More than a decade ago, when I was ap­ply­ing to grad­u­ate school, I went through a pe­riod of deep un­cer­tainty. I had tried the pre­vi­ous year and had­n’t got­ten in any­where. I wanted to try again, but I had a lot go­ing against me.

I’d spent most of my un­der­grad build­ing a stu­dent job-por­tal startup and had­n’t bal­anced it well with aca­d­e­mics. My GPA needed ex­plain­ing. My GMAT score was just okay. I did­n’t come from a big-brand em­ployer. And there was no short­age of peo­ple with sim­i­lar or stronger pro­files ap­ply­ing to the same schools.

Even though I had learned a few things from the first round, the sec­ond at­tempt was still dif­fi­cult. There were mul­ti­ple points af­ter I sub­mit­ted ap­pli­ca­tions where I lost hope.

But dur­ing that stretch, a friend and col­league kept re­peat­ing one line to me:

“All it takes is for one to work out.”

He’d say it every time I spi­raled. And as much as it made me smile, a big part of me did­n’t fully be­lieve it. Still, it be­came a lit­tle maxim be­tween us. And even­tu­ally, he was right — that one did work out. And it changed my life.

I’ve thought about that fram­ing so many times since then.

You don’t need every job to choose you. You just need the one that’s the right fit.

You don’t need every house to ac­cept your of­fer. You just need the one that feels like home.

You don’t need every per­son to want to build a life with you. You just need the one.

You don’t need ten uni­ver­si­ties to say yes. You just need the one that opens the right door.

These processes — col­lege ad­mis­sions, job searches, home buy­ing, find­ing a part­ner — can be emo­tion­ally bru­tal. They can get you down in ways that feel per­sonal. But in those mo­ments, that truth can be ground­ing.

All it takes is for one to work out.

And that one is all you need.

For those un­fa­mil­iar, Zigtools was founded to sup­port the Zig com­mu­nity, es­pe­cially new­com­ers, by cre­at­ing ed­i­tor tool­ing such as ZLS, pro­vid­ing build­ing blocks for lan­guage servers writ­ten in Zig with lsp-kit, work­ing on tools like the Zigtools Playground, and con­tribut­ing to Zig ed­i­tor ex­ten­sions like vs­code-zig.

A cou­ple weeks ago, a Zig re­source called Zigbook was re­leased with a bold claim of “zero AI” and an orig­i­nal “project-based” struc­ture.

Unfortunately, even a cur­sory look at the non­sense chap­ter struc­ture, book con­tent, ex­am­ples, generic web­site, or post-back­lash is­sue-dis­abled repo re­veals that the book is wholly LLM slop and the pro­ject it­self is struc­tured like some sort of syco­phan­tic psy-op, with bot­ted ac­counts and fake re­ac­tions.

We’re leav­ing out all di­rect links to Zigbook to not give them any more SEO trac­tion.

We thought that the broad com­mu­nity back­lash would be the end of the pro­ject, but Zigbook per­se­vered, re­leas­ing just last week a brand new fea­ture, a “high-voltage beta” Zig play­ground.

As we at Zigtools have our own Zig play­ground (repo, web­site), our in­ter­est was im­me­di­ately piqued. The form and func­tion­al­ity looked pretty sim­i­lar and Zigbook even in­te­grated (in a non-func­tional man­ner) ZLS into their play­ground to pro­vide all the fancy ed­i­tor bells-and-whis­tles, like code com­ple­tions and goto de­f­i­n­i­tion.

Knowing Zigbook’s his­tory of de­cep­tion, we im­me­di­ately in­ves­ti­gated the WASM blobs. Unfortunately, the WASM blobs are byte-for-byte iden­ti­cal to ours. This can­not be a co­in­ci­dence given the two blobs (zig.wasm, a lightly mod­i­fied ver­sion of the Zig com­piler, and zls.wasm, ZLS with a mod­i­fied en­try point for WASI) are en­tirely cus­tom-made for the Zigtools Playground.

We archived the WASM files for your con­ve­nience, cour­tesy of the great Internet Archive:

We pro­ceeded to look at the JavaScript code, which we quickly de­ter­mined was sim­i­larly copied, but with LLM dis­tor­tions, likely to pre­vent the code from be­ing com­pletely iden­ti­cal. Still, cer­tain sec­tions were copied one-to-one, like the JavaScript worker data-pass­ing struc­ture and log­ging (original ZLS play­ground code, pla­gia­rized Zigbook code).

The fol­low­ing code from both files is iden­ti­cal:

try {

// @ts-ignore

const ex­it­Code = wasi.start(in­stance);

postMes­sage({

stderr: `\n\n–-\nexit with exit code ${exitCode}\n–-\n`,

} catch (err) {

postMes­sage({ stderr: `${err}` });

postMes­sage({

done: true,

on­mes­sage = (event) => {

if (event.data.run) {

run(event.data.run);

The \n\n–-\nexit with exit code ${exitCode}\n–-\n is per­haps the most ob­vi­ously copied string.

Funnily enough, de­spite copy­ing many parts of our code, Zigbook did­n’t copy the most im­por­tant part of the ZLS in­te­gra­tion code, the JavaScript ZLS API de­signed to work with the ZLS WASM bi­na­ry’s API. That JavaScript code is ab­solutely re­quired to in­ter­act with the ZLS bi­nary which they did pla­gia­rize. Zigbook ei­ther avoided copy­ing that JavaScript code be­cause they knew it would be too glar­ingly ob­vi­ous, be­cause they fun­da­men­tally do not un­der­stand how the Zigtools Playground works, or be­cause they plan to copy more of our code.

To be clear, copy­ing our code and WASM blobs is en­tirely per­mis­si­ble given that the play­ground and Zig are MIT li­censed. Unfortunately, Zigbook has not com­plied with the terms of the MIT li­cense at all, and seem­ingly claims the code and blobs as their own with­out cor­rectly re­pro­duc­ing the li­cense.

We sent Zigbook a neu­tral PR cor­rect­ing the li­cense vi­o­la­tions, but they quickly closed it and deleted the de­scrip­tion, seem­ingly to hide their mis­deeds.

The orig­i­nal de­scrip­tion (also avail­able in the “edits” drop­down of the orig­i­nal PR com­ment) is re­pro­duced be­low:

We (@zigtools) no­ticed you were us­ing code from the Zigtools Playground, in­clud­ing byte-by-byte copies of our WASM blobs and ex­cerpts of our JavaScript source code. This is a vi­o­la­tion of the MIT li­cense that the Zigtools Playground is li­censed un­der along­side a vi­o­la­tion of the Zig MIT li­cense (for the zig.wasm blob).The above copy­right no­tice and this per­mis­sion no­tice shall be in­cluded in

all copies or sub­stan­tial por­tions of the Software.

We’ve fixed this by adding the li­censes in ques­tion to your repos­i­tory. As your repos­i­tory does not in­clude a di­rect link to the *.wasm de­pen­den­cies, we’ve added a li­cense dis­claimer on the play­ground page as well that men­tions the li­censes.

Zigbook’s afore­men­tioned bad be­hav­ior and their con­tin­ued vi­o­la­tion of our li­cense and un­will­ing­ness to fix the vi­o­la­tion mo­ti­vated us to write this blog post.

It’s sad that our first blog post is about the pla­gia­rism of our coolest sub­pro­ject. We chal­lenged our­selves by cre­at­ing a WASM-based client-side play­ground to en­able of­fline us­age, code pri­vacy, and no server costs.

This in­ci­dent has mo­ti­vated us to in­vest more time into our play­ground and has gen­er­ated a cou­ple of ideas:

* We’d like to en­able mul­ti­file sup­port to al­low more com­plex Zig pro­jects to be run in the browser

* We’d like to col­lab­o­rate with fel­low Ziguanas to in­te­grate the play­ground into their ex­cel­lent Zig tu­to­ri­als, books, and blog­postsA per­fect ex­am­ple use­case would be en­abling folks to hop into Ziglings on­line with the play­groundThe Zig web­site it­self would be a great tar­get as well!

* A per­fect ex­am­ple use­case would be en­abling folks to hop into Ziglings on­line with the play­ground

* The Zig web­site it­self would be a great tar­get as well!

* We’d like to sup­port stack traces us­ing DWARF de­bug info which is not yet emit­ted by the self-hosted Zig com­piler

As Zig com­mu­nity mem­bers, we ad­vise all other mem­bers of the Zig com­mu­nity to steer clear of Zigbook.

If you’re look­ing to learn Zig, we strongly rec­om­mend look­ing at the ex­cel­lent of­fi­cial Zig learn page which con­tains ex­cel­lent re­sources from the pre­vi­ously men­tioned Ziglings to Karl Seguin’s Learning Zig.

We’re also us­ing this op­por­tu­nity to men­tion that we’re fundrais­ing to keep ZLS sus­tain­able for our only full-time main­tainer, Techatrix. We’d be thrilled if you’d be will­ing to give just $5 a month. You can check out our OpenCollective or GitHub Sponsors.

Americans have grown sour on one of the long­time key in­gre­di­ents of the American dream.

Almost two-thirds of reg­is­tered vot­ers say that a four-year col­lege de­gree is­n’t worth the cost, ac­cord­ing to a new NBC News poll, a dra­matic de­cline over the last decade.

Just 33% agree a four-year col­lege de­gree is “worth the cost be­cause peo­ple have a bet­ter chance to get a good job and earn more money over their life­time,” while 63% agree more with the con­cept that it’s “not worth the cost be­cause peo­ple of­ten grad­u­ate with­out spe­cific job skills and with a large amount of debt to pay off.”

In 2017, U. S. adults sur­veyed were vir­tu­ally split on the ques­tion — 49% said a de­gree was worth the cost and 47% said it was­n’t. When CNBC asked the same ques­tion in 2013 as part of its All American Economic Survey, 53% said a de­gree was worth it and 40% said it was not.

The eye-pop­ping shift over the last 12 years comes against the back­drop of sev­eral ma­jor trends shap­ing the job mar­ket and the ed­u­ca­tion world, from ex­plod­ing col­lege tu­ition prices to rapid changes in the mod­ern econ­omy — which seems once again poised for rad­i­cal trans­for­ma­tion along­side ad­vances in AI.

“It’s just re­mark­able to see at­ti­tudes on any is­sue shift this dra­mat­i­cally, and par­tic­u­larly on a cen­tral tenet of the American dream, which is a col­lege de­gree. Americans used to view a col­lege de­gree as as­pi­ra­tional — it pro­vided an op­por­tu­nity for a bet­ter life. And now that promise is re­ally in doubt,” said Democratic poll­ster Jeff Horwitt of Hart Research Associates, who con­ducted the poll along with the Republican poll­ster Bill McInturff of Public Opinion Strategies.

“What is re­ally sur­pris­ing about it is that every­body has moved. It’s not just peo­ple who don’t have a col­lege de­gree,” Horwitt added.

National data from the Bureau of Labor Statistics shows that those with ad­vanced de­grees earn more and have lower un­em­ploy­ment rates than those with lower lev­els of ed­u­ca­tion. That’s been true for years.

But what has shifted is the price of col­lege. While there have been some small de­clines in tu­ition prices over the last decade, when ad­justed for in­fla­tion, College Board data shows that the av­er­age, in­fla­tion-ad­justed cost of pub­lic four-year col­lege tu­ition for in-state stu­dents has dou­bled since 1995. Tuition at pri­vate, four-year col­leges is up 75% over the same pe­riod.

Poll re­spon­dents who spoke with NBC News all em­pha­sized those ris­ing costs as a ma­jor rea­son why the value of a four-year de­gree has been un­der­cut.

Jacob Kennedy, a 28-year-old server and bar­tender liv­ing in Detroit, told NBC News that while he be­lieves “an ed­u­cated pop­u­lace is the most im­por­tant thing for a coun­try to have,” if peo­ple can’t use those de­grees be­cause of the debt they’re car­ry­ing, it un­der­cuts the value.

Kennedy, who has a two-year de­gree, re­flected on “the num­ber of peo­ple who I’ve met work­ing in the ser­vice in­dus­try who have four-year de­grees and then within a year of grad­u­at­ing im­me­di­ately quit their ‘grown-up jobs’ to go back to the jobs they had.”

“The cost over­whelms the value,” he con­tin­ued. “You go to school with all that stu­dent debt — the jobs you get out of col­lege don’t pay that debt, so you have to go find some­thing else that can pay that debt.”

The 20-point de­cline over the last 12 years among those who say a de­gree is worth it — from 53% in 2013 to 33% now — is re­flected across vir­tu­ally every de­mo­graphic group. But the shift in sen­ti­ment is es­pe­cially strik­ing among Republicans.

In 2013, 55% of Republicans called a col­lege de­gree worth it, while 38% said it was­n’t worth it. In the new poll, just 22% of Republicans say the four-year de­gree is worth it, while 74% say it’s not.

Democrats have seen a sig­nif­i­cant shift too, but not to the same ex­tent — a de­cline from 61% who said a de­gree was worth it in 2013 to 47% this year.

Over the same pe­riod, the com­po­si­tion of both par­ties has changed, with the Republican Party gar­ner­ing new and deeper sup­port from vot­ers with­out col­lege de­grees, while the Democratic Party drew in more de­gree-hold­ers.

Remarkably, less than half of vot­ers with col­lege de­grees see those de­grees as worth the cost: 46% now, down from 63% in 2013.

Those with­out a col­lege de­gree were about split on the ques­tion in 2013. Now, 71% say a four-year de­gree is not worth the cost, while 26% say it is.

Preston Cooper, a se­nior fel­low at the right-lean­ing American Enterprise Institute, said enough cracks have pro­lif­er­ated un­der the long-stand­ing nar­ra­tive that a col­lege de­gree al­ways pays off to cre­ate a se­ri­ous rup­ture.

“Some peo­ple drop out, or some­times peo­ple end up with a de­gree that is not worth a whole lot in the la­bor mar­ket, and some­times peo­ple pay way too much for a de­gree rel­a­tive to the value of what that cre­den­tial is,” he said. “These cases have cre­ated enough ex­cep­tions to the rule that a bach­e­lor’s de­gree al­ways pays off, so that peo­ple are now more skep­ti­cal.”

The up­shot is that in­ter­est in tech­ni­cal, vo­ca­tional and two-year de­gree pro­grams has soared.

“I think stu­dents are more wary about tak­ing on the risk of a four-year or even a two-year de­gree,” he said. “They’re now more in­ter­ested in any path­way that can get them into the la­bor force more quickly.”

Josiah Garcia, a 24-year-old in Virginia, said he re­cently en­rolled in a pro­gram to re­ceive a four-year en­gi­neer­ing de­gree af­ter work­ing as an elec­tri­cian’s ap­pren­tice. He said he was mo­ti­vated to go back to school be­cause he saw the de­gree as hav­ing a di­rect ef­fect on his fu­ture earn­ing po­ten­tial.

But he added that he did­n’t feel that those who sought other de­grees in ar­eas like art or the­ater could say the same.

“A lot of my friends who went to school for art or dance did­n’t get the job they thought they could get af­ter grad­u­at­ing,” he said, ar­gu­ing that de­grees for “softer skills” should be cheaper than those in STEM fields.

Jessica Burns, a 38-year-old Iowa res­i­dent and bach­e­lor’s de­gree-holder who works for an in­sur­ance com­pany, told NBC News that for her, the worth of a four-year-de­gree largely de­pends on the cost.

She went to a com­mu­nity col­lege and then a state school to earn her de­gree, so she said she grad­u­ated with­out hav­ing to spend an “insane” amount of money.

But her hus­band went to a pri­vate col­lege for his de­gree, and she quipped: “We are go­ing to have stu­dent loan debt for him for­ever.”

Burns said she be­lieves a col­lege de­gree is “essential for a lot of jobs. You’re not go­ing to get an in­ter­view if you don’t have a four-year de­gree for a lot of jobs in my field.”

But she framed the value of de­grees more in terms of how so­ci­ety views them in­stead of in­trin­sic value.

“It’s not valu­able be­cause it’s brought a bunch of value added, it’s valu­able be­cause it’s the key to even get­ting in the door,” she said. “Our so­ci­ety needs to fig­ure out that if we value it, we need to make it af­ford­able.”

Burns said she be­lieves that a lot more peo­ple in her mil­len­nial gen­er­a­tion are “now sad­dled with a huge amount of debt, even as suc­cess­ful busi­ness pro­fes­sion­als,” which will in­flu­ence how her peers ap­proach pay­ing for col­lege for their chil­dren.

There has­n’t just been a de­cline in the cost-ben­e­fit analy­sis of a de­gree. Gallup polling also shows a marked de­cline in pub­lic con­fi­dence in higher ed­u­ca­tion over the last decade, al­beit with a slight in­crease over the last year.

“This is a po­lit­i­cal prob­lem. It’s also a real prob­lem for higher ed­u­ca­tion. Colleges and uni­ver­si­ties have lost that con­nec­tion they’ve had with a large swath of the American peo­ple based on af­ford­abil­ity,” Horwitt said. “They’re now seen as out of touch and not ac­ces­si­ble to many Americans.”

The NBC News poll sur­veyed 1,000 reg­is­tered vot­ers Oct. 24-28 via a mix of tele­phone in­ter­views and an on­line sur­vey sent via text mes­sage. The mar­gin of er­ror is plus or mi­nus 3.1 per­cent­age points.

Fed up with tril­lion-dol­lar com­pa­nies ex­ploit­ing your data? Forced to use their ser­vices? Your data held for ran­som? Your data used to train their AI mod­els? Opt-outs for data col­lec­tion in­stead of opt-ins?

Join the move­ment to make com­pa­nies more like Clippy. Set your pro­file pic­ture to Clippy, make your voice heard.

Below is a video that ex­plains the Be Like Clippy move­ment. It’s a call to ac­tion for de­vel­op­ers, com­pa­nies, and users alike to em­brace a more open, trans­par­ent, and user-friendly ap­proach to tech­nol­ogy.

Hi! I’m Eric Wastl. I make Advent of Code. I hope you like it! I also make lots of other things. I’m on Bluesky, Mastodon, and GitHub.

Advent of Code is an Advent cal­en­dar of small pro­gram­ming puz­zles for a va­ri­ety of skill lev­els that can be solved in any pro­gram­ming lan­guage you like. People use them as in­ter­view prep, com­pany train­ing, uni­ver­sity course­work, prac­tice prob­lems, a speed con­test, or to chal­lenge each other.

You don’t need a com­puter sci­ence back­ground to par­tic­i­pate - just a lit­tle pro­gram­ming knowl­edge and some prob­lem solv­ing skills will get you pretty far. Nor do you need a fancy com­puter; every prob­lem has a so­lu­tion that com­pletes in at most 15 sec­onds on ten-year-old hard­ware.

If you’d like to sup­port Advent of Code, you can do so in­di­rectly by help­ing to [Share] it with oth­ers or di­rectly via AoC++.

If you get stuck, try your so­lu­tion against the ex­am­ples given in the puz­zle; you should get the same an­swers. If not, re-read the de­scrip­tion. Did you mis­un­der­stand some­thing? Is your pro­gram do­ing some­thing you don’t ex­pect? After the ex­am­ples work, if your an­swer still is­n’t cor­rect, build some test cases for which you can ver­ify the an­swer by hand and see if those work with your pro­gram. Make sure you have the en­tire puz­zle in­put. If you’re still stuck, maybe ask a friend for help, or come back to the puz­zle later. You can also ask for hints in the sub­red­dit.

Is there an easy way to se­lect en­tire code blocks? You should be able to triple-click code blocks to se­lect them. You’ll need JavaScript en­abled.

#!/usr/bin/env perl

use warn­ings;

use strict;

print “You can test it out by ”;

print “triple-clicking this code.\n”;

How does au­then­ti­ca­tion work? Advent of Code uses OAuth to con­firm your iden­tity through other ser­vices. When you log in, you only ever give your cre­den­tials to that ser­vice - never to Advent of Code. Then, the ser­vice you use tells the Advent of Code servers that you’re re­ally you. In gen­eral, this re­veals no in­for­ma­tion about you be­yond what is al­ready pub­lic; here are ex­am­ples from Reddit and GitHub. Advent of Code will re­mem­ber your unique ID, names, URL, and im­age from the ser­vice you use to au­then­ti­cate.

Why was this puz­zle so easy / hard? The dif­fi­culty and sub­ject mat­ter varies through­out each event. Very gen­er­ally, the puz­zles get more dif­fi­cult over time, but your spe­cific skillset will make each puz­zle sig­nif­i­cantly eas­ier or harder for you than some­one else. Making puz­zles is tricky.

Why do the puz­zles un­lock at mid­night EST/UTC-5? Because that’s when I can con­sis­tently be avail­able to make sure every­thing is work­ing. I also have a fam­ily, a day job, and even need sleep oc­ca­sion­ally. If you can’t par­tic­i­pate at mid­night, that’s not a prob­lem; if you want to race, many peo­ple use pri­vate leader­boards to com­pete with peo­ple in their area.

I find the text on the site hard to read. Is there a high con­trast mode? There is a high con­trast al­ter­nate stylesheet. Firefox sup­ports these by de­fault (View -> Page Style -> High Contrast).

I have a puz­zle idea! Can I send it to you? Please don’t. Because of le­gal is­sues like copy­right and at­tri­bu­tion, I don’t ac­cept puz­zle ideas, and I won’t even read your email if it looks like one just in case I use parts of it by ac­ci­dent.

Did I find a bug with a puz­zle? Once a puz­zle has been out for even an hour, many peo­ple have al­ready solved it; af­ter that point, bugs are very un­likely. Start by ask­ing on the sub­red­dit.

Should I try to get a fast so­lu­tion time? Maybe. Solving puz­zles is hard enough on its own, but try­ing for a fast time also re­quires many ad­di­tional skills and a lot of prac­tice; speed-solves of­ten look noth­ing like code that would pass a code re­view. If that sounds in­ter­est­ing, go for it! However, you should do Advent of Code in a way that is use­ful to you, and so it is com­pletely fine to choose an ap­proach that meets your goals and ig­nore speed en­tirely.

Why did the num­ber of days per event change? It takes a ton of my free time every year to run Advent of Code, and build­ing the puz­zles ac­counts for the ma­jor­ity of that time. After keep­ing a con­sis­tent sched­ule for ten years(!), I needed a change. The puz­zles still start on December 1st so that the day num­bers make sense (Day 1 = Dec 1), and puz­zles come out every day (ending mid-De­cem­ber).

What hap­pened to the global leader­board? The global leader­board was one of the largest sources of stress for me, for the in­fra­struc­ture, and for many users. People took things too se­ri­ously, go­ing way out­side the spirit of the con­test; some peo­ple even re­sorted to things like DDoS at­tacks. Many peo­ple in­cor­rectly con­cluded that they were some­how worse pro­gram­mers be­cause their own times did­n’t com­pare. What started as a fun fea­ture in 2015 be­came an ever-grow­ing prob­lem, and so, af­ter ten years of Advent of Code, I re­moved the global leader­board. (However, I’ve made it so you can share a read-only view of your pri­vate leader­board. Please don’t use this fea­ture or data to cre­ate a “new” global leader­board.)

While try­ing to get a fast time on a pri­vate leader­board, may I use AI / watch stream­ers / check the so­lu­tion threads / ask a friend for help / etc? If you are a mem­ber of any pri­vate leader­boards, you should ask the peo­ple that run them what their ex­pec­ta­tions are of their mem­bers. If you don’t agree with those ex­pec­ta­tions, you should find a new pri­vate leader­board or start your own! Private leader­boards might have rules like max­i­mum run­time, al­lowed pro­gram­ming lan­guage, what time you can first open the puz­zle, what tools you can use, or whether you have to wear a silly hat while work­ing.

Should I use AI to solve Advent of Code puz­zles? No. If you send a friend to the gym on your be­half, would you ex­pect to get stronger? Advent of Code puz­zles are de­signed to be in­ter­est­ing for hu­mans to solve - no con­sid­er­a­tion is made for whether AI can or can­not solve a puz­zle. If you want prac­tice prompt­ing an AI, there are al­most cer­tainly bet­ter ex­er­cises else­where de­signed with that in mind.

Can I copy/​re­dis­trib­ute part of Advent of Code? Please don’t. Advent of Code is free to use, not free to copy. If you’re post­ing a code repos­i­tory some­where, please don’t in­clude parts of Advent of Code like the puz­zle text or your in­puts. If you’re mak­ing a web­site, please don’t make it look like Advent of Code or name it some­thing sim­i­lar.

Landlock: What Is It?

Landlock is a Linux API that lets ap­pli­ca­tions ex­plic­itly de­clare which re­sources they are al­lowed to ac­cess. Its phi­los­o­phy is sim­i­lar to OpenBSD’s un­veil() and (less so) pledge(): pro­grams can make a con­tract with the ker­nel stat­ing, “I only need these files or re­sources — deny me every­thing else if I’m com­pro­mised.”

It pro­vides a sim­ple, de­vel­oper-friendly way to add de­fense-in-depth to ap­pli­ca­tions. Compared to tra­di­tional Linux se­cu­rity mech­a­nisms, Landlock is vastly eas­ier to un­der­stand and in­te­grate.

This post is meant to be an ac­ces­si­ble in­tro­duc­tion, and hope­fully per­suade you to give Landlock a try.

How Does It Work?

Landlock is a Linux Security Module (LSM) avail­able since Linux 5.13. Unlike MAC frame­works such as SELinux or AppArmor, Landlock ap­plies tran­sient re­stric­tions: poli­cies are cre­ated at run­time, en­forced on the cur­rent thread and its fu­ture de­scen­dants, and dis­ap­pear when the process ex­its.

You don’t tag files with la­bels or ex­tended at­trib­utes. Instead, ap­pli­ca­tions cre­ate poli­cies dy­nam­i­cally.

Handled ac­cesses — the cat­e­gories of op­er­a­tions you want to re­strict (e.g., filesys­tem read/​write).

Access grants — an ex­plicit al­lowlist of which ob­jects are per­mit­ted for those op­er­a­tions.

For ex­am­ple, you could cre­ate a pol­icy that han­dles all filesys­tem reads/​writes and net­work binds, and grants:

The ap­pli­ca­tion then calls land­lock­_re­stric­t_­self() to en­ter the re­stricted do­main. From that point on, that thread’s child threads and child processes are per­ma­nently con­strained. Restrictions can­not be re­voked.

Policies can be lay­ered (up to 16 lay­ers). A child layer may fur­ther re­duce ac­cess, but can­not rein­tro­duce per­mis­sions the par­ent layer re­moved. For ex­am­ple, a child thread may add a layer to this pol­icy to re­strict it­self to only read­ing /home/user, but it can­not re­gain per­mis­sion to bind to port 2222 once a layer omits this grant.

Landlock is un­priv­i­leged — any ap­pli­ca­tion can sand­box it­self. It also uses ABI ver­sion­ing, al­low­ing pro­grams to ap­ply best-ef­fort sand­box­ing even on older ker­nels lack­ing newer fea­tures.

It’s also a stack­able LSM, mean­ing you can com­bine it with selinux or ap­par­mor in a sup­ple­men­tal layer.

Why Should You Use It?

Landlock shines when an ap­pli­ca­tion has a pre­dictable set of files or di­rec­to­ries it needs. For ex­am­ple, a web server could re­strict it­self to ac­cess­ing only /var/www/html and /tmp.

Unlike SELinux or AppArmor, Landlock poli­cies don’t re­quire ad­min­is­tra­tor in­volve­ment or sys­tem-wide con­fig­u­ra­tion. Developers can em­bed poli­cies di­rectly in ap­pli­ca­tion code, mak­ing sand­box­ing a nat­ural part of the de­vel­op­ment process.

Because Landlock re­quires no priv­i­leges to use, adding it to most pro­grams is straight­for­ward.

Bindings ex­ist for lan­guages such as Rust, Go, and Haskell, and sev­eral pro­jects pro­vide user-friendly un­veil-style wrap­pers.

A of­fi­cial c li­brary does­n’t ex­ist yet un­for­tu­nately, but there’s sev­eral out there you can try.

use land­lock::{

ABI, Access, AccessFs, Ruleset, RulesetAttr, RulesetCreatedAttr, RulesetStatus, RulesetError,

path_be­neath_rules,

fn re­stric­t_thread() -> Result {

let abi = ABI::V1;

let sta­tus = Ruleset::default()

.handle_access(AccessFs::from_all(abi))?

.create()?

// Read-only ac­cess to /usr, /etc and /dev.

.add_rules(path_beneath_rules(&[“/usr”, “/etc”, “/dev”], AccessFs::from_read(abi)))?

// Read-write ac­cess to /home and /tmp.

.add_rules(path_beneath_rules(&[“/home”, “/tmp”], AccessFs::from_all(abi)))?

.restrict_self()?;

match sta­tus.rule­set {

RulesetStatus::FullyEnforced => println!(“Fully sand­boxed.“),

RulesetStatus::PartiallyEnforced => println!(“Par­tially sand­boxed.“),

RulesetStatus::NotEnforced => println!(“Not sand­boxed! Please up­date your ker­nel.“),

Ok(())

The State of Linux Sandboxing: Why This Matters

As Linux adop­tion grows, so does the amount of mal­ware tar­get­ing desk­top users. While Linux has his­tor­i­cally en­joyed rel­a­tive safety, this is largely due to smaller mar­ket share and higher tech­ni­cal bar­ri­ers com­pared to Windows — not be­cause Linux is in­her­ently safer.

Linux is not a se­cu­rity panacea. For ex­am­ple, on most ma­jor dis­tri­b­u­tions:

Users can down­load and ex­e­cute un­trusted bi­na­ries with no warn­ings.

Shell scripts can be piped from the in­ter­net and ex­e­cuted blindly.

Many users run pass­word­less sudo, giv­ing them root ac­cess on de­mand.

Unprivileged ap­pli­ca­tions can typ­i­cally:

Read ~/.ssh, ~/.bashrc, browser cook­ies, and any­thing else in $HOME

Several tools try to im­prove the state of se­cu­rity on linux, but each has sig­nif­i­cant draw­backs:

Many users break iso­la­tion by us­ing –privileged or –network host.

Must be ex­plic­itly in­voked each time, or you need a wrap­per script.

Blacklists are frag­ile; new syscalls can break things.

Argument fil­ter­ing is dif­fi­cult and full of TOCTOU haz­ards.

Many users dis­able it due to com­plex­ity.

Not en­abled on most dis­tri­b­u­tions by de­fault. (used a lot in an­droid)

Easier than SELinux, but still re­quires ad­min-de­fined pro­files.

Gets dis­abled by many dis­tri­b­u­tions, but is more com­monly used in the desk­top.

What land­lock could bring to the table:

Long-running sys­tem dae­mons that run with el­e­vated priv­i­leges could ben­e­fit from land­lock re­stric­tions.

Desktop ap­pli­ca­tions deal­ing with bi­nary for­mats, like pdf read­ers, im­age view­ers web browsers, and word proces­sors can be re­stricted to ac­cess­ing the files they orig­i­nally opened.

FTP and HTTP servers can be bound to the files they need. Even if ng­inx is run­ning as root, if an at­tacker gets a full re­verse shell, they won’t be able to see ac­cess files out­side the pol­icy.

If the su­per­vi­sor pro­posal gets added, we could bring an an­droid-like per­mis­sions sys­tem to the linux desk­top. Flatpak does a de­cent job at this, but imag­ine if every process in your desk­top would need to ex­plic­itly ask (at least once) be­fore ac­cess­ing sen­si­tive files or re­sources.

Pair that with an ac­ces­si­ble GUI and a sys­tem for han­dling up­dates and sav­ing per­mis­sion grants, and we have po­ten­tial for a safer, more se­cure linux user ex­pe­ri­ence on the desk­top.

Several promis­ing fea­tures are un­der ac­tive de­vel­op­ment:

Supervise Mode

Lets a user­space “supervisor” in­ter­ac­tively al­low or deny ac­cess — sim­i­lar to Android-style per­mis­sion prompts.

Socket Restrictions

Fine-grained con­trol over which types of sock­ets or ports processes may use.

LANDLOCK_RESTRICT_SELF_TSYNC

Ensures re­stric­tions prop­a­gate to all threads in a process.

LANDLOCK_ADD_RULE_NO_INHERIT (disclosure: this is my patch se­ries)

Prevents rules from un­in­ten­tion­ally in­her­it­ing per­mis­sions from par­ent di­rec­to­ries, giv­ing finer-grained filesys­tem con­trol.

Landlock is a sim­ple, un­priv­i­leged, deny-by-de­fault sand­box­ing mech­a­nism for Linux.

It’s easy to un­der­stand, easy to in­te­grate, and has tremen­dous po­ten­tial for im­prov­ing desk­top and ap­pli­ca­tion se­cu­rity.

Give it a try in your ap­pli­ca­tion.

Among a few other in­te­gral tricks and tech­niques, Feynman’s trick was a strong rea­son that made me love eval­u­at­ing in­te­grals, and al­though the tech­nique it­self goes back to Leibniz be­ing com­monly known as the Leibniz in­te­gral rule, it was Richard Feynman who pop­u­lar­ized it, which is why it is also re­ferred to as Feynman’s trick. Here’s an ex­cerpt from his book, Surely You’re Joking, Mr. Feynman:

“One thing I never did learn was con­tour in­te­gra­tion. I had learned to do in­te­grals by var­i­ous meth­ods shown in a book that my high school physics teacher Mr. Bader had given me.

One day he told me to stay af­ter class. “Feynman,” he said, “you talk too much and you make too much noise. I know why. You’re bored. So I’m go­ing to give you a book. You go up there in the back, in the cor­ner, and study this book, and when you know every­thing that’s in this book, you can talk again.”

So every physics class, I paid no at­ten­tion to what was go­ing on with Pascal’s Law, or what­ever they were do­ing. I was up in the back with this book: Advanced Calculus, by Woods. Bader knew I had stud­ied Calculus for the Practical Man a lit­tle bit, so he gave me the real works — it was for a ju­nior or se­nior course in col­lege. It had Fourier se­ries, Bessel func­tions, de­ter­mi­nants, el­lip­tic func­tions — all kinds of won­der­ful stuff that I did­n’t know any­thing about.

That book also showed how to dif­fer­en­ti­ate pa­ra­me­ters un­der the in­te­gral sign — it’s a cer­tain op­er­a­tion. It turns out that’s not taught very much in the uni­ver­si­ties; they don’t em­pha­size it. But I caught on how to use that method, and I used that one damn tool again and again. So be­cause I was self-taught us­ing that book, I had pe­cu­liar meth­ods of do­ing in­te­grals.

The re­sult was, when guys at MIT or Princeton had trou­ble do­ing a cer­tain in­te­gral, it was be­cause they could­n’t do it with the stan­dard meth­ods they had learned in school. If it was con­tour in­te­gra­tion, they would have found it; if it was a sim­ple se­ries ex­pan­sion, they would have found it. Then I come along and try dif­fer­en­ti­at­ing un­der the in­te­gral sign, and of­ten it worked. So I got a great rep­u­ta­tion for do­ing in­te­grals, only be­cause my box of tools was dif­fer­ent from every­body else’s, and they had tried all their tools on it be­fore giv­ing the prob­lem to me.”

For me, em­ploy­ing this trick felt like I was us­ing cheat codes to deal with in­te­grals. At the same time, it en­abled a lot of cre­ativ­ity and wish­ful think­ing, which trans­formed in­te­grals into puz­zles. Unfortunately, this also means that there is no clear path on how and when to use this tech­nique. In ad­di­tion, what Feynman wrote still ap­plies to­day since the method is­n’t taught much, if at all, in uni­ver­si­ties. Therefore, the trick can seem ob­scure and dif­fi­cult to grasp for new­com­ers.

In the fol­low­ing sec­tion, we will em­bark on a jour­ney to de­velop some rules of thumb to have at our dis­posal when us­ing Feynman’s trick. These are merely some heuris­tics that I tend to use, so de­vi­at­ing from them can be per­fectly ac­cept­able. However, I hope that they can pro­vide a path to fol­low when noth­ing ob­vi­ous or in­tu­itive oc­curs when some­one tries to use this trick, or even bet­ter, so that they can serve as mo­ti­va­tion for some­one to start us­ing the method.

Feynman al­ready pro­vided a sig­nif­i­cant hint about the trick when he men­tioned dif­fer­en­ti­at­ing un­der the in­te­gral sign, which is also an al­ter­na­tive name for the tech­nique. More ex­plic­itly, if \(f(x,t)\) and \(\frac{\partial f(x,t)}{\par­tial t}\) is con­tin­u­ous with re­spect to both vari­ables over the \([a,b]\) in­ter­val, then the fol­low­ing holds:

This is nice, but not so use­ful by it­self since it does­n’t say any­thing about how and when to ap­ply it. Moreover, learn­ing is not a spec­ta­tor sport and one has to get their hands dirty as there are no short­cuts to it. Take for ex­am­ple chess, most peo­ple could read and un­der­stand the rules in a few min­utes, how­ever, if they would go on to play a game then most likely they would get stomped by a more ex­pe­ri­enced player. This is be­cause the other player, through prac­tice, learned some strate­gies to use when play­ing.

Thus, with the goal to de­velop some strate­gies here as well, we will dive straight into ac­tion and ap­proach Feynman’s trick us­ing prac­ti­cal ex­am­ples. As a “Hello, World!” in­tro­duc­tion, let’s take a look at the fol­low­ing in­te­gral:

You are en­cour­aged to try and eval­u­ate the in­te­gral us­ing ba­sic meth­ods, but the log­a­rithm be­ing in the de­nom­i­na­tor makes this in­te­gral quite stub­born to deal with. Feynman’s trick aims to get rid of this is­sue by dif­fer­en­ti­at­ing un­der the int­geral sign, with re­spect to a pa­ra­me­ter, in or­der to ob­tain an in­te­gral that is eas­ier to eval­u­ate.

Unfortunately in the in­te­gral from above we lack a pa­ra­me­ter, there­fore the first step is to pa­ra­me­terise the in­te­gral, which can even mean in­tro­duc­ing a whole func­tion, but for this ex­am­ple we will sim­ply con­sider:

Keep in mind that our orig­i­nal in­te­gral is just \(I(1)\). Also, surely we could’ve placed a pa­ra­me­ter in many dif­fer­ent places, such as:

However, the main idea be­hind the trick is to ob­tain an in­te­gral that we can eval­u­ate eas­ier, af­ter dif­fer­en­ti­at­ing with re­spect to the new pa­ra­me­ter. Let’s put this in ac­tion and see what hap­pens to \(I(t)\).

Notice how easy it was to eval­u­ate the in­te­gral \(I’(t)=\int_0^1x^tdx\) from above, had we kept \(I(a)\), \(I(b)\) or \(I(c)\) the things would­n’t had sim­pli­fied at all af­ter dif­fer­en­ti­at­ing, and most sig­nif­i­cantly is that we would still have the \(\ln x\) in the de­nom­i­na­tor, a thing which made the in­te­gral hard to deal with in the first place.

We can al­ready sense that the fol­low­ing might be an im­por­tant ques­tion in the fu­ture: How to pa­ra­me­terise the in­te­gral when us­ing Feynman’s Trick?

We will worry about that a bit later, for now let’s fin­ish the in­te­gral as we only found \(I’(t)\). Since we are look­ing to find \(I(1)\) we need to in­te­grate \(I’(t)\) back and set \(t=1\) in or­der to ar­rive there. Here it’s use­ful to re­call that:

For us, \(f(x)\) is just \(I(t)\) in the above ex­pres­sion. Luckily \(I(0)=0\), and as we are look­ing for \(I=I(1)\) we have:

So that is the big pic­ture of Feynman’s trick - we have an in­te­gral that is hard to eval­u­ate in it’s orig­i­nal form, there­fore by dif­fer­en­ti­at­ing un­der the in­te­gral sign we at­tempt to trans­form the in­te­gral so that it can be eas­ier in­te­grated, and in the end we go back to undo the dif­fer­en­ti­a­tion step.

As em­pha­sized above, the main goal of the tech­nique is to ob­tain an in­te­gral that is eas­ier to eval­u­ate af­ter dif­fer­en­ti­at­ing with re­spect to a pa­ra­me­ter, and one is­sue is that it is not al­ways ob­vi­ous how to pa­ra­me­terise the in­te­gral. In or­der to make things more in­tu­itively we will play around with the in­te­gral from be­low.

The most an­noy­ing thing is the log­a­rithm, so if we get rid of it every­thing should be straight­for­ward. There are a few pa­ra­me­ter pos­si­bil­i­ties which makes sense to con­sider, namely:

With the first one we are out of luck, as dif­fer­en­ti­at­ing with re­spect to \(a\) gives:

Therefore, if we would try to go back to what we’re look­ing, which is \(I=I(1)-I(0)\), we would end up with \(I=I+\text{other stuff}\). This can­cels out \(I\) and we would­n’t be able to re­cover it. Unfortunately, there’s no magic for­mula that tells a pri­ori whether plac­ing a pa­ra­me­ter in a spe­cific place would suc­ceed or fail in eval­u­at­ing an in­te­gral - and some­times we are sim­ply un­lucky.

In con­trast, things work out nicely with the sec­ond choice from above.

Again, we are look­ing to find \(I(1)\), and as \(I(0) = 0\), we have:

This works, but we can do even bet­ter. Looking at the Hello, World! in­te­gral we can see that there we sim­pli­fied the log­a­rithm in the de­nom­i­na­tor while per­form­ing \(\frac{\partial}{\partial t}x^t\). This is also the first thing that I al­ways at­tempt to look for when us­ing this tech­nique - namely, to sim­plify some­thing from the in­te­grand which is in­de­pen­dent to the pa­ra­me­ter when dif­fer­en­ti­at­ing. Surely for the cur­rent in­te­gral we got rid of the log­a­rithm, but the de­nom­i­na­tor re­mained in­tact.

In short this will be our first rule of thumb: if pos­si­ble, place the pa­ra­me­ter so that some­thing from the in­te­gral, which is not re­lated to the pa­ra­me­ter, gets sim­pli­fied.

In or­der to achieve this with our in­te­gral we would need to get rid of \(1+x^2\), and by us­ing \(\ln x=\frac12\ln(x^2)\) we can rewrite the in­te­gral as:

Finally, in this form it’s more nat­ural to place the pa­ra­me­ter so that it sim­pli­fies \(1+x^2\) when dif­fer­en­ti­at­ing with re­spect to \(t\), namely we can con­sider:

Like for \(I(b)\) we are look­ing to find \(I(1)\), how­ever here \(I(0)\) is equal to \(\frac12\int_0^1\frac{\ln(2x)}{1+x^2}dx\) not \(0\).

For this spe­cific in­te­gral we only avoided per­form­ing par­tial frac­tions so there was­n’t re­ally a big im­prove­ment by sim­pli­fy­ing the de­nom­i­na­tor. However I want to em­pha­size the im­por­tance of this be­cause it will make things come way more nat­ural when de­cid­ing where place the pa­ra­me­ter. Of course, in case there’s not an ap­propi­ate or im­me­di­ate way to achieve this, it’s per­fectly fine to place the pa­ra­me­ter else­where too.

As men­tioned pre­vi­ously, prac­tic­ing is the best ap­proach to get along with new tech­niques, there­fore be­low are more in­te­grals to eval­u­ate along­side some hid­den steps in case those will be needed. However, I strongly rec­om­mend to try and deal with the in­te­grals be­fore look­ing at any hints, and only check them af­ter­wards for cor­rect­ness.

Consider in­tro­duc­ing the fol­low­ing pa­ra­me­ter: \[I(t)=\int_0^\frac{\pi}{2} \frac{\ln(1-t\sin x)}{\sin x}dx \Rightarrow I’(t)= -\frac{2\arctan\left(\sqrt{\frac{1+t}{1-t}}\right)}{\sqrt{1-t^2}}\] This should lead to: \[\int_0^\frac{\pi}{2} \frac{\ln(1-\sin x)}{\sin x}dx = I(1) - I(0)=\int_0^1 I’(t) dt \overset{\sqrt{\frac{1-t}{1+t}}=x} = -\frac{3\pi^2}{8}\] But it would be even bet­ter if the in­te­gral would be pa­ra­me­terised as: \[I(t)=\int_0^\frac{\pi}{2} \frac{\ln(1-\sin t\sin x)}{\sin x}dx\] That is be­cause usu­ally when hav­ing trigono­met­ric func­tions, pa­ra­me­ter­is­ing the in­te­gral with an­other trigono­met­ric func­tion, leads to a more smoother re­sult.

Consider in­tro­duc­ing the fol­low­ing pa­ra­me­ter: \[I(t)=\int_0^1 \frac{\ln(1-t(x-x^2))}{x-x^2}dx\Rightarrow I’(t) = \frac{4\arctan\left(\sqrt{\frac{t}{4-t}}\right)}{\sqrt{t(4-t)}}\] This should lead to: \[I(1)=\int_0^1 \frac{\ln(1-x+x^2)}{x-x^2}dx = I(1) - I(0) = \int_0^1 I’(t)dt \overset{\sqrt{\frac{4-t}{t}}= x}= -\frac{\pi^2}{9}\]

Consider in­tro­duc­ing the fol­low­ing pa­ra­me­ter: \[I(t)=\int_0^\frac{\pi}{2} \frac{\arctan(t\sin x)}{\sin x}dx\Rightar­row I’(t)=\frac{\pi}{2\sqrt{1+t^2}}\] This should lead to: \[I(1)=\int_0^\frac{\pi}{2} \frac{\arctan(t\sin x)}{\sin x}dx = I(1)-I(0) = \int_0^1 I’(t)dt = \frac{\pi}{2}\ln(1+\sqrt 2)\] It will also work if the in­te­gral is pa­ra­me­terised as: \[I(t)=\int_0^\frac{\pi}{2} \frac{\arctan(\tan t\sin x)}{\sin x}dx\] However, in this case the first vari­ant is sim­ple enough to in­te­grate back.

Consider in­tro­duc­ing the fol­low­ing pa­ra­me­ter: \[I(t)=\int_0^\infty x^2e^{-\left(4x^2+\frac{t}{x^2}\right)}dx\Rightar­row I’(t)=-\frac{\sqrt \pi}{4} e^{-4\sqrt t}\] Where the above re­sult fol­lows by us­ing Glasser’s mas­ter the­o­rem along­side the Gaussian in­te­gral. This should lead to: \[\int_0^\infty x^2e^{-\left(4x^2+\frac{9}{x^2}\right)}dx = I(9)- I(0) + I(0) = \int_0^9 I’(t) dt +\frac{\sqrt \pi}{32}=\frac{13}{32}\frac{\sqrt \pi}{e^{12}}\]

Consider pa­ra­me­ter­is­ing the in­te­gral as: \[I(t)=\frac12\int_0^1\frac{\ln(1-t(1-x^2))}{1-x^2}dx\Rightarrow I’(t)=\frac{\arctan\left(\sqrt{\frac{t}{1-t}}\right)}{2\sqrt{t(1-t)}}\] This should lead to: \[\int_0^1 \frac{\ln x}{1-x^2}dx = I(1)- I(0) = \int_0^1 I’(t)dt \overset{\sqrt{\frac{1-t}{t}} = x}= -\frac{\pi^2}{8}\]

Consider pa­ra­me­ter­is­ing the in­te­gral as: \[I(t)=\int_0^\infty \frac{e^{-t(1+x^2)}}{1+x^2}dx\Rightarrow I’(t) = -\frac{\sqrt \pi}{2\sqrt t}e^{-t}\] This should lead to: \[\int_0^\infty \frac{e^{-x^2}}{1+x^2}dx = e\left(I(1)-I(\in­fty)\right) = -e\int_1^\infty I’(t)dt= \frac{\pi e}{2}\op­er­a­tor­name{erfc}(1)\] Where \(\operatorname{erfc}(x)\) is the com­ple­men­tary er­ror func­tion.

Since \(1-x^2+x^4=(1+x^2)^2-3x^2\), con­sider pa­ra­me­ter­is­ing the in­te­gral as: \[I(t)=\int_0^\infty \frac{\ln\left(\frac{t(1+x^2)^2-3x^2}{(1-x^2)^2}\right)}{(1+x^2)^2}dx\Rightarrow I’(t)=\frac{\pi}{2\sqrt{t(4t-3)}}\] And in or­der to go back it should be ob­served that \(\frac34(1+x^2)^2-3x^2=\frac34(1-x^2)^2\). \[\int_0^\infty \frac{\ln\left(\frac{1-x^2+x^4}{(1-x^2)^2}\right)}{(1+x^2)^2}dx=I(1)- I\left(\frac34\right)+ I\left(\frac34\right)\] \[=\int_\frac34^1 I’(t)dt + \frac{\pi}{4}\ln\left(\frac{3}{4}\right) = \frac{\pi}{2}\ln\left(\frac32\right)\]

The pre­vi­ous chap­ter em­pha­sized to pa­ra­me­terise in­te­grals so that some­thing from the in­te­gral, which is not re­lated to the pa­ra­me­ter, gets sim­pli­fied when dif­fer­en­ti­at­ing (if pos­si­ble). However there are times when even though we can in­tro­duce a pa­ra­me­ter to ac­com­plish that, it would­n’t be enough to fin­ish the in­te­gral.

In this chap­ter we will look at a dif­fer­ent way to ob­tain this sim­pli­fi­ca­tion. Let’s start by look­ing at a mod­i­fied ver­sion of an in­te­gral that was pre­vi­ously given as an ex­er­cise.

With \(\int_{-\infty}^\infty \frac{e^{-x^2}}{1+x^2}dx\) it was quite di­rect to pa­ra­me­terise the in­te­gral as \(\int_{-\infty}^\infty \frac{e^{-t(1+x^2)}}{1+x^2}dx\) since it sim­pli­fies the de­nom­i­na­tor, how­ever the sim­i­lar way to do that for our in­te­gral, \(\int_{-\infty}^\infty \frac{e^{-x^2-t(1+x^4)}}{1+x^4}dx\), does­n’t seem to work as it com­pli­cates things a bit too much.

There is how­ever a way to sim­plify the de­nom­i­na­tor and in the same time to ob­tain a de­cent in­te­gral af­ter­wards. Without get­ting into too much de­tails I will pa­ra­me­terise the in­te­gral as:

This will seem ob­scure, but fear not as we will never use this ap­proach again. The whole point is to sim­plify \(1+x^4\), and the above func­tion was cre­ated ex­plic­itly to achieve that, as \(\frac{\partial}{\partial t}e^{-tx^2}(x^2\sin t+\cos t)\) is \(-(1+x^4)e^{-tx^2}\sin t\). Note that even though we in­tro­duced a cou­ple other terms, those aren’t dis­turb­ing.

Here we are look­ing to find \(I=I(0)\), and we also have \(I(\infty)=0\), there­fore:

Where \(S(x)\) and \(C(x)\) are the Fresnel in­te­grals. However, the ap­proach is im­por­tant here, not the re­sult it­self.

We can avoid the para­metri­sa­tion from above by di­rectly us­ing \(\frac{1}{1+x^4}=\int_0^\infty e^{-tx^2}\sin t \, dt\), and then switch to dou­ble in­te­grals, or put in other words: em­ploy the ac­cel­er­ated Feynman’s trick (in which we skip the usual pa­ra­me­ter­i­sa­tion step).

The rest goes ex­actly as with the pre­vi­ous method, as all we did here was to skip dif­fer­en­ti­a­tion step and in­stead we switched to dou­ble in­te­grals.

A nat­ural ques­tion that arises here is how did \(\frac{1}{1+x^4}=\int_0^\infty e^{-tx^2}\sin t\, dt\) ap­pear? Or even bet­ter, how can some­one come up with sim­i­lar re­sults for other in­te­grals? In the case from above, sim­ply the Laplace trans­form of the sine func­tion was used, how­ever in gen­eral it’s use­ful to have a list of such iden­ti­ties. There are ta­bles of in­te­gral re­sults that can be used - for ex­am­ple: Table of Integrals, Series, and Products by Gradshteyn and Ryzhik - but al­ter­na­tively one can build up their own list of re­sults which tend to ap­pear of­ten while eval­u­at­ing other in­te­grals.

Let’s con­clude this chap­ter by eval­u­at­ing one of the most pop­u­lar in­te­grals that ap­pears when Feynman’s trick gets into the con­ver­sa­tion.

Since \(\int_0^\infty e^{-xt} dt = \frac{1}{x}\), we can make use of this to rewrite the in­te­gral as:

Alternatively, we can also con­sider the pa­ra­me­ter ver­sion of this in­te­gral, \(\int_0^\infty \frac{\sin x}{x}e^{-xt}dx\), how­ever I feel like switch­ing to dou­ble in­te­grals is way more in­tu­itively.

It might be worth to high­light again that this method should be used prefer­able when pa­ra­me­ter­is­ing the in­te­gral leads to nowhere. For the above in­te­gral, the nat­ural in­tro­duc­tion of \(\int_0^\infty \frac{\sin(tx)}{x}dx\) un­for­tu­natelly does fail, as we ob­tain a di­ver­gent in­te­gral af­ter dif­fer­en­ti­at­ing un­der the in­te­gral sign.

Like in the pre­vi­ous chap­ter be­low are more in­te­grals along­side some hints in or­der to prac­tice with the ac­cel­er­ated vari­a­tion of Feynman’s trick. However in this case I do rec­om­mend to peek at hints faster in case noth­ing ob­vi­ous comes to mind, and af­ter­wards to at­tempt and un­der­stand why the men­tioned iden­tity can be used.

Start by sub­sti­tut­ing \(x^2\to x\) and then switch to dou­ble in­te­grals us­ing: \[\int_0^\infty e^{-xt^2}dt = \frac{\sqrt \pi}{2\sqrt x}\] Where the lat­ter re­sult is due to the Gaussian in­te­gral. Also, this in­te­gral is one par­tic­u­lar case of the Fresnel in­te­gral.

Switch di­rectly to dou­ble in­te­grals by us­ing: \[\int_0^1 \frac{\ln t}{t-\frac{1}{x}}dt = \operatorname{Li}_2(x)\]

Switch to dou­ble in­te­grals by us­ing the fol­low­ing re­sult: \[\int_0^x \frac{\arctan t}{1+xt}dt = \frac{\arctan x \ln(1+x^2)}{2x}\]

Consider switch­ing to dou­ble in­te­grals with: \[\frac{x}{\pi^2+x^2}=\Im\left(-\frac{1}{\pi+ix}\right)=-\Im\int_0^\infty e^{-(\pi+ix)t}dt\] It’s also re­ally use­ful to try and see what hap­pens when the Laplace trans­form of the co­sine func­tion is used in­stead, or the equiv­a­lent: \[\frac{x}{\pi^2+x^2}=\Re\left(\frac{1}{i\pi+x}\right)=\Re\int_0^\infty e^{-(i\pi+x)t}dt\]

Consider switch­ing to dou­ble in­te­grals us­ing: \[\operatorname{Ci}^2(x)+\operatorname{si}^2(x)=\int_0^\infty \frac{e^{-xy}\ln(1+y^2)}{y}dy\]

Above \(\operatorname{Li}_2(x)\) de­notes the dilog­a­rithm func­tion and \(\operatorname{Ci}(x)\), \(\operatorname{si}(x)\) are the co­sine and the sine in­te­gral func­tions, de­fined as:

We al­ready got fa­mil­iar with a pop­u­lar ver­sion of Feynman’s trick in the pre­vi­ous chap­ter. Similarly, now we will take a look at other in­ter­est­ing vari­ants of Feynman’s trick, which al­though might ap­pear less of­ten, they can still help to ex­pand the ap­plic­a­bil­ity of the tech­nique.

We will start by tak­ing a look at a much sim­pler case of Feynman’s trick, namely, in the sit­u­a­tion when it would be enough to sim­ply dif­fer­en­ti­ate un­der the in­te­gral sign with­out per­form­ing that “undo” step to in­te­grate back.

As a small note, it’s true that “differentiating un­der the in­te­gral sign” tends to be used as an al­ter­na­tive name for Feynman’s trick, how­ever I pre­fer to keep this for the vari­ant where only the dif­fer­en­ti­at­ing process takes part, or as men­tioned above, when there’s no need to in­te­grate back the re­sult, and the name de­scribes quite lit­er­ally what we are do­ing.

Let’s make this more clear by look­ing at the fol­low­ing in­te­gral:

We are al­ready aware from the Hello, World! in­te­gral how \(\ln x\) can be sim­pli­fied, since \(\frac{\partial}{\partial a}x^a = x^a \ln x\). However, by in­tro­duc­ing the pa­ra­me­ter in that orig­i­nal form as \(x^a \ln^2 x\), we would just pro­duce a third log­a­rithm, so that’s go­ing in the op­po­site di­rec­tion.

Fortunatelly, if we take a step back, we can ob­serve that af­ter we find the re­sult of \(\int_0^1 x^a dx\), then dif­fer­en­ti­at­ing it w.r.t.\(a\) would give us as many log­a­rithms as we want. So, let’s put that in­te­gral to use.

Of course the in­te­gral it­self was quite sim­ple this time, how­ever the im­por­tant part that should be high­lighted is that not al­ways we need to per­form that “undo” step af­ter dif­fer­en­ti­at­ing un­der the in­te­gral sign - and some­times know­ing a gen­eral in­te­gral re­sult can pro­vide us more use­ful in­te­grals by dif­fer­en­ti­at­ing it.

Further, we will take a look at how Feynman’s trick can be ap­plied to in­def­i­nite in­te­grals. Let’s con­sider:

In this form it makes no sense to dif­fer­en­ti­ate the in­te­gral with re­spect to any pa­ra­me­ter, but we can ex­tend the in­te­gral with tem­po­rary bounds by writ­ing:

After this we can go on ap­ply Feynman’s trick, how­ever, first we are go­ing get rid of the square root via the sub­sti­tu­tion \(\frac{1}{\sqrt x}\to x\).

Here, we can no­tice that the de­riv­a­tive of \(ax-\frac{b}{x}\) is \(a+\frac{b}{x^2}\) so it would be quite help­ful if we had that ad­di­tional term. In the same time if we dif­fer­en­ti­ate the in­te­grand with re­spect to \(b\) we’ll pro­duce \(a-\frac{b}{x^2}\), which is re­ally use­ful as \((ax-b/x)^2\) is equal to \((ax+b/x)^2+4ab\) and the de­riv­a­tive of \(ax+\frac{b}{x}\) is \(a-\frac{b}{x^2}\). So let’s dif­fer­en­ti­ate as men­tioned above:

Where \(\operatorname{erfc}(x)\) is the com­ple­men­tary er­ror func­tion. Now we’ll go back to \(I(a,b,t)\), but we should be care­ful to re­place the dummy vari­able \(b\), with some­thing else as the \(b\) pa­ra­me­ter does also ap­pear in the bounds.

Or for the in­def­i­nite in­te­gral, this would lead to:

Next, we will take a look at how to com­bine Feynman’s trick with power se­ries. For this we are go­ing to look at:

We are al­ready got fa­mil­iar with what to do when there is a log­a­rithm in the de­nom­i­na­tor as we saw that we can get rid of them by us­ing \(\frac{d}{dt} x^t = x^t\ln x\), how­ever here also the \(1-xy\) term ap­pears. In or­der to solve this is­sue we’ll make use of the geoemtric se­ries, namely \(\frac{1}{1-x}=\sum_{n=0}^\infty x^n\), but we will ex­pand into se­ries a bit later and for now con­tinue with the fol­low­ing in­te­gral:

Now we have to to get back to \(I(n)\):

And fi­nally, we’ll put the geo­met­ric se­ries to use.

So the re­sult is sim­ply \(1-2\gamma\), where \(\gamma\) is the Euler-Mascheroni con­stant.

In what’s to come we are go­ing to take a look at a com­bi­na­tion be­tween Feynman’s trick and dif­fer­en­tial equa­tions. Let’s con­sider the fol­low­ing in­te­gral:

We can start by pa­ra­me­ter­is­ing the co­sine func­tion and then em­ploy the ac­cel­er­ated Feynman’s trick:

We haven’t made much progress above, since we sim­ply ar­rived at an­other in­te­gral with \(x\sin(tx)\) in­stead of \(\cos(tx)\), thus com­plex­ity is the same. However, as \(\frac{\partial}{\partial t}\cos(tx)\) is \(x\sin(tx)\), dif­fer­en­ti­at­ing \(I(t)\) gives us a dif­fer­en­tial equa­tion to work with, namely:

\[I’(t)=- \int_0^\infty \frac{x\sin(tx)}{1+x^2}dx = - I(t) \Rightarrow \frac{I’(t)}{I(t)}=-1\Rightarrow I(t) = C e^{-t}\]

\[I(0)=\int_0^\infty \frac{1}{1+x^2}dx=\frac{\pi}{2} \Rightarrow I(t)=\frac{\pi}{2}e^{-t}\]

\[ I = I(1) \Rightarrow I = \frac{\pi}{2e}\]

As a small note for the start­ing step, al­though em­ploy­ing the ac­cel­er­ated Feynman’s trick was rather ob­vi­ous as to get rid of the de­nom­i­na­tor, the ad­di­tional in­tro­duc­tion of the \(t\) pa­ra­me­ter might be weird first. However per­form­ing the same steps with­out this pa­ra­me­ter gives us:

Which in­di­cates that one might put to use the fact that \(I(1)=-I’(1)\), by adding the ad­di­tional \(t\) pa­ra­me­ter.

So far we’ve seen the Feynman’s trick ap­plied only when the pa­ra­me­ter was in­side the in­te­grand, how­ever it can also be used when the bounds are pa­ra­me­terised as well. More gen­er­ally, the fol­low­ing holds:

We’ll put this to use with the in­te­gral from be­low.

Above we can see that the same \(\sqrt 2\) ap­pears in both the lower bound and the \(\operatorname{arccosh}\) func­tion, so we’ll pa­ra­me­terise the in­te­gral as:

We’re look­ing to find \(I=I\left(\sqrt 2\right)\), and since \(I\left(1\right)=0\), we have:

Now we’ll take a look at a fancier way to use Feynman’s trick, es­pe­cially in or­der to gen­er­ate new in­te­grals, for this we’re con­sid­er­ing:

Note that we are not try­ing to eval­u­ate the above in­te­gral, in­stead we are sim­ply us­ing it in or­der to build up new in­te­grals with the re­sult that fol­lows af­ter dif­fer­en­ti­at­ing w.r.t. \(t\).

We also have that \(I(\pi)=-\frac{\pi^2}{4}\) and \(I(0)=\frac{\pi^2}{8}\), there­fore:

In ret­ro­spect, this in­te­gral also ap­peared as an ex­er­cise in the sec­ond chap­ter, and with the same sug­ges­tion from there, we can eval­u­ate the in­te­gral by ap­ply­ing Feynman’s trick to:

Admittedly, fol­low­ing this pa­ra­me­ter­i­sa­tion is much more in­tu­itevely than what we’ve shown with the new vari­a­tion, how­ever it’s also use­ful to have this trick in the bag.

To keep the prac­tice go­ing, un­der­neath are listed some in­te­grals that can be eval­u­ated with one ver­sion of Feynman’s trick de­scribed in this chap­ter.

Start by show­ing that: \[I(t)=\int_1^\infty \int_1^\infty e^{-t(x+y)}dxdy = \left(\frac{e^{-t}}{t}\right)^2\] Then dif­fer­en­ti­ate both sides two times with re­spect to \(t\) and set \(t=1\).

Differentiate four times with re­spect to \(n\) the fol­low­ing ex­tended in­def­i­nite in­te­gral: \[ I(n,t) = \int_0^t \cos(nx) dx \]

Solve the re­sult­ing dif­fer­en­tial equa­tion af­ter dif­fer­en­ti­at­ing twice the fol­low­ing in­te­gral: \[ I(t) = \int_0^\infty \frac{\sin^2 (tx)}{x^2(1+x^2)}dx \]

This note is to be re­moved be­fore pub­lish­ing as an RFC.¶

Discussion of this draft takes place on the HTTP work­ing group mail­ing list (ietf-http-wg@w3.org), which is archived at https://​lists.w3.org/​Archives/​Pub­lic/​ietf-http-wg/.¶

Working Group in­for­ma­tion can be found at https://​httpwg.org/; source code and is­sues list for this draft can be found at https://​github.com/​httpwg/​http-ex­ten­sions/​la­bels/​query-method.¶

The changes in this draft are sum­ma­rized in Appendix C.14.¶

This Internet-Draft is sub­mit­ted in full con­for­mance with the pro­vi­sions of BCP 78 and BCP 79.¶

Internet-Drafts are work­ing doc­u­ments of the Internet Engineering Task Force (IETF). Note that other groups may also dis­trib­ute work­ing doc­u­ments as Internet-Drafts. The list of cur­rent Internet-Drafts is at https://​data­tracker.ietf.org/​drafts/​cur­rent/.¶

Internet-Drafts are draft doc­u­ments valid for a max­i­mum of six months and may be up­dated, re­placed, or ob­so­leted by other doc­u­ments at any time. It is in­ap­pro­pri­ate to use Internet-Drafts as ref­er­ence ma­te­r­ial or to cite them other than as “work in progress.“¶

This Internet-Draft will ex­pire on 22 May 2026.¶

Copyright (c) 2025 IETF Trust and the per­sons iden­ti­fied as the doc­u­ment au­thors. All rights re­served.¶

This doc­u­ment is sub­ject to BCP 78 and the IETF Trust’s Legal Provisions Relating to IETF Documents (https://​trustee.ietf.org/​li­cense-info) in ef­fect on the date of pub­li­ca­tion of this doc­u­ment. Please re­view these doc­u­ments care­fully, as they de­scribe your rights and re­stric­tions with re­spect to this doc­u­ment. Code Components ex­tracted from this doc­u­ment must in­clude Revised BSD License text as de­scribed in Section 4.e of the Trust Legal Provisions and are pro­vided with­out war­ranty as de­scribed in the Revised BSD License.¶

This spec­i­fi­ca­tion de­fines the HTTP QUERY re­quest method as a means of mak­ing a safe, idem­po­tent re­quest (Section 9.2 of [HTTP]) that en­closes a rep­re­sen­ta­tion de­scrib­ing how the re­quest is to be processed by the tar­get re­source.¶

However, when the data con­veyed is too vo­lu­mi­nous to be en­coded in the re­quest’s URI, this pat­tern be­comes prob­lem­atic:¶

* of­ten size lim­its are not known ahead of time be­cause a re­quest can pass through many un­co­or­di­nated

sys­tems (but note that rec­om­mends senders and re­cip­i­ents to sup­port at least 8000 octets),¶

* ex­press­ing cer­tain kinds of data in the tar­get URI is in­ef­fi­cient be­cause of the over­head of en­cod­ing that data into a valid URI,¶

* re­quest URIs are more likely to be logged than re­quest con­tent, and may also turn up in book­marks,¶

* en­cod­ing queries di­rectly into the re­quest URI ef­fec­tively casts every pos­si­ble com­bi­na­tion of query in­puts as dis­tinct

re­sources.¶

As an al­ter­na­tive to us­ing GET, many im­ple­men­ta­tions make use of the HTTP POST method to per­form queries, as il­lus­trated in the ex­am­ple be­low. In this case, the in­put to the query op­er­a­tion is passed as the re­quest con­tent as op­posed to us­ing the re­quest URI’s query com­po­nent.¶

A typ­i­cal use of HTTP POST for re­quest­ing a query is:¶

In this vari­a­tion, how­ever, it is not read­ily ap­par­ent — ab­sent spe­cific knowl­edge of the re­source and server to which the re­quest is be­ing sent — that a safe, idem­po­tent query is be­ing per­formed.¶

The QUERY method pro­vides a so­lu­tion that spans the gap be­tween the use of GET and POST, with the ex­am­ple above be­ing ex­pressed as:¶

As with POST, the in­put to the query op­er­a­tion is passed as the con­tent of the re­quest rather than as part of the re­quest URI. Unlike POST, how­ever, the method is ex­plic­itly safe and idem­po­tent, al­low­ing func­tions like caching and au­to­matic re­tries to op­er­ate.¶

Recognizing the de­sign prin­ci­ple that any im­por­tant re­source ought to be iden­ti­fied by a URI, this spec­i­fi­ca­tion de­scribes how a server can as­sign URIs to both the query it­self or a spe­cific query re­sult, for later use in a GET re­quest.¶

The QUERY method is used to ini­ti­ate a server-side query. Unlike the GET method, which re­quests a rep­re­sen­ta­tion of the re­source iden­ti­fied by the tar­get URI (as de­fined by Section 7.1 of [HTTP]), the QUERY method is used to ask the tar­get re­source to per­form a query op­er­a­tion within the scope of that tar­get re­source.¶

The con­tent of the re­quest and its me­dia type de­fine the query. The ori­gin server de­ter­mines the scope of the op­er­a­tion based on the tar­get re­source.¶

Servers MUST fail the re­quest if the Content-Type re­quest field ([HTTP], Section 8.3) is miss­ing or is in­con­sis­tent with the re­quest con­tent.¶

As for all HTTP meth­ods, the tar­get URI’s query part takes part in iden­ti­fy­ing the re­source be­ing queried. Whether and how it di­rectly af­fects the re­sult of the query is spe­cific to the re­source and out of scope for this spec­i­fi­ca­tion.¶

QUERY re­quests are safe with re­gard to the tar­get re­source ([HTTP], Section 9.2.1) —  that is, the client does not re­quest or ex­pect any change to the state of the tar­get re­source. This does not pre­vent the server from cre­at­ing ad­di­tional HTTP re­sources through which ad­di­tional in­for­ma­tion can be re­trieved (see Sections 2.3

and 2.4).¶

Furthermore, QUERY re­quests are idem­po­tent ([HTTP], Section 9.2.2) —  they can be re­tried or re­peated when needed, for in­stance af­ter a con­nec­tion fail­ure.¶

As per Section 15.3 of [HTTP], a 2xx (Successful) re­sponse code sig­nals that the re­quest was suc­cess­fully re­ceived, un­der­stood, and ac­cepted.¶

In par­tic­u­lar, a 200 (OK) re­sponse in­di­cates that the query was suc­cess­fully processed and the re­sults of that pro­cess­ing are en­closed as the re­sponse con­tent.¶

The “Accept-Query” re­sponse header field can be used by a re­source to di­rectly sig­nal sup­port for the QUERY method while iden­ti­fy­ing the spe­cific query for­mat me­dia type(s) that may be used.¶

Accept-Query con­tains a list of me­dia ranges (Section 12.5.1 of [HTTP]) us­ing “Structured Fields” syn­tax ([STRUCTURED-FIELDS]). Media ranges are rep­re­sented by a List Structured Header Field of ei­ther Tokens or Strings, con­tain­ing the me­dia range value with­out pa­ra­me­ters.¶

Media type pa­ra­me­ters, if any, are mapped to Structured Field Parameters of type String or Token. The choice of Token vs. String is se­man­ti­cally in­signif­i­cant. That is, re­cip­i­ents MAY con­vert Tokens to Strings, but MUST NOT process them dif­fer­ently based on the re­ceived type.¶

Media types do not ex­actly map to Tokens, for in­stance they al­low a lead­ing digit. In cases like these, the String for­mat needs to be used.¶

The only sup­ported uses of wild­cards are “*/*”, which matches any type, or “xxxx/*”, which matches any sub­type of the in­di­cated type.¶

The or­der of types listed in the field value is not sig­nif­i­cant.¶

The value of the Accept-Query field ap­plies to every URI on the server that shares the same path; in other words, the query com­po­nent is ig­nored. If re­quests to the same re­source re­turn dif­fer­ent Accept-Query val­ues, the most re­cently re­ceived fresh value (per Section 4.2 of [HTTP-CACHING]) is used.¶

Although the syn­tax for this field ap­pears to be sim­i­lar to other fields, such as “Accept” (Section 12.5.1 of [HTTP]), it is a Structured Field and thus MUST be processed as spec­i­fied in Section 4 of [STRUCTURED-FIELDS].¶

The QUERY method is sub­ject to the same gen­eral se­cu­rity con­sid­er­a­tions as all HTTP meth­ods as de­scribed in [HTTP].¶

It can be used as an al­ter­na­tive to pass­ing re­quest in­for­ma­tion in the URI (e.g., in the query com­po­nent). This is pre­ferred in some cases, as the URI is more likely to be logged or oth­er­wise processed by in­ter­me­di­aries than the re­quest con­tent. In other cases, where the query con­tains sen­si­tive in­for­ma­tion, the po­ten­tial for log­ging of the URI might mo­ti­vate the use of QUERY over GET.¶

If a server cre­ates a tem­po­rary re­source to rep­re­sent the re­sults of a QUERY re­quest (e.g., for use in the Location or Content-Location field), as­signs a URI to that re­source, and the re­quest con­tains sen­si­tive in­for­ma­tion that can­not be logged, then that URI SHOULD be cho­sen such that it does not in­clude any sen­si­tive por­tions of the orig­i­nal re­quest con­tent.¶

Caches that nor­mal­ize QUERY con­tent in­cor­rectly or in ways that are sig­nif­i­cantly dif­fer­ent from how the re­source processes the con­tent can re­turn an in­cor­rect re­sponse if nor­mal­iza­tion re­sults in a false pos­i­tive.¶

A QUERY re­quest from user agents im­ple­ment­ing CORS (Cross-Origin Resource Sharing) will re­quire a “preflight” re­quest, as QUERY does not be­long to the set of CORS-safelisted meth­ods (see “Methods” in [FETCH]).¶

The ex­am­ples be­low are for il­lus­tra­tive pur­poses only; if one needs to send queries that are ac­tu­ally this short, it is likely bet­ter to use GET.¶

The me­dia type used in most ex­am­ples is “application/x-www-form-urlencoded” (as used in POST re­quests from browser user clients, de­fined in “application/x-www-form-urlencoded” in [URL]). The Content-Length fields have been omit­ted for brevity.¶

The HTTP Method Registry (http://​www.iana.org/​as­sign­ments/​http-meth­ods) al­ready con­tains three other meth­ods with the prop­er­ties “safe” and “idempotent”: “PROPFIND” ([RFC4918]), REPORT” ([RFC3253]), and “SEARCH” ([RFC5323]).¶

It would have been pos­si­ble to re-use any of these, up­dat­ing it in a way that it matches what this spec­i­fi­ca­tion de­fines as the new method “QUERY”. Indeed, the early stages of this spec­i­fi­ca­tion used “SEARCH”.¶

The method name “QUERY” ul­ti­mately was cho­sen be­cause:¶

* The al­ter­na­tives use a generic me­dia type for the re­quest con­tent (“application/xml”); the

se­man­tics of the re­quest de­pends solely on the re­quest con­tent.¶

* Furthermore, they all orig­i­nate from the WebDAV ac­tiv­ity, about which many have mixed feel­ings.¶

* “QUERY” cap­tures the re­la­tion with the URI’s query com­po­nent well.¶

This sec­tion is to be re­moved be­fore pub­lish­ing as an RFC.¶

We thank all mem­bers of the HTTP Working Group for ideas, re­views, and feed­back.¶

The fol­low­ing in­di­vid­u­als de­serve spe­cial recog­ni­tion: Carsten Bormann, Mark Nottingham, Martin Thomson, Michael Thornburgh, Roberto Polli, Roy Fielding, and Will Hawkins.¶

Ashok Malhotra par­tic­i­pated in early dis­cus­sions lead­ing to this spec­i­fi­ca­tion:¶

Discussion on the this HTTP method was re­opened by Asbjørn Ulsberg dur­ing the HTTP Workshop in 2019:¶

In fair­ness to re­searchers, it can be dif­fi­cult to run a ran­dom­ized clin­i­cal trial for vi­t­a­min D sup­ple­ments. That’s be­cause most of us get the bulk of our vi­t­a­min D from sun­light. Our skin con­verts UVB rays into a form of the vi­t­a­min that our bod­ies can use. We get it in our di­ets, too, but not much. (The main sources are oily fish, egg yolks, mush­rooms, and some for­ti­fied ce­re­als and milk al­ter­na­tives.)

The stan­dard way to mea­sure a per­son’s vi­t­a­min D sta­tus is to look at blood lev­els of 25-hydroxycholecalciferol (25(OH)D), which is formed when the liver me­tab­o­lizes vi­t­a­min D. But not every­one can agree on what the “ideal” level is.

Even if every­one did agree on a fig­ure, it is­n’t ob­vi­ous how much vi­t­a­min D a per­son would need to con­sume to reach this tar­get, or how much sun­light ex­po­sure it would take. One com­pli­cat­ing fac­tor is that peo­ple re­spond to UV rays in dif­fer­ent ways—a lot of that can de­pend on how much melanin is in your skin. Similarly, if you’re sit­ting down to a meal of oily fish and mush­rooms and wash­ing it down with a glass of for­ti­fied milk, it’s hard to know how much more you might need.

There is more con­sen­sus on the de­f­i­n­i­tion of vi­t­a­min D de­fi­ciency, though. (It’s a blood level be­low 30 nanomoles per liter, in case you were won­der­ing.) And un­til we know more about what vi­t­a­min D is do­ing in our bod­ies, our fo­cus should be on avoid­ing that.

For me, that means top­ping up with a sup­ple­ment. The UK gov­ern­ment ad­vises every­one in the coun­try to take a 10-microgram vi­t­a­min D sup­ple­ment over au­tumn and win­ter. That ad­vice does­n’t fac­tor in my age, my blood lev­els, or the amount of melanin in my skin. But it’s all I’ve got for now.