淫審諮詢粗疏

東方日報
私隱署責淫審諮詢粗疏
16/11/2008
【 本 報 訊 】 現 行 的 淫 褻 及 不 雅 物 品 審 裁 制 度 千 瘡 百 孔 ， 政 府 就 檢 討 淫 審 制 度 作 出 的 諮 詢 建 議 ， 亦 被 指 粗 疏 和 有 漏 洞 。 個 人 資 料 私 隱 專 員 公 署 指 出 ， 諮 詢 文 件 建 議 利 用 信 用 卡 號 碼 ， 來 核 實 成 人 網 站 用 戶 是 否 年 滿 十 八 歲 ， 不 但 實 際 上 未 必 可 行 ， 更 可 能 會 不 必 要 地 洩 露 用 戶 的 個 人 資 料 。

信 用 卡 核 身 份 不 可 行
建 議 早 前 已 在 網 上 引 起 廣 泛 爭 議 ， 被 網 民 炮 轟 「 冇 腦 」 和 「 靠 害 」 ， 令 盜 用 信 用 卡 資 料 問 題 加 劇 。 私 隱 署 提 交 委 員 會 的 文 件 指 出 ， 信 用 卡 號 碼 是 跟 戶 口 而 非 跟 人 而 設 ， 戶 口 持 有 人 未 必 是 一 個 個 人 ， 單 憑 號 碼 亦 不 能 核 實 持 有 人 是 否 成 年 ； 若 容 許 互 聯 網 供 應 商 向 信 用 卡 公 司 查 核 持 有 人 的 年 齡 或 更 多 資 料 ， 則 持 有 人 的 真 正 身 份 亦 可 能 外 洩 。

文 件 又 指 ， 由 於 信 用 卡 號 碼 並 非 有 效 核 實 網 站 用 戶 身 份 或 年 齡 的 方 法 ， 有 關 建 議 會 對 個 人 資 料 私 隱 產 生 不 必 要 的 威 脅 。

2GB 手指 終身保養

我買了一條價值 HK$50 元的 2GB 手指，產品享有終身免費保養。問題是如果真的損壞了，我一定不會花 HK$30 來回車費拿去維修，單是車費巳是該貨品的 60%，倒不如買另外一件代替。這表示這些低價消費電子產品，是無須要提供售後保養，而代理商聲稱終身保養，只是騙人的玩意。

Multiple Antivirus software in a single PC

There are a few number of free antivrius (AV) software like Bitdefender, AVG, avast! etc. As no single AV software can detect 100 % new viruses, some might think that having two AV software in a single PC can complement each other to offer higher protection. This is not the case. AV software packages are not only incompatible with each other but also confuse each other. If they were made staying memory resident together or performing virus scan, the PC will slow down and might even hang.

選舉過後

長毛說得好，民建聯你們不要太開心，新界東泛民佔五席，而你們只得兩席。

港島區選民，你們真的了不起，運用了精明投票方法，谷票給陳淑莊團隊，踢走福建婆娘，保住泛民大姐大。

票站調查

今天我投了票給泛民。在票站外遇上港大調查員要求做投票訪問，心想票站調查已淪為某些人士的配票工具，我乾脆地回答投了給民建聯，

功能界別候選人

功能界別候選人，請你們記 “業界利益絕對不能凌駕公眾利 益”， 如果你認為這樣做有難度，請你們立即退選。

我絕不希悍功能界別投票資格，功能界別引致太多利益衝突，一定要盡快廢除。

練乙錚先生的「七不選」

練乙錚先生前天在信報與讀者分享他的「七不選」 ：
（一）過分偏重商界利益、漠視勞苦大眾者不選；
（二）與一些反對普選、咀邊常掛一句「民主不等於普選」的大商賈關係千絲萬縷者不選；
（三）對立法會工作 心不在焉，或與政府「合作」過度密切、不以監督政府為己任者不選（這些人或是當副局長的好材料）；
（四）支持不民主體制及殖民時代遺留下來的惡法如《廣播條例》中的若干過時條文者不選；
（五）不接受○三年教訓，贊成「翻叮」二十三條藍紙草案內容及立法程序而唯恐天下不亂者不選；
（六）在普選議題上贊成設置 各種有利既得利益之嚴苛路障者不選；
（七）功能組別選舉中，過分強調或專注界別私利、輕忽社會公益者不選（選立法會和選商會主席不同）。

在這選舉關鍵時侯，很多具相同理念的網友都盡量把「七不選」廣泛傳播於討論區、Facebook 及網誌 (blog)。既然我擁有自己的網誌，我當然要出一分力轉貼「七不選」，以助流傳。

The difference

This picture tells the difference between Windows and Ubuntu OS.



On the CD surface, the following are marked :

Windows :Please do not lend or make illegal copy of this software.

Ubuntu : Legally free to copy, modify and redistribute.

MTR Internet kiosks block facebook

I tried to access facebook in an MTR Internet kiosk. The connection was blocked and the alert message was that access to dating web sites was prohibited due to security policy. Facebook is a social networking platform with over 1 million Hong Kong people registered. People use facebook for a variety of purposes like exchange of messages, chatting with online friends, sharing of photos and videos, group discussions of a common theme, inviting friends to events and giving electronic gifts etc. I can not imagine why facebook should be blocked.

New Zealand CERT

When talking to a friend from New Zealand, I was told that New Zealand Government will only establish NZ CERT in 2009. I checked this and the finding was correct.

New Zealand is a highly developed country. There should not be resource problems such as funding and skilled workforce to support the CERT operation. The lack of a national CERT could undermine people confidence in e-commerce, online transaction and other Internet-based activities. Suffice to say this is detrimental to the long term development of a country.

「選情告急」- 欺騙選民

9月7日是投票日，我會全家總動員去投票。但還請候選人不要再用「選情告急」去欺騙選民。

Dan Kaminsky

Since July, the name “Dan Kaminsky” appears in numerous web sites related to Internet and IT security because of his great work to dig out an alarming fundamental design flaw in DNS leading to cache poisoning. The presentation (107 slides) by Dan Kaminsky in the Black Hat USA 2008 Conference can be obtained in the link http://www.doxpara.com/DMK_BO2K8.ppt. The title is called “Black Ops 2008 -- Its The End Of The Cache As We Know Or: “64K Should Be Good Enough For Anyone”".

I enjoyed reading his great work though I could only understand less than half of the contents.

Fake lowest and highest MX record to reduce zombie spam

I have been using the method of fake lowest MX record to reduce zombie-originated spam. An example is illustrated as follows :

1H IN MX 10 fake.mymail.com
1H IN MX 20 realmx.mymail.com

The fake record of MX=10 can either be undefined or can point to a dead IP address.

Legitimate sending email servers will get the error and retry the MX=20 and deliver the email successfully with some delay. Zombie spam will not try MX=20 and just move on to the next victim.

The above has a shortcoming that zombie might try deliver to the IP address read from the highest MX record (usually backup server) on the assumption that the backup mail server has less anti-spam features. A more careful setting is :

1H IN MX 10 fake.mymail.com
1H IN MX 20 realmx.mymail.com
1H IN MX 30 fake.mymail.com

Some have reported that the fake lowest MX and highest MX records working together can reduce 90 % of zombie spam.

More information on this method is in http://wiki.apache.org/spamassassin/OtherTricks

A remote control for men only

A friend sent me this remote control in my facebook funwall. It is for men only. Of course, children should not touch on it.

「活塞男」事件

「活塞男」真是哄動全城。大部份市民都認為政府應向「活塞男」追討被損公物的維修費用，我也絕對讚同。我們是絕對不能容忍公共設施被有特殊嗜好人士濫用而受到損壞。政府還需提醒另一個重要信息：當我們使用公園內的設施前，記緊要消毒。

DNS Port Randomness Test

One of my DNS servers has been upgraded from Bind 9.4.2 to Bind 9.5.0-P1 in order to circumvent the cache posioning problem due to the lack of randomness in port numbers. The test string and the server for testing the randomness can be found at https://www.dns-oarc.net/oarc/services/porttest.

After the upgrade, the port randomness problem is resolved.

Curl

Just when I thought wget is powerful and user-friendly, it has a limitation of not able to download files larger than 2GB. Curl is a better choice if I need to download DVD iso image of Linux packages which usually have a file size of around 3.3 GB. The command string looks a bit strange at first, but it is really not difficult to remember, just think of the -o as output to a file instead of output to stdout :

#curl -o linux-dvd.iso http://www.xyz.org/linux-dvd.iso

In fact, I have been troubled by this limitation of wget for many years.

2008 Olympics Opening

Today is the 8 th of August, the day for 2008 Olympics Opening in Beijing China. Google has put up a nice logo to celebrate the 2008 Olympics Opening.



Well-done, Google.

proftpd to replace vsftpd

I decided to replace vsftpd by proftpd. The reason is that proftpd can bypass reverse lookup of IP addresses to domain names with the directive of "UserReverseDNS off" in the config file. There are ISPs that have not properly given reverse hostnames to their IP addresses assigned to customers. In case of lookup failure, vsftpd will result in time out in the login process. I have tried to search if it is possible to disable reverse lookup in vsftpd but in vain. Obviously, proftpd is my choice in order to avoid the trouble of reverse lookup failure.

八萬五

以下這條問題曾在小學常識問答遊戲中出現：

問：形容一個人有逃避問題的性格，會用甚麼政策？

答案：八萬五