Life Editor

2011-10-31T10:29:00.000+08:00

A Better Way to sort a million 32-bit integers in 2MB of RAM

The data of a million 32-bit integers would take up 4 megabytes, assuming binary encoding. So to sort them with minimal memory usage, the sorting algorithm most of people will consider is the MergeSort algorithm. The basic idea is to create a temporary file that is stored in the hard disk. Then read the first 0.5 million integers in the RAM, sort them, and then save them into a temporary file. Afterwards, read the remaining 0.5 million integers in the RAM, sort them, and then save them into another temporary file. Finally, we merge these two temporary files together.

However, there is a better solution without using temporary files (this is proposed by others. see http://news.ycombinator.com/item?id=341037).

Select the 500.000 smallest values, sort them using an in place sorting algorithm and spit them out, then select the 500.000 biggest values, sort them and spit them out.

The problem then boils down to select the n/2 smallest values of the list. To do this we store the n/2 first values in the 2MB buffer. We then organize them into a heap with the biggest at the top. I then process the remaining n/2 values. When one of these values is bigger than the heap top value, it is skipped. If it is smaller, the heap biggest value is replaced with the smaller value and the heap is restored to get the biggest value at the top. When all the n/2 values have been processed, the 2MB buffer contains the n/2 smallest values of the million integer list.

Since it is already organized as a heap one can use heap sort to sort it. Pick the biggest value at the top and swap it with the last value of the list and restore heap to get the next biggest value at the top. Swap it with the last unsorted value and proceed until the heap length is reduced to one element.

Apply the same algorithm with the n/2 biggest value but using a heap with the smallest value at the top.

This algorithm requires two passes over the million integer, and uses nothing more than the 2MB buffer. The complexity is O(nlog).

Why do hash functions use prime numbers?

2011-10-25T17:09:00.001+08:00

A good blog post for this question: http://computinglife.wordpress.com/2008/11/20/why-do-hash-functions-use-prime-numbers/

Improve Your LIfe

2011-08-28T12:01:00.004+08:00

1. Become A Company Leader
Don't try to do everything. Pick your three strongest assets and over-deliver. Of course, those assets will be in line with the boss's wishes and the company's goals, so you'll become a brand that's promoted. Grab any chance to enter competitions or attend industry conferences. When you win an award, remember to thank not only your boss but also the underlings who toiled to make you look good.

2. Run Effortlessly
Instead of counting seconds, count heartbeats. Presetting a time goal, like a 7-minute mile, can undermine your training program because you may push yourself when you shouldn't be pushing. Instead, let how your body feels be your guide. If you train this way, you'll end up achieving the improvements you desire. With this as your norm, push it once a week by running at 90 percent of your maximum heart rate. (To find your max, subtract your age from 220). Sandwich 15 minutes of this hard labour between 15 minutes of running at a relaxed pace, then you'll soon be running faster with less exertion.

3. Reach Enlightenment
This one starts simply: "Say hi and thank you as frequently as possible". Engaging with others and showing gratitude helps flesh out the characteristics in your world and makes it a richer, friendly place. This eases you out of the attack mode you busy life may seem to require.

4. Leave Stress at the Office
Establish one routine for day's star and end. When you start work in the morning, the routine can be: coffee/tea, read email and check today's to-do list. After you finish your last task of the day, make a plan for tomorrow and start your ritual to signal the end of office hours. Do something you find enjoyable and relaxing. For example, listen to a specific singer or band every day on your commute home, or work out for 30 minutes after you arrive home or drink a glass of wine at 7 p.m. each night.

The fate of Adobe Flash

2010-04-11T23:02:00.001+08:00

The war between Adobe and Apple still continues. Apple blocks Flash in iPhone and iPad, and it results to some companies abandon Flash and use HTML5 instead. According to the current situation, in order to

Fast Reading Method

2009-08-30T23:07:00.000+08:00

a good Blog article about fast reading: http://roman-rytov.typepad.com/miles/2006/11/how_to_read_fas.html

Solve USB Problem in VirtualBox (Fedora)

2009-08-18T15:52:00.002+08:00

1. create a group "vboxusers" and make user your current user is in the group "vboxusers"

2. check the group id of "vboxusers", for example, 501

3. Add the following line at the end of /etc/fstab:

none /sys/bus/usb/drivers usbfs devgid=501,devmode=664 0 0

4. reboot

5. start VirtualBox

USB Application Programming in Windows

2009-07-29T18:11:00.002+08:00

1. MSDN - USB device driver
http://msdn.microsoft.com/en-us/library/ms790518.aspx

2. USB Windows Library
http://libusb-win32.sourceforge.net/#documentation

3. AVR USB Software Packages
http://www.atmel.com/dyn/products/tools_card.asp?tool_id=4199

4. Easy HID package
http://www.protongeeks.com/index.php?option=com_content&task=view&id=136&Itemid=30

Linux RS232 Programming

2009-05-30T14:37:00.002+08:00

1. http://www.avsforum.com/avs-vb/archive/index.php/t-838364.html

At the simplest level, if you don't mind the command line (which is where the power of Linux lies anyway, so not using the command line when setting up a powerhouse HTPC is like not using the Tiptronic mode of your new Acura), you can control a serial device with two steps:

1. set the baud rate
stty -F /dev/ttyS0 [[]baud rate[]]
i.e.
stty -F /dev/ttyS0 115200
stty stands for set teletype
/dev/ttyS0 is the UNIX equivalent to COM1 in Windows

2. send the control string
printf "blahblah" > /dev/ttyS0
i.e.
printf "Input 02\r\n" > /dev/ttyS0
printf "\x08\x0f" > /dev/ttyS0
\r\n prints a Windows-style newline, in case your device requires such a newline after a command. \x lets you use hexadecimal bytes directly, as my Plus projector required, for example.

To go beyond one-way control, there is a program called chat or expect or something like that, that can run scripted conversations with your devices. It was designed for handling logins to dial-up Internet/network access back in the day. Beyond that, you can write something in C/C++, perl, bash, or any other language to do your bidding.

2. S-Jinn
S-Jinn is a free, lightweight, open-source Linux application written in C. It is a simple command-line tool designed for sending & receiving data from PC controlled TIA/EIA-232 (RS-232) test, measurement, and control devices.

3. A Linux serial port test program

4. Serial Programming Guide for POSIX Operating Systems

5. Linux Serial Programming Howto

JavaScript Tween 算法

2009-05-26T14:19:00.001+08:00

1. JavaScript Tween 算法及缓动效果 (http://www.cnblogs.com/cloudgamer/archive/2009/01/06/1369979.html)

2. 图片切换效果 (http://blog.csdn.net/wtcsy/archive/2009/05/24/4213118.aspx)

Inversion of Control (dependency injection) in OOP

2009-05-22T17:31:00.002+08:00

1. Inversion of Control Tutorial (http://www.martinfowler.com/articles/injection.html)

2. One famework using IoC: Spring (http://www.ibm.com/developerworks/cn/websphere/library/techarticles/0603_fanggw/)

3. Another framework using IoC (dependency injection) (http://code.google.com/p/google-guice/)

Monday, May 21 2009

2009-05-11T22:40:00.001+08:00

I didn’t work today because of the public holiday. I read the chapter 5 of the book “Professional Android Development”. Since the development of mobile software is hot since last year and a lot of people earned money by developing iPhone software, I studied the current trend of mobile software development by comparing iPhone, Android and Symbian and found that iPhone is the most popular platform and the android is the second. Because I don’t have Apple PC and laptop, I decided to do some programming in android.

After the nap at noon, I played the badminton with my father for about 2 hours. And after dinner, I went to the library with my wife and borrowed two books.

<<金字塔原理：思考，写作和解决问题的逻辑>>

2009-03-22T21:17:00.001+08:00

最清楚的表达顺序是先提出总结性思想，然后再提出被总结的具体思想。
人类有一个共同的特点，即只有以某种方式将思想表达出来--说出来或者写出来，我们才能准确地把握自己的思想。
文章中的思想必须符合以下规则：

文章结构中任一层次上的思想都必须是其下一层次思想的概括。
每一组中的思想都必须属于同一范畴。
每一组中的思想都必须按逻辑顺序组织。

因为演绎推理，发现因果关系，化整为零和归纳总结是大脑可进行的仅有的四种分析活动，因此，这四种顺序也是大脑可用于组织思想的仅有的四种顺序。
金字塔结构的巨大价值，就在于迫使你在理清你的思路时，对纵向的疑问/回答式逻辑关系在视觉上清晰化，你所做的每一个表述都应当引起读者的疑问，而你也必须在这一表述以下的结构层次上横向地对读者的疑问予以回答。
演绎性思想组合具有以下形式：

所有的人都会死
苏格拉底是一个人
因此苏格拉底会死

归纳论述方式的形式是：

法国坦克已抵达波兰边境
德国坦克已抵达波兰边境
俄国坦克已抵达波兰边由以上得出一个推论，“波兰将受到坦克入侵”

问题的起源和发展必然以讲故事的形式出现，因此也应当按照典型的讲故事模式发展。就是说，开头应向读者说明“情境（situation）”的时间和地点，在这一“情境”中应当发生了某种事情称为“冲突（complication）”，使读者提出（或将使读者提出）你的文章中将要回答（Answer）的“疑问（Question）”。

Make Linux: Harder - Better - Faster

2008-10-04T00:01:00.001+08:00

A good article on customizing Linux http://www.linuxhaxor.net/2008/09/30/make-linux-harder-better-faster/

Harder: {security}

- Anatomy of Security-Enhanced Linux (SELinux)

- Understanding AppArmor

- grsecurity

- What is Linux Security Module?

- 10 Basic Linux Security Tips to Implement

- The Best Linux Security Tools

- Linux Audit and Intrusion Detection

- The Unix security audit and intrusion detection tool

- Top 100 Network Security Tools

- Linux vs. Windows Viruses

- The short life and hard times of a Linux virus

- LIDS Secure Linux System

- 10 ways to secure your Linux desktop

Better: {general}

- Beautiful Conky Setup

- Better Linux Sound Management With ALSA

- Building a Better (Linux) GPU Benchmark

- Last-Exit: A Better Linux Client for LastFM

- 10 things Linux does better than Windows

- Ultamatix: Better Package Installer (Caution: Read Comment)

- The best Linux system repair distribution

- A Better Introduction to Linux User Interface

- Better Linux Dock

Faster: {speed}

- How to make Ubuntu extremely fast

- Booting Linux in five seconds

- Improving boot time on a general Linux distribution

- Reboot Linux faster using kexec

- Make Linux Faster and Smoother

- A better, faster desktop search for Linux

- 10 ways to make Linux boot faster

- 10 keyboard shortcuts

- Fast file copy in Linux

- How fast does Arch Linux install? (video)

Change Default Video Player in MythTV

2008-09-29T16:52:00.004+08:00

To change the default player for video playback in MythTV, enter the "Main Menu", then select "Utilities / Setup " --> "Setup" --> "Media Settings" --> "Videos Settings" --> "Player Settings", input your preferred video player in the filed "Default Player". For example, if your preferred play is "mplayer", you can input "mplayer %s -fs -zoom", where %s represents the path name of the current directory (including the vidoe filename).

In order to use a P2P streaming software to play movie in MythTV, I create a perl script "moiveplay.pl". Then I input in the field "Default Player" "/home/mythtv/movieplay.pl %s". Thus when I select a title in MythTv, the P2P streaming software will run and play the movie.

Configure Multiple Virtual IP Addresses on linux

2008-08-21T16:28:00.001+08:00

Creating virtual IP address is very easy task. All we need is root access to the ifconfig command. This commands will create virtual ip addresses on eth0-> eth0:0 and eth0:1 network interface:

ifconfig eth0:1 192.168.148.143
ifconfig eth0:2 192.168.148.144

Add Shutdown Button in MythTV

2008-07-28T12:08:00.002+08:00

copy from here: http://ubuntuforums.org/archive/index.php/t-351184.html

$ sudo nano /usr/share/mythtv/mainmenu.xml
Add the following to the end of mainmenu.xml

Create mythscript directory.
$ mkdir ~/.mythtv/mythscript

Create shutdown script.
$ sudo nano ~/.mythtv/mythscript/shutdown.sh
# ! /bin/bash

# This script will be used to shutdown the computer
# from within MythTV when the myth user selects
# the Shutdown button located on the mainmenu

# This script created on Jan 04 2007

# Shutdown
sudo /sbin/shutdown -h now

exit

Save and exit

Now we need to create a new group called "shutdown"
As Root:
# groupadd shutdown
# nano /etc/group
Add "mythtv" (without quotes) to end of shutdown group

Then
As Root: # visudo
Add: %shutdown ALL= NOPASSWD: /sbin/halt, /sbin/shutdown

## Make Script More Secure
$ sudo chgrp shutdown ~/.mythtv/mythscript/shutdown.sh

Make the script executable only for the group "shutdown"
$ sudo chmod g+x ~/.mythtv/mythscript/shutdown.sh

linux-gate.so.1

2008-07-14T16:10:00.003+08:00

In Linux, ldd prints shared library dependencies for a particular executable. I found a page (http://www.trilithium.com/johan/2005/08/linux-gate/) which gives a very good explanation.

For convenience, I copy all of its content here.

When you use the ldd utility on a reasonably recent Linux system you'll frequently see a reference to an ethereal entity known as linux-gate.so.1:

ldd /bin/sh
linux-gate.so.1 => (0xffffe000)
libdl.so.2 => /lib/libdl.so.2 (0xb7fb2000)
libc.so.6 => /lib/libc.so.6 (0xb7e7c000)
/lib/ld-linux.so.2 (0xb7fba000)

What's so strange about that? It's just a dynamically loaded library, right?

Sort of, for sufficiently generous definitions of dynamically loaded library. The lack of file name in the output indicates that ldd was unable to locate a file by that name. Indeed, any attempt to find the corresponding file – whether manually or by software designed to automatically load and analyze such libraries – will be unsuccessful.

From time to time this is a cause of befuddlement and frustration for users as they go searching for a non-existent system file. You can confidently tell users on this futile quest that there's not supposed to be a linux-gate.so.1 file present anywhere on the file system; it's a virtual DSO, a shared object exposed by the kernel at a fixed address in every process' memory:

cat /proc/self/maps
08048000-0804c000 r-xp 00000000 08:03 7971106 /bin/cat
0804c000-0804d000 rwxp 00003000 08:03 7971106 /bin/cat
0804d000-0806e000 rwxp 0804d000 00:00 0 [heap]
b7e88000-b7e89000 rwxp b7e88000 00:00 0
b7e89000-b7fb8000 r-xp 00000000 08:03 8856588 /lib/libc-2.3.5.so
b7fb8000-b7fb9000 r-xp 0012e000 08:03 8856588 /lib/libc-2.3.5.so
b7fb9000-b7fbc000 rwxp 0012f000 08:03 8856588 /lib/libc-2.3.5.so
b7fbc000-b7fbe000 rwxp b7fbc000 00:00 0
b7fc2000-b7fd9000 r-xp 00000000 08:03 8856915 /lib/ld-2.3.5.so
b7fd9000-b7fdb000 rwxp 00016000 08:03 8856915 /lib/ld-2.3.5.so
bfac3000-bfad9000 rw-p bfac3000 00:00 0 [stack]
ffffe000-fffff000 ---p 00000000 00:00 0 [vdso]

Here cat prints its own memory map. The line marked [vdso] is the linux-gate.so.1 object in that process, a single memory page mapped at address ffffe000. A program can determine the location of the shared object in memory by examining an AT_SYSINFO entry in the ELF auxiliary vector. The auxiliary vector (auxv) is an array of pointers passed to new processes in the same way program arguments (argv) and environment variables (envp) are.

In theory the address could differ between processes, but as far as I know the Linux kernel always maps it at a fixed location. The sample output above come from an x86 box where processes live in plain old 32-bit address spaces divided into pages of 4096 bytes, making ffffe000 the penultimate page. The very last page is reserved to catch accesses through invalid pointers, e.g. dereferencing a decremented NULL pointer or a MAP_FAILED pointer returned from mmap.

Since all processes share the same object at the same location, it's easy to extract a copy of it if we want to take a closer look at it. For example, we can simply ask dd to dump the page from its own memory (carefully choosing an output name different from linux-gate.so.1 to avoid creating a file that's not supposed to exist):

dd if=/proc/self/mem of=linux-gate.dso bs=4096 skip=1048574 count=1
1+0 records in
1+0 records out

We skip 1048574 because there are 220 = 1048576 pages in total and we want to extract the next to last page. The result looks like any other shared ELF object file:

file -b linux-gate.dso
ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), stripped

objdump -T linux-gate.dso

linux-gate.dso: file format elf32-i386

DYNAMIC SYMBOL TABLE:
ffffe400 l d .text 00000000
ffffe460 l d .eh_frame_hdr 00000000
ffffe484 l d .eh_frame 00000000
ffffe608 l d .useless 00000000
ffffe400 g DF .text 00000014 LINUX_2.5 __kernel_vsyscall
00000000 g DO *ABS* 00000000 LINUX_2.5 LINUX_2.5
ffffe440 g DF .text 00000007 LINUX_2.5 __kernel_rt_sigreturn
ffffe420 g DF .text 00000008 LINUX_2.5 __kernel_sigreturn

These symbols are entry points for the rt_sigreturn/sigreturn functions and for making virtual system calls. On the x86 platform linux-gate.so.1 was initially called linux-vsyscall.so.1, but this was changed during development to get a common name accurately reflecting its purpose across platforms: to act as a gateway between user and kernel space. Not all platforms need virtual syscalls, but they must be fairly important for x86 to warrant this elaborate mechanism.

Traditionally, x86 system calls have been done with interrupts. You may remember that the way to request operating system functions was via interrupt 33 (21h) back in the bad old MS-DOS days. Windows system calls are buried beneath layers of user-mode APIs, but at some point they too boil down to int 0x2e. Similarly, syscall implementations in Linux and other *nix kernels have been using int 0x80.

It turns out, though, that system calls invoked via interrupts are remarkably slow on the more recent members of the x86 processor family. An int 0x80 system call can be as much as an order of magnitude slower on a 2 GHz Pentium 4 than on an 850 MHz Pentium III. The impact on performance resulting from this could easily be significant, at least for applications that do a lot of system calls.

Intel recognized this problem early on and introduced a more efficient system call interface in the form of sysenter and sysexit instructions. This fast system call feature first appeared in the Pentium Pro processor, but due to hardware bugs it's actually broken in most of the early CPUs. That's why you may see claims that sysenter was introduced with Pentium II or even Pentium III.

The hardware problems also help explain why it took quite some time before operating systems started supporting fast system calls. If we ignore earlier experimental patches, Linux support for sysenter appeared in December 2002 during kernel 2.5 development. That's ten years after the instruction was defined! Microsoft started using sysenter only slightly earlier, in Windows XP.

You can find out if your Linux machine is using the sysenter instruction for system calls by disassembling __kernel_vsyscall:

objdump -d --start-address=0xffffe400 --stop-address=0xffffe414 linux-gate.dso

linux-gate.dso: file format elf32-i386

Disassembly of section .text:

ffffe400 <__kernel_vsyscall>:
ffffe400: 51 push %ecx
ffffe401: 52 push %edx
ffffe402: 55 push %ebp
ffffe403: 89 e5 mov %esp,%ebp
ffffe405: 0f 34 sysenter
ffffe407: 90 nop
ffffe408: 90 nop
ffffe409: 90 nop
ffffe40a: 90 nop
ffffe40b: 90 nop
ffffe40c: 90 nop
ffffe40d: 90 nop
ffffe40e: eb f3 jmp ffffe403 <__kernel_vsyscall+0x3>
ffffe410: 5d pop %ebp
ffffe411: 5a pop %edx
ffffe412: 59 pop %ecx
ffffe413: c3 ret

The preferred way of invoking a system call is determined by the kernel at boot time, and evidently this box uses sysenter. On an older machine you may see int 0x80 being used instead. In case you are struggling to make sense of that jump (like I was the first time I saw it) you might be interested to learn that it's there because Linus Torvalds is a disgusting pig and proud of it. (It's a trick to handle restarting of system calls with six parameters).

Reading Notes: Myrmic - Secure and Robust DHT Routing

2008-07-04T14:46:00.012+08:00

A secure and robust DHT protocol has to consider two aspects. One is environmental interference, and the other is adversarial behavior. The environmental interference includes membership churn, transient routing failures and high CPU load.

The adversarial behavior includes:

1. sybil attack: an attacker generates a large number of bogus DHT nodes to out-number the honest nodes. This attach is, in general, overcome by introducing an off-line trusted entity, such as a certificate authority (CA).

2. Message corruption, drop, and delay. A DHT node forwards message ( data as well as control) for others using its routing table. An attacker can eavesdrop on and modify overlay messages passing through it. Even if the messages are signed and encrypted, he can drop or delay them. Iterative routing can be used to prevent such attacks on routing messages.

3. Routing table poisoning (Eclipse Attack). Since a node's routing table is generated from information from other nodes, it is possible that its routing table could be corrupted(i.e. filled with attacker's IP addresses).

4. Root spoofing. Routing in a DHT is "proximity" routing. A message is routed to a key's root rather than a node specified by the querier. Without detailed knowledge of the replier's neighborhood, the querier cannot verify whether the replier is indeed the root of the key.

This paper proposes a DHT routing protocol designed to be robust against adversarial behavior. It is based on Chord DHT protocol.

Assumption:

1. the existance of an off-line certification authority (CA).

2. adversaries can not corrupt or prevent IP network layer communication between honest DHT nodes.

3. do not consider denial-of-service attacks (against arbitrary nodes) at the network level; these attacks can essentially defeat any protocol in the literature.

High-level Overview:

In the protocol, (1) the sender must be able to verify the root, (2) in case root verification fails (e.g., a malicious node impersonates the root), the message must be able to bypass malicious nodes and eventually reach the root if it is reachable, and (3) the secure routing protocol must be efficient, even under attack.

In addition to the off-line CA, Myrmic introduces a new on-line authority, called the Neighborhood Authority (NA). The NA has a public/private key pair for signing certificate and we assume that its certificate is publically available. Myrmic uses iterative routing.

Details:

1. Root verification using nCerts.

The range of node R is the interval from the predecessor of R ( p(R) ) to R, i.e., range(R) = (p(R), R].

We include serveral nodes in nCert to serve as witness to the freshness of the nCert. When a nCert is revoked, the witness are notified by the NA. Hence, by consulting with the witnesses, one can verify the freshness of a nCert. If any witness can prove that a revoked nCert is indeed revoked, the a malicous node can use a revoked nCert only if all (live) witnesses are its colluders.

nCert={nList, issueTime, expireTime}

A nCert is signed by the NA using secure digital signature with private key of the NA. The nCert also includes its issue time and its expiration time. The nList in nCert includes tuples I = (nodeId, IP), which allow direct IP connection to R's neighbors.

//verify if R is the root of key K
Q.verify_root(nCert, k)
if(nCert.expireTime <> nCert.issueTime
and is_root(nCert`, k) is false )
return false;
return true;

//verify if R is the root of k according to nCert
Q.is_root(nCert, k)
if ( k in (nodeId(p(R)), nodeId(R) )
return true;
return false;

2. Neighborhood Certificate Update
When a new node joins a Chord network, it first learns its neighborhood information from a bootstrap node.
To generate nCert for node J, NA needs to learn the (nodeId, IP) pairs of the 2L nearest neighbors, which will be in J's nList. Similarly, to update the nearest neighbors, NA nees to find out the (nodeId, IP) pairs of their nearest neighbors.

//node J joins the network, node B is used for bootstrap
J.join(B)
R = B.find_root(J);
NA.update_nCerts(R, J);
init_finger_table(B);
update_others();

//issue a nCert to the joing node and update its neighbors' nCerts
NA.update_nCerts(R, J)
if(accept(J) is true and verify_root(nCert, J) is true)
list = nil;
list = construct_neighbor_list(R, J);
generate_distribute_nCerts(list);

//NA constructs a list of the nearest neighbors of the joining node
NA.construct_neighbor_list(R, J)
list = nil;
for ( X in R.nCert )
for(Y in X.nCert)
for (Z in Y.nCert)
if (in_list(list, Z) is false) and ping(Z) is live
insert_into_list(list, Z);
insert_into_list(list, J);
while(count_live_successors(list, J) < j =" gen_nList(list," x =" gen_nList(list," x =" Sign(nList" z =" Y;" z =" find_root(X," nhos =" 0;" ring =" nil;" current =" G;" p =" find_predecessor_on_ring(ring," s =" find_successor_on_ring(ring," current =" random_select_from(nCert_S);" current =" random_select_from(nCert_P);" href="http://www.blogger.com/www.dtc.umn.edu/publications/reports/2006_20.pdf">Myrmic: Secure and Robust DHT Routing

There are two more papers need to be read in the future.
1. M.Castro, etc. " Secure routing for structured peer-to-peer overlay networks", OSDI, 2002
2. A.Singh, etc. "Defending against eclipse attacks on overlay network", EW11 2004

UNIX 编程中错误输出的线程安全问题

2008-06-29T19:22:00.003+08:00

在IBM developerworks 里看得的一篇文章，对多线程编程有益。

http://www.ibm.com/developerworks/cn/aix/library/0806_xiazq_thread/

在多线程的 UNIX 应用程序中，系统调用出错时，错误输出有时可能不会像在单线程系统中那样正确的反应错误所在，因为需要考虑多线程情况下所使用的错误输出方式是否安全等问题。希望本文能对大家在多线程场景下选择错误报告的输出方式有所启发。

系统调用失败原因分析

在 UNIX 编程中，我们会经常使用系统调用来完成期望的功能；而与此同时，我们也需要付出大段的代码来检测、输出错误和其他意外情况。

以下是系统调用失败的可能原因：

系统可能出现资源短缺或者程序使用的资源可能超过系统为单个程序规定的上限。常见的情况有：程序可能尝试分配大量内存，或者同时打开很多文件等。
程序执行操作时，可能会由于权限不足而被系统阻止。例如，程序可能会试图写一个只读的文件，或者企图访问其他进程的内存空间。
传入系统调用的参数可能无效，原因可能是用户提供无效输入或者程序本身的 bug。例如，程序可能会传入一个无效的内存地址或者无效的文件描述符。
系统调用还有可能因为程序之外的原因出错。系统调用访问硬件的时候经常会有这种情况发生。设备可能会出现异常错误或者不支持特定的操作，或者可能会出现磁盘没有插入驱动器中的情况出现。
系统调用有的时候会被外部事件 ( 如信号等 ) 中断。这可能不代表真正的调用失败，但是如果有必要，程序应当重新尝试执行系统调用。

回页首

库函数的线程安全

Glibc 为上述系统调用失败场景提供了丰富的库函数来处理错误输出。但是任何事物都存在双刃剑，这些错误输出库函数在为我们带来便利的同时，也给我们带来了一定的安全隐患——线程安全问题。

线程安全是为了避免数据竞争或者数据设置的正确性依赖于多个线程修改数据的顺序。假设你的代码所在的进程中有多个线程在同时运行，而这些线程可能会同时运行这段代码。如果每次运行结果和单线程运行的结果是一样的，而且其他的变量的值也和预期的是一样的，就是线程安全的。

对于函数来说，在多线程或有异常控制流的情况下 , 当某个函数运行到中途时 , 控制流 ( 也就是当前指令序列 ) 就有可能被打断而去执行另一个函数。而这个函数很有可能是它本身。如果在这种情况下不会出现问题 , 比如说数据或状态不会被破坏，行为确定。那么这个函数就被称做 " 可重入 " 的。

在多线程编程中，有两种方法使库函数可以保证其安全。一个是简单的将合适的代码使用互斥锁包起来，这样可以保证同时只有一个线程执行这一段例程。虽然这种方法大部分情况下都能奏效，但是它的性能却非常糟糕。而且对于诸如 strtok 函数，该方法就完全不能工作了，因此很多 UNIX 系统都存在 _r 的接口函数。

另一个更好的办法是确保库函数可以同时在多个线程情况下安全的执行。这里指的不仅仅是带有后缀 _r 的可重入对等函数；毕竟可重入和线程安全（Thread-Safe）是两个不同的概念：可重入函数一定是线程安全的；线程安全的函数可能是重入的，也可能是不重入的；线程不安全的函数一定是不可重入的。所以诸如 malloc，free 等函数也在此列，属于线程安全的库函数。

当然，如果你在单线程应用程序中使用线程安全函数会在一定程度上降低性能，所以尽量避免在单线程应用程序中使用它们。

回页首

程序清单

这里先快速浏览一下本文中所要使用的样例程序代码，方便后面的比较说明。

清单 1 尝试打开一个文件，如果打开文件失败，将打印一串错误信息并退出程序。注意：调用 fopen 函数如果操作成功的话返回一个打开文件的描述符，当操作失败的时候返回 NULL。

清单 1 系统调用的错误输出

//filename:test.c
#include 
#include 
#include 
#include 

const char *INFILE = "~/text";

int main()
{
FILE *fd = 0;
char buf[64];
memset(buf, 0, sizeof(buf));

printf( "Try to open input file %s...\n", INFILE );
fd = fopen( INFILE, "r" );
if( fd == NULL ) {
#ifdef PERROR
perror( "(PERROR)Error opening infile" );
#endif
#ifdef STRERROR
printf( "(STRERROR)Error opening infile: %s\n", strerror( errno ) );
#endif
#ifdef PERROR_STRERROR
perror( "(PERROR)Error opening infile");
printf( "(STRERROR)Error opening infile: %s\n", strerror( errno ) );
#endif
#ifdef STRERROR_R
strerror_r(errno, buf, sizeof(buf));
printf( "(STRERROR_R)Error opening infile: %s\n", buf);
#endif
#ifdef FORMAT_M
printf( "(FORMAT_M)Error opening infile: %m\n" );
#endif
}
return EXIT_SUCCESS;
}

编译该程序时候，需要用到 GCC 条件编译的知识，这里使用 -Dmacro 选项，如 gcc –o test test.c –DPERROR，其结果如下所示：

清单 2，PERROR 开关对应的输出内容

$ gcc -o test test.c - DPERROR
$ ./test
Try to open input file ~/text...
(PERROR)Error opening infile: No such file or directory

其他预编译开关打开方法相同。

回页首

错误输出方式枚举

类 UNIX 系统中多数系统调用在执行失败的时候会通过一个特殊的全局变量 errno 来保存错误相关的信息。

errno 简述

全局变量 errno 是在系统头文件中被定义的。注意没有函数会将 errno 清零，所以在调用可能设置 errno 的函数之前先将 errno 清零，以防在本次系统调用无错误发生的情况下，读取到上次系统调用遗留的错误信息；错误发生之后，也应立即用其他变量保存起来。因为下一次系统调用有可能会重写 errno 的值。

Errno 的可能值都是整型的，是以“E”开头的宏来表示的。例如，EACCES 和 EINVAL。程序中使用这些宏会更为形象。在使用 errno 的时候应首先包含头文件。

Glibc 提供的错误输出库函数包括上面样例中提到的 perror, strerror 以及其线程安全版 strerror_r，这些函数可能是最常用的输出错误方式。而另一个优于前三者的错误输出方式却常为大家所忽略，那就是使用输出格式转换符 %m。下面首先对这四种方式逐一进行描述。

perror 函数

perror 函数用来将上一个函数发生上次系统调用所产生的错误信息输出到标准错误 stderr。由 perror 传入的字符串参数作为前缀（如果该参数不为空），跟一冒号和空格，后面再加上错误原因字符串。此错误原因字符串是由 errno 变量中报告的当前错误的数值映射而来的。perror 函数也不是线程安全的，后面会具体分析原因。

函数原型如下：

#include

void perror(const char *s);

strerror 函数

strerror 函数把错误编码映射为一个字符串，该字符串可以用于程序输出的错误信息中。其函数原型如下：

#include 
char *strerror(int errnum);

但是 strerror 函数并不是线程安全的，后面会具体分析原因。

strerror_r 函数

strerror_r 函数是 strerror 的线程安全版本，该函数返回一个包含错误信息字符串的指针。这个指针指向参数 buf 的缓冲区。

其函数原型如下：

#include 
char *strerror(int errnum, char *buf, size_t buflen);

输出格式转换符 %m

转换符 %m 是 GNU C 库的扩展，UNIX libc5 开始添加对它的支持。其用途是打印 errno 中错误码所对应的字符串，表达的效果与 strerror 以及 strerror_r 函数无异。因此：

fprintf (stderr, "can't open ’%s’: %m\n", filename);

等价于：

fprintf (stderr, "can't open ’%s’: %s\n", filename, strerror (errno));

或者

strerror_r (errno, buf, sizeof(buf))
fprintf (stderr, "can't open ’%s’: %s\n", filename, buf);

以上是对 4 种错误处理方式的简单描述，详细内容可以查看 man 手册。接下来从线程安全的角度来比较分析这 4 个库函数，从中我们可以看到为保证线程安全为什么使用第三节中提到的方法二更好以及系统调用错误输出为什么使用 printf, %m 更优。

回页首

线程安全分析

perror 与 strerror 的区别

在 glibc 的实现中，perror 与 strerror 最终都是调用 __strerror_r 函数来实现将 errno 对应的错误信息输出，只不过 perror 直接将结果送到标准错误输出流 stderr。注意这两个函数都不是线程安全的，在单线程环境中可以正常运行。Perror 最大的一个弊病是在调用后，很可能会把 errno 设置成 ESPIPE( 对应值为 29，错误描述为”Illegal seek”)，影响后面 errno 的使用，这也是它线程不安全的原因之一，我们可以通过下面的实验得出此结论。

说明：宏 PERROR_STRERROR 对应的代码块使用 perror 函数来捕获系统调用 fopen() 得到的错误，然后使用 strerror 函数来查看 perror 函数是否改变 errno 的值。如果两者输出结果不一致，则说明 errno 值被 perror 函数更改了。

清单 3，strace 程序的 ELF 文件

$gcc –o test test.c –DPERROR_STRERROR
$ ./test
Try to open input file ~/text...
(PERROR)Error opening infile: No such file or directory
(STRERROR)Error opening infile: Illegal seek
$strace ./test

其部分结果如下：

mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2a95558000
lseek(3, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
write(3, "(PERROR)Error opening infile: No"..., 56(PERROR)Error opening infile: No such
file or directory
) = 56
close(3) = 0
munmap(0x2a95558000, 4096) = 0
write(1, "(STRERROR)Error opening infile: "..., 45(STRERROR)Error opening infile: Illegal
seek
) = 45

观察这里发现，perror 搜索 stderr 导致错误的发生。诸如这类不是程序代码本身所导致的问题，会使你慢慢抛弃使用 perror 函数。至于 strerror 函数为什么不是线程安全的，在后面 strerror 与 strerror_r 的比较中可以找到答案。其他有关 perror 与 strerror 的区别可以查看 man 手册中两个函数的描述。

strerror 与 strerror_r 比较

上面提到 strerror 函数并不是线程安全的，其原因可以从 glibc 具体实现中找到答案。该函数在静态缓冲区中设置错误消息的格式并将返回指向该缓冲区的指针，其他地方再调用 strerror 函数时将会覆盖该缓冲区的内容。

POSIX 1003.1 标准定义了 strerror 的对等可重入函数 strerror_r 函数，该函数除接受错误值之外，还接受缓冲区中的指针和缓冲区大小，这样可以保证每个线程拥有自己的缓冲区空间，不至于其他线程或者后续调用该函数时而导致覆盖问题，从而保证了在多线程场景下是安全的。

另外正如前面提到的，如果单线程中使用 strerror_r 函数时，会导致性能下降；所以非多线程环境下，尽量使用 strerror 函数。

可以通过分别打开清单 1 中 STRERROR 与 STRERROR_R 的开关来做比较。

strerror_r 与 %m 比较

为了线程安全我们使用了可重入函数 strerror_r() 来输出错误，但是却牺牲了一定的空间，并且需要你自己考虑分配存储错误信息 buffer 的大小以及后续回收问题。更优的策略当然是既要保证线程安全又可以省去后顾之忧，这便是选择使用输出格式转换符 %m 的理由所在。

清单 4，FORMAT_M 开关对应的输出内容

$ gcc -o test test.c - DFORMAT_M
$ ./test
Try to open input file ~/text...
(FORMAT_M)Error opening infile: No such file or directory

从清单 1 中代码比较可以看出，开关 STRERROR_R 部分比开关 FORMAT_M 部分多分配了 64byte 字节的空间，这一点转换符 %m 就不需要。

作为打印函数 fprintf(), printf(), snprintf(), sprintf()；vfprintf(), vprintf(),

vsnprintf(), vsprintf() 都可以说是线程安全的。存在一种例外情况就是，当这些函数执行的时候，如果有其它线程调用 setlocale 函数，那么可能会出现不安全的可能。不过我们通常不会轻易设置 locale 的值，所以大可以放心的在打印函数中使用转换符 %m。

回页首

总结

Glibc 所提供的上述错误输出方式，使得 UNIX 应用程序在应对运行时错误时，可以最大程度地告知用户所发生了什么。通过上述描述，我们可以得出使用 strerror_r 函数和转换符 %m 是线程安全的，并且转换符 %m 使用起来更加方便。所以在 UNIX 多线程编程中，推荐大家使用 printf, %m 来输出错误。

参考资料

错误：UNIX 程序中的错误代码 : 该书中的第二章有相关 UNIX 系统调用的进一步信息。
Advanced UNIX Programming: 帮助您了解标准 C 库错误输出机制以及 errno 的详细信息。
The GNU C Library manual online: 通过访问 GNU C 库的在线手册，可以了解到错误信息 (Error-Messages 小节 ) 以及输出格式 (Formatted-Output 小节 ) 的相关知识。
GCC online documentation: 通过访问 GCC 的在线文档，可以了解到 GCC 编译选项相关的知识。
UNIX Manual Page for strace: 访问该网站可以在线查阅本文中提到的 strace 命令相关知识。
AIX and UNIX 专区：developerWorks 的“AIX and UNIX 专区”提供了大量与 AIX 系统管理的所有方面相关的信息，您可以利用它们来扩展自己的 UNIX 技能。
AIX and UNIX 新手入门：访问“AIX and UNIX 新手入门”页面可了解更多关于 AIX 和 UNIX 的内容。
AIX and UNIX 专题汇总：AIX and UNIX 专区已经为您推出了很多的技术专题，为您总结了很多热门的知识点。我们在后面还会继续推出很多相关的热门专题给您，为了方便您的访问，我们在这里为你把本专区的所有专题进行汇总，让您更方便的找到你需要的内容。
获取本专区的 RSS Feed。（了解关于 RSS 的更多信息。）

Build a porfolio as a programmer

2008-05-25T14:17:00.001+08:00

You’re a programmer, so why don’t you create a portfolio for yourself? Find interesting things that you wish software did — and build it for yourself.

Maybe you want a new way to integrate your iPhone with Outlook, or you wish there was a way to scrape all the images off a web page with 1 click. Whatever. Then build it. There — you have a portfolio.

Do you contribute to open-source projects?

Have you started a blog?

Or have you found someone who has an idea and helped them to build it?

Without some/all of those things, you’re just another programmer. Ask yourself how you can stand out.

＜＜精力管理＞＞读书笔记

2008-04-11T16:23:00.003+08:00

在生活和工作中需要周期性恢复精力。

工作时，每隔一段时间：

在办公楼里上上下下走楼梯
每90－120分钟，稍微休息一下

从最实际的角度看，我们全方位投入的能力取决于我们定期让自己从工作压力中摆脱出来的能力

我们是做钟摆式运动的宇宙中的生物，周期性是我们的天性。

增强承受力的关键既在于让自己超越一般的限度，又在于定期找机会恢复。

吃早饭非常重要。早餐包括全麦食品，脱脂牛奶，水果。不要吃松糕，含糖麦片或面包圈。

下午3点是一天中感到最疲劳的时候，可以吃点坚果，或半条朱古力。

每周专门留出时间和朋友打打电话，或上网聊天。

领导者和管理者们面临的关键挑战之一是培养和直接下属之间的积极关系。

真正理解别人的感情需要要放下我们自己的事。

人是有情感的动物，不是机器。所以在工作中，不可避免地要和同事之间建立更多的私人关系。

“三明治”方法的批评性反馈

首先对那个人的表现给以某种真诚的积极评价。
把批评性反馈意见表达得像是讨论而不是训斥，表现出他的理解有可能不完全准确。
最后，用一些鼓励的话结束。

想一想你自己的生活，每个星期有多少个小时你纯粹是为了愉悦和精力上的补充而参加活动？你觉得彻底放松的时间能有百分之多少？

看电视相当于在思想和情感上吃垃圾食品，看电视可能会提供一种临时的恢复形式，但是基本上没什么营养。

世界上有许多对立的品德：自制和自发，诚实和同情，慷慨和节俭，直率和谨慎，热情和超然，耐心和急切，小心和大胆，自信和谦卑。任何品德自身都不能称之为品德，所有品德都需要其他品德的映衬。比如没有了同情，诚实就成了残忍。

没有什么不不能把精力集中在手头的任务上更影响效能和投入了。为了以最佳的状态工作，我们必须能保持精力集中。

按照世界本来面目认识世界，但是总是朝着期望的结果或解决方案而努力。

身体，情感和思想方面的精力储备之间相互依存。在身体方面，因为睡眠太少或健康状况不佳而导致的疲劳感会进一步导致精力分散。在情感方面，像焦虑，挫折和生气这样的感觉会妨碍精力的集中。

时常把工作放下，稍微休息一下是一个非常好的计划。。。。。。当你回来工作时，你的判断会更有把握，因为持续工作会让你失去判断。

HP大中华区总裁孙振耀退休感言

2008-03-30T23:36:00.002+08:00

一、关于工作与生活
　　我有个有趣的观察，外企公司多的是25-35岁的白领，40岁以上的员工很少，二三十岁的外企员工是意气风发的，但外企公司40岁附近的经理人是很尴尬的。我见过的40岁附近的外企经理人大多在一直跳槽，最后大多跳到民企，比方说，唐骏。外企员工的成功很大程度上是公司的成功，并非个人的成功，西门子的确比国美大，但并不代表西门子中国经理比国美的老板强，甚至可以说差得很远。而进外企的人往往并不能很早理解这一点，把自己的成功90％归功于自己的能力，实际上，外企公司随便换个中国区总经理并不会给业绩带来什么了不起的影响。好了问题来了，当这些经理人40多岁了，他们的薪资要求变得很高，而他们的才能其实又不是那么出众，作为外企公司的老板，你会怎么选择？有的是只要不高薪水的，要出位的精明强干精力冲沛的年轻人，有的是，为什么还要用你？
　　从上面这个例子，其实可以看到我们的工作轨迹，二三十岁的时候，生活的压力还比较小，身体还比较好，上面的父母身体还好，下面又没有孩子，不用还房贷，也没有孩子要上大学，当个外企小白领还是很光鲜的，挣得不多也够花了。但是人终归要结婚生子，终归会老，到了40岁，父母老了，要看病要吃药，要有人看护，自己要还房贷，要过基本体面的生活，要养小孩……那个时候需要挣多少钱才够花才重要。所以，看待工作，眼光要放远一点，一时的谁高谁低并不能说明什么。
　　从这个角度上来说，我不太赞成过于关注第一份工作的薪水，更没有必要攀比第一份工作的薪水，这在刚刚出校园的学生中间是很常见的。正常人大概要工作 35年，这好比是一场马拉松比赛，和真正的马拉松比赛不同的是，这次比赛没有职业选手，每个人都只有一次机会。要知到，有很多人甚至坚持不到终点，大多数人最后是走到终点的，只有少数人是跑过终点的，因此在刚开始的时候，去抢领先的位置并没有太大的意义。刚进社会的时候如果进500强公司，大概能拿到3k -6k/月的工资，有些特别技术的人才可能可以到8k/月，可问题是，5年以后拿多少？估计5k-10k了不起了。起点虽然高，但增幅有限，而且，后面的年轻人追赶的压力越来越大。
　　我前两天问我的一个销售，你会的这些东西一个新人2年就都学会了，但新人所要求的薪水却只是你的一半，到时候，你怎么办？
　　职业生涯就像一场体育比赛，有初赛、复赛、决赛。初赛的时候大家都刚刚进社会，大多数都是实力一般的人，这时候努力一点认真一点很快就能让人脱颖而出，于是有的人二十多岁做了经理，有的人迟些也终于赢得了初赛，三十多岁成了经理。然后是复赛，能参加复赛的都是赢得初赛的，每个人都有些能耐，在聪明才智上都不成问题，这个时候再想要胜出就不那么容易了，单靠一点点努力和认真还不够，要有很强的坚忍精神，要懂得靠团队的力量，要懂得收服人心，要有长远的眼光……
　　看上去赢得复赛并不容易，但，还不是那么难。因为这个世界的规律就是给人一点成功的同时让人骄傲自满，刚刚赢得初赛的人往往不知道自己赢得的仅仅是初赛，有了一点小小的成绩大多数人都会骄傲自满起来，认为自己已经懂得了全部，不需要再努力再学习了，他们会认为之所以不能再进一步已经不是自己的原因了。虽然他们仍然不好对付，但是他们没有耐性，没有容人的度量，更没有清晰长远的目光。就像一只愤怒的斗牛，虽然猛烈，最终是会败的，而赢得复赛的人则象斗牛士一样，不急不躁，跟随着自己的节拍，慢慢耗尽对手的耐心和体力。赢得了复赛以后，大约已经是一位很了不起的职业经理人了，当上了中小公司的总经理，大公司的副总经理，主管着每年几千万乃至几亿的生意。
　　最终的决赛来了，说实话我自己都还没有赢得决赛，因此对于决赛的决胜因素也只能凭自己的猜测而已，这个时候的输赢或许就像武侠小说里写得那样，大家都是高手，只能等待对方犯错了，要想轻易击败对手是不可能的，除了使上浑身解数，还需要一点运气和时间。世界的规律依然发挥着作用，赢得复赛的人已经不只是骄傲自满了，他们往往刚愎自用，听不进去别人的话，有些人的脾气变得暴躁，心情变得浮躁，身体变得糟糕，他们最大的敌人就是他们自己，在决赛中要做的只是不被自己击败，等着别人被自己击败。这和体育比赛是一样的，最后高手之间的比赛，就看谁失误少谁就赢得了决赛。
二、根源
　　你工作快乐么？你的工作好么？
　　有没有觉得干了一段时间以后工作很不开心？有没有觉得自己入错了行？有没有觉得自己没有得到应有的待遇？有没有觉得工作像一团乱麻每天上班都是一种痛苦？有没有很想换个工作？有没有觉得其实现在的公司并没有当初想象得那么好？有没有觉得这份工作是当初因为生存压力而找的，实在不适合自己？你从工作中得到你想要得到的了么？你每天开心么？
　　天涯上愤怒的人很多，你有没有想过，你为什么不快乐？你为什么愤怒？
　　其实，你不快乐的根源，是因为你不知道要什么！你不知道要什么，所以你不知道去追求什么，你不知道追求什么，所以你什么也得不到。
　　我总觉得，职业生涯首先要关注的是自己，自己想要什么？大多数人大概没想过这个问题，唯一的想法只是——我想要一份工作，我想要一份不错的薪水，我知道所有人对于薪水的渴望，可是，你想每隔几年重来一次找工作的过程么？你想每年都在这种对于工作和薪水的焦急不安中度过么？不想的话，就好好想清楚。饮鸩止渴，不能因为口渴就拼命喝毒药。越是焦急，越是觉得自己需要一份工作，越饥不择食，越想不清楚，越容易失败，你的经历越来越差，下一份工作的人看着你的简历就皱眉头。于是你越喝越渴，越渴越喝，陷入恶性循环。最终只能哀叹世事不公或者生不逢时，只能到天涯上来发泄一把，在失败者的共鸣当中寻求一点心理平衡罢了。大多数人都有生存压力，我也是，有生存压力就会有很多焦虑，积极的人会从焦虑中得到动力，而消极的人则会因为焦虑而迷失方向。所有人都必须在压力下做出选择，这就是世道，你喜欢也罢不喜欢也罢。
　　一般我们处理的事情分为重要的事情和紧急的事情，如果不做重要的事情就会常常去做紧急的事情。比如锻炼身体保持健康是重要的事情，而看病则是紧急的事情。如果不锻炼身体保持健康，就会常常为了病痛烦恼。又比如防火是重要的事情，而救火是紧急的事情，如果不注意防火，就要常常救火。找工作也是如此，想好自己究竟要什么是重要的事情，找工作是紧急的事情，如果不想好，就会常常要找工作。往往紧急的事情给人的压力比较大，迫使人们去赶紧做，相对来说重要的事情反而没有那么大的压力，大多数人做事情都是以压力为导向的，压力之下，总觉得非要先做紧急的事情，结果就是永远到处救火，永远没有停歇的时候。（很多人的工作也像是救火队一样忙碌痛苦，也是因为工作中没有做好重要的事情。）那些说自己活在水深火热为了生存顾不上那么多的朋友，今天找工作困难是当初你们没有做重要的事情，是结果不是原因。如果今天你们还是因为急于要找一份工作而不去思考，那么或许将来要继续承受痛苦找工作的结果。
　　我始终觉得我要说的话题，沉重了点，需要很多思考，远比唐笑打武警的话阿题来的枯燥乏味，但是，天下没有轻松的成功，成功，要付代价。请先忘记一切的生存压力，想想这辈子你最想要的是什么？所以，最要紧的事情，先想好自己想要什么。
三、什么是好工作
　　当初微软有个唐骏，很多大学里的年轻人觉得这才是他们向往的职业生涯，我在清华bbs里发的帖子被这些学子们所不屑，那个时候学生们只想出国或者去外企，不过如今看来，我还是对的，唐骏去了盛大，陈天桥创立的盛大，一家民营公司。一个高学历的海归在500强的公司里拿高薪水，这大约是很多年轻人的梦想，问题是，每年毕业的大学生都在做这个梦，好的职位却只有500个。
　　人都是要面子的，也是喜欢攀比的，即使在工作上也喜欢攀比，不管那是不是自己想要的。大家认为外企公司很好，可是好在哪里呢？好吧，他们在比较好的写字楼，这是你想要的么？他们出差住比较好的酒店，这是你想要的么？别人会羡慕一份外企公司的工作，这是你想要的么？那一切都是给别人看的，你干吗要活得那么辛苦给别人看？另一方面，他们薪水福利一般，并没有特别了不起，他们的晋升机会比较少，很难做到很高阶的主管，他们虽然厌恶常常加班，却不敢不加班，因为“你不干有得是人干”，大部分情况下会找个台湾人香港人新加坡人来管你，而这些人又往往有些莫名其妙的优越感。你想清楚了么？500强一定好么？找工作究竟是考虑你想要什么，还是考虑别人想看什么？
　　我的大学同学们大多数都到美国了，甚至毕业这么多年了，还有人最近到国外去了。出国真的有那么好么？我的大学同学们，大多数还是在博士、博士后、访问学者地挣扎着，至今只有一个正经在一个美国大学里拿到个正式的教职。国内的教授很难当么？我有几个表亲也去了国外了，他们的父母独自在国内，没有人照顾，有好几次人在家里昏倒都没人知道，出国，真的这么光彩么？就像有人说的“很多事情就像看A片，看的人觉得很爽，做的人未必。”
　　人总想找到那个最好的，可是，什么是最好的？你觉得是最好的那个，是因为你的确了解，还是因为别人说他是最好的？即使他对于别人是最好的，对于你也一定是最好的么？
　　对于自己想要什么，自己要最清楚，别人的意见并不是那么重要。很多人总是常常被别人的意见所影响，亲戚的意见，朋友的意见，同事的意见……问题是，你究竟是要过谁的一生？人的一生不是父母一生的续集，也不是儿女一生的前传，更不是朋友一生的外篇，只有你自己对自己的一生负责，别人无法也负不起这个责任。自己做的决定，至少到最后，自己没什么可后悔。对于大多数正常智力的人来说，所做的决定没有大的对错，无论怎么样的选择，都是可以尝试的。比如你没有考自己上的那个学校，没有入现在这个行业，这辈子就过不下去了？就会很失败？不见得。
　　我想，好工作，应该是适合你的工作，具体点说，应该是能给你带来你想要的东西的工作，你或许应该以此来衡量你的工作究竟好不好，而不是拿公司的大小，规模，外企还是国企，是不是有名，是不是上市公司来衡量。小公司，未必不是好公司，赚钱多的工作，也未必是好工作。你还是要先弄清楚你想要什么，如果你不清楚你想要什么，你就永远也不会找到好工作，因为你永远只看到你得不到的东西，你得到的，都是你不想要的。
　　可能，最好的，已经在你的身边，只是，你还没有学会珍惜。人们总是盯着得不到的东西，而忽视了那些已经得到的东西。
四、普通人
　　我发现中国人的励志和国外的励志存在非常大的不同，中国的励志比较鼓励人立下大志愿，卧薪尝胆，有朝一日成富成贵。而国外的励志比较鼓励人勇敢面对现实生活，面对普通人的困境，虽然结果也是成富成贵，但起点不一样，相对来说，我觉得后者在操作上更现实，而前者则需要用999个失败者来堆砌一个成功者的故事。
　　我们都是普通人，普通人的意思就是，概率这件事是很准的。因此，我们不会买彩票中500万，我们不会成为比尔盖茨或者李嘉诚，我们不会坐飞机掉下来，我们当中很少的人会创业成功，我们之中有30％的人会离婚，我们之中大部分人会活过65岁……
　　所以请你在想自己要什么的时候，要得“现实”一点，你说我想要做李嘉诚，抱歉，我帮不上你。成为比尔盖茨或者李嘉诚这种人，是靠命的，看我写的这篇文章绝对不会让你成为他们，即使你成为了他们，也绝对不是我这篇文章的功劳。“王侯将相宁有种乎”但真正当皇帝的只有一个人，王侯将相，人也不多。目标定得高些对于喜欢挑战的人来说有好处，但对于大多数普通人来说，反而比较容易灰心沮丧，很容易就放弃了。
　　回过头来说，李嘉诚比你有钱大致50万倍，他比你更快乐么？或许。有没有比你快乐50万倍，一定没有。他比你最多也就快乐一两倍，甚至有可能还不如你快乐。寻找自己想要的东西不是和别人比赛，比谁要得更多更高，比谁的目标更远大。虽然成为李嘉诚这个目标很宏大，但你并不见得会从这个目标以及追求目标的过程当中获得快乐，而且基本上你也做不到。你必须听听你内心的声音，寻找真正能够使你获得快乐的东西，那才是你想要的东西。
　　你想要的东西，或者我们把它称之为目标，目标其实并没有高低之分，你不需要因为自己的目标没有别人远大而不好意思，达到自己的目标其实就是成功，成功有大有小，快乐却是一样的。我们追逐成功，其实追逐的是成功带来的快乐，而非成功本身。职业生涯的道路上，我们常常会被攀比的心态蒙住眼睛，忘记了追求的究竟是什么，忘记了是什么能使我们更快乐。
　　社会上一夜暴富的新闻很多，这些消息，总会在我们的心里面掀起很多涟漪，涟漪多了就变成惊涛骇浪，心里的惊涛骇浪除了打翻承载你目标的小船，并不会使得你也一夜暴富。“只见贼吃肉，不见贼挨揍。”我们这些普通人既没有当贼的勇气，又缺乏当贼的狠辣绝决，虽然羡慕吃肉，却更害怕挨揍，偶尔看到几个没挨揍的贼就按奈不住，或者心思活动，或者大感不公，真要叫去做贼，却也不敢。
　　我还是过普通人的日子，要普通人的快乐，至少，晚上睡得着觉。
五、跳槽与积累
　　首先要说明，工作是一件需要理智的事情，所以不要在工作上耍个性，天涯上或许会有人觉得你很有个性而叫好，煤气公司电话公司不会因为觉得你很有个性而免了你的帐单。当你很帅地炒掉了你的老板，当你很酷地挖苦了一番招聘的HR，账单还是要照付，只是你赚钱的时间更少了，除了你自己，没人受损失。
　　我并不反对跳槽，但跳槽决不是解决问题的办法，而且频繁跳槽的后果是让人觉得没有忠诚度可言，而且不能安心工作。现在很多人从网上找工作，很多找工作的网站常常给人出些馊主意，要知道他们是盈利性企业，当然要从自身盈利的角度来考虑，大家越是频繁跳槽频繁找工作他们越是生意兴隆，所以鼓动人们跳槽是他们的工作。所以他们会常常告诉你，你拿的薪水少了，你享受的福利待遇差了，又是“薪情快报”又是“赞叹自由奔放的灵魂”。至于是否会因此让你不能安心，你跳了槽是否解决问题，是否更加开心，那个，他们管不着。
　　要跳槽肯定是有问题，一般来说问题发生了，躲是躲不开的，很多人跳槽是因为这样或者那样的不开心，如果这种不开心，在现在这个公司不能解决，那么在下一个公司多半也解决不掉。你必须相信，90%的情况下，你所在的公司并没有那么烂，你认为不错的公司也没有那么好。就像围城里说的，“城里的人拼命想冲出来，而城外的人拼命想冲进去。”每个公司都有每个公司的问题，没有问题的公司是不存在的。换个环境你都不知道会碰到什么问题，与其如此，不如就在当下把问题解决掉。很多问题当你真的想要去解决的时候，或许并没有那么难。有的时候你觉得问题无法解决，事实上，那只是“你觉得”。
　　人生的曲线应该是曲折向上的，偶尔会遇到低谷但大趋势总归是曲折向上的，而不是象脉冲波一样每每回到起点，我见过不少面试者，30多岁了，四五份工作经历，每次多则3年，少则1年，30多岁的时候回到起点从一个初级职位开始干起，拿基本初级的薪水，和20多岁的年轻人一起竞争，不觉得有点辛苦么？这种日子好过么？
　　我非常不赞成在一个行业超过3年以后换行业，基本上，35岁以前我们的生存资本靠打拼，35岁以后生存的资本靠的就是积累，这种积累包括人际关系，经验，人脉，口碑……如果常常更换行业，代表几年的积累付之东流，一切从头开始，如果换了两次行业，35岁的时候大概只有5年以下的积累，而一个没有换过行业的人至少有了10年的积累，谁会占优势？工作到2-3年的时候，很多人觉得工作不顺利，好像到了一个瓶颈，心情烦闷，就想辞职，乃至换一个行业，觉得这样所有一切烦恼都可以抛开，会好很多。其实这样做只是让你从头开始，到了时候还是会发生和原来行业一样的困难，熬过去就向上跨了一大步，要知道每个人都会经历这个过程，每个人的职业生涯中都会碰到几个瓶颈，你熬过去了而别人没有熬过去你就领先了。跑长跑的人会知道，开始的时候很轻松，但是很快会有第一次的难受，但过了这一段又能跑很长一段，接下来会碰到第二次的难受，坚持过了以后又能跑一段，如此往复，难受一次比一次厉害，直到坚持不下去了。大多数人第一次就坚持不了了，一些人能坚持到第二次，第三次虽然大家都坚持不住了，可是跑到这里的人也没几个了，这点资本足够你安稳的活这一辈子了。
　　一份工作到两三年的时候，大部分人都会变成熟手，这个时候往往会陷入不断的重复，有很多人会觉得厌倦，有些人会觉得自己已经搞懂了一切，从而懒得去寻求进步了。很多时候的跳槽是因为觉得失去兴趣了，觉得自己已经完成比赛了。其实这个时候比赛才刚刚开始，工作两三年的人，无论是客户关系，人脉，手下，和领导的关系，在业内的名气……还都是远远不够的，但稍有成绩的人总是会自我感觉良好的，每个人都觉得自己跟客户关系铁得要命，觉得自己在业界的口碑好得很。其实可以肯定地说，一定不是，这个时候，还是要拿出前两年的干劲来，稳扎稳打，积累才刚刚开始。
　　你足够了解你的客户吗？你知道他最大的烦恼是什么吗？你足够了解你的老板么？你知道他最大的烦恼是什么吗？你足够了解你的手下么？你知道他最大的烦恼是什么吗？如果你不知道，你凭什么觉得自己已经积累够了？如果你都不了解，你怎么能让他们帮你的忙，做你想让他们做的事情？如果他们不做你想让他们做的事情，你又何来的成功？
六、等待
　　这是一个浮躁的、人们最不喜欢的话题，本来不想说这个话题，因为会引起太多的争论，而我又无意和人争论这些，但是考虑到对于职业生涯的长久规划，这是一个躲避不了的话题，还是决定写一写，不爱看的请离开吧。
　　并不是每次闯红灯都会被汽车撞，并不是每个罪犯都会被抓到，并不是每个错误都会被惩罚，并不是每个贪官都会被枪毙，并不是你的每一份努力都会得到回报，并不是你的每一次坚持都会有人看到，并不是你每一点付出都能得到公正的回报，并不是你的每一个善意都能被理解……这个，就是世道。好吧，世道不够好，可是，你有推翻世道的勇气么？如果没有，你有更好的解决办法么？有很多时候，人需要一点耐心，一点信心。每个人总会轮到几次不公平的事情，而通常，安心等待是最好的办法。
　　有很多时候我们需要等待，需要耐得住寂寞，等待属于你的那一刻。周润发等待过，刘德华等待过，周星驰等待过，王菲等待过，张艺谋也等待过……看到了他们如今的功成名就的人，你可曾看到当初他们的等待和耐心？你可曾看到金马奖影帝在街边摆地摊？你可曾看到德云社的一群人在剧场里给一位观众说相声？你可曾看到周星驰的角色甚至连一句台词都没有？每一个成功者都有一段低沉苦闷的日子，我几乎能想象得出来他们借酒浇愁的样子，我也能想象得出他们为了生存而挣扎的窘迫。在他们一生中最灿烂美好的日子里，他们渴望成功，但却两手空空，一如现在的你。没有人保证他们将来一定会成功，而他们的选择是耐住寂寞。如果当时的他们总念叨着“成功只是属于特权阶级的”，你觉得他们今天会怎样？
　　曾经我也不明白有些人为什么并不比我有能力却要坐在我的头上，年纪比我大就一定要当我的领导么？为什么有些烂人不需要努力就能赚钱？为什么刚刚改革开放的时候的人能那么容易赚钱，而轮到我们的时候，什么事情都要正规化了？有一天我突然想，我还在上学的时候他们就在社会里挣扎奋斗了，他们在社会上奋斗积累了十几二十年，我们新人来了，他们有的我都想要，我这不是在要公平，我这是在要抢劫。因为我要得太急，因为我忍不住寂寞。二十多岁的男人，没有钱，没有事业，却有蓬勃的欲望。
　　人总是会遇到挫折的，人总是会有低潮的，人总是会有不被人理解的时候的，人总是有要低声下气的时候，这些时候恰恰是人生中最关键的时候，因为大家都会碰到挫折，而大多数人过不了这个门槛，你能过，你就成功了。在这样的时刻，我们需要耐心等待，满怀信心地去等待，相信，生活不会放弃你，机会总会来的。至少，你还年轻，你没有坐牢，没有生治不了的病，没有欠还不起的债。比你不幸的人远远多过比你幸运的人，你还怕什么？路要一步步走，虽然到达终点的那一步很激动人心，但大部分的脚步是平凡甚至枯燥的，但没有这些脚步，或者耐不住这些平凡枯燥，你终归是无法迎来最后的那些激动人心。
　　逆境，是上帝帮你淘汰竞争者的地方。要知道，你不好受，别人也不好受，你坚持不下去了，别人也一样，千万不要告诉别人你坚持不住了，那只能让别人获得坚持的信心，让竞争者看着你微笑的面孔，失去信心，退出比赛。胜利属于那些有耐心的人。
　　在最绝望的时候，我会去看电影《The Pursuit of Happyness》《JerryMaguire》，让自己重新鼓起勇气，因为，无论什么时候，我们总还是有希望。当所有的人离开的时候，我不失去希望，我不放弃。每天下班坐在车里，我喜欢哼着《隐形的翅膀》看着窗外，我知道，我在静静等待，等待属于我的那一刻。
　　原贴里伊吉网友的话我很喜欢，抄录在这里：
　　每个人都希望，自己是独一无二的特殊者
　　含着金匙出生、投胎到好家庭、工作安排到电力局拿1w月薪这样的小概率事件，当然最好轮到自己
　　红军长征两万五、打成右派反革命、胼手胝足牺牲尊严去奋斗，最好留给祖辈父辈和别人
　　自然，不是每个吃过苦的人都会得到回报
　　但是，任何时代，每一个既得利益者身后，都有他的祖辈父辈奋斗挣扎乃至流血付出生命的身影
　　羡慕别人有个好爸爸，没什么不可以
　　问题是，你的下一代，会有一个好爸爸吗？
　　至于问到为什么不能有同样的赢面概率？我只能问：为什么物种竞争中，人和猴子不能有同样的赢面概率？
　　物竞天择。猴子的灵魂不一定比你卑微，但你身后有几十万年的类人猿进化积淀。
七、入对行跟对人
　　在中国，大概很少有人是一份职业做到底的，虽然如此，第一份工作还是有些需要注意的地方，有两件事情格外重要，第一件是入行，第二件事情是跟人。第一份工作对人最大的影响就是入行，现代的职业分工已经很细，我们基本上只能在一个行业里成为专家，不可能在多个行业里成为专家。很多案例也证明即使一个人在一个行业非常成功，到另外一个行业，往往完全不是那么回事情，“你想改变世界，还是想卖一辈子汽水？”是乔布斯邀请百事可乐总裁约翰& #8226;斯考利加盟苹果时所说的话，结果这位在百事非常成功的约翰，到了苹果表现平平。其实没有哪个行业特别好，也没有哪个行业特别差，或许有报道说哪个行业的平均薪资比较高，但是他们没说的是，那个行业的平均压力也比较大。看上去很美的行业一旦进入才发现很多地方其实并不那么完美，只是外人看不见。
　　说实话，我自己都没有发大财，所以我的建议只是让人快乐工作的建议，不是如何发大财的建议，我们只讨论一般普通打工者的情况。我认为选择什么行业并没有太大关系，看问题不能只看眼前。比如，从前年开始，国家开始整顿医疗行业，很多医药公司开不下去，很多医药行业的销售开始转行。其实医药行业的不景气是针对所有公司的，并非针对一家公司，大家的日子都不好过，这个时候跑掉是非常不划算的，大多数正规的医药公司即使不做新生意撑个两三年总是能撑的，大多数医药销售靠工资撑个两三年也是可以撑的，国家不可能永远捏着医药行业不放的，两三年以后光景总归还会好起来的，那个时候别人都跑了而你没跑，那时的日子应该会好过很多。有的时候觉得自己这个行业不行了，问题是，再不行的行业，做得人少了也变成了好行业，当大家都觉得不好的时候，往往却是最好的时候。大家都觉得金融行业好，金融行业门槛高不说，有多少人削尖脑袋要钻进去，竞争激励，进去以后还要时时提防，一个疏忽，就被后来的人给挤掉了，压力巨大，又如何谈得上快乐？也就未必是“好”工作了。
　　太阳能这个东西至今还不能进入实际应用的阶段，但是中国已经有7家和太阳能有关的公司在纽交所上市了，国美苏宁永乐其实是贸易型企业，也能上市，鲁泰纺织连续10年利润增长超过50%，卖茶的一茶一座，卖衣服的海澜之家都能上市……其实选什么行业真的不重要，关键是怎么做。事情都是人做出来的，关键是人。
　　有一点是需要记住的，这个世界上，有史以来直到我们能够预见得到的未来，成功的人总是少数，有钱的人总是少数，大多数人是一般的，普通的，不太成功的。因此，大多数人的做法和看法，往往都不是距离成功最近的做法和看法。因此大多数人说好的东西不见得好，大多数人说不好的东西不见得不好。大多数人都去炒股的时候说明跌只是时间问题，大家越是热情高涨的时候，跌的日子越近。大多数人想买房子的时候，房价不会涨，而房价涨的差不多的时候，大多数人才开始买房子。不会有这样一件事情让大家都变成功，发了财，历史上不曾有过，将来也不会发生。有些东西即使一时运气好得到了，还是会在别的时候别的地方失去的。
　　年轻人在职业生涯的刚开始，尤其要注意的是，要做对的事情，不要让自己今后几十年的人生总是提心吊胆，更不值得为了一份工作赔上自己的青春年华。我的公司是个不行贿的公司，以前很多人不理解，甚至自己的员工也不理解，不过如今，我们是同行中最大的企业，客户乐意和我们打交道，尤其是在国家打击腐败的时候，每个人都知道我们做生意不给钱的名声，都敢于和我们做生意。而勇于给钱的公司，不是倒了，就是跑了，要不就是每天睡不好觉，人还是要看长远一点。很多时候，看起来最近的路，其实是最远的路，看起来最远的路，其实是最近的路。
　　跟对人是说，入行后要跟个好领导好老师，刚进社会的人做事情往往没有经验，需要有人言传身教。对于一个人的发展来说，一个好领导是非常重要的。所谓“好”的标准，不是他让你少干活多拿钱，而是以下三个。
　　首先，好领导要有宽广的心胸，如果一个领导每天都会发脾气，那几乎可以肯定他不是个心胸宽广的人，能发脾气的时候却不发脾气的领导，多半是非常厉害的领导。中国人当领导最大的毛病是容忍不了能力比自己强的人，所以常常可以看到的一个现象是，领导很有能力，手下一群庸才或者手下一群闲人。如果看到这样的环境，还是不要去的好。
　　其次，领导要愿意从下属的角度来思考问题，这一点其实是从面试的时候就能发现的，如果这位领导总是从自己的角度来考虑问题，几乎不听你说什么，这就危险了。从下属的角度来考虑问题并不代表同意下属的说法，但他必须了解下属的立场，下属为什么要这么想，然后他才有办法说服你，只关心自己怎么想的领导往往难以获得下属的信服。
　　第三，领导敢于承担责任，如果出了问题就把责任往下推，有了功劳就往自己身上揽，这样的领导不跟也罢。选择领导，要选择关键时刻能抗得住的领导，能够为下属的错误买单的领导，因为这是他作为领导的责任。
　　有可能，你碰不到好领导，因为，中国的领导往往是屁股决定脑袋的领导，因为他坐领导的位置，所以他的话就比较有道理，这是传统观念官本位的误区，可能有大量的这种无知无能的领导，只是，这对于你其实是好事，如果将来有一天你要超过他，你希望他比较聪明还是比较笨？相对来说这样的领导其实不难搞定，只是你要把自己的身段放下来而已。多认识一些人，多和比自己强的人打交道，同样能找到好的老师，不要和一群同样郁闷的人一起控诉社会，控诉老板，这帮不上你，只会让你更消极。和那些比你强的人打交道，看他们是怎么想的，怎么做的，学习他们，然后跟更强的人打交道。
八、选择
　　我们每天做的最多的事情，其实是选择，因此在谈职业生涯的时候不得不提到这个话题。
　　我始终认为，在很大的范围内，我们究竟会成为一个什么样的人，决定权在我们自己，每天我们都在做各种各样的选择，我可以不去写这篇文章，去别人的帖子拍拍砖头，也可以写下这些文字，帮助别人的同时也整理自己的思路，我可以多注意下格式让别人易于阅读，也可以写成一堆，我可以就这样发上来，也可以在发以前再看几遍，你可以选择不刮胡子就去面试，也可以选择出门前照照镜子……每天，每一刻我们都在做这样那样的决定，我们可以漫不经心，也可以多花些心思，成千上万的小选择累计起来，就决定了最终我们是个什么样的人。
　　从某种意义上来说我们的未来不是别人给的，是我们自己选择的，很多人会说我命苦啊，没得选择阿，如果你认为“去微软还是去IBM”“上清华还是上北大”“当销售副总还是当厂长”这种才叫选择的话，的确你没有什么选择，大多数人都没有什么选择。但每天你都可以选择是否为客户服务更周到一些，是否对同事更耐心一些，是否把工作做得更细致一些，是否把情况了解得更清楚一些，是否把不清楚的问题再弄清楚一些……你也可以选择在是否在痛苦中继续坚持，是否抛弃掉自己的那些负面的想法，是否原谅一个人的错误，是否相信我在这里写下的这些话，是否不要再犯同样的错误……生活每天都在给你选择的机会，每天都在给你改变自己人生的机会，你可以选择赖在地上撒泼打滚，也可以选择咬牙站起来。你永远都有选择。有些选择不是立竿见影的，需要累积，比如农民可以选择自己常常去浇地，也可以选择让老天去浇地，诚然你今天浇水下去苗不见得今天马上就长出来，但常常浇水，大部分苗终究会长出来的，如果你不浇，收成一定很糟糕。
　　每天生活都在给你机会，他不会给你一叠现金也不会拱手送你一个好工作，但实际上，他还是在给你机会。我的家庭是一个普通的家庭，没有任何了不起的社会关系，我的父亲在大学毕业以后就被分配到了边疆，那个小县城只有一条马路，他们那一代人其实比我们更有理由抱怨，他们什么也没得到，年轻的时候文化大革命，书都没得读，支援边疆插队落户，等到老了，却要给年轻人机会了。他有足够的理由象成千上万那样的青年一样坐在那里抱怨生不逢时，怨气冲天。然而在分配到边疆的十年之后，国家恢复招研究生，他考回了原来的学校。研究生毕业，他被分配到了安徽一家小单位里，又是3年以后，国家第一届招收博士生，他又考回了原来的学校，成为中国第一代博士，那时的他比现在的我年纪还大。生活并没有放弃他，他也没有放弃生活。10年的等待，他做了他自己的选择，他没有放弃，他没有破罐子破摔，所以时机到来的时候，他改变了自己的人生。你最终会成为什么样的人，就决定在你的每个小小的选择之间。
　　你选择相信什么？你选择和谁交朋友？你选择做什么？你选择怎么做？……我们面临太多的选择，而这些选择当中，意识形态层面的选择又远比客观条件的选择来得重要得多，比如选择做什么产品其实并不那么重要，而选择怎么做才重要。选择用什么人并不重要，而选择怎么带这些人才重要。大多数时候选择客观条件并不要紧，大多数关于客观条件的选择并没有对错之分，要紧的是选择怎么做。一个大学生毕业了，他要去微软也好，他要卖猪肉也好，他要创业也好，他要做游戏代练也好，只要不犯法，不害人，都没有什么关系，要紧的是，选择了以后，怎么把事情做好。
　　除了这些，你还可以选择时间和环境，比如，你可以选择把这辈子最大的困难放在最有体力最有精力的时候，也可以走一步看一步，等到了40岁再说，只是到了40多岁，那正是一辈子最脆弱的时候，上有老下有小，如果在那个时候碰上了职业危机，实在是一件很苦恼的事情。与其如此不如在20多岁30多岁的时候吃点苦，好让自己脆弱的时候活得从容一些。你可以选择在温室里成长，也可以选择到野外磨砺，你可以选择在办公室吹冷气的工作，也可以选择40度的酷热下，去见你的客户，只是，这一切最终会累积起来，引导你到你应得的未来。
　　我不敢说所有的事情你都有得选择，但是绝大部分事情你有选择，只是往往你不把这当作一种选择。认真对待每一次选择，才会有比较好的未来。
九、选择职业
　　职业的选择，总的来说，无非就是销售、市场、客服、物流、行政、人事、财务、技术、管理几个大类，有个有趣的现象就是，500强的CEO当中最多的是销售出身，第二多的人是财务出身，这两者加起来大概超过95％。现代IT行业也有技术出身成为老板的，但实际上，后来他们还是从事了很多销售和市场的工作，并且表现出色，公司才获得了成功，完全靠技术能力成为公司老板的，几乎没有。这是有原因的，因为销售就是一门跟人打交道的学问，而管理其实也是跟人打交道的学问，这两者之中有很多相通的东西，他们的共同目标就是“让别人去做某件特定的事情。”而财务则是从数字的层面了解生意的本质，从宏观上看待生意的本质，对于一个生意是否挣钱，是否可以正常运作有着最深刻的认识。
　　公司小的时候是销售主导公司，而公司大的时候是财务主导公司，销售的局限性在于只看人情不看数字，财务的局限性在于只看数字不看人情。公司初期，运营成本低，有订单就活得下去，跟客户也没有什么谈判的条件，别人肯给生意做已经谢天谢地了，这个时候订单压倒一切，客户的要求压倒一切，所以当然要顾人情。公司大了以后，一切都要规范化，免得因为不规范引起一些不必要的风险，同时运营成本也变高，必须提高利润率，把有限的资金放到最有产出的地方。对于上市公司来说，股东才不管你客户是不是最近出国，最近是不是那个省又在搞严打，到了时候就要把业绩拿出来，拿不出来就抛股票，这个时候就是数字压倒一切。
　　前两天听到有人说一句话觉得很有道理，开始的时候我们想“能做什么？”，等到公司做大了有规模了，我们想“不能做什么。”很多人在工作中觉得为什么领导这么保守，这也不行那也不行，错过很多机会。很多时候是因为，你还年轻，你想的是“能做什么”，而作为公司领导要考虑的方面很多，他比较关心“不能做什么”。
　　我并非鼓吹大家都去做销售或者财务，究竟选择什么样的职业，和你究竟要选择什么样的人生有关系，有些人就喜欢下班按时回家，看看书听听音乐，那也挺好，但就不适合找个销售的工作了，否则会是折磨自己。有些人就喜欢出风头，喜欢成为一群人的中心，如果选择做财务工作，大概也干不久，因为一般老板不喜欢财务太积极，也不喜欢财务话太多。先想好自己要过怎样的人生，再决定要找什么样的职业。有很多的不快乐，其实是源自不满足，而不满足，很多时候是源自于心不定，而心不定则是因为不清楚究竟自己要什么，不清楚要什么的结果就是什么都想要，结果什么都没得到。
　　我想，我们还是因为生活而工作，不是因为工作而生活，生活是最要紧的，工作只是生活中的一部分。我总是觉得生活的各个方面都是相互影响的，如果生活本身一团乱麻，工作也不会顺利。所以要有娱乐、要有社交、要锻炼身体，要有和睦的家庭……最要紧的，要开心，我的两个销售找我聊天，一肚子苦水，我问他们， 2年以前，你什么都没有，工资不高，没有客户关系，没有业绩，处于被开的边缘，现在的你比那时条件好了很多，为什么现在却更加不开心了？如果你做得越好越不开心，那你为什么还要工作？首先的首先，人还是要让自己高兴起来，让自己心态好起来，这种发自内心的改变会让你更有耐心，更有信心，更有气质，更能包容……否则，看看镜子里的你，你满意么？
有人会说，你说得容易，我每天加班，不加班老板就会把我炒掉，每天累得要死，哪有时间娱乐、社交、锻炼？那是人们把目标设定太高的缘故，如果你还在动不动就会被老板炒掉的边缘，那么你当然不能设立太高的目标，难道你还想每天去打高尔夫？你没时间去健身房锻炼身体，但是上下班的时候多走几步可以吧，有楼梯的时候走走楼梯不走电梯可以吧？办公的间隙扭扭脖子拉拉肩膀做做俯卧撑可以吧？谁规定锻炼就一定要拿出每天2个小时去健身房？你没时间社交，每月参加郊游一次可以吧，周末去参加个什么音乐班，绘画班之类的可以吧，去尝试认识一些同行，和他们找机会交流交流可以吧？开始的时候总是有些难的，但迈出这一步就会向良性循环的方向发展。而每天工作得很苦闷，剩下的时间用来咀嚼苦闷，只会陷入恶性循环，让生活更加糟糕。

虽然离开惠普仅有十五天，但感觉上惠普已经离我很远。我的心思更多放在规划自己第二阶段的人生，这并非代表我对惠普没有任何眷恋，主要还是想以此驱动自己往前走。
　　万科王石登珠穆朗玛峰的体验给我很多启发，虽然在出发时携带大量的物资，但是登顶的过程中，必须不断减轻负荷，最终只有一个氧气瓶和他登上峰顶。登山如此，漫长的人生又何尝不是。
　　我宣布退休后，接到同事朋友同学的祝贺。大部分人都认为我能够在这样的职位上及年龄选择退休，是一种勇气，也是一种福气。
　　还有一部分人怀疑我只是借此机会换个工作，当然还有一些人说我在HP做不下去了，趁此机会离开。
　　我多年来已经习惯别人对我的说三道四，但对于好友，我还是挺关心大家是否真正理解我的想法，这也是写这篇文章的目的。
　　由于受我父亲早逝的影响，我很早就下定决心，要在有生之年实现自己的愿望，我不要像我父亲一样，为家庭生活忙碌一辈子，临终前感伤，懊恼自己有很多没有实现的理想。
　　一本杂志的文章提到我们在生前就应该思考自己的墓志铭，因为那代表你自己对完美人生的定义，我们应该尽可能在有生之年去实现它。
　　我希望我的墓志铭上除了与家人及好友有关的内容外，是这样写着：
　　1、这个人曾经服务于一家全球最大的IT公司（HP）25年，和她一起经历过数次重大的变革，看着她从以电子仪表为主要的业务变革成全球最大的IT公司。
　　2、这个人曾经在全球发展最快的国家（中国）工作16年，并担任HP中国区总裁7年，见证及经历过中国改革开放的关键最新突破阶段，与中国一起成长。
　　3、这个人热爱飞行，曾经是一个有执照的飞行员，累积飞行时数超过X小时，曾经在X个机场起降过。
　　4、这个人曾经获得管理硕士学位，在领导管理上特别关注中国企业的组织行为及绩效，并且在这个领域上获得中国企业界的认可。
　　我费时25年才总结1和2两项成果，我不知还要费时多久才能达成3和4的愿望，特别是第4个愿望需要经历学术的训练，才能将我的经验总结成知识。否则我的经验将无法有效影响及传授他人。因此重新进入学校学习，拿一个管理学位是有必要的，更何况这是我一个非常重要的愿望。
　　另一方面，我25年的时间都花在运营(operation)的领域，兢兢业业的做好职业人士的工作，它是一份好工作，特别是在HP，这份工作也帮助我建立财务的基础，支持家庭的发展。
　　但是我不想终其一生，都陷入在运营的领域，我想象企业家一样，有机会靠一些点子(ideas)赚钱，虽然风险很高，但是值得一试，即使失败，也不枉走一回，这也是第4个愿望其中的一部份。
　　Carly Fiorina曾经对我说过“这个世界上有好想法的人很多，但有能力去实现的人很少”，2007年5月21日在北大演讲时，有人问起哪些书对我影响较大，我想对我人生观有影响的其中一本书叫“TriggerPoint”，它的主要观点是：人生最需要的不是规划，而是在适当的时机掌握机会，采取行动。
　　我这些愿望在我心中已经酝酿一段很长的时间，开始的时候，也许一年想个一两次，过了也就忘掉，但逐渐的，这个心中的声音，愈来愈大，出现的频率也愈来愈高，当它几乎每一个星期都会来与我对话时，我知道时机已经成熟。
　　但和任何人一样，要丢掉自己现在所拥有的，所熟悉的环境及稳定的收入，转到一条自己未曾经历过，存在未知风险的道路，需要绝大的勇气，家人的支持和好友的鼓励。有舍才有得，真是知易行难，我很高兴自己终于跨出了第一步。
　　我要感谢HP的EER提前退休优惠政策，它是其中一个关键的TriggerPoints,另一个关键因素是在去年五六月发生的事。
　　当时我家老大从大学毕业，老二从高中毕业，在他们继续工作及求学前，这是一个黄金时段，让我们全家可以相聚一段较长的时间，我为此很早就计划休一个长假，带着他们到各地游玩。
　　但这个计划因为工作上一件重要的事情（Mark Hurd访华）不得不取消。这个事件刺激了我必须严肃的去对待那心中的声音，我会不会继续不断的错失很多关键的机会?
　　我已经年过50，我会不会走向和我父亲一样的道路？人事部老总Charles跟我说，很多人在所有对他有利的星星都排成一列时，还是错失时机。
　　我知道原因，因为割舍及改变对人是多么的困难，我相信大部分的人都有自己人生的理想，但我也相信很多人最终只是把这些理想当成是幻想，然后不断的为自己寻找不能实现的藉口，南非前总统曼德拉曾经说过，“与改变世界相比，改变自己更困难”，真是一针见血。
　　什么是快乐及有意义的人生？我相信每一个人的定义都不一样，对我来说，能实现我墓志铭上的内容就是我的定义。
　　在中国惠普总裁的位置上固然可以吸引很多的关注及眼球，但是我太太及较亲近的好友，都知道那不是我追求的，那只是为扮演好这个角色必须尽力做好的地方。
　　做一个没有名片的人士，虽然只有十多天的时间，但我发现我的脑袋里已经空出很多空间及能量，让我可以静心的为我ChapterII的新生活做细致的调研及规划。
　　我预订以两年的时间来完成转轨的准备工作，并且花多点时间与家人共处。这两年的时间我希望拿到飞行执照，拿到管理有关的硕士学位，提升英文的水平，建立新的网络，多认识不同行业的人，保持与大陆的联系。希望两年后，我可以顺利回到大陆去实现我第四个愿望。
　　毫不意外，在生活上，我发现很多需要调整的地方。
　　二十多年来，我生活的步调及节奏，几乎完全被公司及工作所左右，不断涌出的deadline及任务驱动我每天的安排，一旦离开这样的环境，第一个需要调整的就是要依靠自己的自律及意志力来驱动每天的活动，睡觉睡到自然醒的态度绝对不正确，放松自己，不给事情设定目标及时间表，或者对错失时间目标无所谓，也不正确，没有年度，季度，月及周计划也不正确。
　　担任高层经理多年，已经养成交待事情的习惯，自己的时间主要花在思考，决策及追踪项目的进展情况，更多是依靠一个庞大的团队来执行具体的事项及秘书来处理很多协调及繁琐的事情。
　　到美国后，很多事情需要打800号电话联系，但这些电话很忙，常让你在waitingline上等待很长的时间，当我在等待时，我可以体会以前秘书工作辛苦的地方，但同时也提醒我自己，在这个阶段要改变态度，培养更大的耐性及自己动手做的能力。
　　生活的内容也要做出很大的调整，多出时间锻炼身体，多出时间关注家人，多出时间关注朋友，多出时间体验不同的休闲活动及飞行，一步步的，希望生活逐步调整到我所期望的轨道上，期待这两年的生活既充实又充满乐趣及意义。
　　第一个快乐的体验就是准备及参加大儿子的订婚礼，那种全心投入，不需担忧工作数字的感觉真好。同时我也租好了公寓，买好了家具及车子，陪家人在周末的时候到Reno及Lake Tahoe玩了一趟，LakeTahoe我去了多次，但这次的体验有所不同，我从心里欣赏到它的美丽。
　　但同时我也在加紧调研的工作，为申请大学及飞行学校做准备，这段时间也和在硅谷的朋友及一些风险投资公司见面，了解不同的产业。
　　我的人生观是“完美的演出来自充分的准备”，“勇于改变自己，适应不断变化的环境，机会将不断出现”，“快乐及有意义的人生来自于实现自己心中的愿望，而非外在的掌声”。
　　我离开时，有两位好朋友送给我两个不同的祝语，Baron的是“多年功过化烟尘”，杨华的是“莫春者，风乎舞雩，咏而归”，它们分别代表了我离开惠普及走向未来的心情。
　　我总结人生有三个阶段，一个阶段是为现实找一份工作，一个阶段是为现实、但可以选择一份自己愿意投入的工作，一个阶段是为理想去做一些事情。
　　我珍惜我的福气，感激HP及同事、好朋友给我的支持，鼓励及协助，这篇文字化我心声的文章与好友分享。

2008-03-25T23:38:00.007+08:00

今天白天在办公室看了将近一章的C++书。然后回家看了几页"understanding linux driver"，看这本书的进度很慢，想改进一下看书的方法。上网查了查别人的学习方法，发现有些方法可以借鉴：
1。内核不过就几部分。想做什么方面的就学什么方面的。
2。Arch部分不要管，除非你在为一个chipset Vender做。当然关键时候还得看看－－得有hardware的基础（别以为学点i386的体系就是知道hardware），各种接口协议你得懂，比如PCI总线。
3。Net部分，linux用得最多的是在网络通信产品中。少了这部分就没什么发展。
4。内存管理。linux中内存管理的实现大部分是根据arch的特性。大概了解就可以。
5。driver部分，driver有很多种，找个device的datasheet,结合起来看才有点用。
6。进程调度，linux中的精华。简单而可靠－－－取其精神，用于以后的程序设计中。
7。文件系统。事实上也就是设备driver的一部分。知道怎么用就行。
8。情景分析，初学者可以试试看看，系统的启动顺序。从start_kernel()开始跟踪下去。

所以觉得还是要把书粗粗地看一边（包括"linux device driver"), 然后再开始编一些简单的驱动程序，不懂的再翻看书中的相关部分。

有用的学习内核的网站:
http://www.oldlinux.org/

Some steps to make you become richer

2008-03-01T23:00:00.003+08:00

1. Work Smart
Working hard for your money should be a temporary situation until your money starts working hard enough to take your place.

You should set up passive sources of income, which allows you to live your desired lifestyle without having to work or rely on anyone else for money. There are two categories of passive income: Investment earnings from financial instruments such as stocks, bonds, mutual funds, etc, as well as owning mortgages or assets that appreciate in value and can be liquiated for cash. Another type of passive income entails generating ongoing income from business you do not need to personally be involved with. These could be rental from real estate, royalties from intellectual property, licensing your ideas, and becoming a franchisor.

2. Invest in Yourself
The only way for you to have the money you want is to play the game inside out. You need to learn the skills and strategies to accelate your income, manage your money and invest effectively.

2008-02-27T19:51:00.004+08:00

Yesterday is my 33 years old birthday. I went out with wife to have a dinner at Ding Taifeng. Actually we planned to watch a movie but went back home after dinner in the end.

Automatically Start Applications after Login

2008-01-31T16:27:00.004+08:00

Programs that you wish to autostart on Xfce4 startup can be selected by using the xfce4-autostart-editor tool available in Xfce4 menu > Settings > Xfce 4 Autostarted Applications.

If the GUI is not desirable, you can put .desktop files in the ~/.config/autostart/ directory. If this directory does not exist, simply create it.

Details about Gnome and KDE is in
http://gentoo-wiki.com/HOWTO_Autostart_Programs

Automatically Start Applications after Login

2008-01-31T16:27:00.003+08:00

Disable Firewall in Ubuntu

2008-01-31T14:13:00.001+08:00

# iptables -F
# iptables -X
# iptables -t nat -F
# iptables -t nat -X
# iptables -t mangle -F
# iptables -t mangle -X
# iptables -P INPUT ACCEPT
# iptables -P OUTPUT ACCEPT

Enable SSH in Ubuntu

2008-01-31T13:44:00.001+08:00

1. sudo -s
2. apt-get install ssh
3 /etc/init.d/ssh start or restart

Photos taken in Vietname

2008-01-27T19:14:00.000+08:00

Investment

2008-01-27T17:59:00.001+08:00

After purchasing my house, I start to consider putting some money into stocks or funds. Because the interest rate of bank deposit account is too low and the current inflation rate is about 4.5%, it seems investing money in stock or fund market is a better choice for a long time.
As usual, I learned a basic knowledge of investment by reading before I start putting money in stocks or funds. I spent about two weeks reading some books and articles published in web sites. Although there are a lot of complicated details on how to invest, one sentence can conclude these details: "investment with high risk yields high return". For the beginner, like me, index fund with low cost and low turnover is a good choice. With more experience, we can have more options in investment. But no matter how experienced we are, we must have a right plan on investment and stick to the plan.

Memory Addressing (2)

2008-01-09T10:38:00.002+08:00

1. Linux prefers paging to segmentation. So the 2.4 version of linux uses segmentation only when required by the 80x86 architecture.

2. The segments used by Linux
1) A kernel segment: the corresponding Segment Selector is defined by the __KERNEL_CS macro.
2) a kernel data segment: the corresponding Segment Selector is defined by the __KERNEL_DS macro.
3) a user code segment: the corresponding Segment Selector is defined by the __USER_CS macro.
4) a user data segment: the corresponding Segment Selector is defined by the __USER_DS macro.
5) a Task State Segment (TSS) for each processor.
6) a default Local Descriptor Table (LDT)
7) four segments related to Advanced Power Management (APM) support.

3. Contiguous addresses within a page are mapped into contiguous physical addresses.

Convert and Split Video fiel in Linux

2008-01-08T16:52:00.001+08:00

1. Convert Video file
1) To convert mp4 video to avi:

mencoder video.mp4 -ovc lavc -vf scale=352:288 -oac lavc -o video.avi

2) To convert avi to mpeg video:

ffmpeg -i video.avi -target pal-vcd video.mpg

or

ffmpeg -i video.avi -target pal-vcd -s 352x192 -padtop 32 -padbottom 32 video.mpg

Note: -target pal-vcd is for PAL. For NTSC, use -target ntsc-vcd. -padtop 32 and -padbottom 32 will add black padding at the top and bottom.

In certain cases, if you have problem with de-sync audio for the resulted mpeg, try using mencoder like this for PAL format VCD:

mencoder -oac lavc -ovc lavc -of mpeg -mpegopts format=xvcd -vf \
scale=352:288,harddup -srate 44100 -af lavcresample=44100 -lavcopts \
vcodec=mpeg1video:keyint=15:vrc_buf_size=327:vrc_minrate=1152:\
vbitrate=1152:vrc_maxrate=1152:acodec=mp2:abitrate=224 -ofps 25 \
-o movie.mpg movie.avi

3) To convert avi to SVCD format:

ffmpeg -i video.avi -target pal-svcd video.mpg

Note: -target pal-svcd is for PAL. For NTSC, use -target ntsc-svcd.

see details in http://muhdzamri.blogspot.com/search/label/ffmpeg

4) To convert wmv to avi format

mencoder infile.wmv -ofps 23.976 -ovc lavc -oac copy -o outfile.avi

5) To convert mov to avi format

mencoder -ovc copy -oac pcm -o output.avi

2. Split Video file
1) To split avi

avisplit -s 700 -i my_file.avi

will split the file my_file.avi into chunks which's maximum size will not exceed 700 MB, i.e. they will fit onto a CD, each. The created chunks will be named my_file.avi-0000, my_file.avi-0001, etc.

see details in http://www.transcoding.org/cgi-bin/transcode?Avisplit

2. To split mpeg

mpgtx -166 matrix-trailer.mpg -b mychunk

will split matrix-trailer.mpg into 166 playable chunks with the basename mychunk

see details in http://mpgtx.sourceforge.net/#Examples

Memory Addressing (1)

2008-01-08T10:48:00.001+08:00

1. 80x86 microprocessor has 3 kinds of addresses:
1) Logical address: segment indentifier + offset
2) Linear address ( also named as virtual address)
3) physical address

2. Translation among the above 3 kinds of addresses.
logical address --> [segmentation unit] --> linear address -->[paging unit]-->physical address

3. Intel microprocessors perform address translation into two modes: real mode and protected mode. Real mode exists mostly for backward compatibility and bootstrap.

4. To speed up the translation of logical address into linear address, the 80x86 processor provides an additional nonprogrammable register for each of the 6 programmable segmentation register.
Each nonprogrammable register contains the 8-byte Segment Descriptor specified by the Segment Selector contained in the corresponding segmentation register.

读三浦展的“下流社会”

2007-12-23T22:56:00.001+08:00

按照书中所说，所谓“下流”不仅仅是收入低下，其人际沟通能力，生活能力，工作热情，学习意愿，消费欲望等也都全部较之一般人更为低下。

男性的分化：
1 白领精英族
性格积极主动，兴趣爱好也比较偏爱于外向型的比较动感的活动，如体育运动等，重视结婚，成家，将之与立业及成功放在同等位置，总之对于人生目标明确，心无旁骛。
然而，白领精英们往往缺少自己独特的富有个性的价值观，对于社会上流行的，大多数人为好的和向往的东西，他们会抢先一步入手装点自己，并且从中体验到一种满足感。

2 “LOHAS族”

“LOHAS” 是"Lifestyle of Health and Sustainability“。拥有这一志向的人群相对具有较高的学历和较好的收入。他们喜欢按照自己的人生节奏，从事自己喜爱的工作。除了在单位努力工作外，他们还积极参加社会活动，志愿者活动等。对国际问题，环境问题非常关注。
“LOHAS族“中夫妇双方各自拥有工作的人数略占多数。在消费意识方面，“LOHAS族“并不醉心于一流品牌商品，而是选择不太张扬的二三流品牌。不会购买一辆“奔驰“或“宝马“，至多是开“美洲豹“或“标致“。
“LOHAS“还热心于在因特网上制作个人网页，用来经常与职场以外的人联系，构筑起广泛的人脉。

做人的原则

2007-11-11T12:25:00.001+08:00

人不能太死板，要懂得应变。不能说话办事缺乏灵活性和针对性，用一种态度，一种方式对待所有的人和事。要善于从对方的需要和好恶出发去选择自己的言语和方式。迎合别人的需要和好恶并不是不讲道德不要原则，因为它仅仅是顺应了一条最普通的心理规律，即：每个人都是希望被认同的。

要聪明不要精明。聪明的人一般不计较眼下的区区得失，而是把眼光放长远，时刻有一个总体的事业目标，所有努力都是为了这个目标而服务的。精明的人总是很过敏地盯住眼前的利益。

做人不能太偏激。古人云， "忍"字头上一把刀。说明要具备这样一种心理素质也不是一件容易的事。要想具备不急不躁，心平气和的良好心理素质，就要从日常生活中锻炼与家人，亲戚，朋友，同事在个人关系方面须讲究大度，特别是在财运不济，性情郁闷时尤要如此. 喜怒哀乐不形于色，学会倾听别人的意见，哪怕是激烈的言辞，避其锋芒，在适当的时候加以解释和说明。

15 种导致失败的性格：（ 0 - 10，自我评价）

1。知足 - 2

2。自满 - 5

3。保守 - 5

4。懦弱 - 6

5。懒惰（身体，大脑）- 6

7。孤僻 - 7

8。自以为是 - 5

9。狭隘（心胸，视野，知识结构）- 7

10。自私 - 5

11。狂妄 - 0

12。消极 - 5

13。轻信 - 7

14。多疑 - 2

15。冲动 - 7

Software Project Management - Inspection

2007-11-04T18:31:00.001+08:00

1. The goal of the inspection is for all of the inspector to reach consensus on a work product and approve it for use in the project.

2. The job of the inspection team is to work with the author of the document in order to identity any defects and provide a solution to fix it.

3. A moderator need to be selected to control the inspection meeting and be able to objectively evaluate the work product being inspected. The moderator need compile all of the defect resolutions into an inspection log.

------------------------------------------------------------------------------------------------------------------

------------------------------------------------------------------------------------------------------------------

| Attendees: | Mike, Barbara, Jill |

-------------------------------------------------------------------------------------------------------------------

| Time spent | 3 hours |

-------------------------------------------------------------------------------------------------------------------

| |

-------------------------------------------------------------------------------------------------------------------

--------------------------------------------------------------------------------------------------------------------

--------------------------------------------------------------------------------------------------------------------

--------------------------------------------------------------------------------------------------------------------

3. Inspect the work product

During the inspection meeting, the moderator does not actually read each page out loud or give the team time to read the page. The team members read the document prior to the inspection, during their preparation. When the moderator goes through the document page by page, he simply asks the reviewers for their defects on page 1; once those are done, he asks for the defects on page 2 ...

The steps of inspection includes:

1) preparation - each inspector reviews the printed copy of the work product individually, prior to the inspection meeting.

2) overview - the moderator verifies that each inspection team member has read the printed copy of the work product.

3) page-by-page review - the moderator asks for defects on every page.

4) rework - after the inspection meeting, the author makes the changes in the inspection log and works with the inspection team members to resolve all open issues.

5) follow-up - the moderator distributes the updated work product to the inspection team.

6) approval - if any inspector feels that there are still further issues, another inspection meeting can be held. Otherwise, approve the updated work product.

More information on inspection can be found in "Software inspection " by Tom Gilb and Dorothy Graham (Addison Wesley, 1993) and "Peer reviews in software " by Karl Wiegers (Addison Wesley, 2002) Information on the effectiveness of software inspection can be found in the Software Technology Roadmap: http://www.sei.cmu.edu/str/

4. Walkthroughs

A walkthrough is an informal way of presenting a technical document in a meeting. The author runs the walkthrough: calling the meeting, inviting the reviewers, soliciting comments, and ensuring that everyone present understands the work product. Work products that are commonly reviewed using a walkthrough include design specification and use cases.

5. Code reviews

In a code review, a defect is a block of code that does not properly implement its requirements, that does not function as the programmer intended, or that is not incorrect but could be improved.

The first task in a code review is to select the sample of code to be inspected. It's impossible to review every line of code. The candidate portion of the code to be reviewed is:

1) the portion of the software that only one person has the expertise to maintain.

2) the portion implements a highly abstract or tricky algorithm.

3) the code written by someone who is inexperienced or has not written that kind of code before.

4) an area of code that will be especially catastrophic if there are defects.

5) an object, library, or API that is particularly difficult to work with.

Using Rsync and SSH

2007-10-31T14:35:00.001+08:00

You'll need these packages installed:

rsync
openssh
cron (or vixie-cron)

1. Use SSH without password
Use ssh-keygen command as follows:

$ ssh-keygen -t dsa

Next make sure you have correct permission on .ssh directory:

$ cd $ chmod 755 .ssh

Now copy file ~/.ssh/id_dsa.pub on Machine #1 (tom) to remote server jerry as ~/.ssh/authorized_keys:

$ scp ~/.ssh/id_dsa.pub user@jerry:.ssh/authorized_keys

$ chmod 600 ~/.ssh/authorized_keys

2.Create the sricpt

The script should like this:
#!/bin/sh

RSYNC=/usr/bin/rsync
SSH=/usr/bin/ssh
KEY=/home/thisuser/cron/thishost-rsync-key
RUSER=remoteuser
RHOST=remotehost
RPATH=/remote/dir
LPATH=/this/dir/

$RSYNC -az -e "$SSH -i $KEY" $LPATH $RUSER@$RHOST:$RPATH

3. put in cron
When I get the script running successfully, I use 'crontab -e' to insert a line for this new cron job:

0 5 * * * /home/thisuser/cron/rsync-remotehost-backups

for a daily 5 AM sync, or:

0 5 * * 5 /home/thisuser/cron/rsync-remotehost-backups

for a weekly (5 AM on Fridays). Monthly and yearly ones are rarer for me, so look at "man crontab" or here for advice on those.

start a terminal in a remote machine

2007-10-31T11:46:00.002+08:00

ssh -f root@10.0.0.10 "DISPLAY=:0.0 xterm -e '/root/vnode/latest/clirsrv.sh' "&

g4u - Harddisk Image Cloning for PCs

2007-10-29T14:16:00.001+08:00

see the link http://www.feyrer.de/g4u/

Install FTP server in Fedora 7

2007-10-29T14:12:00.001+08:00

http://www.server-world.info/en/note?os=fc7&p=ftp

[1]

Build FTP server to transfer files. Install and configure vsftpd for it.

[root@www ~]#

yum -y install vsftpd

Loading "installonlyn" plugin
Loading "fastestmirror" plugin
Loading mirror speeds from cached hostfile
Setting up Install Process
Parsing package install arguments
Resolving Dependencies
--> Running transaction check
---> Package vsftpd.i386 0:2.0.5-16.fc7 set to be updated
Dependencies Resolved

===========================================================
Package

Arch

Version

Repository

Size

===========================================================
Installing:
vsftpd

i386

2.0.5-16.fc7

fedora

138 k

Transaction Summary
===========================================================
Install

1 Package(s)

Update

0 Package(s)

Remove

0 Package(s)

Total download size: 138 k
Downloading Packages:
(1/1): vsftpd-2.0.5-16.fc

100% |====================| 138 kB 00:00

Running Transaction Test
Finished Transaction Test
Transaction Test Succeeded
Running Transaction
Installing: vsftpd

#################################### [1/1]

Installed: vsftpd.i386 0:2.0.5-16.fc7
Complete!
[root@www ~]#

vi /etc/vsftpd/vsftpd.conf

// open the file

anonymous_enable= NO

// line 12: no anonymous

ascii_upload_enable=YES

// line 79: make valid

ascii_download_enable=YES

(permit ascii mode transfer)

chroot_list_enable=YES

// line 94: make valid

(enable chroot list)

chroot_list_file=/etc/vsftpd/chroot_list

// line 96: make valid

(chroot list file)

ls_recurse_enable=YES

// line 102: make valid

chroot_local_user=YES

// bottom: enable chroot

local_root=public_html

// root directory

use_localtime=YES

// use local time

[root@www ~]#

vi /etc/vsftpd/chroot_list

// create the file

fedora

// write user you permit

[root@www ~]#

/etc/rc.d/init.d/vsftpd start

[root@www ~]#

chkconfig vsftpd on

// set autostart

[2]

Add CNAME in DNS for FTP server.

[root@ns ~]#

vi /var/named/server-linux.info.lan

$TTL

86400

SOA

ns.server-linux.info. root.server-linux.info. (

2007

060503

;Serial

// update serial number

3600

;Refresh

1800

;Retry

604800

;Expire

86400

;Minimum TTL

)

ns.server-linux.info.

192.168.0.17

MX 10

ns.server-linux.info.

192.168.0.17

www

192.168.0.18

nfs

CNAME

ns.server-linux.info.

ftp

CNAME

www.server-linux.info.

// add CNAME

[root@ns ~]#

rndc reload

// reload

server reload successful

Software Project Management - Project Schedules

2007-10-21T10:20:00.000+08:00

Track the performance of the project

- After the schedule is completed and optimized, it should be set aside and used as the baseline. Every time a change to the scope of the project is approved, the schedule should be adjusted. Thus, there is an actual version of the schedule that is updated to reflect what actually happened over the course of the project.
- The budgeted cost for work scheduled (BCWS) is the estimated effort of the actual tasks that appear on the schedule to date. The actual cost of work performed (ACWP) is the effort spent on the tasks in the schedule that have actually been completed by the development team members. The variance is the difference between these two numbers (BCWS - ACWP). If the variance is positive, then the project cost fewer person-hours than were budgeted; if it is negative, then the project overran the budget.
- Cost performance index (CPI) is calculated by dividing BCWS / ACWP and multiplying by 100 to express it as a percentage. A CPI of 100% means that the estimated cost was exactly right and the project came in exactly on budget. It is under 100%, the work cost less effort than planned; a CPI greater than 100% means that the estimate was not adequate for the work involved.

Software Project Management - Software Project Planning

2007-10-21T00:59:00.000+08:00

Understanding the project needs.

- the project manager must identify the people who are making decision that afftect the project and understand why they need the software built. By talking to them and writing down their needs, the project manager can set the project on its proper course.

Drive the scope of the project

- the start of the porject is the time when the scope of the project is defined; only the project manager is equipped to make sure that it's defined properly.

Talk to the main stakeholder

- more information on understanding user and stakeholder needs can be found in "managing software requirements: a user case approach" by Dean leffingwell and Don widrig (Addison Wesley, 2003)

Write the vision and scope document (outline)

1. problem statement
2. 1. prject background - provide a summory of the project that the project will solve. It should provide a brief history of the problem and an explanation of how the organization justified the decision to build software to address it.
  2. shareholder - a bulleted list of the stakeholders.
  3. users - a bulleted list of the users.
  4. risks - list any potential risks to the project. It should be generated by a project team's brainstorming session.
  5. assumptions - a list of assumptions that the stakeholders, users, or project team have make. Often, these assumptions are generated during a Wideband Delphi estimation session.
3. Vision of the solution
4. 1. vision statement - the goal of the vision statement is to describe what the project is expected to accomplish.
  2. List of features
  3. scope of phased release ( optional) - when software projects are released in phases, a plan divides the features into two or more phases.
  4. features that will not be developed

Review the vision and scope document - performing this review can be as simple as emailing the document to every stakeholder and very project team member.

More information on defining features and creating a vision and scope document can be found in "The Art of Project Management" by Scott Berkun (O'Reilly, 2005). A more detailed template for a vision and scope document is described in "Software Requirements" by Karl Wiegers (Microsoft Press, 1999).

Create the project plan

statement of work

resource list

estimate and project schedule

risk plan

1. brainstorm potential risk
2. estimate the impact of each risk
3. make a mitigation plan

Use Emacs as a editor for web development

2007-09-30T10:10:00.001+08:00

nXhtml is an addon to Emacs for editing XHTML, PHP, javascript, jsp etc.

For a quick start (downloading, installation etc) see the Quick Guide to nXhtml.

Software Development Environments

2007-09-29T16:04:00.000+08:00

1. Classic environments
SCM tool: CVS with CVS monitor (http://sourceforge.net/projects/cvsmonitor/)
Build tool: Ant for projects using Java; otherwise, make
Test environment: xUnit
Bug tracker: FogBugz, but only if the preconfigured settings work for you; otherwise, TestTrack.
Documentation: FrameMaker

2. Modern environments
SCM tool: Subversion with CVS monitor (http://sourceforge.net/projects/cvsmonitor/)
Build tool: Ant for projects using Java; SCons for most projects and other languages
Test environment: xUnit
Bug tracker: JIRA
Documentation: OpenOffice and DocBook

3. SCM software - CVS
CVS (http://www.nongnu.org/cvs/) is by far the most commonly used open source software configuration management tool. The best documentation for CVS was " the Cederavist", also known formally as "version management with CVS"(http://ximbiot.com/cvs/manual/).

ACLs: these allows you to control who can commit files, according to the user, the branch, and the directory name. The cvs_acls script from the contrib directory of the CVS source and the patches from http://cvsacl.sourceforge.net/.
Browsing CVS files: for web-based viewing of repositories, the Python-based ViewCVS interface (http://viewcvs.sourceforge.net) is excellent.
Graphical CVS clients: SmartCVS (http://www.smartcvs.com)

4. Building software
4.1 GNU autotools.
The GNU autotools suit consists of three separate tools - Autoconf, Automake, and Libtool. Autoconf (http://www.gnu.org/software/autoconf) creates shell script named configure. These scripts can be executed to find out which features required by an application are present on a particular platform. Automake (http://www.gun.org/software/automake) use Makefile.am files to create Makefile.in template files, which autoconf can then use to create GNU gmake makefiles. Libtool (http://www.gnu.org/software/libtool) helps create static and shared libraries in a portable and versioned manner for programs that written in C.

4.2 Ant
Ant (http://ant.apache.org) is an open source build tool, part of the Apache community of open source software projects. It is used especially for Java.

4.3 SCons
SCons (http://www.scons.org) is a full-featured build tool.

5. Testing software
5.1 xUnit
JUnit (http://junit.sourceforge.net and http://junit.org) is a well-known open source test environment for Java classes.
CheckFramework (http://check.sourceforge.net/) is a mature well-tested unit test framework for C.
CPPUnit (http://sourceforge.net/projects/cppunit) does C# as well as c++.
UnitTest++ (http://unittest-cpp.sourceforge.net/) for C++
For other languages, check the list: http://c2.com/cgi/wiki?TestingFramework

5.2 DejaGnu (http://www.gnu.org/software/dejagnu). If you need to test your program on many platforms (basically anthing that gcc runs on) or if you want a lot of text-based user interactions as part of your testing, then you should consider use DejaGnu.

5.3 Memory analyzers
The best-known memory analyzers are Electric Fence(http://directory.fsf.org/ElectricFence.html), Valgrind(http://valgrind.kde.org), and dmalloc (http://dmalloc.com).

5.4 Performance Tools
Performanc tools record how often each line, function or method, and class were called, but they also record how much time was spent in each place in the source code.
Gcc supports profiling ability with gprof. Valgrind also has this function.

Linux Evolution Error: lost connection to exchange backend process

2007-09-19T11:27:00.003+08:00

Solution:

evolution –force-shutdown

cd ~/.evolution
cd mail/exchange

ls (to see what directory is there - in my case only one as I only have one exchange server account)

rm -rfv ./(name of directory)

Restart Evolution - did not have to re-create account

Linux Evolution Error: lost connection to exchange backend process

2007-09-19T11:27:00.002+08:00

Solution:

evolution –force-shutdown

cd ~/.evolution
cd mail/exchange

ls (to see what directory is there - in my case only one as I only have one exchange server account)

rm -rfv ./(name of directory)

Restart Evolution - did not have to re-create account

Reinstall Grub using Ubuntu live cd

2007-09-13T16:35:00.001+08:00

If you can't boot your machine when you have installed both linux and windows in the machine, your MBR may be corrupted. So you need reinstall Grub.

1. Boot into the live Ubuntu cd.

2. When you get to the desktop open a terminal and enter.

Code:

sudo grub

This will get you a "grub>" prompt (i.e. the grub shell). At grub>. enter these commands

Code:

find /boot/grub/stage1

Next, THIS IS IMPORTANT, whatever was returned for the find command use it in the next line (you are still at grub>. when you enter the next 3 commands)

Code:

root (hd?,?)

Again use the value from the find command i.e. if find returned (hd0,1) then you would enter root (hd0,1)

Next enter the command to install grub to the mbr

Code:

setup (hd0)

3. Finally exit the grub shell

Code:

quit

That is it. Grub will be installed to the mbr.

4. When you reboot, you will have the grub menu at startup.

Building a new SELinux policy module

2007-09-12T13:38:00.002+08:00

A good article to explain how to use the GUI tool - "system-config-selinux" to create a new policy module:

http://www.redhatmagazine.com/2007/08/21/a-step-by-step-guide-to-building-a-new-selinux-policy-module/

Who’s afraid of SELinux? Well, if you are, you shouldn’t be! Thanks to the introduction of new GUI tools, customizing your system’s protection by creating new policy modules is easier than ever. In this article, Dan Walsh gently walks you through the policy module creation process.

A lot of people think that building a new SELinux policy is magic, but magic tricks never seem quite as difficult once you know how they’re done. This article explains how I build a policy module and gives you the step-by-step process for using the tools to build your own.

Before we start, let’s review why we work with policy modules. In the past, in order to modify the current SELinux policy on a system running Red Hat Enterprise Linux 4, a system administrator would have had to to download the policy source, edit the policy source code, and rebuild and install the policy using tools like make install. The introduction of policy modules made this process easier and less error-prone. A system administrator could use the audit2allow utility to generate policy module updates directly from audit.log error messages. These modules function in a way similar to kernel modules in that they enable system administrators to modify part of the policy (a specific module) without having to rebuild the entire thing.

Remember to start small

One reminder! When you start to write policy, start small. Often, people send me email telling me they want to write SELinux policy and then they choose to write it for something huge like Firefox. When you decide to write policy for an application, you should have an idea of what the application does and what your security goals are for the application.For example:

Least privilege.
An application’s security goals are often based on “least privilege,” meaning that the application is only allowed to do the things it was designed to do. For example, FTP isn’t allowed to talk to the telnet port.
Modified privilege.
Sometimes your security goal might be to give the application less privilege than it was designed to have. This is for when you want to prevent Firefox from writing to your home directories.
Booleans. You might want to add booleans so your end user could modify the security policy depending on his security goals for the application. The best example of this is FTP servers. Most people run anonymous FTP servers, but some want full access to the users’ home directories. I can write policy to satisfy both users and have a boolean to arrive at least privilege.

Since simple daemon applications usually have security goals close to what the application is designed to do,a good place to begin writing policy is for daemons started during the system startup routines or CGI scripts. Avoid writing policy for user applications until you thoroughly understand SELinux and your security goals for that application.

For this article I will describe confining the rwho daemon. This daemon generates output similar to who, but for users logged in to hosts on the local network. It’s helpful (but not necessary) if policy writers have an intimate understanding of the applications they’re going to confine.You certainly don’t have to know every application you confine.

The new policy generation GUI tool: polgengui

To build things, you need tools. Starting with RHEL5 and Fedora 7, I began building a GUI tool to help people generate templates for policy generation. I examined the upstream policy and built templates around how that policy is written. The goal was to easily get policy upstreamed to get the maximum usage. So I added the polgengui tool to the system-config-selinux utility. This tool generates four files:

Type enforcement (te) file–contains all of the code used to confine my application
File context (fc) file–contains the mappings between files and file context
Interface (if) file–contains all of the interfaces that other domains might want to use to communicate with my domain and the file types created by my applications.
Shell script (sh)–used to compile, install and fix the labeling on the test system.

Now let’s start writing policy. There are three main steps that we’ll perform.

Step 1 – Use system-config-selinux to create a new policy module

Start by running system-config-selinux:

To begin building a new policy module, click the New button to run the SELinux Policy Generation Druid.

This druid is a wizard that chunks the policy creation process into seven quick dialog boxes:

Name of application to be confined
Application type
Incoming network port connections
Outgoing network port connections
Common application traits
Files and directories (where the application will write)
Generate policy in this directory

Name of application to be confined

This screen will prompt you for a name for your confined application and the path to the executable used to start it. The tool will use this information to create two SELinux types, rwho_t and rwho_exec_t. The running process (domain) will use the rwho_t type. File context on disk will use rwho_exec_t.

Application type

This screen asks you to identify the type of application. This allows you to set up all of the policy to correctly transition from other domains. The supported application types are:

Standard Init Daemon. These applications are started during the init process either by rc.sysinit directly or as a start up script in /etc/init.d.
Internet Services Daemon. These applications are started by inetd or xinetd.
Web Application/Script (CGI). These Applications are actually executed by apache as separate process. This type does not currently work for applications that run in-process, like mod_perl or mod_php.
User Application. These applications are usually started by a logged in user.

In the future we will be adding a mechanism for writing policy to actually confine a logged in user.

Incoming network port connections

This screen allows you to enter a space-separated list of network ports that the application will bind/listen on for incoming connections. If you’re not sure, you can leave this blank and come back to it later.

In this screenshot, rwho will listen on UDP port 513.

Outgoing network port connections

This screen allows you to specify TCP and UDP ports that the confined application needs to connect to. Because rhwod doesn’t connect to any ports, I leave it blank.

Both of the ports screens search through the existing policy to see if a type is already defined for that port number. If the port is defined, it will write the appropriate interface to use the port. If the port is not currently defined, polgengui will generate a new type for the port and the appropriate interface. If you define a new port, you will need to run some semanage commands to define the ports during install. The shpolgengui will contain the correct semanage command. script file that will be generated by

Common application traits

This screen allows you to specify some common traits that applications exhibit. Checking these boxes will add policy to your template and allow the application to perform the selected functions. If you are not sure whether your applications need any of these, leave them blank, and polgengui will generate the policy by running the application. If you have access to the source a you can use grep to quickly find out if the application requires any of these. For example, grep -r syslog . will tell whether or not your application uses syslog, and grep -r getpw . will tell whether or not you want to use nsswitch.

Files and directories

This screen allows you to designate files and directories where the confined application needs write privileges. The tool looks at the paths that you enter and uses them to establish the name of the type to use. It is doing this based on the conventions established in the reference policy. So files stored under /var/logrwho_log_t, and files/directories stored under /var/spool should be labeled rwho_spool_t. In order to get the regular expression labeling correct, polgengui asks you to differentiate between files and directories. Files/directories do not have to exist before running the application. Most new paths added to this screen will result in a new type being generated. should be labeled

Note: One common mistake people make when writing policy is the over-generation of types. File context types should be generated only for files/directories that are owned and written by the confined application. If the file/directory is only read by the application, you are better off leaving it as the default file context. So conf files in /etc/ should usually be left as etc_t. Files with sensitive security data are the exception. Something like a credit card database should not be labeled etc_t, even if the confined application treats it as read-only.

Generate policy in this directory

This screen asks you where to put the tool’s output. It will default to the current working directory, but often you are better off putting your policy files in a separate directory.

Generated policy files

The tool will confirm what you’ve asked it to do. Click Apply to generate the files, and polgengui will display the results:

Warning: The tool will continue running, and you can go back through the steps again, but it will overwrite these four files if you hit the apply button again.

Step 2 – Apply the new policy module

Now that you have the policy files, it’s time to apply them to the current policy. My method is to use a terminal window, log in as root, and execute the shell script generated by polgengui.

# cd /home/devel/dwalsh/tmp
# sh rwho.sh
sh rwho.sh
Compiling targeted rwho module
/usr/bin/checkmodule:  loading policy configuration from tmp/rwho.tmp
/usr/bin/checkmodule:  policy configuration loaded
/usr/bin/checkmodule:  writing binary representation (version 6) to tmp/rwho.mod
Creating targeted rwho.pp policy package
rm tmp/rwho.mod tmp/rwho.mod.fc
/sbin/restorecon reset /usr/sbin/rwhod context system_u:object_r:bin_t:s0->system_u:object_r:rwho_exec_t:s0
/sbin/restorecon reset /var/log/rwhod context system_u:object_r:var_log_t:s0->system_u:object_r:rwho_log_t:s0
/sbin/restorecon reset /var/spool/rwho context system_u:object_r:var_spool_t:s0->system_u:object_r:rwho_spool_t:s0
/sbin/restorecon reset /var/spool/rwho/whod.patriots context system_u:object_r:var_spool_t:s0->system_u:object_r:rwho_spool_t:s0
/sbin/restorecon reset /var/spool/rwho/whod.dhcppc0 context system_u:object_r:var_spool_t:s0->system_u:object_r:rwho_spool_t:s0

The shell script compiles the module that you just created, then loads it into the kernel. It then fixes the file context labels with the restorecon command.

Step 3 – Debug and complete the policy module

So far, so good. You created and applied the policy. What I always do next, and what you should do, too, is to verify the policy module. The best approach to use is to put the machine in permissive mode and allow the application to generate AVC messages, which you can in turn use to debug and fill in any gaps in the new policy module that you just created. This is an iterative process, but it’s the safest way to ensure that the policy is complete and correct.

Note that you should not do this on a production machine, as you will lose your SELinux protection when you run in permissive mode. You could generate AVC messages one at a time in enforcing mode, but it would be very time consuming.

# setenforce 0
# service rwho restart
Stopping rwho services:                                  [FAILED]
Starting rwho services:                                    [  OK  ]
# >>> Run some commands to get rwho to execute.

Now I use audit2allow to generate policy.

# grep rwho /var/log/audit/audit.log | audit2allow -R
require {
    type initrc_var_run_t;
    type rwho_t;
    class capability sys_chroot;
    class file { read write getattr lock };
}

#============= rwho_t ==============
allow rwho_t initrc_var_run_t:file { read write getattr lock };
allow rwho_t self:capability sys_chroot;
kernel_read_system_state(rwho_t)

It searches through the installed policy interfaces files on disk and attempts to find the best match for the AVC messages that were generated. These interface files are installed under the /usr/share/selinux/devel directory. In this case, it kernel_read_system_state(rwho_t). Note that any AVC that requires a domain to interact with itself will include the self qualifier.

The tool did not find an interface to match the AVCs that generated:

allow rwho_t initrc_var_run_t:file { read write getattr lock };

Looking at the AVCs that were generated in the /var/log/audit/audit.log, we see:

type=AVC msg=audit(1184874740.520:1685): avc:  denied  { read write } for  pid=18340 comm="rwhod" name="utmp" dev=dm-0 ino=3178503 scontext=system_u:system_r:rwho_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file

type=PATH msg=audit(1184874740.520:1685): item=0 name="/var/run/utmp" inode=3178503 dev=fd:00 mode=0100664 ouid=0 ogid=22 rdev=00:00 obj=system_u:object_r:initrc_var_run_t:s0

These two things indicate that the rwho daemon is trying to read/write the /var/run/utmp file. (Note the read write getattr lock reference.) From personal experience, I know that the library for interacting with the utmp file always attempts to open it read/write and then falls back to read-only. You also don’t want rwho to be able to write over the utmp file, because it could contains some important security data. If you search through the /usr/share/selinux/devel directories, you’ll find two interface calls:

init_read_utmp(rwho_t)
init_dontaudit_write_utmp(rwho_t)

The first interface will allow rwho to read the utmp file, the second interface tells the kernel to stop generating AVC messages when rwho attempts to write to utmp.

Now you can execute the sh script again and set the machine back in enforcing mode. Watch for additional AVC messages. Rebooting the machine can often generate additional AVC messages that weren’t generated from simply restarting the service. Repeat the process until there are no new AVC messages.

As soon as you’re happy with the way the policy is working, add it to the policy rpm and release it to Rawhide. There, people will happily (maybe not that happily) report back any problems that SELinux is causing their application. (Eventually I also publish the policy to upstream and ask for critique.) Open Source people will then tell me the mistakes that I have made in my policy. It’s just like Eric Raymond said in “The Cathedral and the Bazaar,” “Given enough eyeballs, all bugs are shallow.”

What’s next?

What’s next for you is to try out this step-by-step process for building a new policy module. You’ll no doubt see AVC messages unique to your own target applications, but if you take your time and make use of audit2allow, you’ll be able to create your own new policy modules.

For me? The next article in this series will describe locking down userspace.

Setup A Bittorrent Tracker in Fedora 7

2007-09-03T14:40:00.001+08:00

1. Install Apache (httpd)
yum install httpd

2. Configure the new services to start automatically
  /sbin/chkconfig httpd on
  /sbin/service httpd start

3. Install Bittorrent Tracker
  yum install bittorent

4. Start Bittorrent Tracker
   /etc/init.d/bttrack start

5. Disable firewall and SElinux.

6. Test
  Point your web browser to the bittorrent port on your server (e.g. http://yourdomain.com:6969)
  and the announce URL will be something like http://yourdomain.com:6969/announce

6. If you want to change the default Bittorent port (6969), modify the two files:
   /etc/sysconfig/bittorent and /etc/init.d/bttrack

Installing Apache, PHP, and MySQL on Fedora Core

2007-09-01T19:00:00.001+08:00

This will install the basic components for a dynmaic, database-driven web site. We use yum to handle dependencies and gather all of the required packages.

1. Install Apache (httpd), PHP, MySQL (server and client), and the component that allows php to talk to mysql.

 yum -y install httpd php mysql mysql-server php-mysql

2. Configure the new services to start automatically

  /sbin/chkconfig httpd on
/sbin/chkconfig --add mysqld         [this is not required with FC4 and above]
/sbin/chkconfig mysqld on


/sbin/service httpd start
/sbin/service mysqld start

3. IMPORTANT! Set up the mysql database root password. Without a password, ANY user on the box can login to mysql as database root. The mysql root account is a separate password from the machine root account.

 mysqladmin -u root password 'new-password'           [quotes are required]

4. Make additional security-related changes to mysql.

 mysql -u root -p

mysql> DROP DATABASE test;                            [removes the test database]
mysql> DELETE FROM mysql.user WHERE user = '';        [Removes anonymous access]
mysql> FLUSH PRIVILEGES;

5. Following the above steps, the document root for Apache is /var/www/html/

Create a test PHP script (such as phpinfo.php) and place it in the document root. A useful test script sample:

6. Create a database and database user for your data. You will use this database and user name in your database connection string. The GRANT statement actually creates a new MySQL user account.

 mysql> CREATE DATABASE web_db;
mysql> GRANT ALL PRIVILEGES ON web_db.* TO 'web_user'@'localhost' IDENTIFIED BY 'thepassword';


Copy from http://www.flmnh.ufl.edu/linux/install_apache.htm

Solve the problem of wireless network in ThinkVantage Access Connections

2007-08-29T21:08:00.001+08:00

It seems Windows conflicts with ThinkVantage Access Connections that makes my X61 can't access a wireless network. After stop the "wireless zero configuration" service in Windows XP, the ThinkVantage Access Connections work well.

Control Panel => Administrative Tools => Services => Wireless zero configuration, then stop this service.

LinkSys USB Wireless adapter (WUSB54G) in Fedora 7

2007-07-21T21:36:00.001+08:00

1. Log in to root:

Code:

$ su -

2. Blacklist rt2x00 drivers:

Code:

# nano /etc/modprobe.d/blacklist

2A. Paste the following at the end of the file:

Quote:

blacklist rt73usb
blacklist rt2570
blacklist rt2x00lib

3. Install necessary packages for building the legacy driver:

Code:

# yum install kernel-devel gcc kernel-headers wget

4. Grab the legacy driver for compiling:

Code:

# wget http://rt2x00.serialmonkey.com/rt73-cvs-daily.tar.gz -O /opt/rt73-cvs-daily.tar.gz
# cd /opt
# tar -zxvf rt73-cvs-daily.tar.gz

5. Compile and install the legacy driver:

Code:

# cd rt73*/Module
# make
# strip -S rt73.ko
# make install

6. Disable network-manager:

Code:

# system-config-services

6A. Untick 'NetworkManager' and 'NetworkManagerDispatcher'. Click Save.

6B. Disable the nm-applet by going to Preferences > Personal > Sessions and unticking Network Manager.

7. Restart your PC with the device plugged in.

8. Log in.

9. Run the following commands to connect to the network. KEEP IN MIND YOU SHOULD INSERT THE CORRECT VALUES WHEREVER YOU SEE RED TEXT. ALSO THIS ONLY SHOWS HOW TO CONNECT VIA WEP.

Code:

$ su -
# ifconfig wlan0 up
# iwconfig wlan0 mode managed
# iwconfig wlan0 essid YOUR_ESSID
# iwconfig wlan0 key open
# iwconfig wlan0 key YOUR_WEP_KEY
# dhclient

10. Install graphic configuration tool "RutilT" instead of 9.

Other useful links:
1. http://www.fedoraforum.org/forum/showthread.php?s=cf09c2b3438c8674bdf46caeea37e922&t=156537&amp;page=2&pp=15
2. http://rt2x00.serialmonkey.com/wiki/index.php?title=Downloads

What You should Learn as CS Student

2007-07-11T16:23:00.000+08:00

* basics of digital circuit design
* algorithms
* data structures
* at least one language from each of several major areas:
* assembly language
* structured/procedural
* functional
* other areas like logic programming
* computer organization (processors, interrupts, buses, memory hierarchy)
* intro to operating systems
* intro to compilers
* survey of programming languages and programming language concepts
* enough math that you are literate, can think rigorously, do proofs
* some calculus
* some probability
* discrete math
* set theory
* logic
* boolean algebra
* a little bit of information theory
* CS theory (state machines, grammars, types of languages, turing machines) * English composition, with emphasis on clear communication
* some science, so you grasp how to think scientifically

And there is some ACM's guidelines.
The most recent version can be found at
http://acm.org/education/curric_vols/cc2001.pdf
or for a higher-level perspective laying out several different degree programs (computer science, computer engineering, etc.)
http://acm.org/education/curric_vols/CC2005-March06Final.pdf
all linked from
http://www.acm.org/education/curricula.html

Virtualization in Fedora 7

2007-07-03T21:57:00.001+08:00

1. Fedora wiki: http://fedoraproject.org/wiki/Docs/Fedora7VirtQuickStart

2. Fedora 7 KVM Virtualization How-To: http://www.phoronix.com/scan.php?page=article&item=656&num=1

IEEE754

2007-06-15T15:33:00.000+08:00

The standard for storing floating point number is known as IEEE754. Most computer uses this format for doing floating point math. Therefore, when transmitting floating point number through network, most of time it is no necessary to serialize the floating number. But if you want your source code to be portable, that's an assumption you can't necessarily make.

IEEE-754 standard

warning: incompatible implicit declaration of built-in function 'exit'

2007-06-05T10:30:00.000+08:00

When I used gcc 4.1.1 to compile my program, it complains one warning "warning: incompatible implicit declaration of built-in function 'exit' ". The source code complained by gcc is:

int main( void)
{
...
if ( rc ) {
printf(" Error: can't allocate memory. ");
exit(-1);
}
...
}

According to C language books, the usage of exit() is correct. After I searched this problem in google, I found I need include the header file in my program.

After I included , gcc stops this warning. Great!

Useful Web Links about C/C++

2007-05-24T12:03:00.001+08:00

Useful Web Links about P2P/Chord

2007-05-24T12:00:00.001+08:00

Tame Tutorial

2007-05-24T11:50:00.001+08:00

Tame

Tame library is used by Chord DHT software.

In libasync, the object involved with making asynchronous RPC calls is called an "aclnt". The most relevant method for the "aclnt" object is the aclnt::call function, whose signature for our purposes is:

callbase *call(u_int32_t procno, const void *in, void *out, aclnt_cb);

Note there are optional arguments that have been omitted for clarity. The first argument to call() is the RPC procedure number that will be called, which is often represented by an enumerated value in C/C++ code. The next two arguments to call() tell it where to find the argument to the RPC call, and where it should put the response when the RPC completes. Note that the out argument needs to be dynamically allocated and persist past the scope of the caller, since it will be set arbitrarily long in the future (accounting for network delay and so on). The final argument is the callback to call once the RPC completes. aclnt_cb is given by:

typedef callback::ref aclnt_cb;

The clnt_stat type is the standard RPC enumerated type for reporting the status code of an RPC call. Thus, aclnt_cb is a callback that expects to be called with one argument, of type clnt_stat, that will report how the RPC fared — did it succeed, did it timeout, was it rejected due to a protocol mismatch, etc.

standard libasync class that wraps a TCP connection
ptr x;

standard libasync class for an anonymous RPC client
ptr cli;

vec rv : vec<> is a vector template class.

A rendezvous_t is a simple object that will coordinate launches and joins for a given group of events (see libtame/tame_core.h for the class definition of a rendezvous_t). Each rendezvous_t is also associated with data types used in distinguishing callbacks from each other when they are eventually joined.

Libasync Tutorial

2007-05-24T11:47:00.001+08:00

Libasync
Libasync Library is used by Chord DHT software.

Libasync usage:

A program using libasync should call async_init() before doing anything else. The last statement of main() is typically amain(). This puts the program in an event loop. Only an explicit call to exit() will stop the program.

"warn" is the libasync equicalent of cerr in C++ or fprintf(stderr, "...") in C.

delaycb() takes 3 arguments: seconds, nanoseconds, and a callback. timecb_remove() can cancel the delaycb() call. But call timecb_remove() twice will cause the program to crash.

callback::ref foo = wrap(hello): This result of the call to wrap(hello) is of type callback::ref. The <> means we're dealing with C++ templates. The void between the <> brackets is to indicate that the callback function ( hello in this case) return void. ( The ::ref thingy refers to the ref member of the callback class. Forget it).

typedef callback::ref cbi : cbi is a callback function, that should be called with one argument of type int. The return type is void.

"strbuf" allows you to build up a string by appending to it using the operator. One situation where you will find strbuf most useful is when iteratively reading chunks of data from a file descriptor.

Libasync provides C++ support for debugging malloc. You should use the "New" operator where you would otherwise use "new". New is a wrapper around new that includes line information, making it easy to debug memory leak.

You can create reference counted object with the refcounted template. Refcounted can turn any ordinary C++ type into a reference counted type.

The only difference between ref and ptr is that ptr's can be zero, and ref's cannot.

Implementation of Binary Search

2007-05-19T16:48:00.001+08:00

Although the idea of binary search is simple, it is extremely easy to program it incorrectly. It is said one study showed that about 90% of professional programmers failed to code binary search correctly. Unbelievable!

In order to avoid repeating the same error, I read two versions of implementation of binary search. One is FreeBSD version, the other is GNU Libc version. The code of FreeBSD is a bit sneaky, and GNU Libc version is easier to be understood.

You can find the source codes in the following links:
FreeBSD : http://fxr.watson.org/fxr/source/libkern/bsearch.c?v=RELENG60
GNU Libc: http://cvs.savannah.gnu.org/viewvc/libc/stdlib/bsearch.c?revision=1.7&root=libc&view=markup

If you feel a little difficult to understand the code, you can read Diomidis Spinellis's book "Code Reading - The Open Source Perspective", P56-59 for FreeBSD version, and Robert Kruse's book "Data Structures & Program Design in C, version 2", P248-253 for GNU version.

================== FreeBSD =======================

55 void *
56 bsearch(key, base0, nmemb, size, compar)
57         register const void *key;
58         const void *base0;
59         size_t nmemb;
60         register size_t size;
61         register int (*compar)(const void *, const void *);
62 {
63         register const char *base = base0;
64         register size_t lim;
65         register int cmp;
66         register const void *p;
67
68         for (lim = nmemb; lim != 0; lim >>= 1) {
69                 p = base + (lim >> 1) * size;
70                 cmp = (*compar)(key, p);
71                 if (cmp == 0)
72                         return ((void *)(uintptr_t)p);
73                 if (cmp > 0) {  /* key > p: move right */
74                         base = (const char *)p + size;
75                         lim--;
76                 }               /* else move left */
77         }
78         return (NULL);
79 }

================================ End of FreeBSD ===========================================

================================ GNU LibC =================================================
#include 


/* Perform a binary search for KEY in BASE which has NMEMB elements
of SIZE bytes each.  The comparisons are done by (*COMPAR)().  */
void *
bsearch (const void *key, const void *base, size_t nmemb, size_t size,
  int (*compar) (const void *, const void *))
{
size_t l, u, idx;
const void *p;
int comparison;

l = 0;
u = nmemb;
while (l < class="blsp-spelling-error" id="SPELLING_ERROR_15">idx = (l + u) / 2;      p = (void *) (((const char *) base) + (idx * size));      comparison = (*compar) (key, p);      if (comparison < u =" idx;"> 0)
 l = idx + 1;
   else
 return (void *) p;
 }

return NULL;
}
========================== End of GNU Libc =========================================

& , << and >>

2007-05-19T11:29:00.000+08:00

do {
....
} while ( column & 7 )

The & operator performs a bitwise-and between its two operands. In this case, we are not dealing with bits, but by masking off the most significant bits of the column variable it returns the remainder of column divided by 8. When performing arithmetic, read a & b as a % (b+1) when b = 2^n - 1. This is a trick used in old times, and avoid writing it now.

The shift operators <<>> are two other common cases where bit instructions are used as sbustitutes for arithmetic instructions. Since every bit position of an integer has a value equal to a power of 2, shifting an integer has the effect of multiplying or divigiing it by a power of 2 equal to the number of shifted bits.

For example, read a<< k =" 2^n.">> n as a / k, where k = 2^n.

But Java's logical shift right operator >> should not be used to perform division arithmetic on signed quantities since it will produce erroneous results when applied on negative numbers.

Commnd "find" and "grep" for reading source code

2007-05-14T22:39:00.000+08:00

Search through the source code using the following command in Unix/Linux

find [directory] -name '*.c' -print | xargs grep 'malloc.*NULL'

The Freelancer’s Toolset: 100 Web Apps for Everything You Will Possibly Need

2007-05-12T17:01:00.000+08:00

http://www.cogniview.com/convert-pdf-to-excel/post/the-freelancers-toolset-100-web-apps-for-everything-you-will-possibly-need/

Linux RPC

2007-05-06T00:06:00.000+08:00

Two useful web pages about Linux RPC programming:

1. http://www.linuxjournal.com/article/2204

2. http://www.cs.cf.ac.uk/Dave/C/node33.html

Business books about entrepreneurship

2007-05-01T00:45:00.000+08:00

"Reading about other people's successes and failures as entrepreneurs can hold the key to helping you decide how to navigate your own business."

This link indicates some business books worthy of reading.

Business Biographies That Instruct and Inspire

Customizing .emacs for C/C++ programming

2007-04-26T13:46:00.001+08:00

1. Download JanBorsodi.zip and site-lisp.zip from dotemacs.

2. Extract the .zip files and install files according README.

3. Create a directory in my home directory.
mkdir .emacs-options

4. Comments the lines related to mwheel in /usr/share/emacs/site-lisp/defaul.el

Becoming a programmer

2007-04-25T10:09:00.000+08:00

Want to become a real programmer? Read the two articles. They are very useful. :-)

1. Becoming a Better Programmer
2. How to be a Programmer

A guide of becoming a hacker

2007-04-21T01:06:00.000+08:00

I accidentally read an article "How to become a hacker", which is written by Eric S.Raymond. Eric is the author of the book "The art of Unix programming". When watching Hollywood films about computer hackers, I feel very excited and am very curious about everything about a hacker. So once I saw the title of the article, I were immediately impressed about the content. According to what Eric said, becoming a hacker need have the spirit of hacker: intelligence, practice, dedication, hard work, and freedom.

All these requirements are not easy to have and keep. But they are very challenging and exciting, which motivate me to want to become a hacker. Just as described in the article, if you want to become a hacker, you should

To follow the path:
look to the master,
follow the master,
walk with the master,
see through the master,
become the master.

HTML and CSS

2007-04-21T00:44:00.001+08:00

In the past years, I used C for Linux kernel programming, and network protocol development in Unix/Linux. Thus I have no idea of PHP, MySql and HTML/CSS. I want to develop web applications using LAMP as a freelancer. So I starting learning all relevant knowledge.

Today I read some tutorials about HTML/CSS in HTMLDOG. In general, these materials are suitable for a beginner like me except the tutorial of advanced CSS is not good enough.

GNU Wget

2007-04-20T00:42:00.002+08:00

Wget is a commandline tool for retrieving files using HTTP, HTTPS and FTP. We can use it to recursively mirror web sites by typing "wget -m [URL]" in Terminal.

More information will be found in http://www.gnu.org/software/wget/

How to convert APE to MP3

2007-04-19T15:36:00.001+08:00

A Howto article to explain how to convert APE music files to wav/mp3/ogg in Linux.

http://gimpel.gi.funpic.de/wiki/index.php?title=Howto:convert_ape_to_wav/mp3/ogg_on_Linux

安装Realtek ACL885声卡驱动导致系统瘫痪

2007-04-15T21:50:00.001+08:00

一直觉得在Fedora 6下听音乐，音质不是很好，很想升级驱动改善音质。我电脑的主板是Giga的, 板内集成的Realtek ACL885声卡。昨天我到Realtek的主页上下载了Linux 驱动程序。然后加压，按照Readme.txt，在root下，执行“./install”. 虽然在编译Alsa Driver时有错误，但“./install”还是把有错误的驱动安装到系统中。由于“./install”执行太快，我没看到显示的错误信息，误以为安装正确。所以就重启系统，结果系统无法识别声卡硬件，无法播放，而且系统运行很慢，无法启动Terminal。只好按“Ctrl+Alt+Backspace”切换到命令行，然后执行“su”到root，执行“initi 3”。试图单独重新编译Realtek Driver，而不使用“./install”. 但编译无法成功，只得删除刚才安装的驱动程序。用“rm”删除程序，但有些配置程序似乎也被修改。要恢复到以前的配置很困难，因为我不知道那些驱动修改了什么。突然想起在安装Fedora 6时，我其实用“yum”安装过“Alsa Driver”，而Realtek Linux Driver就是Alsa Driver。（我正是没事找事，好好的系统硬是被我弄坏。:-( ）于是执行“yum remove alsa*”。

但是不知道怎么， yum不仅删除了alsa driver，还把GNOME Desktop Environment的相关文件页删除了。结果一共删除192个packages。我试图用Fedora 6 安装盘恢复Gnome，因为我使用Linksys USB 无线网卡，网卡的启动方式特殊，需要启动system-config-network来激活网卡。所以在重启前，执行“yum install system-config-network， gdm， gnome-panel”。系统重启后，结果无法进入Gnome, 网卡也没法激活。我重启系统，试图用Fedora 6 安装盘安装Gnome，但是如果不重装系统而是upgrade，则无法安装Gnome，只能安装kernel source。退出安装盘，重启，再编译无线网卡驱动，激活网卡。然后执行 yum groupinstall “GNOME Desktop Environment” 。安装完后，重启，成功恢复Gnome。但系统启动后，仍然无法启动Terminal，系统反应极慢，CPU usage是98%。执行“Ctrl + Alt + Backspace”切换到命令行，执行 “top”，发现有两个“scim-launcher”进程占用了97%CPU， kill这两个进程。再切换回Gnome，系统恢复正常。看来问题出在scim，所以 yum remove scim* 删除scim。重启，系统正常，但不能输入中文。

从www.fcitx.org下载源代码，编译然后安装，然后编辑/HOME/.bashrc。重启，可以输入中文。终于，一切恢复正常。

Reinstall Gnome Desktop via yum

2007-04-15T00:43:00.001+08:00

Use the command to install:

yum groupinstall "GNOME Desktop Environment"

我的Linux PC开发环境

2007-04-11T01:10:00.000+08:00

一篇不错的文章，关于Linux 开发环境的。

我的Linux PC开发环境

Useful Photography Links

2007-04-08T00:00:00.000+08:00

GIMPguru.org: A resource for those using GIMP to edit photographs.
Varp.net: A resource for photography techniques, composition tips.
PhotoSIG: The most impressive collection of user photographs uploaded for some serious critiquing.
PhotoNet: A lot of information, tips, reviews, and a good user group.
PhotoZone: Good tips on basic techniques. You can also take a look at Fodor's Focus on Photography.
PhotCritique: Critique others' work and get to look at some really great photographs. Also take a look at Dan Smith's Articles.
Kodak's Taking Great Pictures.

HOWTO: Installing Brother DCP-115C/MFC210C printer in Fedora 6

2007-04-06T19:01:00.001+08:00

1. Step 1: Download from Brother

[The CUPS wrapper]
[The LPR Driver]

For other Brother machines: Please make sure the appropriate drivers are downloaded. Check the Brother website for the LPR Drivers and for the CUPS Wrapper.

2.TURN PRINTER OFF
DO NOT SKIP THIS STEP! THINGS GO TERRIBLY WRONG WHEN THIS IS AVOIDED!

3. LPR Driver Install
rpm -Uvh MFC210Clpr-1.0.2-1.i386.rpm

4. Install the CUPS Wrapper
rpm -Uvh cupswrapperMFC210C-1.0.0-1.i386.rpm

5. TURN PRINTER ON

6. System → Administration → Printing

Paper Tab: Ensure your local paper size is selected.
Advanced Tab: Review the choices and make appropriate adjustments.
Click "Print a test page" to confirm all works well.

7. The current drivers do not support SELinux(FedoraCore4/GNOME etc). If you get an error when printing you have to disable SELinux.

System -> Administration -> Security Level and Firewall -> SELinux and the set SELinux Setting to 'Permissive'.

Adobe Reader can't start in Fedora Core 6

2007-04-05T10:28:00.001+08:00

A workaround to run acroread on Fedora Core 6 is to edit the file /bin/acroread and replace the following line (line-no 644):

check_gtk_ver_and_set_lib_path "$MIN_GTK_VERSION"

with

# check_gtk_ver_and_set_lib_path "$MIN_GTK_VERSION"

Install NVIDIA Driver in Fedora 6

2007-04-05T09:50:00.001+08:00

1. Download linux driver from NVIDIA website http://www.nvidia.com/object/unix.html

2. Type "CTRL+ALT+Backspace" to exit Xserver. Then type "sh NVIDIA-Linux-x86-1.0-9755-pkg1.run" to install the driver.

3. Reboot. And in "Application-->System Tools , "NVIDIA now provides a utility to assist you with configuration of your X Config file.

VSFTPD-server cannot write in user's home directory

2007-04-04T22:37:00.001+08:00

Description of problem:
FTP'ing to a freshly installed FC system fails when trying to write in the home directory of the user.

Solution:
Need to turn on the ftp_home_dir boolean.

man ftpd_selinux
...
BOOLEANS
     SELinux  ftp  daemon  policy  is  customizable  based  on  least access
     required.  So by default SElinux does not allow users to login and read
     their home directories.
     If  you  are setting up this machine as a ftpd server and wish to allow
     users  to  access  their  home  directories,  you  need  to  set  the
     ftp_home_dir boolean.

     setsebool -P ftp_home_dir 1

More info in https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=163495

Fedora repositories

2007-04-04T10:24:00.001+08:00

Fedora uses the RPM packaging system. And RPM can be downloaded and installed using the YUM package management tool.

1. You can add alternative repositories to yum configuration files.
/etc/yum.conf additional entries:
[main]
cachedir=/var/cache/yum
keepcache=0
debuglevel=2
logfile=/var/log/yum.log
pkgpolicy=newest
distroverpkg=redhat-release
tolerant=1
exactarch=1
obsoletes=1
gpgcheck=1
plugins=1
metadata_expire=1800

# PUT YOUR REPOS HERE OR IN separate files named file.repo
# in /etc/yum.repos.d

[Spanasia]
name=Fedora Core 6 Singapore Mirror
baseurl=http://mirror.spanasia.net/fedora/linux/core/updates/6/i386/

[Eznetsols]
name=Fedora Core 6 Singapore Mirror2
baseurl=ftp://ftp.oss.eznetsols.org/linux/fedora/updates/6/i386/

2. Update the package lists.
yum update

3. If you would like to automatically update your system nightly with the latest package updates, enable the yum service:
/sbin/chkconfig --add yum
/sbin/service yum start

More info is included in http://www.brandonhutchinson.com/Fedora_apt_and_yum_repositories.html

LinkSys USB Wireless adapter (WUSB54G) in Fedora 6

2007-04-03T16:39:00.001+08:00

1. Open a terminal and log in as root # su

2. Download Driver software "rt73 USB nightly CVS tarball" from http://rt2x00.serialmonkey.com/wiki/index.php?title=Downloads

3. Download the nightly tarball and extract to your home directory: /home/USER, (USER is your login name) then

tar zvxf rtxxxxx.tar.gz

4. Compile the module # cd /home/USER/rt73-xxxxx/Module
# make
...
# make install
...
modprobe rt73

5. Read the file "README" in /home/USER/rt73-xxxxx/ to do further configuration. Can also refer to the HOWTO http://rt2x00.serialmonkey.com/fc4howto/rt2570_fc4_howto.html

6. Because "Network Configuration" tool in Fedora 6 doesn't work very well. Some extra steps is needed.
6.1 Configure the wireless interface in "Network Configuration".
6.2 In the terminal, type in the commads. "/sbin/ifconfig rausb0 up", then "/sbin/iwconfig rausb0 essid key ".
6.3 Activate the wireless interface in "Network Configuration".

Perl Books

2007-03-31T00:56:00.000+08:00

1. Learning Perl
Written by Randal L. Schwartz, Tom Phoenix, and brian d foy. Published by O'Reilly.

2. Perl Cookbook
Written by Tom Christiansen, and Nathan Torkington. Published by O'Reilly.

3. Learning Perl Objects, References, & Modules
Written by By Randal L. Schwartz, with Tom Phoenix. Published by O'Reilly.

4. Programming Perl
Written by Larry Wall, Tom Christiansen, Jon Orwant. Published by O'Reilly.

Related Links:
1. http://johnbokma.com/perl/recommended-perl-books.html

2. http://learn.perl.org/books.html

3. http://www.perlmonks.org/?node_id=543480

Ctr-l to Redisplay the Line

2007-03-22T21:29:00.001+08:00

Sometimes Cisco router/switch/firewall might display an informational or error message while you are entering a command line. To see what you've entered so far, you can press Ctr-l ( lowercase L) to redisplay the line and continue editing.

router#conf t
router(config)#hostnNov 15 2006 00:34:08 single_vf: User 'enable_15' executed cmd: show interface
router(config)#hostn

使用md5sum验证下载的Linux ISO

2007-03-20T01:13:00.001+08:00

用Ftp或http下载Linux ISO后，可以用md5sum验证ISO文件是否错误或被损坏。

首先，你需要下载ISO文件和相应的md5sums文件。然后在下载目录下，敲命令 "ls -l"，确认所需文件存在.

$ ls -l
-rw-rw-r-- 1 user user 652709888 2006-08-23 00:00 CentOS-4.4-i386-bin1of4.iso
-rw-rw-r-- 1 user user 309 2006-08-27 00:00 md5sum

接着，用命令"cat md5sum"来查看原有的md5值.

$ cat md5sum
9f4ec5284ef5ddcc4cccb354b06cf1c5 CentOS-4.4-i386-bin1of4.iso

然后，在本机上运行命令"md5sum -b CentOS-4.4-i386-bin1of4.iso", 比较运行结果和上面cat显示的值. 如果相同，则说明Linux ISO文件完好无损。否则，说明文件下载时出现错误，需重新下载。

$md5sum -b CentOS-4.4-i386-bin1of4.iso
9f4ec5284ef5ddcc4cccb354b06cf1c5 *CentOS-4.4-i386-bin1of4.iso

Shutdown Timer in Linux

2007-03-18T10:42:00.001+08:00

Code:

shutdown -h 12:00

will shut your computer down at 12 o clock.

Code:

shutdown -h +60

will do it an hour after you issue the command. Can see

Code:

man 8 shutdown

for more details

Thirst for Success and Money

2007-03-10T10:05:00.000+08:00

I often heard a story about the Wall Street. It says a person without a thirst for money can succeed in the Wall Street. I agree with this truth and also believe a person without a thirst for success can't be a successful person.

Moreover, a excellent entrepreneur must have a thirst for both success and money. Being eager for Success is the first thing he/she should have and earning a large amount of money is the second one he/she should pursue. In the current economic world, without money, he/she can't maintain the daily life and neither keep the growth of the company.

MIT OpenCourseWare

2007-03-03T23:17:00.000+08:00

MIT has published its course materials online. I read the lecture 1 notes for Computer Networks ( course number 6829) and wrote an abstract ( see the above picture).

There are many universities put their course materials online freely, which gives everyone an opportunity to have the same chance to learn knowledge as the students of those famous students. It is indeed the benefit brought by Internet, which changes the world completely.

一则寓言

2007-03-03T03:06:00.000+08:00

从前，有一些小鱼儿对只能游泳的生活感到厌倦，它们仰望着天空里飞翔的海鸥，羡慕地说：我们要是能飞该多美啊！

海鸥说：我可以教你们飞啊。可想飞，首先就要离开水。

小鱼儿纷纷跃出水面。于是，它们中的大部分成了海鸥的点心；幸运的几个，学会了拍动背鳍，成了海面的飞鱼。

GTD using Google tools

2007-02-18T11:25:00.001+08:00

Some useful links about GTD using Google tools:

1. GTD and Google Tools
http://www.davidco.com/blogs/kelly/archives/2006/11/gtd_and_google.html

2. Gettings Things Done with Googlehttp://starkos.industriousone.com/gettings-things-done-google

3. GTDmail
http://www.gtdgmail.com/

4. GTD with Google's New Calendarhttp://www.isaacbowman.com/gtd-with-googles-new-calendar

Getting up early will help you to success

2007-02-05T17:54:00.001+08:00

If you are busy in work and want to be productive, you maybe need getting up early instead of sleeping after midnight. As described in the following article, most of CEOs gets up at 5:30 or earlier during working days and exercise every morning.

http://finance.yahoo.com/expert/article/leadership/23188

Turning $60 Router into $600 Router ( Linksys WRT54G)

2007-02-01T17:53:00.001+08:00

I subscribed an Internet Access plan at home two years ago, and the ISP provided me a free Motorola Cable Modem and a free Linksys wireless router ( WRT54G, version 2.2). Previously, I shared the Internet access with two other guys living in the same apartment, and I surfed Internet smoothly. But these days one guy is using BT software and P2P online video software, which consumes a large amount of bandwidth. Since he is using a wire to connect to the Ethernet port of the router and I am using wireless card, I often loses the Internet access during three of us are using network simultaneously. Because he is unwilling to stop using BT and P2P software, I am looking for a method to limit the bandwidth of each Ethernet port.

At first, I downloaded a new firmware from http://www.linksys.com/ and upgraded it into my WRT54G router. After finishing upgrade, I found the firmware doesn't provide enough QoS features that can let me to limit the bandwidth of each Ethernet port. I was told that WRT54G is a low-end router for home users and I need buy a expensive router for business users if I want to have such advanced QoS features.

Of course, I don't want to spend more money in buying a new router. Fortunately, I searched an open source firmware in Google. This firmware is named DD-WRT ( http://www.dd-wrt.com/ ), which can enable WRT54G to have the same features as a $600 business router has.

First, I downloaded the corresponding version of the software from http://www.dd-wrt.com/dd-wrtv2/downloads.php.

Second, I flashed the firmware in my WRT54G router according to the installation guide in http://www.dd-wrt.com/wiki/index.php/Installation. During flashing, if there is any error occurred and the router is bricked, you need revive the router from a bad flash according to the WRT54G Reviving Guide in http://www.linksysinfo.org/forums/showthread.php?t=47259.

Third, after I flashed the firmware successfully and I configured the router according to the Conifugration Howto in http://www.dd-wrt.com/wiki/index.php/Configuration_HOWTOs. In the end, I have limited the bandwidth of each Ethernet port by specifying the QoS options.

Finally, I can surf Internet smoothly again! :-)

让Windows XP中显示的字体更圆润清晰

2007-01-26T18:40:00.001+08:00

如果你的操作系统是Windows XP，那么你可以调节系统字体显示的清晰度(ClearType)，使之适合你的显示器，达到最佳的显示效果。这只需要几个简单步骤

一、调节系统字体的显示清晰度
调节方法很简单，在微软公司的网页上调节ClearType字体即可，下面会一步步介绍如何调节。
由于在调节的过程中，网页会安装一个微软公司的ActiveX控件(也是一种程序)，所以请注意如果你的浏览器出于安全考虑过滤了控件安装，请开启它

1) 访问http://www.microsoft.com/typography/cleartype/tuner/1.htm
此时会弹出Microsoft Clear Tuning Control控件的安装对话框，点击安装即可 - 程序会自动完成安装，安装后会自动回到页面
(此控件为微软发布，上面有微软的数字签名，所以请放心安装)
页面显示调节的第一步 Step 1: Turn on Windows XP ClearType (开启Windows XP的ClearType功能)
复选页面底部的Turn on ClearType(开启ClearType)，然后点击Next按钮

2) 进入Step 2: Select ClearType configuration(选择ClearType配置类型)后，有两幅图显示不同方案下的显示效果
左边为使用RGB的ClearType方案，右边为BGR
哪副图看起来清楚，没有重影，就点击选择哪边
推荐选择左边的RGB
然后点击Next按钮进入下一步

3) 进入Step 3: Tune ClearType settings (调节ClearType设置)
一共有6幅图，显示不同的ClearType重量等级情况下的文字显示情况，在你觉得显示效果最佳的文字显示图上点击，选中此种方案，选中后图片周围的边框会加粗
然后选择Finish即可
此时ClearType字体调节完成，你可以马上从浏览器界面上的文字变化看出来效果，如果不满意，可以后退到Step3重新选择别的图

二、删除垃圾
如果您觉得以后不再需要重新设置，可以删除第一步的时候安装的Clear Tuning Control控件 - 该控件仅用于调节ClearType参数，不是必须的程序。
您可以按如下设置删除该控件
1) 在浏览器菜单中选择Internet选项，弹出Internet选项对话框
2) 点击第二排的设置按钮，弹出设置对话框
3) 点击查看对象按钮，弹出查看对象的资源管理器，上面会列出已经安装的ActiveX控件
4) 点击选中CTAdjust Class，按下Delete键，系统会提示您是否删除该控件

三、ClearType原理几句话简介
关于ClearType的介绍充满了神话和传说，其实这东西简单的很，就是为文字轮廓加入一些补偿像素，使文字看起来平滑圆润。

另外:有些介绍中说的ClearType技术只对液晶显示屏才有效，对传统CRT反而使文字变得不清楚 - 这是错误的理解。其实它对哪种显示屏起的作用都一样，如果你喜欢它，那么CRT显示屏同样可以开启。只不过对于液晶显示屏，由于像素都是方形，所以开启后效果更好一些，而由于有的CRT显示屏由于聚焦本身就不清晰，所以才会让人觉得反而开启后失真。

Cisco PIX Firewall

2007-01-25T17:33:00.001+08:00

I am looking for a new job of network engineer now. In order to learn some basic knowledge about Cisco PIX Firewall, I found some online materials about PIX and here is the summary.

1. A good tutorial.
http://www.netcraftsmen.net/welcher/papers/pix01.html

2. The Getting Started document for more detailed information from the Cisco Website:

http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_configuration_guide_chapter09186a0080172790.html

3. Cisco PIX Firewall Command Reference, version 6.3

http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_command_reference_book09186a008017284e.html

A Blog About Learning Cisco Knowledge

2007-01-22T13:06:00.001+08:00

I found a blog about learning Cisco Knowledge, and it is useful for my current study.

===> Cisco Learning Blog

Cisco IOS Tips

2007-01-17T13:01:00.001+08:00

Here is some tips about Cisco IOS commands provided by James Boney, who is the ahthor of "Cisco IOS in a Nutshell". Very useful!

==> Top Ten Cisco IOS Tips

Free software for Windows and Linux

2006-12-19T11:35:00.000+08:00

There are a lot of good free software for windows and Linux, which provide equivalent or similar functions to the expensive commercial software. Here are some links introducing these free software.

1. Open source software list

Wikipedia

2. 30 free software for Windows

30 essential pieces of free ( and open ) software for windows

3. free software for Linux

The Linux equivalent project

How to success?

2006-12-16T22:03:00.001+08:00

I found a very good and interesting video in the Ted.com talking about how to become a successful person. In order to success, you need

Passion. you must have passion on work. Work for passion, not for money.
Work. You must work hard.
Focus. You must focus on one thing.
Persist. You must persist on your goal.
Idea. You must have a good idea.
Good. You must become very good at what you are doing.
Push. You must push yourself very hard.
Serve. You must provide others something, or are able to serve others by your work.

Here is the link of the video.

Career decision

2006-12-13T01:32:00.001+08:00

What is your dream job? Have you decided the career for your whole life? These are questions that may make you sleepless at night repeatedly. Actually it is not easy to decide your career. Some people have worked in their current jobs for many years and suddenly found their jobs are not really suitable for themselves. And others have too many options to decide which one they should choose for their career.

Therefore, people are striving to find methods that can help them to resolve these problems. In general, there are three popular methods now. The first one is to get help from career consultants. Normally career consultants will inquire some personal information of you and ask you to take some tests. Based on your information and test results, the career consultants will provide you some options. The second is to get advice from your family members or friends. Those persons are familiar with you and know your strengths and limitations well. And they may also have deep understanding and experience in the careers which you will choose. Hence, they may be the best persons to help you to make decision in your career. The third is to just do it. The rationale of this method is without really doing it and get the first-hand experience, you will never know whether this job is suitable for yourself or not.

I prefer to the third method. Rather than spending lots of time in thinking which job is suitable for yourself, doing the real job and then you will know the answer.