Why I want direct certificate checking instead of having to rely on CAs

The common SSL model is that you verify someone's good nature bychecking to see that their certificate is signed by an approved CA.For example, if you are verifying that hosts you are connecting toare approved you would make up a CA certificate, then make up a bunchof host certificates and sign them with the CA certificate. When youconnect to a machine, you verify that its certificate is signed by yourCA certificate.

(Except that that's a simplification; you actually need to verify that


對我們微笑

上星期
有朋友靜靜地離開了
我們之間沒有很多的溝通
不過
每次見到他
他的笑容總是令我深刻

上路
愉快


我想起這首歌
同樣是有人離開了而寫的

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

對我們微笑 (raido blog


得閒飲湯


朋友送來電子炖盅
以後就沒有藉口說怕麻煩而湯水不足了
科技真是日新月異
我以前獨居都喜歡煲湯
不過雞手鴨腳搞成日自己煲比自己飲
真係要好有閒情先會做一次
工作之後就更少時間飲湯了
現在有了這東西
感覺上是以後得閒就可
Continue reading...

A grump about the socket module's SSL support

It is nice that Python's socket module has simple SSL support (although it has some limitations ). My grump is that it doesn't giveyou any good way of checking the identity of the server'scertificate, which is especially annoying as the SSL codedoesn't do any certificate verification.

(This matters to me because I have recently become quiteinterested in being able to verify machines by checkingthat they have a specific SSL certificate.)

What SSL objects have is .issuer( ) and


野孩子

我從來不受教,只受管於我愛的人。
一朝不愛,故態復萌。

用 Dapp 製作 RSS Feed

最近幫朋友用 Dapper 製作了一個 MySinaBlog 的 Comment RSS Feed,製法簡單,在此公諸同好。雖然簡單,但要說明還是很複雜,所以錄了個 Screencast (首個!),以自己的舊 MySinaBlog 為例子。不過做得很簡陋,沒有什麼解說,而且上了 Youtube 後更是「矇查查」,敬請見諒


其後

近日處於“休養”狀態,工作之外,就是休息。所謂休息,就是暫時不努力讀書和寫作,減輕不必要的壓力,有時間就看電影,看漫畫,只為娛樂。



較早前看了森田芳光導演的《其後》,早就聽聞這是好片,想不到好到這個地步
Continue reading...

Why I don't have a GPG key

In theory I ought to be just the sort of person who has a GPG key; afterall, I'm geeky, quite aware of how easy it is to impersonate people onthe Internet, reasonably concerned about privacy, and so on. But inpractice I don't have one because I don't feel I could keep it secureenough for what people believe a digital signature implies.

As a system administrator, I get to be quite aware of all the waysthat a bad guy could attack the


揮我生命寫正義故事

星矢冥王篇

(對,老人家又要想當年了…)

最近大家都談集體回憶,看著電視播映的星矢「冥王十二宮篇」的動畫,相信也會喚起不少人的回憶吧!當時星矢也是在深夜播映,主題曲是由譚耀文主唱的,片頭通常只會播「中」段:

匆匆一生


Configuring VLANs on Fedora Core

Interactive VLAN configuration is done with the vconfig program. Thebasic usage is ' vconfig add eth0 6 '; this makes a new Ethernet devicecalled eth0.6 (by default; vconfig can change this, but you probablydon't want to). ' vconfig rem eth0.6 ' will then remove the VLAN.

A configured VLAN is up enough so that you can receive traffic on it. Ifall you're interested in is doing things like bridging virtual machinesonto the VLAN's