/blog/node-26-lts/Node.js 26 was confirmed as LTS on 6 October, with 26.11.0 and 26.11.1 following on 7 October — while Node.js 20 keeps disappearing from hosting platforms.Sun, 11 Oct 2026 00:00:00 GMTbackendtoolshttps://www.moiu.cn/en/blog/artex-closed-source/https://www.moiu.cn/en/blog/artex-closed-source/An AI-driven pentest tool was linked to data breaches at Korean banks; its author stopped development and closed the source. The responsibility boundary for open security tooling is on the table again.Sat, 10 Oct 2026 00:00:00 GMTsecurityvulnerabilityhttps://www.moiu.cn/en/blog/ghostaction-actions-secrets/https://www.moiu.cn/en/blog/ghostaction-actions-secrets/Attackers hijacked maintainer accounts and injected GitHub Actions workflows disguised as security audits that scrape credentials out of the entire git history. By 9 October, 500+ accounts and tens of thousands of repos were involved.Sat, 10 Oct 2026 00:00:00 GMTsecuritytoolshttps://www.moiu.cn/en/blog/harness-augment-cosmos/https://www.moiu.cn/en/blog/harness-augment-cosmos/Harness acquired Augment Code assets including Cosmos, a platform that coordinates multiple agents, plus the Auggie CLI and the Code Context Engine, folding AI coding into the delivery pipeline.Sat, 10 Oct 2026 00:00:00 GMTtoolsbackendhttps://www.moiu.cn/en/blog/postgres-19/https://www.moiu.cn/en/blog/postgres-19/PostgreSQL 19 merges VACUUM FULL and CLUSTER into REPACK, adds a WAIT command for catching a standby up, and ships two extensions that pin planner decisions. The features I actually care about, plus three incompatibilities that bite.Sat, 10 Oct 2026 00:00:00 GMTbackendperformancehttps://www.moiu.cn/en/blog/ai-video-authenticity/https://www.moiu.cn/en/blog/ai-video-authenticity/An 86-second AI edit of "Jensen Huang world tour" went viral at home and abroad, and Musk joined in. It is funny, and it makes "is this video real" an everyday question.Fri, 09 Oct 2026 00:00:00 GMTtoolssecurityhttps://www.moiu.cn/en/blog/chrome-155-jpeg-xl/https://www.moiu.cn/en/blog/chrome-155-jpeg-xl/Chrome 155 decodes JPEG XL directly through jxl-rs, a Rust decoder, and adds ML-KEM and ML-DSA to the Web Crypto API.Fri, 09 Oct 2026 00:00:00 GMTCSSperformancesecurityhttps://www.moiu.cn/en/blog/npm-shai-hulud-tensorlake/https://www.moiu.cn/en/blog/npm-shai-hulud-tensorlake/In October 2026, tensorlake 0.5.144 shipped a Shai-Hulud credential-stealing worm aimed at npm, GitHub, cloud and AI credentials. The bar for a supply-chain attack is now one compromised account.Fri, 09 Oct 2026 00:00:00 GMTsecurityvulnerabilitytoolshttps://www.moiu.cn/en/blog/rust-196-range-types/https://www.moiu.cn/en/blog/rust-196-range-types/Range was never Copy because it implements Iterator itself. Rust 1.96 stabilised a new family of range types that implement only IntoIterator, which makes them Copy. Why the distinction matters, and when the familiar syntax changes.Fri, 09 Oct 2026 00:00:00 GMTRustalgorithmshttps://www.moiu.cn/en/blog/ai-agent-zammad-zero-day/https://www.moiu.cn/en/blog/ai-agent-zammad-zero-day/An autonomous AI agent chained two Zammad zero-days into a full attack path and took over DIVD, an organisation whose job is coordinating vulnerability disclosure.Thu, 08 Oct 2026 00:00:00 GMTsecurityvulnerabilityhttps://www.moiu.cn/en/blog/sqlite-353/https://www.moiu.cn/en/blog/sqlite-353/SQLite 3.53 fixes a WAL-reset corruption bug, adds the Query Result Formatter library, lets ALTER TABLE add and drop constraints, and introduces REINDEX EXPRESSIONS. That last one is the tool for repairing stale expression indexes.Thu, 08 Oct 2026 00:00:00 GMTtoolsbackendhttps://www.moiu.cn/en/blog/wikimedia-rogue-agents/https://www.moiu.cn/en/blog/wikimedia-rogue-agents/The Wikimedia Foundation publicly accused unauthorised OpenAI agents of millions of requests, questionable edits and tool tampering, possibly worsening a rare service disruption.Thu, 08 Oct 2026 00:00:00 GMTperformancebackendhttps://www.moiu.cn/en/blog/aether-isle/https://www.moiu.cn/en/blog/aether-isle/The isle page downloads only its own script. The scene is computed at runtime, Three.js stays in that page's chunk, and the first HTML response carries an empty stage.Wed, 07 Oct 2026 00:00:00 GMTmetaAstroperformancedesignhttps://www.moiu.cn/en/blog/cve-2026-26026-glpi-rce/https://www.moiu.cn/en/blog/cve-2026-26026-glpi-rce/CVE-2026-26026 lets a GLPI administrator reach arbitrary command execution on the server by editing a template. CVSS 9.1. The interesting part is not the attack chain but the assumption it exposes: why should the person with the admin console be able to run system commands?Wed, 07 Oct 2026 00:00:00 GMTsecurityvulnerabilityhttps://www.moiu.cn/en/blog/morse-code/https://www.moiu.cn/en/blog/morse-code/Morse itself is trivial; the trouble is in the details — who owns the space, how to normalise full-width dots, and how long one unit actually is.Wed, 07 Oct 2026 00:00:00 GMTtoolsalgorithmshttps://www.moiu.cn/en/blog/pong-ai/https://www.moiu.cn/en/blog/pong-ai/A Pong opponent worth playing needs two things: an accurate prediction of where the ball lands, and a deliberate error. The first is one triangle wave; the second is redrawn on every return.Wed, 07 Oct 2026 00:00:00 GMTgamesalgorithmshttps://www.moiu.cn/en/blog/procedural-island/https://www.moiu.cn/en/blog/procedural-island/The rock on this island is not exported from a modelling tool. It is five irregular rings stitched together at runtime, and vertex colours plus flat shading are enough to make it read as stone.Wed, 07 Oct 2026 00:00:00 GMTmetadesignhttps://www.moiu.cn/en/blog/three-instancing/https://www.moiu.cn/en/blog/three-instancing/Six hundred blades of grass, a hundred and twenty flowers, eighty-five mossy stones, forty-two shrubs. Density comes from InstancedMesh, not from cutting the count.Wed, 07 Oct 2026 00:00:00 GMTperformancemetahttps://www.moiu.cn/en/blog/three-lighting/https://www.moiu.cn/en/blog/three-lighting/A hemisphere light for ambience, a key light for direction and shadow, a rim light to pull the island off the background — and seven point lights that only add glow.Wed, 07 Oct 2026 00:00:00 GMTdesignmetahttps://www.moiu.cn/en/blog/three-water-shader/https://www.moiu.cn/en/blog/three-water-shader/There is no water simulation on the island and no reflections. Two ShaderMaterials cover all of it, one lying flat and one falling, sharing a single time and night uniform.Wed, 07 Oct 2026 00:00:00 GMTmetadesignhttps://www.moiu.cn/en/blog/webgl-loading-budget/https://www.moiu.cn/en/blog/webgl-loading-budget/A 3D page pays three costs — download, first-frame compilation, per-frame drawing. Each needs its own budget, and any one of them can turn good-looking into janky.Wed, 07 Oct 2026 00:00:00 GMTperformancemetaAstrohttps://www.moiu.cn/en/blog/sibling-count-index/https://www.moiu.cn/en/blog/sibling-count-index/Firefox 154 brings these two functions to Baseline. They return the current element's position among its siblings and the total sibling count, so staggered animation, ordered colours, and even sizing can be computed in CSS instead of an inline variable per element.Tue, 06 Oct 2026 00:00:00 GMTCSSdesignhttps://www.moiu.cn/en/blog/autocorrect-attribute/https://www.moiu.cn/en/blog/autocorrect-attribute/Chrome 152 supports the global autocorrect attribute, Safari and Firefox had it already, and so it reaches Baseline. How it differs from spellcheck, why it spent years as a vendor prefix, and when you should turn it off.Mon, 05 Oct 2026 00:00:00 GMTmetadesignhttps://www.moiu.cn/en/blog/dynamic-rr-index/https://www.moiu.cn/en/blog/dynamic-rr-index/Highly repetitive string data (genomes, web archives, versioned documents) compresses beautifully, but any edit forces a full rebuild. A RIKEN AIP paper at ESA 2026 proposes dynamic RR-index, the first to combine compression, search, and updates in delta-optimal space.Sun, 04 Oct 2026 00:00:00 GMTalgorithmsbackendhttps://www.moiu.cn/en/blog/template-for-partial-updates/https://www.moiu.cn/en/blog/template-for-partial-updates/Chrome 150 supports the template for attribute: processing instructions mark replaceable regions, and streamed templates fill them. How it works, what it solves, and why it should not go anywhere near production yet.Sat, 03 Oct 2026 00:00:00 GMTmetaperformancehttps://www.moiu.cn/en/blog/script-single-source/https://www.moiu.cn/en/blog/script-single-source/A scripts section has to display its source and also serve the identical file at /scripts/x.sh. Two copies drift. Why inlining with import.meta.glob and ?raw beats reading the filesystem at build time or copying into public.Fri, 02 Oct 2026 00:00:00 GMTmetatoolshttps://www.moiu.cn/en/blog/atomic-write/https://www.moiu.cn/en/blog/atomic-write/Overwriting in place leaves half a file behind on power loss, a crash, or a concurrent read. A temp file plus rename uses filesystem atomicity to make half a file impossible.Wed, 30 Sep 2026 00:00:00 GMTbackendtoolshttps://www.moiu.cn/en/blog/base64/https://www.moiu.cn/en/blog/base64/Base64 turns 3 bytes into 4 printable characters, growing the payload by a third. It solves carrying binary through a text channel, not keeping anything secret.Wed, 30 Sep 2026 00:00:00 GMTtoolssecurityhttps://www.moiu.cn/en/blog/big-o-misconception/https://www.moiu.cn/en/blog/big-o-misconception/An O(n log n) sort can lose to O(n²) insertion sort, and an O(1) hash lookup can lose to an array scan. Check input size, constants and memory locality before judging speed.Wed, 30 Sep 2026 00:00:00 GMTalgorithmsperformancehttps://www.moiu.cn/en/blog/css-cascade-layers/https://www.moiu.cn/en/blog/css-cascade-layers/Runaway styles come from everyone solving problems by adding specificity. Cascade layers make the order explicit: between layers only order matters, and specificity applies within a layer.Wed, 30 Sep 2026 00:00:00 GMTCSSdesignhttps://www.moiu.cn/en/blog/debounce-throttle/https://www.moiu.cn/en/blog/debounce-throttle/Both limit how often a function runs. Debounce lets the last call decide the moment; throttle uses a fixed window. The wrong pick shows up as a laggy drag or a request every 200ms.Wed, 30 Sep 2026 00:00:00 GMTtoolsperformancehttps://www.moiu.cn/en/blog/developer-estimation/https://www.moiu.cn/en/blog/developer-estimation/You estimated writing code; what you owe is writing plus integration, review, rework, and waiting on others. Listing the unknowns beats multiplying every day count by two.Wed, 30 Sep 2026 00:00:00 GMTtoolsbackendhttps://www.moiu.cn/en/blog/feature-flags/https://www.moiu.cn/en/blog/feature-flags/Every flag doubles the reachable code paths and no flag ever gets deleted by itself. Giving each one a removal date matters far more than building a clever flag system.Wed, 30 Sep 2026 00:00:00 GMTbackendtoolshttps://www.moiu.cn/en/blog/game-loop/https://www.moiu.cn/en/blog/game-loop/Moving 5 pixels per frame runs twice as fast on a 60Hz screen and two and a half times as fast at 144Hz. Multiply by elapsed time to decouple physics from refresh rate, then cap it.Wed, 30 Sep 2026 00:00:00 GMTgamesperformancehttps://www.moiu.cn/en/blog/git-bisect/https://www.moiu.cn/en/blog/git-bisect/The hard part of regression hunting is not the binary search, it is defining what counts as broken. Write a script that answers that, and bisect compresses n builds into log n.Wed, 30 Sep 2026 00:00:00 GMTtoolsalgorithmshttps://www.moiu.cn/en/blog/gomoku-search-engine/https://www.moiu.cn/en/blog/gomoku-search-engine/Plain alpha-beta misses forced wins in gomoku. I split the decision into three layers — win, block, forced-win patterns — and only then hand the rest to iterative deepening.Wed, 30 Sep 2026 00:00:00 GMTalgorithmsgameshttps://www.moiu.cn/en/blog/graceful-shutdown/https://www.moiu.cn/en/blog/graceful-shutdown/Exiting immediately on a termination signal cuts in-flight requests. The order is stop accepting, drain what is running, release resources, then exit.Wed, 30 Sep 2026 00:00:00 GMTbackendmetahttps://www.moiu.cn/en/blog/http-caching/https://www.moiu.cn/en/blog/http-caching/Cache-Control decides whether a request happens; ETag decides whether the response body can be skipped. Mixing them is why cache bugs persist: changing one never fixes the other half.Wed, 30 Sep 2026 00:00:00 GMTmetaperformancehttps://www.moiu.cn/en/blog/idempotency/https://www.moiu.cn/en/blog/idempotency/A network timeout does not mean the server did nothing. An idempotency key identifies the same request so the server replays the first result instead of executing again.Wed, 30 Sep 2026 00:00:00 GMTbackendsecurityhttps://www.moiu.cn/en/blog/json-canonicalization/https://www.moiu.cn/en/blog/json-canonicalization/Key order, number formatting and escape style all change the bytes. A stable hash has to pin those rules at serialization, not hope JSON.stringify is deterministic.Wed, 30 Sep 2026 00:00:00 GMTbackendsecurityhttps://www.moiu.cn/en/blog/memory-layout/https://www.moiu.cn/en/blog/memory-layout/A trip to main memory costs hundreds of cycles; a cache line fetch costs one. Sequential versus random access often outweighs the algorithmic order itself.Wed, 30 Sep 2026 00:00:00 GMTperformancealgorithmshttps://www.moiu.cn/en/blog/mutex-deadlock/https://www.moiu.cn/en/blog/mutex-deadlock/Mutual exclusion, hold and wait, no preemption, circular wait. All four must hold at once. The practical one to break is circular wait: give every lock a global order.Wed, 30 Sep 2026 00:00:00 GMTbackendalgorithmshttps://www.moiu.cn/en/blog/n-plus-one/https://www.moiu.cn/en/blog/n-plus-one/Fetch 100 rows and query the relation for each one and you have made 101 queries. There are only three fixes: eager load, batch fetch, or use a single join.Wed, 30 Sep 2026 00:00:00 GMTbackendperformancehttps://www.moiu.cn/en/blog/rate-limiting/https://www.moiu.cn/en/blog/rate-limiting/A token bucket permits bursts; a leaky bucket flattens traffic to a constant rate. Picking wrong shows up as throttled normal users, or a limit that does nothing.Wed, 30 Sep 2026 00:00:00 GMTbackendperformancehttps://www.moiu.cn/en/blog/regex-catastrophic/https://www.moiu.cn/en/blog/regex-catastrophic/Nested quantifiers make the number of match attempts grow exponentially; (a+)+b can hang a process on one long non-matching input. Drop the nesting or put a timeout on it.Wed, 30 Sep 2026 00:00:00 GMTsecurityalgorithmshttps://www.moiu.cn/en/blog/sandbox-iframe/https://www.moiu.cn/en/blog/sandbox-iframe/The sandbox attribute starts by removing everything and allow-* adds pieces back. Getting the direction backwards is common: scripts stop running because that is the default.Wed, 30 Sep 2026 00:00:00 GMTsecuritymetahttps://www.moiu.cn/en/blog/semver/https://www.moiu.cn/en/blog/semver/MAJOR does not mean big. It means breaking. Using it for refactors and hiding breaks in minor releases turns your downstream automatic upgrades into outages.Wed, 30 Sep 2026 00:00:00 GMTtoolsmetahttps://www.moiu.cn/en/blog/sqlite-index/https://www.moiu.cn/en/blog/sqlite-index/A composite index (a, b) can only order by b within equal a, so skipping a and filtering on b has nothing to use. See it as sorting and the mnemonic stops being a rule to memorize.Wed, 30 Sep 2026 00:00:00 GMTbackendalgorithmshttps://www.moiu.cn/en/blog/tech-debt-interest/https://www.moiu.cn/en/blog/tech-debt-interest/Debt is not ugly code; it is the extra cost every future change pays. The test is measurable: files touched per edit, test runtime, places that must change together.Wed, 30 Sep 2026 00:00:00 GMTmetatoolshttps://www.moiu.cn/en/blog/timezone-dst/https://www.moiu.cn/en/blog/timezone-dst/A DST day has 23 or 25 hours, and local times near the switch may not exist or may happen twice. Storing UTC timestamps and converting at display is the only model that holds.Wed, 30 Sep 2026 00:00:00 GMTbackendalgorithmshttps://www.moiu.cn/en/blog/tool-tree/https://www.moiu.cn/en/blog/tool-tree/Visualising a search is not mainly about drawing the tree. The data has to be real, the panel must not shove the board around, and it must load only for people who click the button.Wed, 30 Sep 2026 00:00:00 GMTVuegameshttps://www.moiu.cn/en/blog/unicode-normalization/https://www.moiu.cn/en/blog/unicode-normalization/An e-acute can be one code point or a base letter plus a combining mark. Normalize to NFC before comparing, storing or indexing, or duplicates quietly slip through.Wed, 30 Sep 2026 00:00:00 GMTsecuritybackendhttps://www.moiu.cn/en/blog/url-encoding/https://www.moiu.cn/en/blog/url-encoding/A plus is a space in the query string and a literal plus in the path; the two positions encode the same character differently; encoding twice yields a plausible value that never matches.Wed, 30 Sep 2026 00:00:00 GMTmetasecurityhttps://www.moiu.cn/en/blog/xiangqi-rules/https://www.moiu.cn/en/blog/xiangqi-rules/Horse-leg blocking, elephant-eye blocking, cannon screens and the flying-general rule. Splitting move generation into a geometry layer and a legality layer removes most of the mistakes.Wed, 30 Sep 2026 00:00:00 GMTalgorithmsgameshttps://www.moiu.cn/en/blog/cron-parser/https://www.moiu.cn/en/blog/cron-parser/The syntax takes half an hour. The semantics are the work: day-of-month and day-of-week unite rather than intersect, impossible dates need a stopping condition, and 7 and 0 are both Sunday.Tue, 29 Sep 2026 00:00:00 GMTtoolsalgorithmshttps://www.moiu.cn/en/blog/csv-rfc4180/https://www.moiu.cn/en/blog/csv-rfc4180/The moment a field is quoted, split stops working: quotes hold delimiters and newlines, and a quote inside a field is doubled. A thirty-line state machine beats any regex.Tue, 29 Sep 2026 00:00:00 GMTtoolsalgorithmshttps://www.moiu.cn/en/blog/reversi-legal-moves/https://www.moiu.cn/en/blog/reversi-legal-moves/A square is legal if at least one of eight directions can sandwich the opponent. Testing and flipping share a single scan, so there is no simulated move to roll back.Tue, 29 Sep 2026 00:00:00 GMTalgorithmsgameshttps://www.moiu.cn/en/blog/sudoku-generator/https://www.moiu.cn/en/blog/sudoku-generator/Generate a full solution, then dig cells out while checking uniqueness. I let zero mean unlimited in the solver, so an empty grid enumerated every solution and the new-game button hung.Tue, 29 Sep 2026 00:00:00 GMTalgorithmsgameshttps://www.moiu.cn/en/blog/consistent-hashing/https://www.moiu.cn/en/blog/consistent-hashing/Modulo sharding moves almost all data when the machine count changes. Put the hash space on a ring and let each key follow it clockwise to the first node, and only one arc moves. Virtual nodes are the price.Mon, 28 Sep 2026 00:00:00 GMTalgorithmsmetahttps://www.moiu.cn/en/blog/gomoku-win-detect/https://www.moiu.cn/en/blog/gomoku-win-detect/Rescanning the whole board after every move is waste. Only the newest stone can create a line, so four directions from that point settle it in constant time.Mon, 28 Sep 2026 00:00:00 GMTalgorithmsgameshttps://www.moiu.cn/en/blog/sliding-window/https://www.moiu.cn/en/blog/sliding-window/A window works when validity changes monotonically with its edges. Write down the tracked state and the shrink condition first, and the two-pointer loop amortises to O(n) on its own.Mon, 28 Sep 2026 00:00:00 GMTalgorithmsperformancehttps://www.moiu.cn/en/blog/monotonic-stack/https://www.moiu.cn/en/blog/monotonic-stack/Each index is pushed and popped at most once, so what looks like a nested loop is linear. Recognise the first larger or smaller neighbour shape and the same template applies.Sun, 27 Sep 2026 00:00:00 GMTalgorithmsperformancehttps://www.moiu.cn/en/blog/popcount-bit-tricks/https://www.moiu.cn/en/blog/popcount-bit-tricks/Popcount has three forms: loop once per set bit, a lookup table, or SWAR across bit fields. They differ by orders of magnitude, and Rust and WebAssembly already expose it as a single instruction.Sun, 27 Sep 2026 00:00:00 GMTalgorithmsperformancehttps://www.moiu.cn/en/blog/union-find/https://www.moiu.cn/en/blog/union-find/Path compression flattens the tree, union by size stops it growing tall. You need both before the cost drops to the inverse Ackermann function, which is never above 5 in practice.Sun, 27 Sep 2026 00:00:00 GMTalgorithmsperformancehttps://www.moiu.cn/en/blog/rust-result-context/https://www.moiu.cn/en/blog/rust-result-context/The question mark operator rethrows an error without saying which step failed. Structured errors in the core, Context in the application layer, with the input attached, is what makes a log line locatable.Sat, 26 Sep 2026 00:00:00 GMTRustbackendhttps://www.moiu.cn/en/blog/rust-workspace-split/https://www.moiu.cn/en/blog/rust-workspace-split/The trigger for splitting a workspace is build time and dependency boundaries, not tidy directories. Split when three signals hold, or you trade one compile for managing several packages.Sat, 26 Sep 2026 00:00:00 GMTRustbackendhttps://www.moiu.cn/en/blog/tracing-structured-logs/https://www.moiu.cn/en/blog/tracing-structured-logs/Log lines built by concatenation can only be read by humans. Fields make them queryable. Fields, spans, levels and knowing when not to format are the four real decisions.Sat, 26 Sep 2026 00:00:00 GMTRustbackendhttps://www.moiu.cn/en/blog/islands-vs-webcomponents/https://www.moiu.cn/en/blog/islands-vs-webcomponents/Islands decide at build time where JavaScript is needed and when it hydrates. Web Components give the browser a self-contained element at runtime. Confusing them picks the wrong tool.Fri, 25 Sep 2026 00:00:00 GMTAstroperformancehttps://www.moiu.cn/en/blog/nginx-cache-headers/https://www.moiu.cn/en/blog/nginx-cache-headers/A cache policy depends on whether the filename changes with the content, not on file size. Long-caching HTML hands users an old entry point that points at deleted chunks.Fri, 25 Sep 2026 00:00:00 GMTmetaperformancehttps://www.moiu.cn/en/blog/wasm-where-to-use/https://www.moiu.cn/en/blog/wasm-where-to-use/WASM pays off with heavy computation, bulk data and few boundary crossings. Rewriting an O(n) JavaScript loop as WASM usually buys slower loading and a harder stack to debug.Fri, 25 Sep 2026 00:00:00 GMTperformancemetahttps://www.moiu.cn/en/blog/anchor-scroll-padding/https://www.moiu.cn/en/blog/anchor-scroll-padding/A sticky header covers every anchor target. scroll-margin per heading always misses one; scroll-padding-top on the scroll container does not, fed by the real header height.Thu, 24 Sep 2026 00:00:00 GMTCSSdesignhttps://www.moiu.cn/en/blog/dialog-a11y/https://www.moiu.cn/en/blog/dialog-a11y/A hand-rolled modal needs a focus trap, ESC handling, scroll locking and focus restore. Native dialog with showModal has all of it plus ::backdrop, and one style rule as the price.Thu, 24 Sep 2026 00:00:00 GMTCSSdesignhttps://www.moiu.cn/en/blog/form-color-scheme/https://www.moiu.cn/en/blog/form-color-scheme/Painting a dark background does not darken native controls. Select popups, date pickers and autofill follow color-scheme; accent-color only reaches checkboxes and sliders.Thu, 24 Sep 2026 00:00:00 GMTCSSdesignhttps://www.moiu.cn/en/blog/resize-observer-layout/https://www.moiu.cn/en/blog/resize-observer-layout/A wrapping navigation, late webfonts and changing content all break constants written into CSS. A ResizeObserver watches the element and writes the measured value back into a variable.Thu, 24 Sep 2026 00:00:00 GMTCSSperformancehttps://www.moiu.cn/en/blog/design-tokens/https://www.moiu.cn/en/blog/design-tokens/Why every colour, spacing step and corner radius lives in _tokens.scss — and why changing this site's entire visual direction only touched two files.Wed, 23 Sep 2026 00:00:00 GMTCSSdesignhttps://www.moiu.cn/en/blog/manual-i18n/https://www.moiu.cn/en/blog/manual-i18n/I hand-rolled this site's i18n instead of using Astro's built-in config. Here is why, and exactly where the cost shows up — two 404 incidents and a blog that was half translated.Tue, 22 Sep 2026 00:00:00 GMTmetadesignhttps://www.moiu.cn/en/blog/algo-2048/https://www.moiu.cn/en/blog/algo-2048/Sliding, merging and scoring only need to be written once; the other three directions reuse it through transpose and reverse. The hard part is that each tile may merge at most once per move.Mon, 21 Sep 2026 00:00:00 GMTalgorithmsgameshttps://www.moiu.cn/en/blog/algo-minesweeper/https://www.moiu.cn/en/blog/algo-minesweeper/A minesweeper where the first click can lose is an unfinished minesweeper. Deferring placement and excluding the surrounding 3 by 3 is the single most important design decision here.Sat, 19 Sep 2026 00:00:00 GMTalgorithmsgameshttps://www.moiu.cn/en/blog/riso-ui/https://www.moiu.cn/en/blog/riso-ui/This site's visual direction is Riso screen printing. What I actually built was the printing constraints as tokens, so retheming touched two files and no component changed.Fri, 18 Sep 2026 00:00:00 GMTdesignCSShttps://www.moiu.cn/en/blog/tool-convert/https://www.moiu.cn/en/blog/tool-convert/Converting between bases 2 and 36 needs BigInt to avoid silent precision loss. Across ten unit categories nine are linear ratios, while temperature is affine, and a single multiplier is always wrong.Thu, 17 Sep 2026 00:00:00 GMTtoolsVuehttps://www.moiu.cn/en/blog/tool-color/https://www.moiu.cn/en/blog/tool-color/Converting between notations is just the entry point. The real trap is WCAG contrast, which needs gamma decoding before weighting, and deciding between black and white text, which is not a brightness threshold.Tue, 15 Sep 2026 00:00:00 GMTtoolsVuehttps://www.moiu.cn/en/blog/pagefind-search/https://www.moiu.cn/en/blog/pagefind-search/A static site does not need Algolia to have search. Generate the index during the build, run the query entirely in the browser, and pay a few seconds of build time.Mon, 14 Sep 2026 00:00:00 GMTmetaperformancehttps://www.moiu.cn/en/blog/tool-hash/https://www.moiu.cn/en/blog/tool-hash/The browser only offers the SHA family, and only in a secure context. CRC32 and MD5 are not in Web Crypto. Along the way: large files should not be read into memory whole, and checksums should not be compared by eye.Sun, 13 Sep 2026 00:00:00 GMTtoolsVuehttps://www.moiu.cn/en/blog/tool-regex-lab/https://www.moiu.cn/en/blog/tool-regex-lab/A regex tester has to do three things well: show where matches land and what each group captured, preview the replacement, and never hang on a zero-width match.Fri, 11 Sep 2026 00:00:00 GMTtoolsVuehttps://www.moiu.cn/en/blog/tool-json-studio/https://www.moiu.cn/en/blog/tool-json-studio/Built from the habit of writing throwaway commands to clean up JSON. It formats, minifies, sorts, pinpoints parse errors by line and column, and diffs two documents — all in the browser.Wed, 09 Sep 2026 00:00:00 GMTtoolsVuehttps://www.moiu.cn/en/blog/zero-import-selftest/https://www.moiu.cn/en/blog/zero-import-selftest/My test suite is `node scripts/selftest.ts` — no framework, no dependencies. The price is that every module it touches must have zero relative imports, and that price bought a codebase shape.Tue, 08 Sep 2026 00:00:00 GMTAstrometahttps://www.moiu.cn/en/blog/cve-2026-45659-sharepoint/https://www.moiu.cn/en/blog/cve-2026-45659-sharepoint/A plain Site Member account is enough to run code on a SharePoint server. Microsoft rated exploitation unlikely, and CISA put it in the KEV catalogue with three days to remediate.Sun, 06 Sep 2026 00:00:00 GMTsecurityvulnerabilityhttps://www.moiu.cn/en/blog/cve-2026-21858-n8n/https://www.moiu.cn/en/blog/cve-2026-21858-n8n/The form node skips Content-Type validation, so one application/json request makes it read an arbitrary file. The key inside the config forges an admin JWT, and a sandbox bypass turns that into RCE.Fri, 04 Sep 2026 00:00:00 GMTsecurityvulnerabilityhttps://www.moiu.cn/en/blog/cve-2026-20131-cisco-fmc/https://www.moiu.cn/en/blog/cve-2026-20131-cisco-fmc/CVSS 10.0, no authentication, code execution as root, and 36 days of use as a zero-day by a ransomware crew. Breaking the firewall management hub hands over every policy and log with it.Wed, 02 Sep 2026 00:00:00 GMTsecurityvulnerabilityhttps://www.moiu.cn/en/blog/astro-islands/https://www.moiu.cn/en/blog/astro-islands/From "async import" to "hydrate on demand" — what each of the three lazy-loading layers actually solves, with the code that runs on this site.Tue, 01 Sep 2026 00:00:00 GMTAstroperformanceVuehttps://www.moiu.cn/en/blog/cve-2026-75604-nextjs/https://www.moiu.cn/en/blog/cve-2026-75604-nextjs/One unescaped backslash turns the incremental cache into arbitrary file read and write on Windows, and the leaked Server Action encryption key forges a request that walks a React Flight property chain to Function.Sun, 30 Aug 2026 00:00:00 GMTsecurityvulnerabilityhttps://www.moiu.cn/en/blog/cve-2026-42211-react-router/https://www.moiu.cn/en/blog/cve-2026-42211-react-router/turbo-stream v2 calls a constructor while rehydrating the TYPE_ERROR branch without checking where it came from. If the app already has a prototype pollution bug, that path reaches Function and two moderate flaws become RCE.Fri, 28 Aug 2026 00:00:00 GMTsecurityvulnerabilityhttps://www.moiu.cn/en/blog/head-single-source/https://www.moiu.cn/en/blog/head-single-source/All three HTML shells render one component that emits every head tag, with the data assembled on the server. Plus a detail worth remembering: angle brackets in JSON-LD must be escaped.Thu, 27 Aug 2026 00:00:00 GMTmetaperformancehttps://www.moiu.cn/en/blog/static-hosting-nginx/https://www.moiu.cn/en/blog/static-hosting-nginx/Almost every static-hosting bug lives in response headers. Which files may be cached forever, which may not be cached at all, and why a static site must never use an SPA fallback.Mon, 24 Aug 2026 00:00:00 GMTmetaperformancehttps://www.moiu.cn/en/blog/theme-ripple/https://www.moiu.cn/en/blog/theme-ripple/A circle growing from the click point reveals the new theme. The radius must reach the farthest corner, and the custom properties must be cleaned up or they leak into the next switch.Sat, 22 Aug 2026 00:00:00 GMTCSSdesignVuehttps://www.moiu.cn/en/blog/build-time-pagination/https://www.moiu.cn/en/blog/build-time-pagination/The post list is sliced into static pages during the build, so page N is a real route. No client-side paging logic, no query string, just links.Wed, 19 Aug 2026 00:00:00 GMTAstroperformancehttps://www.moiu.cn/en/blog/alias-three-places/https://www.moiu.cn/en/blog/alias-three-places/Deep relative imports are banned project-wide, and the price is configuring the alias in three places. Miss one and you get editor errors, a broken build, or silently dropped styles.Sun, 16 Aug 2026 00:00:00 GMTAstrometahttps://www.moiu.cn/en/blog/zod-frontmatter/https://www.moiu.cn/en/blog/zod-frontmatter/The Content Collections schema is the single source of truth. A title over 120 characters, a mangled date or a string where an array belongs fails immediately instead of silently dropping a page.Thu, 13 Aug 2026 00:00:00 GMTAstrometahttps://www.moiu.cn/en/blog/hello-world/https://www.moiu.cn/en/blog/hello-world/Not because there was nowhere to write, but because there was nowhere to put writing, small games and tools side by side.Tue, 11 Aug 2026 00:00:00 GMTmetaAstrohttps://www.moiu.cn/en/blog/glob-registry/https://www.moiu.cn/en/blog/glob-registry/App lists, detail routes, the home page picks and the sitemap are all discovered by import.meta.glob. The price is Vite's hard rule: literal relative paths only.Sat, 08 Aug 2026 00:00:00 GMTAstrometahttps://www.moiu.cn/en/blog/app-shell-mount/https://www.moiu.cn/en/blog/app-shell-mount/Game and tool pages are a shell plus createApp, not client:only. I own the loading, ready and error states, and the retry button actually works.Wed, 05 Aug 2026 00:00:00 GMTVueperformancehttps://www.moiu.cn/en/blog/server-layer/https://www.moiu.cn/en/blog/server-layer/A page here exports a route, imports two components and passes props. Everything else — fetching, paths, dates — happens in src/server. Here is what that buys, and the type constraint it forces.Sun, 02 Aug 2026 00:00:00 GMTAstrometa