How to exploit unsigned repository metadata

Courtesy of Don Kaminsky's slides for his Black Hat DNS talk, I wound up reading Attacks on PackageManagers ,which identifies a number of attacks that can be mounted if you canset yourself up as a package repository mirror for your favoriteLinux distribution. A number of the attacks are straightforward,but judging from the Slashdot discussion the dangers of unsignedrepository metadata are not as clear. So here is an attempt toexplain them simply.

Suppose that you are an attacker with a repository mirror (the papershows that


A workaround for the Python module search path issue on Unix

One of the little challenges with writing Unix programs in Python isthe search path problem. The natural structure of Python programs is tosplit functionality up into a bunch of modules and then import themall in the main program, but the natural structure of a Unix program isto put its binary into one directory (such as /usr/bin ) but all ofits helper bits into a second, completely different directory. So theproblem is: how is a Unix Python program supposed to find its modules?

(The


Erica and Mark Spitz!!


Continue reading...

點擊近五萬人次



無剪接的力量,真實比電影更電影。警方什麼都不用再說了。

The pragmatics of language changes

There is a certain view, one that is easy for people to fall into,to the effect that while backwards compatibility in new versions oflanguages is important and should be given due weight, sometimes thelanguage designers can, do, and should decide that the change isimportant enough so that it should be made. Let us call this thelanguage designer view of language changes.

The problem for this view and for the decisions that come from itis simple:

Programmers do not have to accept what you give them.


中國加油?


奧運快來吧


王府井的情況



Continue reading...

心情的好壞變成來去無限

1. 電腦遊戲菜鳥的幸福回憶:
從實驗室到工業大樓——憑弔軒轅劍

「軒轅劍系列」是台灣大宇公司研發的長壽遊戲(以角色扮演為主),一代1990年發佈, 到2007年底發佈五代外傳「漢之雲」,共發佈14個版本。


More on the funding capture problem

The usual rejoinder to the funding capture problem is that organizations will still have to actto in order to stay meaningful and important. If an organization doesnothing, outside people will come to see it as unimportant, useless, andmeaningless, resulting in the people funding it winding up not gettinganything for their money, so they'll stop paying. After all, why pay forsomething that gives you no benefits?

(Let us skip lightly over all of the practical difficulties here,starting with organizational inertia.)


世界電影經典回顧 9月 日本新浪潮電影

各位期待SUMMER IFF日本戲碼的朋友, 你們無氣抖了! 康文署 電影節目辦事處 舉辦的 世界電影經典回顧─日本新浪潮電影 (9月) , 片目堪稱近年最強!


中平康 瘋狂的果實 》(1956), 太陽族電影首席之選. 石原慎太郎 原作,

Continue reading...