上禮拜上o左去 KL 參加 Hack in the Box 2008 Malaysia.

Logistics
搭 Aeroline 巴士o係某方面比搭飛機好, 全程有得用 Blackberry,, 電腦要上 3.5G 最好用天線最勁o既華為 E270, 車上有插蘇, 之但係, 如果你部腦唔係用 SSD, well, 願主保佑你。

Accommodation
Crowne Plaza Hotel KL internet 勁慢仲要收我 USD10, blacklisted。

慈善拍賣
大會壓軸有慈善拍賣, 所得款項將撥出幫助自閉仔。Hmm... 我埋首做研究/打機/玩音樂時都好自閉, 因乜解究我從冇收過善款...?

斬獲
Anyway, 我用一千馬幣 bid 贏 IDA Pro (Standard) 一年 Named License 一張, 等同半價, 呵呵~~ 唔明點解咁少人 bid, 係o的人唔知價, 定係因為用咩 tools 唔使落 report 所以唔使買 license?

回程買土產:

顯然, 哩套o野純粹睇 card ID 就開門, 囉唻做 cloning attack demo 就o岩晒。

Obsessive-Compulsive Disorder

有人興趣集郵, 有人鍾意收藏名錶...

Hong Kong's Abandoned Edge

曾蔭權說：『國家在多方面如製造業、科研都很棒，香港唯一突出的便是做金融中心，有自由兌換及金融基建等。』

Oh well putting all the eggs in one basket eh? Great way to show your leadership.

香港玩具 R&D, hardware R&D 都係世界一流, 偏偏政府非但不施以援手, 還協助外來企業打擊本土創新科技, 可恥! 我不會忘記力生係點死。

打擊 reverse engineering 文化只會導致 IT 受他國勢力控制, 嚴重威脅國家安全。香港政客只懂自毀長城。

反觀祖國, 經年累月大量投放資金, 做唐吉訶德式極度戇居的事, 只為國家要有自己的通訊架構 (TD-SCDMA) 和 CPU (龍芯)。這才是負責任的政府!

Look ma, no 火牛!

我整o左條 cable, 雙 USB 頭 (Y-cable) 確保 5v/2x500mA 供電, 另一邊係常見於萬用火牛兩個窿o個種頭, 插咩 plug 都得:

禮貌地我要講句 thanks for offering me a hacked copy of ISO27001.

But I will not take it.

知你勁, 識得鏟走個 watermark, 唔該唔好要 share 畀我, 因為我 take hacker ethics very seriously.

我當然有買老翻有 bt, 但好 game 好 software 我係一定會畀錢買, 更多時已經有成個 crack 版o係度, 都要特登出去買; shareware 我都會買, 雖然我手痕就會 crack o左佢; 更重要係, 用唻搵食o既, 我通通買晒 license。

Because it's the right thing to do.

Research?

我堅持 research 要能夠o係三句說話以向 layman 介紹得到, 否則一係個 topic irrelevant, 一係個 researcher 自閉。

鳳凰何少鳥何多。

San Jose Tech Museum 有個 exhibition, 係請o的 Nobel laureates 上去影相, o係毫無準備下畀張大白紙請佢o地畫出自己得獎o既研究。大師大都能夠扼要地畫出重點, 哩o的叫『言簡意賅』。

最令我感動o既一幅相, 係一位大師微笑住展示手中大白紙, 張紙空白一片。

I <3 Tux

Colleague: What's that?
Me: I went to LinuxWorld!
Colleague: Oh you went to DisneyWorld...
Me: No, I went to LinuxWorld.
Colleague: You went to what?

l'Occitane Honey Cream

左邊係舊甖, 右邊係新甖。

新甖勁 generic, 本來冇乜o野, 但珠玉在前立即給比下去, 其情況有如玩 hi-fi, 好多 product 本來好好地, 一 A-B test with 人o地副袈生, 即刻就身痕要 upgrade...

P.S. 據巴黎分店講法, 哩隻 product 已經 EOLed, 但事實上香港 IFC 現尚有大量存貨, 而 sales 未曾收到消息要 discontinue...

Blow Water Demo

表揚

我要表揚 InterContinental San Fran, 佢個 lounge 有 easily accessible o既 power outlets; 而佢個 wifi 雖然正常 surf web 竟敢向個客收錢, 但 outbound port 22 冇 block 到, 方便o的有 ssh tunnel o既朋友。

Johnny Rockets Burger

所謂 50s burgers o既 franchise 重有 Peggy Sue's, 不過都係 Johnny Rockets 就腳o的...





Shakes! 竟然係用真正士多啤梨同香蕉做...

Cray

Cray 係 usability design o既典範...



法國家俬洋溢 art deco 風味...



只可惜 Cray-2 摒棄o左佢最為人津津樂道o既 feature...


後來佢摺o左。

~~ The End ~~~

太多人誤解, 唔理解, 或者冇資源去理解。我必須要強調, upgrade o左唔等於安全, NAT derandomization 係非常普遍o既現像, 而o個o的齋睇 stdev 就 rate 你 "GREAT" o既 web-based testers 更加係 downright misleading... 唔該先生睇睇你個 port range 先出聲。

Thought-Provoking

昨日o係 USENIX Security '08 聽o左兩個好 thought-provoking o既 talks。第一個係 Coverity o既 co-founder Dawson Engler 講返 commercialize 一件 research product o既血淚史。

對於當年曾年少無知心口寫個勇字學人開 startup o既我, 實在有如當頭棒喝, 令我一再返思一o的我似懂非懂o既概念... o的 slides 實在係笑中有淚﹗

而事實上整個 talk apply 落任何 real-world situation 都係出奇地 relevant, 對於 manage o的客o既 expectations, 有時 a better product == bad thing 等見解, 都係 IT management 定立 strategic direction 時必要面對o既 issues。

我最鍾意哩張 slide：

矽谷名勝

One preconference vacation,
Two consecutive days,
Three different Fry's.




雖然 San Jose Fry's (Mayan Temple) o的電子o野係齊o的, 但果然, Sunnyvale 係最好o既, 乜都有得買, 仲可以食埋餐晏仔先返屋企, 一流!




"Conservation of Pulse..." I'm not gonna spoil it. See it for yourself.




戰利品... 我應該帶多個吉 gip 唻...

Difference Engine

Charles Babbage's Difference Engine version 2 number 2 at Computer History Museum, Silicon Valley

VMware Server vs. Host Firewall

If your VM is hosting a web server in bridged network mode, if you are using the Windows version of VMware Server, other than the usual hole-poking in the VM's OS's own firewall, you have to also allow inbound stream on port 80 on the VM host even though it has a completely different IP address. Talk about counterintuitive.

Now it seems to me some fine things
have been laid upon your table,
but you only want the one that you can't get...

EeePC 701 Install Notes

1. Install Ubuntu EEE.
2. Install customization script.
3. Install custom kernel.
4. Install Wicd.
5. Edit /etc/wvdial.conf.
   

Singapore

噚晚o係星加坡落機, 順手買些少o野。
店員: What's your flight number?
我: Why do you need my flight number?
隔離睇唔過眼o既鬼佬: They want your passport too if you're buying alcohols...
我: 'coz it's Singapore, eh?
鬼佬: ...and they sent me invitation to Alcoholic Anonymous after three years.
我: What the...

Data Center Staff: 喂? 許生, 你部 server 想點樣呢?
Me: 麻煩你幫我 reboot 佢
Data Center Staff: 嗯, 我 access 到佢咖喎, 如果有 service 行緊, 就咁 reboot 可能唔係咁好
Me: 係呀, 我都 ping 到, 不過佢家下係傻傻地o既
Data Center Staff: 我 remote desktop 到佢...
Me: o個部係 Linux...

Ubuntu's sudo

The Ubuntu way of using sudo, whereby the console user is given ALL=(ALL) ALL access, is worrisome. To 0wn a box you only need to know that console user password, which has a much greater risk area of exposure than a typically well-protected root password.