Home » Posts tagged "window"

Ubuntu 18.04 將從 Wayland 換回 Xorg...

在「Ubuntu 18.04 LTS is Switching back to Xorg」這邊看到 Ubuntu 18.04 將要從 Wayland 換回 Xorg 的消息,只能說不意外 XDDD

Ubuntu 官方的說明在「Bionic Beaver 18.04 LTS to use Xorg by default」這邊,文章裡面給了三個理由:

  • Screen sharing in software like WebRTC services, Google Hangouts, Skype, etc works well under Xorg.
  • Remote Desktop control for example RDP & VNC works well under Xorg.
  • Recoverability from Shell crashes is less dramatic under Xorg.

講白了就是還有一堆東西有問題,看起來在 17.10 導入 Wayland 後沒搞定:

17.10, released in October 2017, ships with the Wayland based graphics server as the default and the Xorg based equivalent is available as an option from the login screen.

在 18.04 預設會用 Xorg,但系統內還是會有 Wayland 讓使用者可以選:

The Wayland session will still be available, pre-installed, for people to use, but for our ‘out of the box’ users the Ubuntu experience needs to be stable and provide the features they have come to expect and use in daily life and Xorg is the best choice here, at least for 18.04 LTS, but for 18.10 we will re-evaluate Wayland as the default.

再測個兩年吧 XD

PS4 下載速度很慢的原因

在「Why PS4 downloads are so slow」這篇作者花了不少力氣找出原因,發現 PS4 下載速度很慢是故意的... 另外討論了在什麼情況下會變慢,以及要怎麼避免的方式。

懶得看的人可以直接看 Conculsions 那段,主要的原因是 PS4 會因為背景程式而調整 TCP window size (就算背景程式在 idle 也會影響到下載的 TCP window size),進而影響速度:

If any applications are running, the PS4 appears to change the settings for PSN store downloads, artificially restricting their speed. Closing the other applications will remove the limit.

用 TCP window size 來調整速度也算是頗有「創意」的方法...


前陣子在 Black Hat 上發表的 HEIST 攻擊 (對 HTTPS 的攻擊)

又是一個對 HTTPS 的攻擊:「HEIST attack on SSL/TLS can grab personal info, Black Hat」、「New attack steals SSNs, e-mail addresses, and more from HTTPS pages」。

一樣是 Compression 產生的 side-channel attack,只是這次是結合 TCP window size 的攻擊。投影片可以在「HTTP Encrypted Information can be Stolen through TCP-windows (PDF)」這邊看到。

這次的攻擊只需要在瀏覽器上插入 HTTP 產生 HTTPS 的流量,然後從旁邊看 HTTPS 連線的 TCP packet 就可以了,而且對 HTTP/2 也很有效:

而且很不幸的,目前沒有太好的解法,因為所有的攻擊手法都是照著使用者無法發現的路徑進行的 @_@

對於使用者,大量使用 HTTPS (像是 HTTPS Everywhere 這樣的套件),能夠降低政府單位與 ISP 將 javascript 插入 HTTP 連線,產生 HTTPS 的行為。

而對於網站端來說,全站都隨機產生不同長度的 HTTP header 可能是個增加破解難度的方式 (而且不會太難做,可以透過 apache module 或是 nginx module 做到),但還是可以被統計方法再推算出來。

不知道有沒有辦法只對 HTTPS 開 javascript,雖然攻擊者還是可以用 <img> 攻擊...

也許以後 HTTP/3 之類的協定會有一區是不壓縮只加密的,避開這類 compression-based attack @_@

DVD 的發行時間差異導致盜版

MPAA 資助的報告顯示 DVD 的發行時間差異導致盜版:「DVD Release Delays Boost Piracy and Hurt Sales, Study Shows」,報告在「Windows of Opportunity: The Impact of Piracy and Delayed International Availability on DVD Sales」這邊可以看到。


"When we run our regressions on Spain and Italy alone, we observe a 10% drop in sales for every 10-day delay in legal availability, as compared to a 2% drop in sales for every 10-day delay in the entire sample," the paper reads.

"Our results suggest that an additional 10-day delay between the availability of digital piracy and the legitimate DVD release date in a particular country is correlated with a 2-3% reduction in DVD sales in that country," the researchers write.