Steven Paul “Steve” Jobs, February 24, 1955 – October 5, 2011 — R. I. P.

While Chrome has one of the most secure sandboxes and has always survived the Pwn2Own contest during the last three years, we have now uncovered a reliable way to execute arbitrary code on any installation of Chrome despite its sandbox, ASLR and DEP.

I would hope an update to fix the exploit would be released soon, although sandboxing has already proved to be insecure which makes future exploits easier. Meanwhile, I’m going back to browsing by telnet hostname 80.

location ~ \.php$ { # For nginx -V >= 0.7.27
  try_files $uri =404;
  fastcgi_pass localhost:8080;
  ...
}
location ~ \.php$ { # For nginx -V < 0.7.27, i.e. Debian 5
  if (-f $request_filename) {
    fastcgi_pass localhost:8080;
  }
  ...
}

The shift from procedural to OO brings with it a shift from thinking about problems and solutions to thinking about architecture. That’s easy to see just by comparing a procedural Python program with an object-oriented one. The latter is almost always longer, full of extra interface and indentation and annotations. The temptation is to start moving trivial bits of code into classes and adding all these little methods and anticipating methods that aren’t needed yet but might be someday.

Haven’t I seen that all too often on that project that I have worked on over the past 10 years?! Premature optimisation is the root of all evil. Unnecessary architecting the solution won’t be too far from that.

This brings us to the most important quality that enables impact: trust. Without trust, employees aren’t empowered. And without empowerment, there can be no impact… This is exactly the reason why startup hiring is difficult: the amount of trust required in the candidate is magnitudes above that of large companies.

It is so hard when you are evolving from one to two.

Interestingly though, that when I disconnect the ATA from WAN interface, I could connect to its admin interface via the LAN port. However right after I connect LAN port to my ADSL hub, any request to admin interface would timeout. That’s weird, so I turned on syslog to log the system message to my external syslogd, and then connect the LAN port. Wow — heaps of log messages. Here is a snippet:

Mar  3 22:26:24 CDUaUdpStack::OnReceiveFrom(803fa460, 334)
Mar  3 22:26:24 from:50.22.171.5, port:5112, len=334, REGISTER sip:xx.xx.xx.xx SIP/2.0^M Via: SIP/2.0/UDP 50.22.171.5:5112;branch=z9hG4bK-1614305573;rport^M Content-Length: 0^M From: "152" ^M Accept: application/sdp^M User-Agent: friendly-scanner^M To: "152" ^M Contact: sip:123@1.1.1.1^M CSeq: 1 REGISTER^M Call-ID: 2269038874^M Max-Forwards: 70^M ^M
...
Mar  3 22:26:24 CUserAgent::SendTo(806f9750, 234, 5112, 50.22.171.5, 0, encryptType=0, udp, 0)
Mar  3 22:26:24 to:50.22.171.5, port:5112, len=234, SIP/2.0 403 Forbidden^M Via: SIP/2.0/UDP 50.22.171.5:5112;branch=z9hG4bK-1079254239;rport^M From: "152" ^M To: "152" ;tag=2cfa115b^M Call-ID: 807709011^M CSeq: 1 REGISTER^M Content-Length: 0^M ^M

Repeat the above for around 15 times per second! What appears to be happening is — this host 50.22.171.5 has been sending me SIP registration message at the rate of 15 times per second, and my VoIP ATA is merely replying back with 403 forbidden message at the same rate. My ATA is pretty much DoS’ed — I am denied of my VoIP service, because it has been too busy servicing bogus requests!

So once I firewall’ed the requests (dropping all packets from that IP), my VoIP ATA got back its sanity again. Hooray!

However, the “attack” did not stop. Large number of requests are still hitting my ADSL router every second. It is also chewing up quite a bit of bandwidth that counts towards my ADSL monthly quota. Here is an MRTG graph.

Not a lot of things I can do.

• I have sent an email to Softlayer’s abuse department (that IP address belongs to Softlayer). Did that a few days ago and still waiting for the reply.
• I could request a new IP address from Exetel to switch to. A lot of hassle especially with some IP-based authentication.

will update once there’s a solution. This kind of SIP-based DoS attack seems to get very frequent now — what are they trying to achieve?!

Going into Control Panel to change the audio playback device, and saw that “ATI HDMI Output” device showing “Not plugged in“, and unable to be selected.

Solution: I googled the problem, browsed a few solutions in various forums, opened up the HTPC case to make sure everything is plugged in properly (which they are, as it’s actually an all-in-one motherboard), updated to the latest ATI driver, etc. Nope. Nothing works.

Then it turns out that it’s just a matter of getting into the BIOS (pressing [DEL] when the computer boots), going into “Advanced BIOS feature”, and changing “Onboard VGA Output Connect” to “D-SUB/HDMI”. It is usually “D-SUB/DVI” as default setting.

Booting back into Windows, and the audio would just work :)

Introduce my new toy — a Lenovo ThinkPad T410. I have been a Dell man for the last 10 years — having a total of 3 Dell laptops (Inspiron 8000, Latitude D600 and Latitude D630). Well now I am having a change and migrated off Malaysian product to Chinese product :) Built quality is probably on par comparing to Dell Latitudes, but a good $500-$1000 cheaper on a similar configured system, thanks to regular Lenovo bargains that are up to 35% off.

Spec of my new toy work horse

• Intel Core i5 580M
• 4GB memory
• 320GB SATA HDD with 7200RPM
• NVIDIA Quadro NVS3100M graphics
• Windows 7 Professional 64bit
• DVD-RW, 2.0MP webcam, Intel 802.11bgn, and all the works
• Legendary Lenovo ThinkPad keyboard with UltraNav

Since I am doing so much typing on the keyboard, it makes sense to get a notebook with the best keys. That rules out most cheap notebooks and any with chiclet keyboards, consider I was using this at work before. ThinkPad keyboard rocks, even better than the D630 I had before, which I thought was pretty good already.

And the UltraNav. Wow. Now I remember why I never bothered to use that blue sticky thing on my old Dell Latitude, because it sucks. Lenovo’s implementation is so much better (consider they actually popularised it). At the same time I found the trackpad not as responsive as my old Dell, which forces me to use the trackpoint more.

So far so good. This will be my main computer for the next 3 years, and hopefully it lasts.

A great community isn’t something that you just set up and periodically patch. Running a great community is a full-time job, not a weekend hack project.

Indeed — and that applies to some of the community sites I run as well. You do need to put “time” into it.

Got this via this Dell Swarm offer for just $23.76 to replaced my old scanner (9 year old HP ScanJet 4200C that refuses to work on Vista/Windows 7). It has got wireless printing and scanning, although I am quite a bit disappointed that it can only scan to your Windows desktop computer running Dell’s proprietary software. I guess I was dreaming when I thought it could scan to a Samba share running on my NAS when I bought it.

Well what am I to complain when it’s just $24 delivered.

And according to Nokia entry on Wikipedia

In 1898, Eduard Polón founded Finnish Rubber Works, manufacturer of galoshes and other rubber products, which later became Nokia’s rubber business. At the beginning of the 20th century, Finnish Rubber Works established its factories near the town of Nokia and began using Nokia as its product brand.

Always a solution if Windows Mobile does not work out.