# Kevin Cui's Blog

> Personal blog of Kevin Cui (BlackHole1), co-founder of OOMOL: Electron, Node.js, Go, containers and virtualization, web security and troubleshooting notes, in English and Chinese.

- English site: https://bugs.cc/ (RSS: https://bugs.cc/index.xml)
- Chinese site: https://bugs.cc/zh/ (RSS: https://bugs.cc/zh/index.xml)
- Every post has a Markdown copy at `<post URL>index.md`; the links below point at those copies. Drop the `index.md` for the HTML page.
- Content license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)

## Posts in English

- [Troubleshooting Periodic 100% CPU on a Bun Service](https://bugs.cc/posts/troubleshooting-bun-kafkajs-cpu-spin/index.md): A few days ago we hit a fairly interesting production issue. A Bun service was periodically pegging one CPU core across three pods, for exactly 10 minutes… (2026-08-25)
- [Troubleshooting Electron 39.6.0 Tag Build Failure on Windows](https://bugs.cc/posts/troubleshooting-electron-39.6.0-tag-build-failure-on-windows/index.md): It's been quite a while since I last built Electron on Windows. Yesterday afternoon, I tried building the electron@39.6.0 tag, but it failed repeatedly.… (2026-03-10)
- [View and analyze Electron crashes on macOS](https://bugs.cc/posts/view-and-analyze-electron-crashes-on-macos/index.md): When developing an Electron application, you might encounter crashes. However, for various reasons, the application may not have integrated Sentry or other… (2024-10-15)
- [Switch Kernel for Fedora(40)](https://bugs.cc/posts/switch-kernel-for-fedora40/index.md): A few days ago, I upgraded from Fedora 39 to Fedora 40. However, after the upgrade, my VirtualBox could not start properly due to a mismatch between the… (2024-05-11)
- [Podman basics and how it talks to containers](https://bugs.cc/posts/podman-basic-principles-and-communication-mechanisms/index.md): How Podman talks to containers (2023-08-07)
- [Build / debug Electron source](https://bugs.cc/posts/build-and-debug-electron-code/index.md): How to build and debug Electron source (2021-09-21)
- [Dynamically modifying a Protocol Buffers string message](https://bugs.cc/posts/dynamically-modify-the-string-message-of-protocol-buffers/index.md): Dynamically modifying an already-encoded pb message (2021-05-27)
- [Download and build Chromium on macOS 10.15](https://bugs.cc/posts/macos-10.15-download-and-build-chromium/index.md): Notes on downloading and building Chromium on macOS 10.15 (2020-03-31)
- [How server-side recording works](https://bugs.cc/posts/rebirth-principle-analysis/index.md): The idea behind server-side recording, and some pitfalls I hit (2019-12-07)
- [Pitfalls of requesting camera and microphone permission for an Electron app on macOS](https://bugs.cc/posts/electron-app-request-camera-and-microphone-permission-by-macos/index.md): Starting with macOS 10.14, tighter privacy rules can make Electron apps crash when they use the camera or microphone (2019-10-23)
- [Web security overview](https://bugs.cc/posts/web-security-overview/index.md): Common web attacks and how they work (XSS, CSRF, SSRF, JSON hijacking), plus Docker labs so you can try them (2019-10-17)
- [Flexible scheduling of a k8s cluster based on task volume](https://bugs.cc/posts/flexible-scheduling-of-k8s-cluster-based-on-task-volume/index.md): Flexible scheduling of a k8s cluster based on task volume, to save resources (2019-08-20)
- [Why ('b' + 'a' + + 'a' + 'a').toLowerCase() prints banana](https://bugs.cc/posts/javascript-output-banana/index.md): Step-by-step walkthrough of why it prints banana (2019-08-15)
- [From the fdk_aac encoder to automated static FFmpeg builds](https://bugs.cc/posts/in-fdk-aac-to-ffmpeg-static-build/index.md): Integrating the libfdk_aac encoder into FFmpeg, and using a free gitlab-runner to automatically statically compile FFmpeg (2019-07-15)
- [GitLab Runner service registration and job capture](https://bugs.cc/posts/gitlab-runner-service-registry-and-principle/index.md): Reading the source to understand how GitLab Runner captures jobs (2019-07-06)
- [Production deploy time checks with GitLab CI](https://bugs.cc/posts/gitlab-ci-production-date-check/index.md): Decide whether to ship by checking the current time (2019-07-06)
- [Webm progress bar issue, analysis and a fix](https://bugs.cc/posts/webm-progress-bar-problem-and-solution/index.md): Why it happens, and how to fix it (2019-05-21)
- [Listen for page crashes with the WebKit remote debugging protocol](https://bugs.cc/posts/webkit-remote-debugging-protocol-listening-crash/index.md): Detect page crashes using the Chrome remote interface (2019-04-22)
- [Error retry in RxJS](https://bugs.cc/posts/rxjs-error-retry/index.md): Retry failed requests with RxJS operators (2019-01-12)
- [Reading notes: From Lucene to Elasticsearch: full-text search in practice](https://bugs.cc/posts/reading-notes-from-lucene-to-elasticsearch-full-text-search/index.md): Notes cover only the Elasticsearch search parts (2018-12-30)
- [Integrating Sentry with JavaScript](https://bugs.cc/posts/javascript-integration-sentry/index.md): Integrating Sentry in React, plus a brief look at how it works (2018-08-24)
- [Analyze the axios source to find out why you can't use all and spread](https://bugs.cc/posts/analyze-the-axios-source-to-find-out-why-you-cant-use-all-and-spread-methods/index.md): Find why some APIs don't work by reading Axios source (2018-04-14)
- [Some thoughts on implementing image drag-and-drop and paste with vue-simplemde](https://bugs.cc/posts/simplemde-realizes-some-thoughts-on-drag-and-drop-and-paste-function/index.md): Listen to drop and paste events to add image drag-and-drop and paste in vue-simplemde (2018-04-12)
- [Run a qcow2 image in VMware](https://bugs.cc/posts/run-qcow2-image-in-vmware/index.md): Convert qcow2 to vmdk with qemu-img (2018-01-23)
- [Add a unified operation extension to Promise](https://bugs.cc/posts/add-unified-operation-extensions-to-promise/index.md): Add a callback that always runs, success or failure, and knows the previous state (2018-01-06)
- [Some NumPy, Pandas, and Matplotlib APIs](https://bugs.cc/posts/numpy-pandas-matplotlib-some-api/index.md): Notes on some NumPy, Pandas, and Matplotlib APIs (2017-11-12)
- [pm2 configuration for Vue+Koa](https://bugs.cc/posts/koa-pm2-configuration/index.md): Using pm2 to manage a Vue frontend and a Koa backend (2017-11-07)
- [Some ideas based on URLProtocol attacks](https://bugs.cc/posts/some-ideas-based-on-urlprotocol-attacks/index.md): Some attack ideas that use URLProtocol (2017-03-26)
- [Automated XSS intranet invasion](https://bugs.cc/posts/use-xss-automation-invade-intranet/index.md): Probe and break into the intranet with WebRTC (2016-12-14)
- [Company Wi-Fi security](https://bugs.cc/posts/company-wifi-security/index.md): Companies generally don't take Wi-Fi security seriously enough. This post outlines some problems that show up when Wi-Fi is left unmanaged. (2016-12-13)
- [Browser plugin attack vectors](https://bugs.cc/posts/browser-plugin-attack-vector/index.md): Browser plugins have many privileged APIs. With those APIs you can do things that were not possible before. This post is only a starting point. (2016-10-05)
- [How to log in to Thunder under Debian](https://bugs.cc/posts/how-to-use-thunder-login-account-under-debian/index.md): When you open Thunder (Xunlei) with Wine on Linux, login does not work. This post uses Wireshark to solve that. (2016-08-24)
- [Notes on bypassing WAFs (Web Application Firewalls)](https://bugs.cc/posts/talk-about-how-to-bypass-waf/index.md): A few tricks for bypassing a WAF (2016-08-20)
- [Automated CSRF detection (part 2)](https://bugs.cc/posts/automated-detection-of-csrf-second-part/index.md): Automatically detect CSRF with a browser extension (2016-06-23)
- [Automated CSRF detection](https://bugs.cc/posts/automated-detection-of-csrf/index.md): Automatically detect CSRF with a browser extension (2016-06-15)
- [XSS principles, dissected](https://bugs.cc/posts/principle-analysis-and-anatomy-of-xss/index.md): XSS principles, part 1 (2016-05-30)

## Posts in Chinese

- [Bun 服务周期性 CPU 100% 排查](https://bugs.cc/zh/posts/troubleshooting-bun-kafkajs-cpu-spin/index.md): 前几天线上遇到一个挺有意思的问题：一个用 Bun 写的服务，三个 pod 的 CPU 会周期性打满一个核，每次正好 10 分钟，然后自己掉下去。服务本身没报错，接口正常，健康检查也从来没失败过，就是 CPU 监控很难看。 (2026-08-25)
- [Electron 39.6.0 tag 在 Windows 上构建失败排查](https://bugs.cc/zh/posts/troubleshooting-electron-39.6.0-tag-build-failure-on-windows/index.md): 挺久没在 Windows 上构建 Electron 了，昨天下午构建 electron@39.6.0 这个 tag 一直失败，而最新的 commit 上却完全正常。一直排查到晚上。 (2026-03-10)
- [在 macOS 上查看并解析 electron crash](https://bugs.cc/zh/posts/view-and-analyze-electron-crashes-on-macos/index.md): 在开发 electron 应用时，有时会遇到 crash 的情况，但是由于因为某些原因，应用可能没有接入 sentry 或者其他 crash 分析平台，这时候就需要手动查看 crash 日志来定位问题。 (2024-10-15)
- [切换 Fedora(40) 内核](https://bugs.cc/zh/posts/switch-kernel-for-fedora40/index.md): 前几天我从 Fedora 39 升级到了 Fedora 40，但是在升级后，我的 VirtualBox 无法正常启动了，提示我的 kernel 和 kernel-header 版本不匹配。 (2024-05-11)
- [Podman 基本原理及通信机制](https://bugs.cc/zh/posts/podman-basic-principles-and-communication-mechanisms/index.md): 介绍 Podman 如何和容器通信 (2023-08-07)
- [构建 / 调试 Electron 源码](https://bugs.cc/zh/posts/build-and-debug-electron-code/index.md): 如何构建和调试 Electron 源码 (2021-09-21)
- [动态修改 Protocol Buffers 的 string message](https://bugs.cc/zh/posts/dynamically-modify-the-string-message-of-protocol-buffers/index.md): 动态修改已编码的 pb message (2021-05-27)
- [macOS 10.15 下载及编译 Chromium](https://bugs.cc/zh/posts/macos-10.15-download-and-build-chromium/index.md): 在 macOS 10.15 下载及编译 Chromium 的一些过程 (2020-03-31)
- [服务端录制原理分析](https://bugs.cc/zh/posts/rebirth-principle-analysis/index.md): 介绍服务端录制的原理及遇到的一些坑 (2019-12-07)
- [Electron App 在 MacOS 下 申请摄像头及麦克风权限踩坑指南](https://bugs.cc/zh/posts/electron-app-request-camera-and-microphone-permission-by-macos/index.md): 由 macOS 在 10.14 版本及以上版本增加了隐私的安全性，导致 Electron 应用在使用摄像头、麦克风时会 Crash (2019-10-23)
- [Web 安全概览](https://bugs.cc/zh/posts/web-security-overview/index.md): 介绍 Web 端常见的攻击手法及原理 (如: XSS、CSRF、SSRF、JSON Hijacking)。并且提供 Docker 靶场，方便根据介绍的攻击手法去实战 (2019-10-17)
- [基于任务量进行 k8s 集群的灵活调度处理](https://bugs.cc/zh/posts/flexible-scheduling-of-k8s-cluster-based-on-task-volume/index.md): 基于任务量进行 k8s 集群的灵活调度处理，以达到节省资源的目的 (2019-08-20)
- [('b' + 'a' + + 'a' + 'a').toLowerCase() 输出 banana 的剖析](https://bugs.cc/zh/posts/javascript-output-banana/index.md): 一步步解析为何会输出 banana (2019-08-15)
- [从 fdk_aac 编码器到自动静态编译 FFmpeg](https://bugs.cc/zh/posts/in-fdk-aac-to-ffmpeg-static-build/index.md): 为了在 FFmpeg 集成 libfdk_aac 编码器，利用免费的 gitlab-runner 来做到自动静态编译 FFmpeg (2019-07-15)
- [Gitlab Runner 服务注册及任务捕获原理](https://bugs.cc/zh/posts/gitlab-runner-service-registry-and-principle/index.md): 通过查看源码了解 Gitlab-Runner 的捕获原理 (2019-07-06)
- [基于 Gitlab CI 的上线时间校验](https://bugs.cc/zh/posts/gitlab-ci-production-date-check/index.md): 通过对时间的判断来决定是否进行项目发布 (2019-07-06)
- [Webm 进度条问题分析与解决](https://bugs.cc/zh/posts/webm-progress-bar-problem-and-solution/index.md): 分析问题出现的原因，并为此寻找相关的解决方案 (2019-05-21)
- [通过 Webkit 远程调试协议监听网页崩溃](https://bugs.cc/zh/posts/webkit-remote-debugging-protocol-listening-crash/index.md): 基于 chrome remote interface 来检测网页是否 Crash (2019-04-22)
- [聊聊 RxJS 中的错误重试](https://bugs.cc/zh/posts/rxjs-error-retry/index.md): 使用 RxJS 操作符对请求进行错误重试 (2019-01-12)
- [读书笔记: 从 Lucene 到 Elasticsearch: 全文检索实战](https://bugs.cc/zh/posts/reading-notes-from-lucene-to-elasticsearch-full-text-search/index.md): 笔记只有 Elasticsearch 搜索部分 (2018-12-30)
- [JavaScript 集成 Sentry](https://bugs.cc/zh/posts/javascript-integration-sentry/index.md): 在 React 里集成 Sentry，以及浅入介绍原理 (2018-08-24)
- [分析 axios 源码来找出无法使用 all 和 spread 等方法的原因](https://bugs.cc/zh/posts/analyze-the-axios-source-to-find-out-why-you-cant-use-all-and-spread-methods/index.md): 通过分析 Axios 的源码，来找出无法使用部分 Api 的问题 (2018-04-14)
- [基于 vue-simplemde 实现图片拖拽、粘贴功能的一些思考](https://bugs.cc/zh/posts/simplemde-realizes-some-thoughts-on-drag-and-drop-and-paste-function/index.md): 监听 drop 和 paste 事件来在 vue-simplemde 实现图片拖拽、粘贴功能 (2018-04-12)
- [在 vmware 里运行 qcow2 镜像](https://bugs.cc/zh/posts/run-qcow2-image-in-vmware/index.md): 使用 qemu-img 把 qcow2 转化为 vmdk 格式 (2018-01-23)
- [对 Promise 增加统一操作扩展](https://bugs.cc/zh/posts/add-unified-operation-extensions-to-promise/index.md): 添加一个无论是否成功失败，都会调用的函数，且函数知道上一步的状态 (2018-01-06)
- [Numpy & Pandas & Matplotilb 部分 API 操作](https://bugs.cc/zh/posts/numpy-pandas-matplotlib-some-api/index.md): 介绍下 Numpy、Pandas、Matplotilb 部分的 API (2017-11-12)
- [基于 Vue+Koa 的 pm2 配置](https://bugs.cc/zh/posts/koa-pm2-configuration/index.md): 使用 pm2 管理 vue 前端和 koa 后端项目 (2017-11-07)
- [基于 URLProtocol 攻击的一些想法](https://bugs.cc/zh/posts/some-ideas-based-on-urlprotocol-attacks/index.md): 基于 URLProtocol 协议的一些攻击手法的想法 (2017-03-26)
- [XSS 自动化入侵内网](https://bugs.cc/zh/posts/use-xss-automation-invade-intranet/index.md): 利用 webrtc 的特性对内网进行检测、入侵 (2016-12-14)
- [公司 wifi 安全](https://bugs.cc/zh/posts/company-wifi-security/index.md): 公司一般对于 wifi 的安全没有足够的认知，这篇文章会大概说明 wifi 不进行管理会出现的一些问题 (2016-12-13)
- [浏览器插件的攻击向量](https://bugs.cc/zh/posts/browser-plugin-attack-vector/index.md): 因为浏览器插件具有很多特权的 API，利用这些 API 可以做到之前不能做到的事情，本篇文章也只是抛砖引玉 (2016-10-05)
- [在 debian 下如何使用迅雷登陆账号](https://bugs.cc/zh/posts/how-to-use-thunder-login-account-under-debian/index.md): 使用 wine 在 Linux 打开迅雷时，是无法进行登陆的，这里使用 wireshark 来解决这个问题 (2016-08-24)
- [杂谈如何绕过 WAF（Web 应用防火墙）](https://bugs.cc/zh/posts/talk-about-how-to-bypass-waf/index.md): 一些绕过 WAF 的小技巧 (2016-08-20)
- [自动化检测 CSRF(第二篇)](https://bugs.cc/zh/posts/automated-detection-of-csrf-second-part/index.md): 使用浏览器插件做到自动检测 CSRF 漏洞 (2016-06-23)
- [自动化检测 CSRF](https://bugs.cc/zh/posts/automated-detection-of-csrf/index.md): 使用浏览器插件做到自动检测 CSRF 漏洞 (2016-06-15)
- [XSS 的原理分析与解剖](https://bugs.cc/zh/posts/principle-analysis-and-anatomy-of-xss/index.md): XSS 原理分析第一章 (2016-05-30)

## Optional

- [Projects](https://bugs.cc/projects/): Open source projects Kevin Cui builds and maintains.
- [Full text of every post](https://bugs.cc/llms-full.txt): all posts above in one Markdown file.