You're running one of the world's busiest e-commerce sites, handling up to 4 million checkouts per day. Response time is critical. Every page is customized on the fly using over 150 network services. And the system must manage failures of any component, including entire data centers. You are taking real money and shipping real goods. Quality of Service is your lifeblood. How does Amazon do it? Enterprise reliability at massive scale Like Google (see Google's three rules) Amazon: Uses commodity servers Embraces failure Architects for scale Yet Amazon raises the ante on Google: application developers can tune the storage infrastructure, Dynamo, to meet application needs. Scalable architecture Here's an illustration from a recent Amazon paper on Dynamo, their main storage...

Uli Drepper is a Red Hat developer and the lead contributor and maintainer of the GNU C Library (glibc). Watch the first and second videos in this series.

This third installment in our five-part series of videos featuring Ulrich Drepper is a discussion of memory allocation errors. Specifically Uli covers exploits related to linked lists and the heuristics set to catch these errors. He also discusses what that means for the end user.

Next time Uli will talk about how to make SELinux easeir for you in your day-to-day tasks so that you can enjoy the benefits of a secure environment.

As a supplement to the video, we’re providing an unedited podcast.

 
 
 
 

This item from Howard Rogers sums up the shared server technology (formerly multi-threaded server, or MTS) so well that I decided it was worth a special mention.

　　北大历史系的水平不过如此，好的历史文章要有人去读才算成功，当年明月的文风很适合普及，写的好书！

 

　　对北大兼容并蓄的胸怀，自由创新的精神早已心向往之。今天看了刘先生的博客，果然真切感受到了刘先生身上的这种“北大精神”。先生的本硕博学了三门截然不同的专业，果然是“兼容并蓄”！海纳百川，有容乃大！！先生的博客中嬉笑怒骂，把别人的书、把中医药贬得一文不值，果然是传说中北大“自由创新”的“批判”精神！先生的博客，晚辈收藏了，希望今后先生能给晚辈多些指教。先生之风，山高水长~真是令晚辈高山仰止，心向往之啊！！！（按：后者很有勇气地留下了她的新浪博客地址；来而不往非礼也，我再一次贯彻了鲁迅先生的精神，把这种“混帐东西”掷过来的秽物“照样的掷回去”。）

©作者：eygle 发布在 eygle.com

在国庆节来临前的夜晚，终于回到了广东，和老婆儿子团聚在一起。

国庆节劳动最光荣，开始帮岳母大人维修电脑，还着实发现了一堆不知道的问题。
其中一个就是Windows XP里无法显示隐藏文件及隐藏文件夹，即使在"文件夹选项"里选择了"显示隐藏文件"，但确定后还是显示不了，再看文件夹选项又变回老样子。

看来Windows还真是比Unix复杂得多，求助Google，很快找到了能够解决我这个问题的答案：
进入注册表展开：
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
将右窗的双字节项值CheckedValue 改为1即可。

看来是某个病毒作祟，这年头Windows的病毒防护成了一个严峻的大问题。

进一步的，如果我们想通过隐藏文件属性来保护一些密密文件，可以学习一下这些病毒的处理方法。
运行"regedit"启动注册表编辑器，打开
KEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Advanced\Folder\Hidden\SHOWALL
为安全起见，请先将该分支导出，然后删除SHOWALL分支，重新打开"高级设置"窗口，现在你就再也找不到"显示所有文件和文件夹"选项，你的隐藏文件现在可以高枕无忧了。

-The End-

相关文章|Related Articles

• 解决防火墙等服务（ICS）不能启动问题
  
• Infostealer.Gampass病毒的清除方法
  
• 有多少病毒可以再来-记大战7y7.us
  
• ntoskrnl.exe文件丢失或损坏的问题解决
  
• Windows还能删什么-ServicePackFiles or dllcache
  

评论数量(0)|Add Comments

本文网址：http://www.eygle.com/archives/2007/10/windows_hidden_folders.html

I've said many times - go ahead, erase all of my .exe files, but don't you dare touch my data.  Take word away from me, leave me my .doc files.  I'll be able to find something that can process the data eventually.

It is all about the data, applications are sugar on top of them to make them look prettier, but are not the end goal. 

Funny though, in most organizations, the thought process runs the opposite direction - for many people it is all about the application.  That is totally backwards.  Applications come, applications go.  They are secondary.  The instant an application is production - we are looking to replace it already.  Be it with version 2.0 of the application, or be it with another application entirely.

It is all about the data.

Even non-technical people understand that :)  I've always enjoyed Seth Godin's blog entries - short, and sweet and to the point.  That one, from a marketing guy, was good to hear.

Today, we are launching a new addition to the Zoho Suite - Zoho DB & Reports - An Online Database & Reporting Application.

Zoho DB comes with a simple spreadsheet like user interface. You can create online databases and analyze your data using different views and charting tools. You can start by creating a database from an existing XLS/CSV/TSV files or by creating blank database. Once you have the data in the database, you can create different views and do visual analysis on the data in your database.

Zoho DB lets you create multiple types of views - Tabular View, Chart View, Pivot View, Summary View etc from the ‘New’ button.

One of the core functionalities of Zoho DB is Data Visualization. The ‘Chart View’ option enables you to visualize your data in simple charts. This complex functionality is simplified with a very simple Drag-n-Drop interface. You have to play with it to really know the power of this feature.

This Drag-n-drop interface is also extended to creating ‘Pivot Tables’ in Zoho DB.

One of the unique features of Zoho DB is the ability to run SQL Queries of ANY dialect on the data. It understands SQL Queries/dialects from any of the supported databases which include Oracle, SQL Server, DB2, Sybase, MySQL, PostgreSQL, Informix and ANSI SQL. So you can run the SQL queries you already know on Zoho DB data to create custom tables or reports.

Ofcourse, once you have all the tables, views, charts etc created, you can share them with appropriate permissions or make them public (checkout existing public databases). You can also embed these views and charts on your website or blogs. Here is a sample chart from one of our public databases that has info on the population.

You can start playing with the application with your existing Zoho ID @ http://db.zoho.com. But wait….before you hop on, we recommend viewing the video below (for better clarity, use this one) for a quick intro on the capabilities of the application.

Now that the application is out, this will open up new possibilities for integration across other Zoho Apps. Stay tunes on that front. Meanwhile, do play with this new app and let us know your feedback.

今天改程序，无意中在discuz的注册页面停留了一下，看到他那个验证码，我忽然想到前段时间一个论坛开起了验证码，仍然被spam疯狂注册，一个月被注册了2000多个帐号！
应该说这个验证码已经挺复杂的，主要是字体比较奇怪，如果找不到字体，用简单的模式匹配解码很难。

discuz的验证码只有四位数字，用穷举的方式暴力破解，最多只需要10000次(0000-9999)就可以找到正确的验证码。
问题在于discuz能不能使用暴力破解，于是要自己研究一下。

验证码实现验证的原理是这样的（明白人可以跳过）：后台产生一个随机数，存放于服务器session，然后生成一个图片丢给客户端，同时给客户端一个sessionID。客户端输入一个验证码，提交到服务器的验证脚本，脚本根据sessionID去取session，跟提交上来的验证码比较，就可以获得结果。

discuz的注册系统是用ajax实现实时验证的，很方便使用，这也方便了我作测试，输入一个验证码马上会自动发送判断请求，点一下验证码的图片马上会换一个验证码。也因为方便，产生了很大的问题！

暴力破解的原理是：
1.如果程序不是在每次验证之后产生新的验证码的话，hacker就可以不断提交验证码去碰
2.如果服务器每次都更换新的验证码，可以在本地提供一个固定数字，不断向服务器提交验证请求，直到跟本地验证码一致，概率应该是一样的，只不过把产生随机数的过程交给了服务器，这样本地压力更小。

discuz的验证码用上面任何一种破解方式都可以，上面说过，4位的数字，最多只需要10000次就可以得到正确结果，10000此对于机器来说太快了，主要取决于网速。而实际上，验证的过程只需要提交非常小的数据量（小于1K），所以只要服务器响应够快，破解速度就可以足够快。

那么，应该如何防止暴力破解呢？方法其实很简单，一是提高随机数宽度，这种方法不好，验证码位数太长，意味着用户输入更多；二是限制重试次数，比如50次，我想没有那个正常人闲得没事可以反复输错50次，并且重试50次。对于登录来说，这个验证很容易，对于注册来说就不好办，碰上用大量代理暴破的，一点用都没有。不过只要在登录的地方卡死了，注册了也登录不了。

总的来说，现在大部分网站系统的验证码，都跟discuz的这个差不多，很容易暴破，有的甚至用很简单的字体，很固定的排列方式，直接就可以识别，比如我的blog留言那里的那个验证码。我以前曾经写过一个针对网易投票系统的破解程序，有兴趣的可以搜索一下。

其实像一些大的网站那样，比如google、yahoo等，用6位扭曲的英文＋数字进行验证已经很强了（36^6＝2176782336），关键是不要被识别出来，他们那样的扭曲算法写不出来不要紧，可以直接用多种字体拼凑，每个验证位用一种随机字体，这样就增加了一定的破解难度，当然用传统验证码，总是可以设计出识别算法的，现在流行的用随机问题的方式进行验证，不失为一个好的选择，但是对于大型网站来说要做一个足够大，不容易被人工复制，问题又足够简单的问题库是个很难的事情。