針對分析在 GFW 牆內的情況，看到「GFWaaS - GFW as a Service」這樣的服務出現了，依據價位提供兩個不同等級的功能：
- $49/month 是 HAR Logs + Screencasts
- $199/month 則是再加上 Browser VNC
對於人不在中國，但需要照顧中國市場的開發團隊應該會有些幫助？
測試 GFW 變成一個服務了...
Leave a reply
Category Archives: Murmuring
幫你的 iPhone 電話簿找到對應的頭像
前幾天看到的：「Announcing Vignette」，透過 social network 的資料，把本來電話簿裡面的 icon 更新：
透過 app store 的搜尋找不太到，我一開始用了「Vignette」搜不到，但用「Vignette Update」就可以。或者你可以透過他提供的連結直接開 app store：「Vignette – Update Contact Pics」。
這是一個 IAP 類的付費服務，搜尋是免費的，但如果要把資料更新回通訊錄，需要付 USD$4.99 (一次性)，台灣帳號是付 TWD$170，應該是因為最近的稅務調整：
Vignette allows you to scan your contacts and see what it can find for free. If you wish to actually save these updates to your contact list, you must pay for a one-time in-app purchase. That purchase costs $4.99, is not a subscription, and is the only in-app purchase.
搜尋的範圍包括了 Gravatar、Twitter、Facebook 與 Instagram：
Email is used for Gravatar
A custom network called Instagram
另外作者有提到這個 app 不傳資料到伺服器上，都是在自己的裝置上連到上面提到的 social network 尋找：
Privacy is paramount
All the processing is done on-device; this isn’t the sort of app where your contacts are uploaded en masse to some server, and out of your control.
所以速度不會太快，但對隱私比較好...
Firefox 引入 BigInt，Safari 也在實作...
Firefox 實作了 BigInt (進度可以在「Implementation of BigInt values for SpiderMonkey」這邊看到)：「bigint shipping in firefox!」，現在可以在 68 beta 版裡使用：
I am delighted to share with folks the results of a project I have been helping out on for the last few months: implementation of "BigInt" in Firefox, which is finally shipping in Firefox 68 (beta).
另外文中也提到了其他瀏覽器的情況 (再 Can I Use 也可以看到「BigInt」目前的支援情況)，用 V8 engine 的都已經支援 (包括 Chrome 與新版的 Edge)，而 Safari 也在實作中：
BigInt is also shipping already in V8 and Chrome, and my colleague Caio Lima has an project in progress to implement it in JavaScriptCore / WebKit / Safari. Depending on your target audience, BigInt might be deployable already!
另外一個有趣的事情是 license，其中馬上可以想到的是 GMP，裡面牽扯到 LGPLv3 GPLv2：
Since version 6, GMP is distributed under the dual licenses, GNU LGPL v3 and GNU GPL v2. These licenses make the library free to use, share, and improve, and allow you to pass on the result. The GNU licenses give freedoms, but also set firm restrictions on the use with non-free programs.
從說明有提到一些目標，短期可能會用 GMP 以儘快時做出合理的效能版本，長期則是希望用自己的版本：
An important design question is whether to implement the arithmetic operators as native or self-hosted intrinsics, probably using an external library such as GMP in the former case. Using an existing library has the advantage of providing good performance for less initial effort, but a self-hosted library also has advantages, such as greater flexibility in representation, better compiler integration, and simpler integration with the rest of the JS runtime (GC, etc.).
2018 年一月的討論有提到有一包 patch 是使用 GMP 的版本，這樣看起來應該是有解決 license 上的問題...
The current version of the patch uses libgmp for BigInt arithmetic, supports most features from the current proposal, and passes all up-to-date test262 tests for BigInt. Direct compiler support for BigInt has been removed; instead, compilation should fail if a possible BigInt value is encountered.
後續的描述裡面也都有提到 GMP 相關的事情，應該是沒錯...
利用 Sensor 校正資訊產生 Device Fingerprint 的隱私攻擊
看到「Fingerprinting iPhones」這篇提出的攻擊，標題雖然是提到 iPhone，但實際上攻擊包括了 Android 的手機：
You are affected by this fingerprinting attack if you are using any iOS devices with the iOS version below 12.2, including the latest iPhone XS, iPhone XS Max, and iPhone XR. You are also likely to be affected if you are using a Pixel 2/3 device, although we hypothesise the generated fingerprint has less entropy and is unlikely to be globally unique. A SensorID can be generated by both apps and mobile websites and requires no user interaction.
目前 iPhone 升級到 12.2 之後可以緩解這個問題，Android 看起來還不清楚...
攻擊的方式是透過手機在出場前會使用外部的校正工具，找出手機內 sensor 所偵測到的值與實際值的差異，然後把這些資訊燒到韌體裡，當呼叫 API 時就可以修正給出比較正確的值。
而因為這些校正資訊幾乎每一隻手機都不一樣，而且不會因為重裝而變更 (即使 factory reset)，加上還可以跨 app 與 web 追蹤，就成為這次攻擊的目標：
In the context of mobile devices, the main benefit of per-device calibration is that it allows more accurate attitude estimation.
資訊量其實相當大，透過 app 分析可以得到 67 bits entropy，透過網頁也有 42 bits entropy，而且不怎麼會變：
In general, it is difficult to create a unique fingerprint for iOS devices due to strict sandboxing and device homogeneity. However, we demonstrated that our approach can produce globally unique fingerprints for iOS devices from an installed app -- around 67 bits of entropy for the iPhone 6S. Calibration fingerprints generated by a website are less unique (~42 bits of entropy for the iPhone 6S), but they are orthogonal to existing fingerprinting techniques and together they are likely to form a globally unique fingerprint for iOS devices.
We have not observed any change in the SensorID of our test devices in the past half year. Our dataset includes devices running iOS 9/10/11/12. We have tested compass calibration, factory reset, and updating iOS (up until iOS 12.1); the SensorID always stays the same. We have also tried measuring the sensor data at different locations and under different temperatures; we confirm that these factors do not change the SensorID either.
目前提出來的解法是加入隨機值的噪音 (iOS 的作法)，不過作者有建議預設應該要關閉 js 存取 sensor 的權限：
To mitigate this calibration fingerprint attack, vendors can add uniformly distributed random noise to ADC outputs before calibration is applied. Alternatively, vendors could round the sensor outputs to the nearest multiple of the nominal gain. Please refer to our paper for more details. In addition, we recommend privacy-focused mobile browsers add an option to disable the access to motion sensors via JavaScript. This could help protect Android devices and iOS devices that no longer receive updates from Apple.
不過當初這群人怎麼會注意到的...
靜態網頁服務的選擇
在 Hacker News 上看到「Show HN: Scar – Static websites with HTTPS, a global CDN, and custom domains (github.com)」這篇，除了文章連結外，留言提到了不少工具...
一種是透過 GitHub Pages 的方式提供服務，或是透過 Netlify，需求真的需要動到 AWS 元件的情況其實還是考慮用傳統一點的架構 (EC2 或是 VPS) 會更有彈性。
算是提出一個雞肋後，其他人把真正有用的工具整理了出來...
「Oh shit, git!」：常見的 Git 操作問題
「Oh shit, git!」這個站台列出了常見的 Git 問題與可能的解法，不過我最愛最後一個，看起來很萬用的砍掉重練：
cd .. sudo rm -r fucking-git-repo-dir git clone https://some.github.url/fucking-git-repo-dir.git cd fucking-git-repo-dir
雖然最後這個方法有種惡搞感，不過裡面其他提到的問題其實都還蠻常見的，包括了修改最新一個 commit 的 commit log，或是想要再多加一些東西到最新的 commit 上，以及 commit 錯 branch 後要怎麼處理。
Nokia 釋出的 Memory Profiler
用 Rust 開發的 memory profiler，可以抓 memory leaking 與 memory fragmentation，然後宣稱效能影響也比較低：「A memory profiler for Linux」，有提供網頁界面，還蠻美觀的：
給的範例有兩行，一行是跑 profiler：
LD_PRELOAD=./libmemory_profiler.so ./your_application
另外一行是讀資料給 HTTP server：
./memory-profiler-cli server memory-profiling_*.dat
之後有機會抓漏時可以拿來用看看...
在一連串的安全更新後，AMD 的 CPU 比 Intel 快了...
在「Intel Performance Hit 5x Harder Than AMD After Spectre, Meltdown Patches」這邊看到的測試：
把現有的安全性更新都開啟後，Intel CPU 的效能掉了 20% 左右 (在 Intel 上需要把 HT 關掉)：
While the impacts vary tremendously from virtually nothing too significant on an application-by-application level, the collective whack is ~15-16 percent on all Intel CPUs without Hyper-Threading disabled. Disabling increases the overall performance impact to 20 percent (for the 7980XE), 24.8 percent (8700K) and 20.5 percent (6800K).
The AMD CPUs are not tested with HT disabled, because disabling SMT isn’t a required fix for the situation on AMD chips, but the cumulative impact of the decline is much smaller. AMD loses ~3 percent with all fixes enabled
可以注意到兩家目前桌機的頂規在上了安全性更新後，AMD 的 2990WX 比 Intel 的 7980XE 快了一些些... 當初擠牙膏擠出來的都吐回去了，不知道之後出的 security issue 還需要再吐多少回去。
Elasticsearch 提供免費版本的安全功能
Elasticsearch 決定將基本的安全功能從付費功能轉為免費釋出，很明顯的是受到 Open Distro for Elasticsearch 的壓力而做出的改變：「Security for Elasticsearch is now free」。
要注意的是這不是 open source 版本，只是將這些功能放到 basic tier 裡讓使用者免費使用：
Previously, these core security features required a paid Gold subscription. Now they are free as a part of the Basic tier. Note that our advanced security features — from single sign-on and Active Directory/LDAP authentication to field- and document-level security — remain paid features.
這代表 Open Distro for Elasticsearch 提供的還是比較多：
With Open Distro for Elasticsearch, you can leverage your existing authentication infrastructure such as LDAP/Active Directory, SAML, Kerberos, JSON web tokens, TLS certificates, and Proxy authentication/SSO for user authentication. An internal user repository with support for basic HTTP authentication is also avaliable for easy setup and evaluation.
Granular, role-based access control enables you to control the actions a user can perform on your Elasticsearch cluster. Roles control cluster operations, access to indices, and even the fields and documents users can access. Open Distro for Elasticsearch also supports multi-tenant environments, allowing multiple teams to share the same cluster while only being able to access their team's data and dashboards.
目前看起來還是可以朝 Open Distro for Elasticsearch 靠過去...
用 Google Docs 惡搞的方式...
看到「UDS : Unlimited Drive Storage」這個專案，利用 Google Docs 存放資料。主要的原因是因為 Google Docs 不計入 Google Drive 所使用的空間：
Google Docs take up 0 bytes of quota in your Google Drive
用這個方法可以存放不少大檔案 (像是各種 ISO image)，讓人想起當年 Love Machine 的玩法 (不知道的人可以參考「愛的機器 Love machine」這篇)，切割檔案後傳到某些空間以提供下載？只是這邊是用 base64 放到 Google Docs 上...
base64 的資料會比原始資料大 33%，而 Google Docs 單篇的上限大約是 710KB：
Size of the encoded file is always larger than the original. Base64 encodes binary data to a ratio of about 4:3.
A single google doc can store about a million characters. This is around 710KB of base64 encoded data.
方法不是太新鮮，但是讓人頗懷念的... XD