Tag Archives: code

透過手機螢幕上的餘熱猜測 PIN 碼

利用手機螢幕上的餘熱分析可能的 PIN 碼:「Heat traces left by fingers can reveal your smartphone PIN」,在輸入完 PIN 碼的 30 秒內的準確度都還是很高 (80%): The report further revealed that if the thermal image is collected within 15 seconds of a PIN being entered, the technique is accurate … Continue reading

Posted in Computer, Hardware, Murmuring, Security, Telephone | Tagged , , , , , , , , , , | Leave a comment

CodeDeploy 的權限設定...

這陣子在弄 AWS CodeDeploy,調整了半天才把權限壓低到合理的範圍 (AWS 給的預設值還是有點大),記錄下來之後會比較好找... 在權限部份,AWS CodeDeploy 應該有三個權限要設定: IAM user:給 CI 跑完後丟上 Amazon S3 並且呼叫 AWS CodeDeploy 佈署用的,像是 Travis CI 或是之類的服務。但如果是手動到 web console 觸發的話,這個部份就不需要了。 Service Role:給 AWS CodeDeploy 的服務本身用的。 EC2 Role:給跑在機器上 AWS CodeDeploy Agent 用的。 如同前面講的,IAM user 的部份有兩個要處理,一個是讓 CI 服務把檔案傳上 … Continue reading

Posted in AWS, Cloud, Computer, Murmuring, Network, Programming, Security, Software | Tagged , , , , , , , , , , , , , | 1 Comment

AWS CodeDeploy 支援 BlueGreenDeployment

AWS CodeDeploy 推出了 BlueGreenDeployment 的功能:「AWS CodeDeploy Introduces Blue/Green Deployments」。 BlueGreenDeployment 的目的不計成本想辦法把上線的 downtime 壓到最低,而且當出問題時 rollback 的時間壓到最低的方法: One of the challenges with automating deployment is the cut-over itself, taking software from the final stage of testing to live production. You usually need … Continue reading

Posted in AWS, Cloud, Computer, Murmuring, Network, Programming, Software | Tagged , , , , , , , , , , , , , , | Leave a comment

Unix 程式碼演進的記錄

在 GitHub 上的「dspinellis/unix-history-repo」專案放進了 Unix 程式碼從 1970 年演進到 2016 年的記錄: The history and evolution of the Unix operating system is made available as a revision management repository, covering the period from its inception in 1970 as a 2.5 thousand line kernel … Continue reading

Posted in Computer, FreeBSD, Murmuring, OS, Programming | Tagged , , , , , , | Leave a comment

用手勢在會議中表達意思

英國內閣辦公室中的英國政府數位服務 (Government Digital Service) 發展了一套手勢 (六個),可以在不用打斷發言過程下表達出一些簡單的意見或是表示想要有進一步的討論:「Platform as a Service team takes even-handed approach to meetings」(網站好像有點熱門,讀取速度變慢不少 XD)。 提高會議溝通的效率...

Posted in Murmuring, Political | Tagged , , , , , , , , , , , , | Leave a comment

把 CSC (卡片背面的三碼) 變成 OTP (動態密碼)

把信用卡背面的後三碼 (Card security code) 變成動態密碼,雖然一般只會有三碼,但對於網路消費應該會有不少幫助,不過這樣就不能完全不拿出卡片了...:「This high-tech card is being rolled out by French banks to eliminate fraud」。 產品叫做 MotionCode,會先從法國開始: Today both Société Générale and Groupe BPCE, two of France’s largest banking groups, are preparing to roll out these cards across … Continue reading

Posted in Computer, Financial, Hardware, Murmuring, Network, Security, WWW | Tagged , , , , , , , , , , , | 1 Comment

MySQL 全系列的安全性漏洞

包含 MySQL 本家與所有從 MySQL 改出去的分支都中了,引用 Percona 的通報:「Percona Server Critical Update CVE-2016-6662」。 This is a CRITICAL update, and the fix mitigates the potential for remote root code execution. 原始的 security advisory 在「CVE-2016-6662 - MySQL Remote Root Code Execution / Privilege Escalation … Continue reading

Posted in Computer, Database, MariaDB, Murmuring, MySQL, Network, Security, Software | Tagged , , , , , , , , , , , , , | 1 Comment

在遊戲上模擬跑步的動作

從「Balls to learning how to animate, let's film some parkour!」這篇看到讓人懷念的遊戲,1989 年的《波斯王子》: Jordan Mechner (波斯王子的作者) 用 Rotoscoping 的方式將他弟弟做這些動作的畫面拍下來,然後確保在電腦上角色的動作是順暢的: Here's the source frames used to rotoscope the above animation. Don't let the ghostly pallor fool you! Jordan Mechner's brother is in fact … Continue reading

Posted in Computer, Game, Murmuring, Programming, Recreation, Software | Tagged , , , , , , , , , | 1 Comment

Cisco 與 Fortinet 防火牆的 RCE 漏洞

NSA 使用這些漏洞來大量監聽企業的流量:「Leaked Exploits are Legit and Belong to NSA: Cisco, Fortinet and Snowden Docs Confirm」。 Cisco 已經確認這個安全性漏洞了,全系列包括已經停產的 Cisco PIX、上個世代的 Cisco ASA 5500 (但還有些型號還在賣),以及目前主力的 Cisco ASA 5500-X,另外還包括了安全模組系列也中獎:「Cisco Adaptive Security Appliance SNMP Remote Code Execution Vulnerability」。 Cisco ASA 5500 Series Adaptive Security … Continue reading

Posted in Computer, Hardware, Murmuring, Network, Political, Security, Social, VPN, WWW | Tagged , , , , , , , , , , , , , , , , | Leave a comment

在 Python 的 pip、Nodejs 的 npm、Ruby 的 RubyGems 上面放木馬研究?

在 Python 領域裡常用 pip 安裝軟體: $ pip install reqeusts 或是: $ sudo pip install reqeusts 其他的平台也大致類似於這樣的動作。而在「Typosquatting programming language package managers」這篇文章裡,作者用 typo 之類的方式列出可能的名稱,像是這樣的名稱: $ sudo pip install reqeusts 然後在這三個平台上發動攻擊,上傳了數百個套件並且觀察: All in all, I created over 200 such packages and equipped them … Continue reading

Posted in Computer, Murmuring, Network, Programming, Security, Software | Tagged , , , , , , , , , , , , , | Leave a comment