OpenSSL HeartBleed 漏洞来势凶猛

最近透露出来的OpenSSL HeartBleed (心脏滴血）漏洞很厉害，yahoo.com 都被用来作为POC攻击的示范站点。不过发此文时yahoo似乎已修复， 但查询top 1000...网站确实还有不少中招。ssltest python script 轻易就可以搜到，就不放在此了，注意它们只是显示是否vulnerable，并没有显示message content，当然这也很简单。此时攻防双方应该是在分秒必争，我觉得一些搞bitcoin的一些网站真是应该小心了。。。

INSECURE - bitcurex.com:443 has the heartbeat extension enabled and is vulnerable
INSECURE - localbitcoins.com:443 has the heartbeat extension enabled and is vulnerable
INSECURE - vip.btcchina.com:443 has the heartbeat extension enabled and is vulnerable
INSECURE - www.bitfinex.com:443 has the heartbeat extension enabled and is vulnerable
INSECURE - www.bitgo.com:443 has the heartbeat extension enabled and is vulnerable
INSECURE - www.bitstamp.net:443 has the heartbeat extension enabled and is vulnerable
INSECURE - www.cryptsy.com:443 has the heartbeat extension enabled and is vulnerable
INSECURE - www.virwox.com:443 has the heartbeat extension enabled and is vulnerable

OpenSSL HeartBleed bug
http://heartbleed.com/

Online heartbleed test
http://possible.lv/tools/hb/
http://filippo.io/Heartbleed/
https://www.ssllabs.com/ssltest/

Skype Silk 与Opus的关系

Skype自2009年1月以来一直采用自己的SILK音频编码解码器，但是从2012年起过渡到新的Opus标准。Opus标准已经获互联网工程任务组（IETF）批准，标准格式为RFC 6716。它 是一个有损声音编码的格式，适用于网络上的实时声音传输。Opus支持6kbps到510kbps的可变比特率。由于是一个开放格式，Opus在使用上没有任何专利限制。

Opus合并了Xiph.org的CELT低延时音频编解码器和Skype的SILK语音编解码器，专为互联网音频设计，可用于替代现有的私有音频编解码器，由 Xiph.Org、Mozilla、微软、Broadcom、Octasic和Google联合开发。


目前软件包版本是Opus v1.1
Skype Opus Codec

VC2005 --> 2008

Vs2008兼容vs2005 的项目；但vs2008的项目却不能放在vs2005中.

将vs2008 项目 转换成到2005 下的解决方法：
l. 修改解决方案文件：解决方案.sln
Microsoft Visual Studio Solution File, Format Version 10.00 [9.00]
# Visual Studio 2008 [2005]

2. 修改项目文件：项目.vcproj
delete ToolsVersion="3.5"
change MSBuildTools to MSBuildbin
通过以上步骤就可以用Vs2005打开vs2008下的项目.

另：vs2008下使用的类库跟vs2005的类库是有区别的：
1 删除 using System.Linq;
2 移除包含！号的引用


手动卸载 Visual Studio 2005/2008
refer to http://support.microsoft.com/kb/907965

or 卸载 Visual Studio 2008 组件时，必须按照以下顺序进行。 （VS2005类同）

打开“添加或删除程序”（Windows Server 2003 和 Windows XP）或“程序和功能”（Windows Vista 和 Windows Server 2008）。

1. 删除“Microsoft SQL 发布向导”。

2. 删除“Crystal Reports Basic for Visual Studio 2008”。

3. 删除“Crystal Reports Basic for Visual Studio 2008 64 位运行库(x64)”。 只有当 Visual Studio 安装在 64 位计算机时，才需要此步骤。

4. 删除“Microsoft Windows SDK for Visual Studio 2008 SDK 引用程序集和 IntelliSense”。

5. 删除“Microsoft Windows SDK for Visual Studio 2008 .NET Framework Tools”。

6. 删除“Microsoft Windows SDK for Visual Studio 2008 Win32 Tools”。

7. 删除“Microsoft Windows SDK for Visual Studio 2008 标头和库”。

8. 删除“Microsoft Windows SDK for Visual Studio 2008 Tools”。

9. 删除“Microsoft Visual Studio 2008 远程调试器”。 只有当 Visual Studio 安装在 64 位计算机时，才需要此步骤。

10. 删除“Microsoft SQL Server 2005 Express Edition”。

11. 删除“Microsoft SQL Server Native Client”。

12. 删除“Microsoft Device Emulator 3.0 版”。

13. 删除“Windows Mobile 5.0 SDK R2 for Smartphone”。

14. 删除“Windows Mobile 5.0 SDK R2 for Pocket PC”。

15. 删除“Microsoft SQL Server Compact 3.5 for Devices”。

16. 删除“Microsoft SQL Server Compact 3.5 设计工具”。

17. 删除“Microsoft SQL Server Compact 3.5”。

18. 删除“Microsoft Visual Studio 2005 Tools for the 2007 Microsoft Office System Runtime”。

19. 删除“Microsoft Visual Studio Tools for the Microsoft Office system (3.0 版运行库)”。

20. 删除“Microsoft .NET Compact Framework 3.5”。

21. 删除“Microsoft .NET Compact Framework 2.0 SP2”。

22. 删除“Microsoft Visual Studio”。

23. 删除“Microsoft Visual Studio Web 创作组件”。

24. 删除“Microsoft Document Explorer 2008”。

25. 删除“Microsoft Visual Studio 2008 64 位系统必备”。 只有当 Visual Studio 安装在 64 位计算机时，才需要此步骤。

26. 删除“Microsoft .NET Framework 3.5”。

Update vbox guest additions

New VirtualBox 3.1.4
How to update VBox Guest(Ubuntu) Additions?

1. use Vbox install option in GUI to download file "VBoxGuestAdditions_3.1.4.iso". The file was put into "C:\Documents and Settings\Administrator\.VirtualBox", and hint to mount. It will be mount to "/media/cdrom"

2. go to this directory and run
sudo ./VBoxLinuxAdditions-x86.run
Before do this, you might want to run
sudo apt-get install build-essential linux-headers-generic

3. restart guest OS (virtual linux)

Note: If you already download a *.iso file, you can mount it manually in vbox media manager.

P.S.: vbox 3.1.4 still has an annoying problem "could not switch the monitor configuration... CRTC56"!

PyGTK下编写多线程程序

虽然在PyGTK中Python有关多线程的库(thread,threading)可以使用，但其行为常现异常，所以一定要按照PyGTK的要求编写多线程应用程序。

How threads works in pygtk using the threading module?

Threads are a way for a program to split itself into two or more simultaneously running tasks. The way that we create threads in python is writing subclasses of the threading.Thread class, the method run, should be overloaded so we include there the code that we want to be rant on each thread.

In order to create a new thread, we should create a new Thread object and then, call the start method which creates the new thread, and executes the run method in its context.

The problem with PyGTK is that the gtk.main() loop won't refresh the screen each time that the fraction is set, we need to use the gtk thread engine. We need to call the gtk.thread_init() function to start the thread engine, this call should be made on the same thread that the gtk.main() function is called. In fact, calling it right afer importing the gtk module is a good practice.

Thus, we should use gtk.threads_enter() before any access to gtk object, and, once we end up doing transformations, we should call gtk.threads_leave().

We should call to the stop method in the exit callback so when the window is closed the application ends the thread and the script doesn't hangs.

只允許主線程修改圖形界面

這是較常用的一種方式，但編寫時略顯複雜。首先，在程序初始化時調用（一定在gtk.main()之前運行）：

gobject.threads_init()

多線程的實現方式與純Python相同：

t=threading.Thread(target=新线程的函数)
t.start()

要修改界面的代碼則使用gobject.idle_add加到GTK的主循環中。

gobject.idle_add(新线程函数, 参数)

注意如果新線程函數返回True，則該函數仍在GTK的主循環中，如果返回False，則退出主循環。下面的例子是PyGTK.org上給出的：

import threading
import time
import gobject
import gtk

gobject.threads_init()

class MyThread(threading.Thread):
 def __init__(self, label):
     super(MyThread, self).__init__()
     self.label = label
     self.quit = False

 def update_label(self, counter):
     self.label.set_text("Counter: %i" % counter)
     return False

 def run(self):
     counter = 0
     while not self.quit:
         counter += 1
         gobject.idle_add(self.update_label, counter)
         time.sleep(0.1)

w = gtk.Window()
l = gtk.Label()
w.add(l)
w.show_all()
w.connect("destroy", lambda _: gtk.main_quit())
t = MyThread(l)
t.start()

gtk.main()
t.quit = True

允許所有線程修改圖形界面

這種方法要簡單很多。與前面類似，在程序初始化時調用：

gtk.gdk.threads_init()

不過要把gtk.main()用下面兩個函數括起來：

gtk.threads_enter()
gtk.main()
gtk.threads_leave()

其它線程也是如此，在修改界面內容的代碼前後加上
gtk.threads_enter()
...
gtk.threads_leave()

The following example shows how to do it using a random fraction for the progress bar:

---

import threading
import random, time
import gtk
#Initializing the gtk's thread engine
gtk.threads_init()


class FractionSetter(threading.Thread):
 """This class sets the fraction of the progressbar"""

#Thread event, stops the thread if it is set.
stopthread = threading.Event()

def run(self):
  """Run method, this is the code that runs while thread is alive."""

 #Importing the progressbar widget from the global scope
 global progressbar

 #While the stopthread event isn't setted, the thread keeps going on
 while not self.stopthread.isSet() :
  # Acquiring the gtk global mutex
  gtk.threads_enter()
  #Setting a random value for the fraction
  progressbar.set_fraction(random.random())
  # Releasing the gtk global mutex
  gtk.threads_leave()
 
  #Delaying 100ms until the next iteration
  time.sleep(0.1)
 
def stop(self):
  """Stop method, sets the event to terminate the thread's main loop"""
 self.stopthread.set()

def main_quit(obj):
 """main_quit function, it stops the thread and the gtk's main loop"""
#Importing the fs object from the global scope
global fs
#Stopping the thread and the gtk's main loop
fs.stop()
gtk.main_quit()

#Gui bootstrap: window and progressbar
window = gtk.Window()
progressbar = gtk.ProgressBar()
window.add(progressbar)
window.show_all()
#Connecting the 'destroy' event to the main_quit function
window.connect('destroy', main_quit)

#Creating and starting the thread
fs = FractionSetter()
fs.start()

gtk.main()

---

Refer to:
http://aruiz.typepad.com/siliconisland/2006/04/threads_on_pygt.html
http://docs.python.org/library/threading.html