thegoodfellas/blogset-br huggingface dataset:
I have been working on the KOW framework for a couple of years now. So much we have accomplished, and then rewritten and finally we are really close of a public release with some tutorials and stuff like that.So, in order to celebrate that I decided to write a simple overview on the framework and what it is all about. So, here it is.The framework was designed with simplicity and modularity in mind. Once you have your application up and running it should be straightforward to extend and maintain it. You shouldn't have to worry about versioning much (well, you need some sort of versioning but not as grained as "take the revision #1012023".... a simple "use the release 2.0" should be enough).Also, memory management is a big concern (after all it is a server based framework.. all users will be using the same memory space on the server).We did our best to make it robust, fast and small. Yes, being small is actually a good thing. The framework has no tool for handling complex scripts. Neither for processing images or any of the sorts. If you need something that does that you should by all means use GNAT.Expect package for calling other process (which can be considered an ugly workaround but works like magic) or implement your own (or even find a 3rd party) package. You can put this package inside your app folder and you will be just fine.A more detailed post about the framework and how to use it is yet to be written. Actually, our biggest issue right now is not having a decent set of introduction documentation. It's quite easy to use the framework after you got yourself used to the main libraries (only tree are quite important here: kowconfig, kowview and kowent) but there is no "make a blog in 2 minutes" kind of documentation (which I think is quite possible and easy to do... but I tend to get busy with other things easily). My last post was about the attack method described in 28c3 conference and how it affected AWS servers.Quickly the folks at AdaCore picked up this issue and in the same day they already had it fixed on their repository. Now they are making public releases with the fix.It's amazing how quickly they fixed this. And they where really kind on keeping me up to date with the situation.If you compare this response with the one of larger teams such as Tomcat and PHP I'd say it's a huge win to AdaCore and the Ada community in general.Thanks AdaCore. Foi rapido! Ja recebi a resposta... pontinho positivo por isso. Primeiro a mensagem, depois meus comentariosPrezado Sr. Marcelo CoracaAgradecemoso seu contato e informamos que conforme exposto,compreendemos seu descontentamento quanto ao fato ocorrido, desde ja, agradecemos sua mensagem e ressaltamos que a mesma e muito importante para que o crescimento da marca, bem como, para o desenvolvimento dos produtos Samsung.A Samsung busca sempre, melhorar sua imagem junto as sugestoes ereclamacoes recebidas dos nossos clientes.------------------------------------------------------------------------Se voce tiver perguntas adicionais ou qualquer outro comentario, porfavor nao
hesite em nos contatar novamente.Samsung EletronicsServico de Atendimento ao ConsumidorTelefone: 4004-0000Atenciosamente,Nome: Ana , Paula nery rosmaninhoDesignacao: SACBom, tipica mensagem se desviando do assunto.. alias, tem muita cara de resposta automatica para reclamacoes...O problema persiste, a Samsung continua se desviando... vamos ver o q rola daqui pra frente...
Update: as of 2011-01-19, AdaCore is aware of the situation and is already working on a fix to this problem.Update 2: as of 2011-01-19 (yes, the same day), the problem is fixed in the repository (revision 9f1405).Update 3: AdaCore changed it's name from ACT several years ago. Changed all references to that name accordingly. Sorry about that. :)Update 4: as Pascal Obry informed in his comment on this post, the updated version is available to all AdaCore customers and the GPL version has been updated at Open-DO forge.A few weeks ago, the following video has been released:Well, those guys did a great job not only studying this vulnerability but also spreading the news. Then the question arose: is Ada Web Server vulnerable to this sort of attack?The short answer is: sadly yes. This post tries to explain how we have tested this issue.Keep in mind that only if a few hours I managed to get this code working and managed to keep my server at 100% for over 3 minutes with only 46656 variables in my post request.The compiler used was GNAT GPL 2011. The AWS version is 2.10.0. And the operating system is Sabayon Linux.IntroductionIt all started at the #ada IRC channel at freenode. As I am used to run AWS servers all around I was curious if my servers were vulnerable or not.After some research on the web I realized there wasn't any official report on the issue and I couldn't find anything useful. So, I went to the chat room and started talking to jesselang.He discovered the AWS uses the Ada.Strings.Hash function internally. As it isn't really complex I realized we where not safe.This is the actual implementation of this function (which is actually inside the file s-strhas.adb in your GNAT distribution):-------------------------------------------------------------------------------- ---- GNAT COMPILER COMPONENTS ---- ---- S Y S T E M . S T R I N G _ H A S H ---- ---- S p e c ---- ---- Copyright (C) 2009, Free Software Foundation, Inc. ---- ---- GNAT is free software; you can redistribute it and/or modify it under ---- terms of the GNU General Public License as published by the Free Soft- ---- ware Foundation; either version 3, or (at your option) any later ver- ---- sion. GNAT is distributed in the hope that it will be useful, but WITH- ---- OUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY ---- or FITNESS FOR A PARTICULAR PURPOSE. ---- ---- ---- ---- ---- ---- You should have received a copy of the GNU General Public License and ---- a copy of the GCC Runtime Library Exception along with this program; ---- see the files COPYING3 and COPYING.RUNTIME respectively. If not, see ---- ---- GNAT was originally developed by the GNAT team at New York University. ---- Extensive contributions were provided by Ada Core Technologies Inc. ---- --------------------------------------------------------------------------------pragma Compiler_Unit;package body System.String_Hash is -- Compute a hash value for a key. The approach here is follows the -- algorithm used in GNU Awk and the ndbm substitute SDBM by Ozan Yigit. ---------- -- Hash
-- ---------- function Hash (Key : Key_Type) return Hash_Type is pragma Compile_Time_Error (Hash_Type'Modulus /= 2 ** 32 or else Hash_Type'First /= 0 or else Hash_Type'Last /= 2 ** 32 - 1, "Hash_Type must be 32-bit modular with range 0 .. 2**32-1"); function Shift_Left (Value : Hash_Type; Amount : Natural) return Hash_Type; pragma Import (Intrinsic, Shift_Left); H : Hash_Type; begin H := 0; for J in Key'Range loop H := Char_Type'Pos (Key (J)) + Shift_Left (H, 6) + Shift_Left (H, 16) - H; end loop; return H; end Hash;end System.String_Hash;Turns out this is a linear hash function. It should easy to come up with a reverse algorithm, but ...Generating Strings with Colliding HashGenerating a code for this should be hard. I haven't got lazy right from the start; I spent like 20 minutes trying to crack this up but as I have no previous experience in doing such thing and binary arithmetic isn't really my thing I decide to go for the brutal force approach. :)So I generated a short string. Something arbitrary, such as "ccc" (that's actually what I used). And I implemented a dirty loop to generate substrings with 6 characters each with the same has. Bingo! I found out 12 strings but I decided to use only 8 of them for they only had alphanumeric characters.And here is the pretty thing: as this hash function is linear all I had to do is to combine all those strings. I came up with 46656 combinations in total - only because I didn't want big variable names in my post requests.Another thing I found out is that it seems to be quite more likely to have collisions in bigger strings. First I tested against "tt" I and came up with only 4 usable collisions. Adding another character gave me twice as much. I haven't really tested this though.The attackI decided to use AWS.Client to implement my attack on AWS.Server. Ironic, isn't it?The code is really simple. Using unbounded string as a buffer I generated a string containing all the post data I needed. And then I invoked the AWS.Client.Post function. The client code is quite fast (really, less than 1 second).Now the server code. I just implemented a hello world. Simply as that. It's actually a slightly changed version of the code listed in Gem #29 AdaCore have published. The changes where just to check if I was calling AWS.Client right, before I did the not-so-tricky part of generating the post data. Of course.The resultsI ran both client and server in a computer with AMD Athlon(tm) II X4 640 Processor and 4gB ram. The client being small I see no problem. :)As expected, the client kept my server using 100% of one core. It stayed that way until the process completion, which took well over 3 minutes.Firing up 5 client instances managed to get a DoS.Both brutal force, client and server codes have been forwarded to jesselang's email address who kindly will report back to Ada Core Technologies. With any luck we will be seeing a patch for this in the near
future.ConclusionIt was a really bad surprise finding any information about this issue online. I don't know if Ada Core has been working on it already of they have ignored it completely. Until there is a fix for this available, let's hope no one uses this to damage running systems. Even more astonishing is that the development community (with the exception of perl community) assumed plain Hash tables are great for everything. I've avoided it in the past for security reasons myself. After seeing anyone using hash table I decided to use it a lot.... and now I've been using Hash table myself to represent json data and key/value pairs from configuration files. Time to review all my code. :)
This is a question I get a lot. Actually, no. But if I did get that a lot this would be the answer. :DI got the idea of writing this from this post on the Learn Japanese with Tae Kim facebook group. I started learning this language when I was back in Brazil on May 2014. Almost two years now and I am still a beginner (even though I didn't really take this seriously back home).I first started by subscribing to the www.japanesepod101.com website. The content is ok, the method isn't that great, but it was more than enough to get me started.Now I am Living in Japan and, even though I learn a lot from my daily life, I felt like I needed a system to make my learning progress more effective. I wanna be fluent in less than 1 year from now so I can enjoy the most of the experiences I am having here and I figured out that every time I decided to work like "2 ours of Japanese study every day" I got bored really quickly or just gave up altogether. Because you know, "I only have 10 minutes before going to bed... so it is not the 2 hours I set myself to do".So, the system I came up with is to get myself into situations where I have to use Japanese. Whenever I receive a letter I try to read it (but usually I have a friend confirm the contents because I don't wanna get in trouble with the bank lol), I decided to avoid spending time with English speakers by not making new English speaker friends (I am not going to avoid my current friends, so I just try to meet Japanese people with no interest in English instead). I found out this system is making a huge difference on how fast I learn and how confident I am with using the little I know. So here it goes:Like most people here, I commute to work by train. When going to work I go trough Anki flash cards. The collection of cards changes from now and then, but at the moment I am focusing on phrases taken from the Human Japanese app - I really want to buy the app now, btw - and kanji from the weirdly good Kanji Damage site. I usually study from 100 to 200 cards every day and always in my way to work. If I leave it for when I am coming back, tired, I know I will not study.I usually go to lunch by myself and try to get into situations where I need to get by with the little I knowI go out with my Japanese friends and get into some activities that are 100% in Japanese. I think I really understand about 10% of that is said, but I usually can get the gist of what is going on. And whenever I realize some word I don't know is being used over and over again I go to jisho.org using my phone to look it
up. I am glad my Japanese friends are so patient and understanding with me.I listen to www.japanesepod101.com about 3 times a week. I usually do this before going to bed, while cooking or doing other boring task that keep my hands busy. And as soon as I can understand the conversation, even if I don't really know every single word to the heart, I move on to the next lesson because I know they will keep reusing most of those words anyway.After I adopted this system I started saying things I didn't really know the meaning (meaning I never studied that before), but I say them in the right way, the right context, and meaning exactly what I wanted to express. THIS is what it means to speak a language. If you are translating what you wanna say from your language to your target language back and forth then you are doing it wrong.And if you think that it doesn't work, the fact I can write this blog is enough proof of that I in fact it does work. I did basically the same with the English language after I got the verb to be covered and now I am fluent enough to work with native people in an environment where the understanding of English language is crucial.This was a long post, but I really hope it helps you with some ideas and get you motivated in your quest of learning whatever language you feel like learning now.See you in the next post.. or not - we both know it will be like 2 years until my next post, and by them we don't even know if Google will still be keeping blogger up and running.
Faz um tempao que nao posto; odeio ficar bolando ideias pra blog. Mas tem horas que me vem uma ideia ou historia que eu acho que vale a pena compartilhar.Pois bem, nessa semana a luz aqui de casa oscilou pra ca-ra-lho! Sem brincadeira, no dia do ocorrido minha maquina rebootou umas 30 vezes.BOM, quem ja e usuario de PC ja sabe o que esperar: sistema de arquivos corrompido, bad clusters escondidos no HD e coisas afim. Bom... nao se voce usa FreeBSD com ZFS.Nada daquelas mensagens gigantescas de "transaction replayed" de outros sistemas de arquivos. Nada de arquivo perdido. Nada de dor de cabeca! Sim, zero dor de cabeca.Essa coisa e mesmo um tanque de guerra. \\o/ I know I won't keep my word if I say I will keep this blog updated. Life happens, and I tend to be really busy. So I am doing something different this time.I am just going to write a small update on what is going on with my life.But wait... wtf, English?! This was supposed to be a blog written in Portuguese language! What the fuck?!Settle down, will ya?! So, as the title of the post says, I moved to Japan. This is a country far far away from Brazil (it takes about 30 long ours to get from Sao Paulo city to Tokyo) and in case you didn't know the language spoken here is . Exactly, if you don't know how to read what I just wrote then you get where I am going at.More and more foreigners come to Japan each and every year. But Japanese (or ni.ho.n.go in something called romaji - actually you don't use the dots in romaji; I added this so you get the cadence of the language) is a very different language. And the writing system is based on the Chinese writing system, which uses Kanji (). In case of the Japanese language they even added more... unh.... "complexity" with two new sets of characters (in fact this simplifies a lot our lives, because instead of having to learn 20000+ kanji you only need to learn about 1/10 of that to be fluent - or kinda fluent, I am not there yet so I don't really know).So yeah, Japanese is different. And you can't really read once you get out of your airplane (so, even using a dictionary can be difficult). So what do you do? Well, you meet some foreigners that have been here longer than you! They come from everywhere, having different native languages. But they all tend to have something in common: English as a 2nd language.So, here it goes. I am focusing now on writing in English about Japanese things until I really know enough Japanese to write in Japanese, if that ever happens.This got already too long and I am not going to proof read this anytime soon, so I am going to just stop... and move on to the next post (I kinda feel inspired today lol) Um ano e tra-la-la (ok, um ano e meio e tra-la-la) passado, decidi tirar po
do meu blog.O que aconteceu? Me formei, estou trabalhando como DevOp, voltei a morar em SP, fechei minha empresa.... ah, coisas e mais coisas.Decidi, com apoio da minha chefe, voltar a escrever aqui - se bem que eu nunca escrevi direito. Entao vamos la; alguma regrinhas que pretendo seguir.escrever primariamente em portugues (evitarei usar ingles, mas vez ou outra nao tera jeito)publicar exclusivamente sobre tecnologias que eu domino ate certo nivel (por mais tentador que seja, evitarei publicar sobre boatos)criar posts com alguma frequenciaEntao... po tirado, sobre o q vou escrever agora?
Disciplina na IgrejaIntroducaoNossas igrejas estao sempre tendo problemas relacionados a disciplina de membros. Se a igreja e fiel e biblica ao disciplinar, ha a necessidade de que todos os membros compreendam as bases biblicas para tanto; se a igreja e falha, e necessario que todos se conscientizem das razoes dadas pelas Escrituras para a aplicacao da disciplina e dos perigos e consequencias de negligencia-la. Esse e, portanto, um tema sempre relevante. Nao se trata de um caminho opcional para a administracao da igreja, mas de uma trilha necessaria, que deve ser entendida, acatada, apoiada e aplicada, para que tenhamos saude espiritual em nosso meio.O exercicio da disciplina na igreja e algo tao importante que o reformador Joao Calvino a considerou, ao lado da proclamacao da Palavra e da administracao dos sacramentos, uma das marcas que distinguem a igreja verdadeira da falsa. Ou seja, na igreja falsa nao somente esta ausente a pregacao das inspiradas Escrituras e os sacramentos sao antibiblicos, ou incorretamente administrados, mas ela e negligente, tambem, na preservacao de sua pureza moral e doutrinaria. A igreja, as vezes, nao segue os passos e objetivos de disciplina eclesiastica delineados na Palavra de Deus. Quando negligencia essa area, passa a abrir mao da identidade peculiar dos seus membros, perante o mundo. O resultado e que a autoridade na pregacao e o testemunho do Evangelho ficam prejudicados.Nao queremos desenvolver um espirito de censura gratuita, no qual enxerguemos sempre o argueiro no olho do irmao antes da trave que esta no nosso. Mas precisamos despertar um senso de comportamento biblico que faca justica ao nome de Cristo e que nao envergonhe o Evangelho. Isso comeca com o cuidado sobre a nossa propria vida e deve se estender pela nossa igreja local.A disciplina, exercida com amor, pelas razoes especificadas na Biblia e com os objetivos que ela prescreve, deve ser exercida na esfera pessoal e apoiada e compreendida quando ja estiver na esfera do Conselho da Igreja, ou de outras autoridades superiores.Queremos examinar alguns textos biblicos que se relacionam com a disciplina na igreja. Alguns outros tratam igualmente desse assunto, mas os que apresentaremos sao fundamentais a nossa compreensao. Com o seu exame, oramos para que sejamos despertados ao apreco da pureza tanto do individuo como da igreja visivel.1. O perigo da falta de disciplinaPaulo, escrevendo a igreja da Corinto (1 Co 5.1-13), alerta para os perigosque sobrevem quando se e negligente na aplicacao da disciplina. Nesse trecho lemos:Geralmente, se ouve que ha entre vos imoralidade e imoralidadetal, como nem mesmo entre os gentios, isto e, haver quem seatreva a possuir a mulher de seu proprio pai.E, contudo, andais vos ensoberbecidos e nao chegastes a lamentar, para que fosse tirado do vosso meio quem tamanho ultraje praticou?Eu, na verdade, ainda que ausente em pessoa, mas presente em espirito, ja sentenciei, como se estivesse presente, que o autor de tal infamia seja,em nome do Senhor Jesus, reunidos vos e o meu espirito, com o poder de Jesus, nosso Senhor,entregue a Satanas para a destruicao da carne, a fim de que o espirito seja salvo no Dia
do Senhor Jesus.Nao e boa a vossa jactancia. Nao sabeis que um pouco de fermento leveda a massa toda?Lancai fora o velho fermento, para que sejais nova massa, comosois, de fato, sem fermento. Pois tambem Cristo, nosso Cordeiropascal, foi imolado.Por isso, celebremos a festa nao com o velho fermento, nem com o fermento da maldade e da malicia, e sim com os asmos da sinceridade e da verdade.Ja em carta vos escrevi que nao vos associasseis com os impuros;refiro-me, com isto, nao propriamente aos impuros deste mundo, ou aos avarentos, ou roubadores, ou idolatras; pois, neste caso, terieis de sair do mundo.Mas, agora, vos escrevo que nao vos associeis com alguem que, dizendo-se irmao, for impuro, ou avarento, ou idolatra, ou maldizente, ou beberrao, ou roubador; com esse tal, nem ainda comais.Pois com que direito haveria eu de julgar os de fora? Nao julgais vos os de dentro?Os de fora, porem, Deus os julgara. Expulsai, pois, de entre vos o malfeitor.Notem, no trecho, os seguintes pontos que o Espirito Santo fez registrar para a nossa instrucao:a. O pecado na igreja entra em choque com o seu carater santo, mas ele ocorre.Nao e negando a realidade de sua existencia que resolvemos o problema. No versiculo 1, ele diz: "...ha entre vos imoralidade e imoralidade tal, como nem mesmo entre os gentios...". Ou seja, o que estava ocorrendo naquela igreja chocaria ate os descrentes, mesmo com sua visao dissoluta.b. Muitos pecados atingem um estagio publico e notorio . Esse mesmo versiculo 1 comeca com as palavras: "Geralmente, se ouve que ha entre vos...". A questao nao era privada, de mais facil resolucao e aconselhamento, mas ja se espalhara, chegando ate ao conhecimento de Paulo, que se encontrava distante.c. Acomodacao e orgulho. A falta de acao revelava acomodacao da consciencia individual e coletiva ao pecado, em forma de rebeldia e soberba. No versiculo 2, Paulo se espanta que aqueles irmaos "... nao chegaram a lamentar" toda aquela demonstracao de vida em pecado. Paulo diz ainda que eles se achavam"ensoberbecidos", ou seja, se orgulhavam da postura tomada em vez de estarem conscientes do mal que era causado ao testemunho do Evangelho. Ainda sobre a ausencia de disciplina naquela igreja Paulo diz: "... nao e boa a vossa jactancia..."(v.6). Eles nada haviam feito, portanto, para "... tirar do meio" o que havia praticado aquilo que o proprio Paulo chama "ultraje" e "infamia" (v.3). Quando a disciplina nao e exercida, nossas consciencias vao sendo cauterizadas e conformamo-nos ao modo de comportamento do mundo e, tambem, deixamos de nos chocar, de identificar o contraste com a forma de vida prescrita para o servo de Deus. Paulo ensina que a acao correta era a exclusao daquele membro (v. 5) - ele deveria ser "entregue a Satanas", ou ser considerado como descrente, pois o seu modo de vida nao testemunhava uma conversao verdadeira. Estaria, portanto, sob o dominio de Satanas. Essa constatacao nao era para ser feita individualmente, mas corporativamente, pela autoridade e no poder de Cristo. No versiculo 4 ele escreve: "...em nome do Senhor Jesus, reunidos vos e o