2013年11月13日 星期三

電腦病毒襲國際太空站

蘋果日報

俄羅斯保安專家卡巴斯基(Eugene Kaspersky)透露,因為一名俄羅斯太空人使用的USB記憶棒含有病毒,令國際太空站(圖)的電腦系統被蠕蟲病毒Stuxnet入侵,但他無談及病毒是否影響太空站運作。他指出,雖然太空站沒連接到互聯網,但因為站內的監控和數據採集(SCADA)系統由Linux平台運作,病毒可輕易入侵。他又透露,不時都收到有關太空站出現「病毒傳播」的消息。

美研發Stuxnet破壞伊朗核設施

外界普遍認為Stuxnet是由美國及以色列政府研發,目的是令伊朗納坦茲濃縮鈾設施運作受影響,令提煉濃縮鈾的離心機失控,破壞伊朗發展核武。卡巴斯基表示,研發類似Stuxnet的蠕蟲病毒過程非常複雜,成本高達1,000萬美元(7,800萬港元)。

美國《國際財經時報》

2013年10月29日 星期二

滲透系統 關閉兩天 黑客襲以色列隧道

蘋果日報

以色列一個重要公路隧道系統上月遭黑客成功滲透,連續兩日要一度關閉,其中一天更關閉長達八小時,造成嚴重交通擠塞,經濟損失達到數以10萬美元(數以 78萬港元)計,但相信攻擊並非由敵對國家政府發動。
卡爾邁勒隧道(Carmel Tunnels圖)收費道路系統,是以色列第三大城市海法(Haifa)的主要道路網,該市甚至考慮在發生緊急事故時,讓公眾到隧道內避難。
但保安專家披露,上月8日,有黑客用木馬程式向隧道保安攝錄系統發動襲擊,令隧道網關閉20分鐘;翌日早上繁忙時段,黑客再出擊,更令系統關閉長達八小時。該專家要求身份保密,因事件屬機密資料。
專家指,調查人員認為襲擊水平未到敵對國家如伊朗政府黑客水準,而是類似「無名氏」(Anonymous)黑客組織所為,又指國家網絡局知悉事件。
但該局對記者的查詢拒絕評論。隧道管理公司則否認遇襲,指關閉是因電腦故障。

系統自動化 脆弱易受襲

以色列常遭黑客襲擊,官員承認政府網站有時一天會受到數以千次襲擊,這次隧道系統遇襲,是該國歷來受襲的最知名地標。有國際保安專家形容這類襲擊是「新世 代標記」,「這類系統大都是自動化,因此脆弱易受襲」。
美聯社

2013年10月5日 星期六

Adobe290萬戶被黑 港人私隱恐洩

文匯報

美國軟件公司Adobe前日表示系統被黑客入侵,全球290萬名用戶資料被盜,包括姓名、登入名稱、加密密碼 和信用卡號碼,另有多個受歡迎軟件的原始碼外洩。公司已為受影響用戶重置密碼,通知用戶更新程式,並與多間銀行和執法部門合作保障用戶賬戶免遭入侵。報道 指,香港用戶資料也可能被盜。

 Adobe網絡專家兩周前發現,PDF文書軟件Adobe Acrobat和開立網頁的電腦程式ColdFusion和ColdFusion Builder的原始碼被盜,已解密的信用卡和提款卡號碼則沒被盜。有保安專家擔心,黑客盜取多個軟件原始碼後,可發動新一輪難以追查的網絡攻擊,入侵所有相關軟件用戶的電腦。Adobe表示未有證據顯示用戶被攻擊的風險上升。  

■路透社

2013年9月15日 星期日

黑客扮維修員 銀行裝遙控器謀偷錢

文匯報

英國警方偵破嚴重科技騙案,有匪徒假扮維修員潛入倫敦東南部一間桑坦德銀行分行,暗中在一部電腦安裝市值10 英鎊(約123港元)的KVM(鍵盤、屏幕及滑鼠)切換器,企圖遙距入侵銀行網絡偷錢,幸有人及時發現並關掉遙控器。當局上周四拘捕12名男疑犯,其中4 人被控串謀爆竊罪,案件昨日提堂。桑坦德銀行指無職員涉案。

 當地有不少公司安裝這款遙控器,可讓多人在數千公里外控制同一部電腦。匪徒在電腦背面安裝遙控器,可透過互聯網傳送電腦所有資料,遙距控制銀行電腦。科技罪案組探員雷蒙德指,匪徒犯案手法精密,銀行可能一下子損失數百萬英鎊。不過亦有互聯網安全專家指,即使匪徒成功入侵和控制銀行系統,取得敏感資料前,仍要破解多種保安關卡,才能從系統偷錢。 

 疑犯介乎23至50歲,來自英國、印度、葡萄牙、伊拉克和伊朗。當局在6處地方搜出多部電腦和大量犯案裝備,將交由專家檢驗。 

■《每日鏡報》/《每日郵報》/綜合外電消息

2013年9月13日 星期五

40萬危害軟件襲Android

蘋果日報

【本報訊】智能手機功能多,使其成為黑客最新「戰場」。網絡保安公司指,今年1月錄得17萬種針對Android的危害軟件,7月已跳升至逾40萬種,近半夾雜間諜軟件和廣告軟件等,惟用戶防範意識不高,個人及企業用戶的資料隨時被盜。

F-secure保安實驗室經理吳樹謙表示,Android智能手機系統是主要攻擊目標,其中版本較舊的Gingerbread2.3.3至2.3.7的入侵比率達36.4%,ICS4.0.3至4.0.4有25.6%,最新版本的Jelly bean4.2.1則只有4%。

香港電腦保安事故協調中心今年7月開始,對香港地區Google Play商店可下載的應用程式,進行惡意及可疑行為檢測,8月份對184個程式的檢測當中,發現六款高風險程式,其中三款至8月20日仍然在架。蘋果的 iOS系統也不一定與危害軟件絕緣,F-secure發現,過去半年其病毒種子已由1月份只有兩個,累計至6月已有33個。

2013年9月11日 星期三

Google地圖升呢 室內都睇埋

蘋果日報

【本報訊】港版Google地圖「升呢」推出四項新功能,用戶可利用「地圖製作工具」修改地圖或新增地標,通過審核便可加入地圖。Google首次利用衞星圖片及街景圖,繪製香港地圖,如原本只顯示一片綠色的維園,現可仔細看見園內小路。Google會為拍到的面孔「打格」,免侵私隱。
記者:袁樂婷

Indoor Maps加添商場平面圖

港版Google地圖本只支援街道圖,新推的Indoor Maps室內地圖創新加港澳逾70個地點的室內平面圖,包括香港國際機場、九龍香格里拉酒店、山頂凌霄閣、海港城及時代廣場。用戶只需拉大地圖,便可自動 轉換至平面圖(圖),再透過右側的樓層切換工具,可瀏覽不同樓層。平面圖除顯示商舖,亦有自動櫃員機、洗手間及升降機等。

Indoor Maps已在16個地區推出,香港是繼日本及新加坡後,第3個引入的亞洲城市。Google香港銷售總監張蔓詩笑指,大型商場範圍太大,要找特定商戶不容易,甚至會迷路,「依家入到商場唔使再周圍搵directory(商場指南)」。

2013年8月9日 星期五

瀏覽器保安漏洞 Chrome儲密碼不保密

蘋果日報

Google瀏覽器Chrome被揭發存在保安漏洞。Chrome容許用戶儲存不同網站的登入密碼,省卻每次瀏覽都重複輸入一次密碼的功夫,但軟件工程師肯伯(Elliot Kember)發現,只要數個步驟,任何人都可以看到用戶儲存在Chrome的密碼。
肯伯表示,只要在Chrome主欄目,由「選項」和「進階設定」中,點選幾項設置,再按下「管理系統儲存的密碼」,用戶儲存了密碼的網頁就會在清單中出現,再按下顯示密碼就會以文字顯示出來,密碼不再是密碼。

關密碼儲存功能防洩密

如果用戶要與別人共用一部電腦,或在公司使用的電腦卻沒有設定上鎖密碼,其他人就能得到用戶儲存的網站密碼,例如銀行網頁或電郵密碼。肯伯表示,要解決這個問題,只好關閉Chrome預設的密碼儲存功能。
肯伯批評Google這個漏洞「極愚蠢」,Chrome只要提供「主密碼」(master password)設置,每次瀏覽儲存了密碼的網頁時必須輸入「主密碼」驗證,就能堵塞這個漏洞。

美國哥倫比亞廣播公司

熄WiFi照追蹤定位 Android系統涉侵私隱

文匯報

科技網站Android Police發現,互聯網巨擘Google最新推出的Android 4.3流動作業系統,具有「Scanning always available」功能,即使用家關掉WiFi網絡,作業系統仍可自動掃描網絡,追蹤用家位置,私隱問題引起關注。

 根據Google指,該功能用於改善定位的準確性和其他用途。透過確認附近的WiFi網絡,流動裝置能確定用家位置,作用類似全球定位系統(GPS)。掃描所得的位置和其他資料,Google及其他安裝於流動裝置內的應用程式(app)都可分享。 

■《每日郵報》

蘋果日報

今季Google正式推出Android4.3操作系統,被發現即使關閉了wifi功能,電話仍會尋找網絡和追蹤用家位置,引起不少用家擔心行蹤被洩露。記者:梁海威

我們使用一部已升級至Android4.3的Nexus7作測試,證實就算關上wifi,同樣能進行定位。其實用家可自行關閉此功能,只要於wifi設定裡,把「一律執行掃描」此選項關上,便可停止這個「被追蹤」的功能。

Google就回應指,由於不少App都需要確定用家位置,用wifi定位比GPS省電,才會有此設定。至於會否好像斯諾登聲稱,有組織靜悄悄地追蹤全球用戶,便沒法證實了。 

2013年7月28日 星期日

六色帽子 分辨各路黑客

蘋果日報

黑客人多勢眾又良莠不齊,就如魔法故事裏的巫師世界,因應黑客的品性和專長分成很多種類,黑帽黑客是奸惡罪犯、白帽黑客代表光明磊落的專家。道不同 有時也會走在一起,即將於美國召開的「黑帽大會」雖名為黑帽,但出席的不一定全是壞蛋,紅白藍灰綠各路黑客都會參與交流一番。

黑帽 奸惡罪犯

黑客界的壞人,非法入侵網絡盜取個人資料,為了金錢或純粹惡意搞破壞,屬電腦罪犯

白帽 道德專家

受聘於某公司專門測試網絡系統是否安全,或受聘於保安公司設計保安軟件,是道德黑客

灰帽 黑白之間

介乎黑帽與白帽之間,愛非法入侵網絡但沒有惡意,有時只為提醒該公司注意安全漏洞,事後會主動通知,收取象徵式費用後負責修復系統

紅帽 邀進分子

白帽黑客的「激進版」,多數受聘於政府部門,專門入侵其他政府的電腦主機網絡,癱瘓系統

藍帽 貪玩報復

通常不受僱於電腦保安公司,為了貪玩或者報復,針對特定人士或公司而入侵網絡。相對較被動,除非被招惹激怒,否則多數不會主動出手

綠帽 聽話新手

綠帽是黑客界的「菜鳥」,多數指缺乏經驗、技巧生澀的新手,他們熱衷學習,肯聽命於有經驗的黑客

2013年6月23日 星期日

Open Source Workshop #15 開源工作坊 (2013/07/06)

下一次 Open Source Hong Kong 和 HKLUG 合辦的開源工作坊,訂於 7 月 6 日 (星期六) 在城大舉行。

今 次除了新鮮開源消息分享外,你也可以跟我們一起透過連場 Lightning Talks 閃電講, 五分鐘內講解你的 open source projects, 程式開發, 用家經驗或 idea 等等,讓大家了解和學習不同 open source projects ,繼而在緊接的 Hacking / Discussion Session 進行有關實作或討論。

第 15 次開源工作坊 (2013年7月)

日期: 2013 年 7 月 6 日 (星期六)
時間: 14:30 - 17:45
地點: 香港城市大學一號教學樓 5/F Y5-203 課室。
報名: http://opensourcehk201307.eventbrite.hk/
聯絡: Sammy Fung sammy@opensource.hk

Agenda
  1. Open Source News & Updates.
  2. Lightning Talks - your open source project ideas / updates
  3. Open discussion and hacking session.
Lightning Talks
  • Sammy Fung - hk0weather open source weather data project
  • Wan Leung Wong - Raspberry Pi
  • Pockey Lam - Digital Freedom Foundation (DFF) (10 min)
  • 你也告訴我們你的題目吧
特別鳴謝: 香港城市大學電腦系. (場地提供)

(English)

Next Open Source Workshop co-organized by Open Source Hong Kong and HKLUG, will be hosted again at CityU in 2013/7/6 Saturday.

Open Source news updates will be shared by co-organizers.

At lightning talk session, you can demostrate or express your open source projects, user experiences, and brainstom ideas to others in 5 minutes, then we will form some hacking / discussion groups to continue  works or discussions on your topics after lightning talks.

Open
Source Workshop #15 (2013 July)


Date: 6 July 2013, Saturday
Time: 14:30 - 17:45
Venue: Classroom Y5-203, Academic 1, City University of Hong Kong, Tat Chee Road, Kowloon Tong.
RSVP: http://opensourcehk201307.eventbrite.hk/
Contact: Sammy Fung sammy@opensource.hk

Agenda
  1. Open Source News & Updates.
  2. Lightning Talks - your open source project ideas / updates
  3. Open discussion and hacking session.
Lightning Talks
  • Sammy Fung - hk0weather open source weather data project
  • Wan Leung Wong - Raspberry Pi
  • Pockey Lam - Digital Freedom Foundation (DFF) (10 min)
  • Tell us your topics if you got any.
Special Thanks: Department of Computer Science, City University of Hong Kong (Venue Provider)

--
Yours Sincerely,
Sammy Fung
Community Manager
Open Source Hong Kong
http://opensource.hk

2013年5月24日 星期五

Open Source Workshop #14 (2013/6/1)

開源工作坊 #14 (2013年6月)
日期: 2013 年 6 月 1 日 (六)
時間: 下午 2:30-5:45 (最早可在 2pm 到場)
地點: 香港城市大學一號教學樓 5/F Y5-303 課室
請到 http://registrano.com/events/01332d 登記

議程:
* Open Source News & Updates by sammyfung and haggen.
* Introduction of Mozilla Webmaker and Firefox OS by sammyfung.
* Kernel-based Virtual Machine (KVM) talk by wanleung.
* Open discussion and hacking session.

語言: 廣東話
(除了英語講者以英語演講外)

人數: 40.

主辦:
* Hong Kong Linux User Group.
* Mozilla Hong Kong Community.
* Open Source Hong Kong.

(English)
Next workshop will be hosted on June 1st at CityU.
Open Source Workshop #14 (June 2013)
Date: 1 June 2013 (Saturday)
Time: 2:30-5:45pm (door open at 2pm)
Venue: Classroom Y5-303, 5/F Academic 1, City University of Hong Kong, Tat Chee Road, Kowloon Tong.
Please RSVP at http://registrano.com/events/01332d

Agenda:
* Open Source News & Updates by sammyfung and haggen.
* Introduction of Mozilla Webmaker and Firefox OS by sammyfung.
* Kernel-based Virtual Machine (KVM) talk by wanleung.
* Open discussion and hacking session.

Language: Cantonese
(except English for English speakers if any)

Capacity: 40.

Organizers:
* Hong Kong Linux User Group.
* Mozilla Hong Kong Community.
* Open Source Hong Kong.





--
Yours Sincerely,
Sammy Fung
Community Manager
Open Source Hong Kong
http://opensource.hk

2013年5月17日 星期五

Skype with care – Microsoft is reading everything you write

www.h-online.com

Anyone who uses Skype has consented to the company reading everything they write. The H's associates in Germany at heise Security have now discovered that the Microsoft subsidiary does in fact make use of this privilege in practice. Shortly after sending HTTPS URLs over the instant messaging service, those URLs receive an unannounced visit from Microsoft HQ in Redmond.

A reader informed heise Security that he had observed some unusual network traffic following a Skype instant messaging conversation. The server indicated a potential replay attack. It turned out that an IP address which traced back to Microsoft had accessed the HTTPS URLs previously transmitted over Skype. Heise Security then reproduced the events by sending two test HTTPS URLs, one containing login information and one pointing to a private cloud-based file-sharing service. A few hours after their Skype messages, they observed the following in the server log:
65.52.100.214 - - [30/Apr/2013:19:28:32 +0200]
"HEAD /.../login.html?user=tbtest&password=geheim HTTP/1.1"
 
They too had received visits to each of the HTTPS URLs transmitted
over Skype from an IP address registered to Microsoft in Redmond. URLs
pointing to encrypted web pages frequently contain unique session data
or other confidential information. HTTP URLs, by contrast, were not
accessed. In visiting these pages, Microsoft made use of both the login
information and the specially created URL for a private cloud-based
file-sharing service.
In response to an enquiry from heise Security, Skype referred them to a passage from its data protection policy:
"Skype may use automated scanning within Instant Messages and SMS to (a) identify suspected spam and/or (b) identify URLs that have been previously flagged as spam, fraud, or phishing links."
A spokesman for the company confirmed that it scans messages to filter out spam and phishing websites. This explanation does not appear to fit the facts, however. Spam and phishing sites are not usually found on HTTPS pages. By contrast, Skype leaves the more commonly affected HTTP URLs, containing no information on ownership, untouched. Skype also sends head requests which merely fetches administrative information relating to the server. To check a site for spam or phishing, Skype would need to examine its content.
Back in January, civil rights groups sent an open letter to Microsoft questioning the security of Skype communication since the takeover. The groups behind the letter, which included the Electronic Frontier Foundation and Reporters without Borders expressed concern that the restructuring resulting from the takeover meant that Skype would have to comply with US laws on eavesdropping and would therefore have to permit government agencies and secret services to access Skype communications.
In summary, The H and heise Security believe that, having consented to Microsoft using all data transmitted over the service pretty much however it likes, all Skype users should assume that this will actually happen and that the company is not going to reveal what exactly it gets up to with this data.
 

2013年5月12日 星期日

International Space Station to boldly go with Linux over Windows

www.telegraph.co.uk

Computers aboard the International Space Station are to be switched from Windows XP to the Linux operating system in an attempt to improve stability and reliability. 

Dozens of laptops on the ISS's 'opsLAN' network - which provides the ship's crew with vital capabilities for day-to-day operations, from telling the astronauts where they are to interfacing with onboard cameras - will be switched, removing Windows entirely from the ISS.
“We migrated key functions from Windows to Linux because we needed an operating system that was stable and reliable – one that would give us in-house control. So if we needed to patch, adjust or adapt, we could," said Keith Chuvala of the United Space Alliance, which runs opsLAN for NASA.
Astronauts using the system were trained on specific courses tailored by the non-profit Linux Foundation.
Linux is already used to run various systems aboard the ISS, including the world's first 'Robonaut', sent to the Space Station in 2011. 'R2' can be manipulated by astronauts as well as ground controllers and is designed to carry out tasks "too dangerous or mundane" for astronauts in microgravity, according to the Linux Foundation.
Tailored versions of Linux are widely used in scientific projects, including CERN’s Large Hadron Collider.

“Linux Foundation had it all, and provided the trainer on-site at our headquarters, which was a huge plus,” said Chuvala. “On top of that, the cost was very good, so it was overall a great value.”
The ISS computers were previously infected by a virus while running Windows. In 2008 the W32.Gammima.AG worm was found aboard, having reportedly been carried on a Russian astronaut's laptop. The Windows-based worm was classed as low risk by anti-virus software manufacturer Symantec.
Reports from Russian officials today reveal that the ISS is suffering a "very serious" ammonia leak that may require astronauts to perform an emergency spacewalk

 

2013年4月28日 星期日

Open Source Workshop #13 (2013/5/4)

下個 HKLUG 和 OSHK 合辦的開源工作坊將於 5 月 4 日城大舉行,建議主題是 Web,歡迎交題目來分享任何 Open Source 有關的講題作 talk 或 workshop 等。

第 13 次開源工作坊 (2013年5月)

日期: 2013 年 5 月 4 日 (星期六)
時間: 14:30 - 17:45
地點: 香港城市大學一號教學樓 5/F Y5-205 課室。
報名: http://registrano.com/events/508972
Facebok 報名 (OSHK): https://www.facebook.com/events/280182835446159/
聯絡: Sammy Fung sammy@opensource.hk

程序:
14:00 Reception, Networking
14:30 Talks
- Opening by Sammy Fung.
- Joomla by Simon Ball.
- What's happening at Open Source Hackfest by Mathieu Bridon.
- And more, let tell us if u got anything would like to share.
16:00 Break
16:15 Workshop (Open Source Hackfest)
17:45 End


特別鳴謝: 香港城市大學電腦系. (場地提供)

台灣開源人年會 2013 海外徵稿和第一輪 keynote 講者公佈

(Keynote: 政委張善政,Greg Kroah-Hartman)

COSCUP 全稱為 Conference for Open Source Coders, Users and Promoters,COSCUP 是台灣最大型開放源碼年會,今年預期 1,800 人出席。

COSCUP 2013 將移師到更大場地的台灣國際會議中心 (TICC),2013/8/3-4 舉行。

話說今年台灣開源人年會 COSCUP 主題之一 OpenData,其中扮演相當重要的角色 — 當然就是政府囉!

而今年我們非常興奮的邀請到曾任 Google 亞太營運總監,數年來擔任政府雲端技術以及 OpenData 的推手 — 張善政行政院政務委員擔任 Keynote 講者!

另外,台灣開源人年會 COSCUP 辦得那麼龐大,聚集台灣本土超過 20 個社群,甚至香港、日本、大陸社群去出席,號稱開源「社群大拜拜」。

COSCUP 這個開源社群大拜拜要拜什麼呢?當然是「拜大神」了!

今年 COSCUP 邀請到了 Linux Kernel 「第一位交椅」- Linux Kernel stable branch maintainer、知名 Linux Kernel 開發者 Greg Kroah-Hartman 來台演講!

Greg Kroah-Hartman 是 Linux Kernel 相當多組件的維護者包括 Linux Kernel stable branch,USB, sysfs 等等,更撰寫了現在每個 Linux 使用者每天都會用到 udev 裝置管理系統!他亦是 Linus Torvalds 之外, 另一位 Linux Foundation 負責全職 Linux Kernel 開發的 Fellows。

OpenData 的開發者們怎麼能錯過跟政府直接交流的機會呢?跟大神一起在 COSCUP 演講的機會?趕快來投稿 COSCUP 吧! (5/3 截止)
你可以用英語、國語、甚至廣東話也可以.

香港朋友除左可向大會查詢外,還可以聯絡我 (Sammy Fung),我是今年 COSCUP 議程組成員之一。
http://coscup.org/2013
(English)

Hi,

Next Open Source Workshop co-organized by HKLUG and OSHK will be hosted again at CityU in 2013/5/4 Saturday. Suggested theme is Web, you are welcome to submit any open source related topics for talk or workshop, etc.

Open Source Workshop #13 (2013 May)

Date: 4 May 2013 Saturday
Time: 14:30 - 17:45
Venue: Classroom Y5-205, Academic 1, City University of Hong Kong, Tat Chee Road, Kowloon Tong.
RSVP: http://registrano.com/events/508972
Facebok RSVP (OSHK): https://www.facebook.com/events/280182835446159/
Contact: Sammy Fung sammy@opensource.hk

Agenda
14:00 Reception, Networking
14:30 Talks
16:00 Break
16:15 Workshop
17:45 End

Special Thanks: Department of Computer Science, City University of Hong Kong (Venue Provider)

--
Yours Sincerely,
Sammy Fung
Community Manager
Open Source Hong Kong
http://opensource.hk

2013年4月19日 星期五

Alert- US House of Representatives Passes CISPA Cybersecurity Bill

silverdoctors.com

The US House of Representatives has passed the controversial Cyber Intelligence Sharing and Protect Act (CISPA).
Lawmakers in the House voted 288-to-127 Thursday afternoon to accept the bill. Next it will move to the Senate and could then end up on the desk of US President Barack Obama for him to potentially sign the bill into law.

2013年4月7日 星期日

[ITFest] 自由及開源軟件在香港研討會 Seminar on Free and Open Source Software in Hong Kong

在香港,不論是個人或團體,
都有不少透過使用自由及開源軟件獲益的故事。藉著今次「國際IT匯」,香港Linux用家協會請了來自出版、資訊科技、長者服務和中學教育等的專業人士,分享他們參與自由及開源軟件的經驗。
 
自由及開源軟件在香港研討會
日期: 2013年4月20日(星期六)
時間: 下午3:00-6:00
地點: 九龍塘達之路,香港城巿大學,教學大樓四樓,LT-15演講廳
語言:廣東話 (部份附英文演示片)
聯絡人: 蘇孝恆博士 / info@linux.org.hk
參加者必須在 http://registrano.com/events/hklugitfest2013/ 登記。
議程內容:
  • 主辦單位致開幕詞
  • 立法會議員 (資訊科技界) 莫乃光致開幕詞
  • LinuxPilot – 亞洲唯一的中文Linux期刊 (麥經倫先生)
  • 開源軟件如何在香港協助推廣開放資料 (馮振華先生)
  • 開源硬件與教育 - Raspberry Pi和三維印刷 3D Printing (梁志宏老師)
  • 自由及開源軟件與長者 (梁敬文先生)
活動主辦:香港 Linux 用家協會 (HKLUG)
場地贊助及提供:香港城市大學電腦系
(English)
Different individuals and organisations in Hong Kong are enjoying the benefits of Free and Open Source Software. In the Hong Kong International IT Fest, professionals from area of publishing, information technology, elderly service and secondary education will share own experiences in Free and Open Source Software.Seminar on Free and Open Source Software in Hong Kong
Date: 20 April 2013(Sat)
Time: 3-6pm
Venue: LT-15, 4/F. Academic Building 1, City University of Hong Kong, Tat Chee Avenue, Kowloon Tong.
Language: Cantonese (English may be used in some slides)
Contact: Dr. Haggen So / info@linux.org.hk
Registration is required. Please register at http://registrano.com/events/hklugitfest2013/ .
Programme:
  • Opening by Organizer
  • Opening Remarks by Legislative Council member (ITFC) Hon. Charles Mok.
  • LinuxPilot – the Chinese Linux Magazine (Mr. Kenneth Mak)
  • How does Open Source Software helps Open Data in Hong Kong (Mr. Sammy Fung)
  • Open Hardware and Education - Raspberry Pi and 3D Printer (Mr. Parker Leung)
  • Free and Open Source Software and Elders (Mr. Kingman Leung)
This event is organized by the Hong Kong Linux User Group (HKLUG).
Venue is sponsored and supplied by the Department of Computer Science, City University Hong Kong.
--
Yours Sincerely,
Sammy Fung
Community Manager
Open Source Hong Kong
http://opensource.hk

2013年4月2日 星期二

Raspberry Pi 工作坊 (2013.04.06 PolyU)

*** 本活動名額有額,必需經由 Registrano 報名。 ***
報名表格:http://registrano.com/events/32be70
*** 優先接納中學生報名 ***


Raspberry Pi 工作坊
日期2013 年 4 月 6 日 ( 星期六 )
時間下午 2:00-5:00
地點香港九龍紅磡,理工大學六樓,CD634
語言:廣東話 ( 部份附英文演示片 )
內容:
  • 什麼是Raspberry Pi?
  • 如何使用 Raspberry Pi 學習
  • Raspberry Pi 電子實驗習作 (以小組進行)
報名程序:
  • 先經 Registrano 表格報名,等待主辦單位人手接納報名。
  • 中學生將被優先接納。
報名表格http://registrano.com/events/32be70

人數:20 人
主辦單位:香港 Linux 用家協會
場地贊助及提供:香港理工大學電子及資訊工程學系
協助單位:Open Source Hong Kong
(English)
This is a workshop conducted in Cantonese. Local secondary school students are primary targeted participants in this workshop, and they will have first priority to get a seat after registration.
Raspberry Pi Workshop
Date: 2013.4.6 Saturday
Time: 2:00-5:00 pm
Venue: PolyU
Language: Cantonese
Program:
  • What is Raspberry Pi?
  • How to learn with Raspberry Pi ?
  • Practical Raspberry Pi workshop (in groups)
Registration Procedure:
  • Register thru Registrano is a must, and wait for confirmation / reply from organizer.
  • Students of local secondary school will be accepted in first priority.
Registration Form: http://registrano.com/events/32be70

Capacity: 20
Organizor: Hong Kong Linux User Gruop (HKLUG)
Venue Sponsor and Provder: Department of Electronic and Information Engineering, Hong Kong Polytechic University.
Supporting Organisation: Open Source Hong Kong
--
Yours Sincerely,
Sammy Fung
Community Manager
Open Source Hong Kong
http://opensource.hk

2013年3月7日 星期四

太混賬 政府踢走iProA

蘋果日報

【本報訊】獲政府撥款逾億元推行上網學習支援計劃的「信息共融基金會」,因推行計劃以來管理混亂及向政府提供失實資料,近日被政府罕有地以違反撥款和營運 協議為由,宣佈將於今年5月中解約。基金會原本由小童群益會及唐營的互聯網專業協會(iProA)合組。政府現要求小童群益會接手「爛攤子」。

點名暗批前會長

本報取得一封由政府資訊科技總監賴錫璋於上月19日發給信息共融基金會署理主席鍾志平的信件,力數基金會四宗罪,包括至今仍未提交去年11月至今年4月的 工作計劃書,交代推行上網學習支援計劃的人手與開支;至今無法確保上網學習支援計劃使用一個獨立於iProA的銀行戶口。

信 中又形容,信息共融基金會由去年11月底至今年2月初,先後七次向政府提供不盡不實的資料,並點名暗批基金會前會長鄧淑明,包括指鄧去年7月去信政府聲稱 已使用獨立銀行戶口,但事實並非如此;又指鄧去年12月曾去信政府聲稱已有嚴格措施去核實開支,但同樣事不符實。所以決定根據合約條款於今年5月19日終 止合約。

據了解,政府已委託小童群益會繼續執行在香港東推行上網學習支援計劃,並向立法會資訊科技及廣播事務委員會滙報事件。

資訊科技總監辦公室回覆表示,鑑於小童群益會一直參與上網學習支援計劃,相信由小童群益會繼續兼負項目對受眾影響最細,故不打算將計劃的香港東部份重新招標,現時信息共融基金會已展開上網計劃交接程序,細節稍後公怖。

小童群益會總幹事羅淑君回覆稱,會繼續執行上網學習支援計劃,並密切留意有關發展。
信 息共融基金會由iProA與小童群益會合組,於2011至12年度獲政府撥款2,980萬元,按合約要求,執行機構獲撥款後,要立即開設獨立銀行帳戶。現 任iProA會長洪為民昨回應時推說,他於去年5月才上任,「iProA一年才開四次會,5月開董事大會時,冇人喺agenda加入要開銀行 account。」

信息共融基金會則稱,去年底已決定由小童群益會全面執行上網計劃,iProA已不再參與前線服務,反指政府終止合約是多此一舉,又稱政府未能提供受眾資料,令推行計劃遇到很大困難。

被政府暗批的信息共融基金會前會長鄧淑明(圖)表示,今年初已退出基金會及iProA,不便回答。

2013年3月5日 星期二

Open Source Workshop (Mar 2013)

Open Source Workshop (Mar 2013) 

 
Date/Time: 9 Mar 2013, Sat 14:30-18:00
Venue: Classroom Y4702, 4/F Academic 1, City University of Hong Kong, Tat Chee Road, Kowloon Tong.

Agenda:

2:30pm Open Source in Open Data - From hk0weather to Open Data
From his hk0weather open source project, Sammy will talk and discuss with participants how should open source help in open data.
Speaker: Sammy Fung

3:00pm Open Source Community News Update (Sammy Fung)

3:15pm Open Source Lightning Talks

4:00pm Workshop and Free Discussions:
- open source in open data (Sammy Fung)
If you are interested to give a lightning talk to share a open-source topic, or do some hacking or discussion, please contact with Sammy at sammy@opensource.hk. Thank you.

Organizers:
  • Open Source Hong Kong.
  • Opensource Application Knowledge Association.
  • Hong Kong Linux User Group.

--
Yours Sincerely,
Sammy Fung
Open Source HK Community Coordinator
http://opensource.hk

2013年2月13日 星期三

BarCampHK 2013 (2013.2.23-24 PolyU)

Hi, all open source friends,

BarCamp is a un-conference event which you can learn and share any topics. Making new friends and meet with your old friends. Usually a number of open source related topics will be presented during BarCamp.
So, we would like to invite you to join BarCampHK this year, learn new stuffs from others, and share your knowledge to others.

See you at BarCampHK!
BarCamp 是一個非一般會議, 你可以在 BarCamp 學習和分享任何題目. 結交新朋友, 和舊朋友見面. 通常 BarCamp 也會有一些 open source 有關的題目.

所以我們邀請你參加今年的 BarCampHK, 跟別人學習新題目, 也向其他人分享你所認識的知識.
BarCamp 見!
Sammy Fung

Register 參加登記 :
barcamphk2013.eventbrite.com

2013年1月29日 星期二

The Most Ridiculous Law of 2013 (So Far): It Is Now a Crime to Unlock Your Smartphone

www.theatlantic.com

ADVISORY
BY DECREE OF THE LIBRARIAN OF CONGRESS
IT SHALL HENCEFORCE BE ORDERED THAT AMERICANS SHALL NOT UNLOCK THEIR OWN SMARTPHONES. 

PENALTY: In some situations, first time offenders may be fined up to $500,000, imprisoned for five years, or both. For repeat offenders, the maximum penalty increases to a fine of $1,000,000, imprisonment for up to ten years, or both.* 

That's right, starting this weekend it is illegal to unlock new phones to make them available on other carriers.

I have deep sympathy for any individual who happens to get jail time for this offense. I am sure that other offenders would not take kindly to smartphone un-lockers.
But seriously: It's embarrassing and unacceptable that we are at the mercy of prosecutorial and judicial discretion** to avoid the implementation of draconian laws that could implicate average Americans in a crime subject to up to a $500,000 fine and up to five years in prison.

If people see this and respond, well no one is really going to get those types of penalties, my response is: Why is that acceptable? While people's worst fears may be a bit unfounded, why do we accept a system where we allow such discretionary authority? If you or your child were arrested for this, would it comfort you to know that the prosecutor and judge could technically throw the book at you? Would you relax assuming that they probably wouldn't make an example out of you or your kid? When as a society did we learn to accept the federal government having such Orwellian power? And is this the same country that used jury nullification against laws that it found to be unjust as an additional check upon excessive government power? [The only silver lining is that realistically it's more likely that violators would be subject to civil liability under Section 1203 of the DMCA, instead of the fine and jail penalties, but this is still unacceptable (but anyone who accepts payments to help others unlock their phones would clearly be subject to the fine of up to $500,000 and up to five years in jail).]

WHO REALLY OWNS YOUR PHONE?

When did we decide that we wanted a law that could make unlocking your smartphone a criminal offense?

The answer is that we never really decided. Instead, Congress passed the Digital Millennium Copyright Act (DMCA) in 1998 to outlaw technologies that bypass copyright protections. This sounds like a great idea, but in practice it has terrible, and widely acknowledged, negative consequences that affect consumers and new innovation. The DMCA leaves it up to the Librarian of Congress (LOC) to issue exemptions from the law, exceptions that were recognized to be necessary given the broad language of the statute that swept a number of ordinary acts and technologies as potential DMCA circumvention violations.

Every three years groups like the American Foundation for the Blind have to lobby Congress to protect an exception for the blind allowing for books to be read aloud. Can you imagine a more ridiculous regulation than one that requires a lobby group for the blind to come to Capitol Hill every three years to explain that the blind still can't read books on their own and therefore need this exception?

Until recently it was illegal to jailbreak your own iPhone, and after Saturday it will be illegal to unlock a new smartphone, thereby allowing it to switch carriers. This is a result of the exception to the DMCA lapsing. It was not a mistake, but rather an intentional choice by the Librarian of Congress, that this was no longer fair use and acceptable. The Electronic Frontier Foundation among other groups has detailed the many failings of the DMCA Triennial Rulemaking process, which in this case led to this exception lapsing.
Conservatives should be leading the discussion on fixing this problem. Conservatives are understandably skeptical of agencies and unelected bureaucrats wielding a large amount of power to regulate, and are proponents of solutions like the REINS Act (which has over 121 co-sponsors). However, if Congress truly wants to rein in the power of unelected bureaucrats, then they must first write laws in a narrow manner and avoid the need for intervention by the Librarian of Congress to avoid draconian consequences, such as making iPhone jail-breakers and smartphone un-lockers criminals, or taking away readable books for the blind.

If conservatives are concerned of unelected bureaucrats deciding upon regulations which could have financial consequences for businesses, then they should be more worried about unelected bureaucrats deciding upon what is or isn't a felony punishable by large fines and jail time for our citizens. And really, why should unelected bureaucrats decide what technological choices you can make with your smartphone? These laws serve to protect the interests of a few companies and create and maintain barriers to entry.
But there is another matter of critical importance: Laws that can place people in jail should be passed by Congress, not by the decree of the Librarian of Congress. We have no way to hold the Librarian of Congress accountable for wildly unfair laws. There are still plenty of crazy laws passed by elected officials, but at least we can then vote them out of office.

There are numerous other problems with the DMCA. As I explained in an essay for Cato Unbound:
"The DMCA bars developing, selling, providing, or even linking to technologies that play legal DVDs purchased in a different region, or to convert a DVD you own to a playable file on your computer. Because no licensed DVD playing software is currently available for the Linux operating system, if a Linux user wishes to play a DVD that they have legally bought, they cannot legally play it on their own computer.
In order to regulate this anti-circumvention market, the DCMA authorizes injunctions that seem to fly in the face of First Amendment jurisprudence on prior restraint. The DMCA also makes companies liable for copyright infringement if it doesn't remove content upon notification that someone believes the content infringes their copyright - this creates a very strong business interest in immediately taking down anything that anyone claims is infringing to not be liable. Christina Mulligan's essay for Copyright Unbalanced details how in mid-July 2012 a Mitt Romney campaign ad hosted on Youtube was forcibly removed from the site, and in 2008 Youtube blocked several John McCain ads for more than 10 days. As Mulligan details, the ads were legitimate under "fair use." Allowing individual people to veto political speech that they do not like stifles free expression and political dialogue and even if a rare occurrence under the DMCA should not be taken likely. There are also other examples of abuse, Mulligan details that one group had all Justin Bieber songs removed from Youtube as a prank."
And if you thought this was bad, provisions of the DMCA relating to anti-circumvention are part of the Trans-Pacific Partnership (TPP) Treaty -- and the United States is the party asking for it as part of the negotiations. Placing it in the treaty will enact our dysfunctional system on an international level in countries that don't want it, and it will "re-codify" the DMCA in an international treaty making it significantly more difficult to revise as necessary. Copyright laws are domestic laws and they need to be flexible enough to adjust accordingly to not inhibit new innovation.
I for one am pro-choice with regard to my smartphone. Our representatives ought to be, as well.
__________________________
* Specifically this refers to Section 1204 of Public Law 105-304, which provides that "any person who violates section 1201 or 1201 willfully and for purposes of commercial advantage or private financial gain. . .[shall be subject to the listed penalties]." However, given copyright laws broad interpretation by the courts, it could be argued that merely unlocking your own smartphone takes a device of one value and converts it into a device of double that value (the resale market for unlocked phones is significantly higher) and therefore unlocking is inherently providing a commercial advantage or a private financial gain - even if the gain hasn't been realized. In other words, unlocking doubles or triples the resale value of your own device and replaces the need to procure the unlocked device from the carrier at steep costs, which may be by definition a private financial gain. Alternatively, one can argue that a customer buying a cheaper version of a product, the locked version vs. the unlocked version, and then unlocking it themselves in violation of the DMCA, is denying the provider of revenue which also qualifies. There are several cases that have established similar precedents where stealing coaxial cable for personal use has been held to be for "purposes of commercial advantage or private financial gain." (See Cablevision Sys. New York City Corp. v. Lokshin, 980 F. Supp. 107, 109 (E.D.N.Y. 1997)); (Cablevision Sys. Dev. Co. v. Cherrywood Pizza, 133 Misc. 2d 879, 881, 508 N.Y.S.2d 382, 383 (Sup. Ct. 1986)).

** The Ninth Circuit recently explained in United States v. Nosal, 676 F.3d 854 (9th Cir. 2012) that under a "broad interpretation of the [Computer Fraud and Abuse Act (CFAA) you could be prosecuted for personal use of work computers]." The court explained that under this approach "While it's unlikely that you'll be prosecuted for watching Reason.TV on your work computer, you could be [emphasis in original]. Employers wanting to rid themselves of troublesome employees. . . could threaten to report them to the FBI unless the quit. Ubiquitous, seldom-prosecuted crimes invite arbitrary and discriminatory enforcement." The Court rejected this interpretation which would have made regular activity by average citizens as a potential felony and ruled that running afoul of a corporate computer use restriction does not violate the CFAA. It's possible that here a court would use judicial discretion to narrowly interpret the DMCA and reject the broad definitions that are typically advanced by the government.

2013年1月16日 星期三

Open Source Workshop (Feb 2013) and Hacking Thursday HK (This Thurs 17/Jan)

Two open source events are coming in the town.
又有兩個開放源碼活動啦。

1. Hacking Thursday Hong Kong 2013-01 (***This Thursday***, 17-Jan-2013)
(Cantonese and English as well)
please RSVP at http://registrano.com/events/82b652 first for our advanced cafe booking.
Cafe: Miracle House at Flat 697, 3/F Winner Mansion, 691-697 Nathan Road, Mong Kok.

Minimum charge by cafe: a dinner set $70-110/head.
Organizer: Hong Kong Linux User Group. (Mr Wong)

2.
Open Source Workshop (Feb 2013) 

 
Date/Time: 2 Feb 2013, Sat 14:30-18:00
Venue: Classroom Y5-306, 5/F Academic 1, City University of Hong Kong, Kowloon Tong.

Agenda:
  • Talk: Past, Present and Future of IBus for Hong Kong users
  • Hackfest: Usability testing of ibus-cangjie
  • Hackfest: Raspberry Pi
Organizers:
  • Open Source Hong Kong.
  • Opensource Application Knowledge Association.
  • Hong Kong Linux User Group.

2013年1月14日 星期一

Java推補鑊程式

蘋果日報

【本報訊】美國國土安全部早前發警告指Java程式有嚴重保安漏洞,呼籲全球用戶停用和解除安裝Java。Java所屬的甲骨文公司(Oracle)發聲 明,表示短期內會發表修補程式堵塞保安漏洞,以免用戶電腦被黑客入侵。

僅最新版本軟件有漏洞

聲明指,僅應用於互聯網瀏覽器的Java最新版本軟件「JDK7」有保安漏洞,直接用在電腦、伺服器等裝置的Java應用程式不受影響。路透社引述防毒軟 件公司的報告指,去年逾半數網絡攻擊涉及Java,黑客循Java漏洞入侵用戶電腦,第二常用入侵途徑是透過Adobe Reader,佔28%。
本 港政府資訊科技總監辦公室早前建議市民,在軟件商提供修補程式前,停用瀏覽器的Java功能,只在政府或銀行等可信網站有需要使用Java時才暫時啟動。 香港保安事故協調中心指,黑客可在有Java漏洞的網站植入黑客程式,連網主也未必知道。當網民瀏覽網頁時,黑客程式會自動啟動盜取密碼控制網民電腦,或 將電腦內的資料加密,向機主勒索金錢。

2013年1月13日 星期日

Java 爆保安漏洞 港府籲停用

文匯報

美國國土安全部上周四發出警告,指甲骨文公司旗下的Java軟件發現嚴重保安漏洞,可能被黑客利用入侵電腦, 呼籲所有用戶應立即停用。由於全球主要作業系統及網上服務都有使用Java,估計可能有數以億計電腦受影響。甲骨文計劃於後日發表修補漏洞的更新檔,呼籲 用家盡快安裝以策安全。

 香港不少政府電子服務及商業機構都有使用Java,包括「稅務易」或「繳費靈」網站等,政府資訊科技總監辦公室及電腦保安專家建議,市民在軟件商提供修補程式前,應暫時停用Java。

 不少需要登入的港府網站規定使用Java,若瀏覽器沒開啟Java,用戶無法登入。港府資訊科技總監辦公室回應指,保安事故協調中心會密切注視事態進展。辦公室表示,在一些可信任網站,如政府網站有需要使用Java時,才暫時啟動,之後立即停用。

暫無解決辦法 美促移除 

 美國國土安全部旗下「電腦安全緊急應變小組」(CERT)指,Java的漏洞受到公開攻擊,黑客亦製成針對漏洞的網絡攻擊工具,料有更多漏洞曝光及遭攻擊。CERT表示,尚未發現可行解決方法,建議用戶解除安裝或停用。 

 Java是軟件編程語言之一,由於具有跨平台特色,能在微軟視窗、蘋果OS X及Linux等作業系統使用,故廣受電腦及網絡程式編寫員歡迎,香港除政府網站外,不少拍賣和遊戲網站都有使用Java。不過Java向來漏洞多多,加 上使用廣泛,故屢成黑客目標。俄羅斯防毒軟件生產商卡巴斯基數據顯示,去年全球網絡攻擊中,針對Java的攻擊佔了一半。

可盜密碼鎖機 防毒軟件難防 

 網絡安全專家指出,黑客有可能透過Java漏洞,在用戶電腦安裝惡意軟件,藉以操控電腦運作,盜取用戶密碼,或把電腦作為傀儡發動網絡攻擊。黑客亦可蓄意鎖定電腦,要求受害者付錢才解鎖,或是向用戶兜售偽冒的防毒軟件圖利,防毒軟件未必可以預防。
 蘋果周四晚上透過遙距操作修改Mac電腦運作守則,暫時禁止Java運作,等待修正檔。Firefox瀏覽器研發團隊Mozilla亦表示,已修改瀏覽器運作Java的準則,只有在用戶同意下才會啟用Java。

■綜合外電消息/路透社/CNET/《今日美國報》