Systems on Ethan-ZYF

HyperLogLog: Counting Billions of Distinct Items in Kilobytes

Sun, 31 May 2026 01:10:00 -0700

HyperLogLog (HLL) is a probabilistic cardinality estimation algorithm: using a tiny, fixed amount of memory (typically ~12 KB), it estimates the number of distinct elements in a huge set, with a standard error of about 0.81%.

Cuckoo Filter: Approximate Membership That Supports Deletion

Sun, 31 May 2026 00:45:00 -0700

A Cuckoo Filter is a probabilistic data structure for approximate set membership. Like a Bloom filter it answers “is this element possibly in the set?” with a tunable false-positive rate and zero false negatives — but unlike a standard Bloom filter it also supports deleting elements, is more space-efficient at low false-positive rates, and is more cache-friendly on lookups.

Day 5: AppArmor + layered sandbox design

Sat, 16 May 2026 00:00:00 -0700

How AppArmor actually attaches to a process (via the bprm_check_security LSM hook at execve time, keyed on binary path), why bash script.sh silently runs unconfined while ./script.sh does not, the six exec modifiers (ix/Px/Cx/Ux and their setuid-preserving uppercase forms), the hardlink and bind-mount tricks that bypass path-based MAC, and why a production sandbox layers namespace + capability + seccomp + AppArmor + cgroup — with the argument that, if you can only afford two, seccomp + AppArmor is the highest-ROI pair.

Day 4: seccomp BPF Filter (filter mode deep dive)

Thu, 14 May 2026 00:00:00 -0700

A deep dive into seccomp filter mode: the BPF data layout, why pointer args can’t be dereferenced (TOCTOU and atomic context), the cBPF instruction skeleton, the multi-ABI bypasses every filter must defend against, and the eight SECCOMP_RET_* actions that power modern container security — including the USER_NOTIF + fd-injection pattern that runc/crun use.

Day 3: seccomp Basics + Strict Mode

Wed, 13 May 2026 00:00:00 -0700

How seccomp intercepts syscalls at the kernel entry, what SECCOMP_MODE_STRICT actually allows (and the _exit() trap that fools nearly everyone), plus the design philosophy that filter mode inherits: monotonic, irrevocable security state.

Day 2: strace + Common Syscalls in Practice

Tue, 12 May 2026 00:00:00 -0700

A practical guide to strace: flag cheat sheet, how to read program startup as three distinct layers (ld.so → libc init → main), annotated syscalls, and the gotchas you actually hit (fd reuse races, EINTR, short writes, locale noise).

Day 1: Linux Syscall Internals

Mon, 11 May 2026 00:30:00 -0700

A deep dive into how Linux system calls actually work on x86_64: the ABI, the syscall instruction’s hardware side effects, the full user→kernel path, and a categorized cheat sheet of the syscalls worth knowing.