Spontaneous Core Dump

2010-05-06T17:21:00.001+08:00

SANS OnDemand offers discount in the form of non-essential craps http://ping.fm/ya01u

2010-04-29T21:19:00.001+08:00

How does BinDiff compare to DarunGrim2?

2010-04-23T12:38:00.001+08:00

is suffering from caffeine overdose

對明報副刊《年輕有罪？》一文之我見

2009-10-24T03:10:00.001+08:00

原文見於 http://bit.ly/48kFfv

整篇文章借買中環樓入題, 欲以此「冰山一角」帶出階級傲慢知識傲慢云云。

回應支節

事實上, 醫生買中環樓其實根本冇問題, 只係其人心有不甘。這既非重點, 坊間以及敝人亦都講o左好多, 不贅多言。

年輕人受擠壓?

對於所謂年輕人處處受擠壓云云, 我實在 O 晒嘴 (注意原文所講年輕人係指三四十歲人, 即包括其他人論調中擠壓後生的第三代香港人)。事實上中

環就係多年輕人 (無他, 有返咁上下年紀要住o個頭都搬o左上 escalator 上面)。Trading floor 勁多青年白髮, 據說有o的係特登染白些少使個 look 襯返佢成就。Trader 之外, i-banker, 甚至做得好o既 IT 人啊 sales 啊, 都係晨早就有 job freedom。哩個年代, 個個發達行業都係狂向年輕人傾斜, 老o的先至係有 handicap, 就連最大o個個餅, 勁多人 end up in o既 middle management, 都係越唻越後生, o的 complacent o左o既阿伯先至要驚。

大學生平均質素下降

另外, 起碼我唔會似得原文咁講, 用一個有三十年工作經驗者同一個 fresh grad 比, 事實係即使原文都承認, 以中英古典文學素養做標準, 則三十年前大學生, 平均優於哩一代大學生。當然, 哩一代大學生普遍有更多創意技術出框思想等等, 此乃 trade off, 但三十年前, 會有細路連搭車食飯都拿住部 PSP 唔放嗎? 生活舒服o左確係會令人戰意消磨, 要用更大意志去鞭策自己, 這點應無異議。社會富庶o左, 令新生代較易流於平庸, 但同時富庶社會亦讓精英更能發揮。我完全唔懷疑哩一代最叻o個班, 平均叻過上一代最叻o個班。

主題回應

至於五十年代出生的人佔着位置不走, 造成後面年代的人不能上位, 哩個根本唔係新聞, 最近八千年都係如此, 唔係, 再早o的, 如 2001: Space Odyssey 第一幕所講, 班識用工具o既猩猩打走班霸住水源o既猩猩上位。

Fair 唔 fair? 班老o野本身唔係叻過人, 憑住生得早, 封殺後輩上位之路, 明明我叻過佢, 但佢高高在上抹殺我一個 fair chance to fight, 唔 fair! 咁我又用返原文做例, 反問一下, 國民黨同軍閥玩晒, 毛澤東周恩來林彪又上到位?

同理, 個社會唔 fair, 官商勾結, 地產商操控全港, 又會有咁多神童 trader 住中環渣波子? 又會有公屋仔白手興家做到上市? 又會有 F.5 畢業做地產經紀做到坐擁成疊樓? 你可以話哩o的都係特例, 咁原文中所舉毛澤東周恩來林彪又何嘗唔係特例? 我o的特例顯然普遍過o個o的革命英雄, 係真真正正o係現今香港搵到o既情況。

先來者有 first to market 優勢, 後來者則有 agility, 原是千古不變之大道, 故國有盛衰, 代有交替。大公司係玩晒, resources 又多過人, 又有 economy of scale, 你蒲個頭出唻佢實用 dumping tactics 趕絕你。哩個係商業現實, 認命吧!

咁 Apple 係點唻? Microsoft 係點唻?

Run startup 都知道, 我o地叫哩o的做 disruptive technology, 係 game changing innovation。既得利益者越大越霸道, 必然越擁腫越多包袱, 細公司一線生機就係做大公司唔願做或不屑做o既事。話說 Apple 初製成, Steve Wozniak 本想賣畀 HP 等佢賣, 囉到上去畀大老細睇, 大老細問: "你件o野真係好正, 但你話台o野插咩普通電視都得, 咁哩個o個個又得唔得? HP o既品牌係建立於賣o既貨都係 well tested, guaranteed to work with 所有 HP 其他產品, 我o地賣你件o野會 tarnish o左個品牌, 拖垮既有生意, 所以你都係自己去賣啦, 我叫 legal 出返封不反對信過你"。

又, 如原文所講, 年輕的確係無價, 當年 Bill Gates 根本冇 OS, 膽粗粗簽好契先囉住 down payment 去買起人o地個 OS, 哩o的勇氣只有兩袖清風o既年青人先會有。同理, 四廿歲人, 仔細老婆嫩, 莫講話 quit o左份工開鋪, 轉份工都驚餐飽啦!

所以, 既得利益者, 與後起競爭者, 根本各有其 edge, o的 game rules 唔 fair, 打低佢囉! 一代打低一代, 社會就係咁進步。

網上交易, 用家之責任何在?

2009-10-24T03:09:00.001+08:00

有人認為, 既然行出街冇著避彈衣被槍殺, 罪不在自己, 那未做好防護措施或不小心引致網上交易出事, 怎麼要負上責任?

其實, 用『冇著避彈衣出街比人槍殺』做 analogy 係未盡然恰當, 因為網上交易出事, 通常你唔會瓜老襯, 卻必定會累街坊。

以 credit card fraud 做例, 隨手搵個 T&C, 卡主合理地乜乜物物, 則最高賠償僅為幾舊水 (e.g. 星加坡卡限賠 SGD100, ref: http://bit.ly/2ZsWum )。如是者, 你失卡被盜用, 受傷的卻是商戶或銀行, 即使賠償轉嫁予保險公司, 仍會反映於增高了的保費之上。(當然, 假如你非常黑仔成為 identity theft victim, 也何因此毀了一生。)

因此, 網上交易之責任, 很大程度上應來自「不連累他人」。

On personal data

2009-09-13T01:42:00.004+08:00

Lately, the Hong Kong Personal Data (Privacy) Ordinance (PD(P)O) is up for review. There has been quite a bit of controversies surrounding a number of issues, one of them is the special treatment given to biometric measurements.

PII vs. PII that can be used alone as an authentication factor

I want to illustrate the need to distinguish between a common PII such as name + dob + phone + address, and a PII that can be used alone as an authentication factor such as password or thumbprint biometric measurements.

The primary threat that can come from PII leakage PII is identity theft, as PII by definition (the NIST definition) can potentially be used to convince a third party that the bad guy is actually the identity theft victim. Leakage of a common PII is bad enough, but leaking a PII that can be used alone as an authentication factor is even worse, as this can potentially let the bad guy directly assume the identity of the victim.

Consider two scenarios:

Call up phone banking, say you forgot the password and respond to the operator's challenge by correctly stating the victim's name + dob + phone + address, having "proven" you are who you claim to be, proceed to operate on the victim's account, and
Log into e-banking with the victim's login name + password.

These two scenarios make a world of difference:

From an audit trail / forensics / monitoring perspective, the e-banking compromise vector is the "normal" way of access, making detection much more difficult.
From an authentication soundness perspective, pedantically speaking the bank probably should not have given trust to someone based solely on the fact that he can state an account holder's name + dob + phone + address, because none of these PII is private to the individual only (e.g. a receptionist of a hotel that the victim stayed in before probably could have access to his name + dob + phone + address).

This is precisely why I consider passwords and biometrics to be much more dangerous than any common PII.

On the changing PII hierarchy

An even more interesting phenomenon is the changing PII hierarchy. If you follow my rationale above you see that passwords are more important than name + dob + phone + address, but what if the hypothetical bank operator above really was so naive as to have fallen for the impersonator, reset the password and release it to him? Does it not make these more-widely-shared information more permission-granting than "unique" passwords?

Whereas we see things like credit card numbers generally protected (e.g. encrypted in accordance to PCI-DSS), I haven't seen many people taking very proactive measures protecting your mother's maiden name and your first pet's name. We all know it's entirely plausible that given those "secret" information alone a bad guy can gain access to your account (perhaps via a password reset) and make purchase on your behalf with your "properly protected" credit card number (think one-click purchase).

Go figure.

Dual-booting Windows 7 x64 and Ubuntu 9.10 x64 on Intel Matrix RAID'ed hard disks, with TrueCrypt

2009-09-09T18:56:00.004+08:00

Install Windows 7.
Encrypt system volume with TrueCrypt.
Boot a Linux live CD with support for isw (Intel Matrix RAID), e.g. Ubuntu 9.04.
Plug in a thumb drive, mount it on /media/thumb
dd if=/dev/sda of=/media/thumb/truecrypt.mbr count=1 bs=512
Install Ubuntu 9.10, DO NOT REBOOT JUST YET because grub2 does not support isw, we want to install grub1
mount --bind /dev /target/dev
mount -t proc proc /target/proc
mount -t sysfs sys /target/sys
cp /etc/resolv.conf /target/etc
chroot /target /bin/bash
apt-get update
apt-get install grub
mkdir /boot/grub
cp /usr/lib/grub/x86_64-pc/* /boot/grub
grub --device-map=/dev/null
device (hd0,5) /dev/mapper/isw_xxxxxxxxxx_Volume05
root (hd0,5)
setup (hd0)
Plug in the thumb drive where you put truecrypt.mbr, mount it on /media/thumb
cp /media/thumb/truecrypt.mbr /boot/grub
Add this to /boot/grub/menu.lst:
title Windows 7
rootnoverify (hd0,5)
makeactive
chainloader /boot/grub/truecrypt.mbr

朱經武, shame on you!

2009-06-02T18:07:00.001+08:00

朱教授, 對於閣下之學術成就, 我只有衷心的景仰, 但作為一個校長, 你壓根沒有盡過基本責任。

大學本科教育, 最基本訴求乃在於協助學生發揮本身光華, 讓天賦與學科不符者早日另覓合適出路。如 Randy Pausch 所講, 大學教授收得你錢就要鞭撻你成材, 先謂之負責。而你, 卻沒有把持本科學術水平, 任由科大中學化, 八年來本科程度普遍低下, 還妄圖超英趕美。千千萬萬莘莘學子都交足學費, 未出社會已經負債纍纍, 付出三年無價青春, 得到的卻是三流訓練, 同是大學生卻輸人一大截。你愧對將兒女交托于你的父母,

愧對納稅人。

更甚者, 你任由科大本科尊崇地位遭受踐踏, 縱容取錄會考十二分。我等千千萬萬校友, 誰不曾為著遵守無聊的遊戲規則, 灑下血淚汗爬進校門? 陳小朋友我管他是曠世奇材, 曠世奇材連碌過無聊遊戲都做不到或不屑, 這算是那門子曠世奇材? 而當初我們又是為了甚麼要受如斯折磨? 對於陳小朋友的同屆同學, 你又情何以堪? 你, 有顧過我們感受嗎?

Shame on you.

2008-11-03T15:57:00.003+08:00

上禮拜上o左去 KL 參加 Hack in the Box 2008 Malaysia.

Logistics
搭 Aeroline 巴士o係某方面比搭飛機好, 全程有得用 Blackberry,, 電腦要上 3.5G 最好用天線最勁o既華為 E270, 車上有插蘇, 之但係, 如果你部腦唔係用 SSD, well, 願主保佑你。

Accommodation
Crowne Plaza Hotel KL internet 勁慢仲要收我 USD10, blacklisted。

慈善拍賣
大會壓軸有慈善拍賣, 所得款項將撥出幫助自閉仔。Hmm... 我埋首做研究/打機/玩音樂時都好自閉, 因乜解究我從冇收過善款...?

斬獲
Anyway, 我用一千馬幣 bid 贏 IDA Pro (Standard) 一年 Named License 一張, 等同半價, 呵呵~~ 唔明點解咁少人 bid, 係o的人唔知價, 定係因為用咩 tools 唔使落 report 所以唔使買 license?

回程買土產:

顯然, 哩套o野純粹睇 card ID 就開門, 囉唻做 cloning attack demo 就o岩晒。

Obsessive-Compulsive Disorder

2008-11-03T15:41:00.002+08:00

有人興趣集郵, 有人鍾意收藏名錶...

Hong Kong's Abandoned Edge

2008-10-19T04:21:00.002+08:00

曾蔭權說：『國家在多方面如製造業、科研都很棒，香港唯一突出的便是做金融中心，有自由兌換及金融基建等。』

Oh well putting all the eggs in one basket eh? Great way to show your leadership.

香港玩具 R&D, hardware R&D 都係世界一流, 偏偏政府非但不施以援手, 還協助外來企業打擊本土創新科技, 可恥! 我不會忘記力生係點死。

打擊 reverse engineering 文化只會導致 IT 受他國勢力控制, 嚴重威脅國家安全。香港政客只懂自毀長城。

反觀祖國, 經年累月大量投放資金, 做唐吉訶德式極度戇居的事, 只為國家要有自己的通訊架構 (TD-SCDMA) 和 CPU (龍芯)。這才是負責任的政府!

Look ma, no 火牛!

2008-10-03T04:03:00.002+08:00

我整o左條 cable, 雙 USB 頭 (Y-cable) 確保 5v/2x500mA 供電, 另一邊係常見於萬用火牛兩個窿o個種頭, 插咩 plug 都得:

2008-09-24T03:26:00.003+08:00

禮貌地我要講句 thanks for offering me a hacked copy of ISO27001.

But I will not take it.

知你勁, 識得鏟走個 watermark, 唔該唔好要 share 畀我, 因為我 take hacker ethics very seriously.

我當然有買老翻有 bt, 但好 game 好 software 我係一定會畀錢買, 更多時已經有成個 crack 版o係度, 都要特登出去買; shareware 我都會買, 雖然我手痕就會 crack o左佢; 更重要係, 用唻搵食o既, 我通通買晒 license。

Because it's the right thing to do.

Research?

2008-08-28T16:51:00.004+08:00

我堅持 research 要能夠o係三句說話以向 layman 介紹得到, 否則一係個 topic irrelevant, 一係個 researcher 自閉。

鳳凰何少鳥何多。

San Jose Tech Museum 有個 exhibition, 係請o的 Nobel laureates 上去影相, o係毫無準備下畀張大白紙請佢o地畫出自己得獎o既研究。大師大都能夠扼要地畫出重點, 哩o的叫『言簡意賅』。

最令我感動o既一幅相, 係一位大師微笑住展示手中大白紙, 張紙空白一片。

I <3 Tux

2008-08-25T18:58:00.002+08:00

Colleague: What's that?
Me: I went to LinuxWorld!
Colleague: Oh you went to DisneyWorld...
Me: No, I went to LinuxWorld.
Colleague: You went to what?

l'Occitane Honey Cream

2008-08-22T15:13:00.002+08:00

左邊係舊甖, 右邊係新甖。

新甖勁 generic, 本來冇乜o野, 但珠玉在前立即給比下去, 其情況有如玩 hi-fi, 好多 product 本來好好地, 一 A-B test with 人o地副袈生, 即刻就身痕要 upgrade...

P.S. 據巴黎分店講法, 哩隻 product 已經 EOLed, 但事實上香港 IFC 現尚有大量存貨, 而 sales 未曾收到消息要 discontinue...

Blow Water Demo

2008-08-06T22:04:00.005+08:00

表揚

2008-08-05T22:38:00.003+08:00

我要表揚 InterContinental San Fran, 佢個 lounge 有 easily accessible o既 power outlets; 而佢個 wifi 雖然正常 surf web 竟敢向個客收錢, 但 outbound port 22 冇 block 到, 方便o的有 ssh tunnel o既朋友。

Johnny Rockets Burger

2008-08-02T04:15:00.002+08:00

所謂 50s burgers o既 franchise 重有 Peggy Sue's, 不過都係 Johnny Rockets 就腳o的...

Shakes! 竟然係用真正士多啤梨同香蕉做...

Cray

2008-08-01T22:34:00.005+08:00

Cray 係 usability design o既典範...

法國家俬洋溢 art deco 風味...

只可惜 Cray-2 摒棄o左佢最為人津津樂道o既 feature...

後來佢摺o左。

~~ The End ~~~

2008-08-01T22:24:00.005+08:00

太多人誤解, 唔理解, 或者冇資源去理解。我必須要強調, upgrade o左唔等於安全, NAT derandomization 係非常普遍o既現像, 而o個o的齋睇 stdev 就 rate 你 "GREAT" o既 web-based testers 更加係 downright misleading... 唔該先生睇睇你個 port range 先出聲。

Thought-Provoking

2008-08-01T21:26:00.003+08:00

昨日o係 USENIX Security '08 聽o左兩個好 thought-provoking o既 talks。第一個係 Coverity o既 co-founder Dawson Engler 講返 commercialize 一件 research product o既血淚史。

對於當年曾年少無知心口寫個勇字學人開 startup o既我, 實在有如當頭棒喝, 令我一再返思一o的我似懂非懂o既概念... o的 slides 實在係笑中有淚﹗

而事實上整個 talk apply 落任何 real-world situation 都係出奇地 relevant, 對於 manage o的客o既 expectations, 有時 a better product == bad thing 等見解, 都係 IT management 定立 strategic direction 時必要面對o既 issues。

我最鍾意哩張 slide：

矽谷名勝

2008-07-28T21:11:00.005+08:00

One preconference vacation,
Two consecutive days,
Three different Fry's.

雖然 San Jose Fry's (Mayan Temple) o的電子o野係齊o的, 但果然, Sunnyvale 係最好o既, 乜都有得買, 仲可以食埋餐晏仔先返屋企, 一流!

"Conservation of Pulse..." I'm not gonna spoil it. See it for yourself.

戰利品... 我應該帶多個吉 gip 唻...

Difference Engine

2008-07-28T20:17:00.004+08:00

Charles Babbage's Difference Engine version 2 number 2 at Computer History Museum, Silicon Valley

VMware Server vs. Host Firewall

2008-07-24T10:18:00.003+08:00

If your VM is hosting a web server in bridged network mode, if you are using the Windows version of VMware Server, other than the usual hole-poking in the VM's OS's own firewall, you have to also allow inbound stream on port 80 on the VM host even though it has a completely different IP address. Talk about counterintuitive.

2008-07-22T23:02:00.002+08:00

Now it seems to me some fine things
have been laid upon your table,
but you only want the one that you can't get...

EeePC 701 Install Notes

2008-07-19T03:37:00.005+08:00

Singapore

2008-07-16T04:12:00.003+08:00

噚晚o係星加坡落機, 順手買些少o野。
店員: What's your flight number?
我: Why do you need my flight number?
隔離睇唔過眼o既鬼佬: They want your passport too if you're buying alcohols...
我: 'coz it's Singapore, eh?
鬼佬: ...and they sent me invitation to Alcoholic Anonymous after three years.
我: What the...

2008-07-09T23:43:00.003+08:00

Data Center Staff: 喂? 許生, 你部 server 想點樣呢?
Me: 麻煩你幫我 reboot 佢
Data Center Staff: 嗯, 我 access 到佢咖喎, 如果有 service 行緊, 就咁 reboot 可能唔係咁好
Me: 係呀, 我都 ping 到, 不過佢家下係傻傻地o既
Data Center Staff: 我 remote desktop 到佢...
Me: o個部係 Linux...

Ubuntu's sudo

2008-07-06T00:58:00.003+08:00

The Ubuntu way of using sudo, whereby the console user is given ALL=(ALL) ALL access, is worrisome. To 0wn a box you only need to know that console user password, which has a much greater risk area of exposure than a typically well-protected root password.