Ref: https://security.googleblog.com/2021/06/introducing-slsa-end-to-end-framework.html

今天要探討的是一個由 Google Blog 於上個月所推廣的軟體安全性框架，該框架名為 SLSA，全名則是 Supply Chain Levels for Software Artifacts，中文部分我不知道該怎麼翻譯才可以精準達到意思，所以建議就唸英文就好了。

該框架的目的是希望於整個軟體生產鏈中能夠進一步的去提升且確保所有產物的完整性(Integrity 這個詞該怎麼翻呢..)。

文章中用了一個很簡易的流程來清楚的解釋到底何謂 Software Supply Chain 以及整個流程中可能會有什麼問題。

Software Supply Chain 一個範例譬如
1. 開發者撰寫程式碼，並且提交到遠方的 SCM Repository
2. SCM Repo 因為程式碼改變，所以觸發相關的 CI/CD 流程
3. CI/CD 建置結束後則需要打包整個程式碼，產生最後的 Package.
4. 產生後的 Packet 則可以正式上場使用

文章認為上述的流程中有兩個不同類別的安全性問題，分別是
1. Source Integrity
2. Build Integrity.

Source Integrity 這邊主要是針對 Source Code 相關的問題，譬如
1. 開發者是否有意的故意塞入一些會不懷好意的程式碼到 SCM Repo 內。
範例: Linux Hypocrite commits, 之前美國某大學研究團隊基於研究嘗試上傳一些不太好的程式碼而影響的討論風波
2. SCM 的管理平台是否可能被惡意攻擊
範例: PHP 事件: 之前自架的 PHP Git Server 被攻擊者惡意攻擊並且塞入兩筆不懷好意的 Commit

而 Build Integrity 本身則是有更多不同的面向，譬如
1. SCM 觸發 CI/CD 過程是否有可能有問題
範例: Webmin 事件，攻擊者去修改團隊的建置系統去使用沒有被 SCM 所記錄的修改檔案。
2. CI/CD 建置系統本身被攻擊
範例: SolarWinds 事件，攻擊者攻破建置系統去安裝一些軟體來修改整的建置流程
3. CI/CD 建置過程中引用到錯誤的 Dependency
4. 攻擊者上傳一些惡意產物到應該只有 CI/CD 系統才可以存取的場所。
... 等

目前來說， SLSA 還處於非常早期階段，經由業界的共識來思考每個領域有什麼好的措施與指引來避免與偵測系統是否被攻破。其最終目標狀態是希望能夠根據環境自動產生出一套可整合到系統中的產物，並且最後可以給出 SLSA 憑證來給平台或是建置後的 Package。

對 SLSA 這個專案有興趣看看的請參考原始連結，內容不長但是頗有趣的

【給自己一個機會紅起來】❤️
Give Yourself A Chance To Shine

如果說宇宙的力量可以分為五種，那那五種力量就是金、木、水、火和土了。

世界萬物萬事都能以這五行去分類，而每個人的八字就是這五行的獨特混合體。這混合體遇到外在人事物的五行力量時，就會產生不同的吉凶禍福局面。

我個人經驗是，就算有著同樣八字的雙胞胎，也不會有一模一樣的命運，因為面相有細微之分，姓名的字義、音韻、筆畫和含義也會有不同的靈動力，影響著雙胞胎的命運。

看命，關鍵就在於找出自己需要的五行是什麼。這很考經驗，不是把八字裡的五行加減乘除一番就能斷出。如果這第一步搞錯，全盤的分析就會錯得一塌糊塗了。

在捉準需要的五行後，再來就是引導客人如何在衣食住行方面去補運，進而趨吉避凶。坦白說，如果客人不照著做，其實來看命也沒什麼意思。

知道未來好或不好，然後就聽天由命嗎？那豈不是只是花錢，來聽我說出你人生電視連續劇的劇透而已嗎？

我見了那麼多客人後，自己有個感想。如果人生一切都很安好，但自己就是開心不起來，這樣活著如行屍走肉，太痛苦了。

在批八字時，我都會告訴客人該用什麼顏色來旺自己。不要小看色彩學，每個顏色都有它們的五行。我也多次以色彩學，幫助一些客人應徵成功，在疫情期間依然能奏效。

但在七彩繽紛的顏色當中，只要我一提到紅色，客人們的反應普遍都很大。

什麼？那麼亮啊？
我的老婆說看不慣我穿這色！
那不是天天過年嗎？
我以前的命理師也是這麼說，
但我就是沒有做。

我的答案：你穿了幾十年這樣的顏色，也不見得你好。想命好一點，何不試一下我說的顏色？

紅能分出深淺、濃淡、明暗和不同的色度。沒有人叫你每天穿得像紅包似的。你每天穿黑，也不見得你像包青天那般的黑白分明。

附上A小姐和B先生「走紅」後的個別見證。

寫這電郵見證的B先生，在九月與我做了個後續諮詢。我遠遠看到他時，就已在想，怎麼身上絲毫沒有改變，而且還一副苦瓜臉？

他說，當初我三月見他時，他剛買了一堆衣服。顏色雖不利他，但他不捨得丟，而且老婆也不支持他穿紅色。公司裡的人也都是穿暗色的。

我說，那些新衣你也穿了幾個月了，可以拿去捐給有需要的人，佈施也不算浪費。老婆固然好意，但命是你自己的，你痛苦只有你自己知。

對待自己的命運，我們應該持有科學家的研究精神。你不去做這個實驗，你永遠不會知道我說的到底對不對。做這個實驗不難，不妨叫你的太太給你一個機會去改變。

換衣服顏色而已，又不是叫你換老婆。😂

與其內心糾結直到頭腦打結，我永遠選擇踏出第一步試一下。Never try, never know.

我一生人經歷了那麼多起起落落，老實告訴大家，命好起來時，心豁然開朗時，那種感覺真的很爽。不信，你試一下。

————————————

If the energies in the Universe can be categorised, they would come in the 5 forms of Metal, Wood, Water, Fire and Earth.

All manifestations, be it things or events, in this world falls under these 5 elements, and each and every one of our Bazi is the combination of these 5 elements. The interaction between these elements in our Bazi and those in our circumstances will result in myriad of happenings, good fortunes or otherwise.

My personal experience tells me that even though 2 person may have exactly the same Bazi, but their destinies may turn out different. Reasons being the discrepancy in their facial features, the meanings, tonality, character strokes and essence of their names.

The crux of reading your own destiny lies in uncovering which of the 5 elements is or are mandatory for you. This calls for plenty of practical experience. It is not simply doing simple math of plus, minus, multiply and divide. If this first step is wrong, the whole deck of cards will surely collapse.

After deciphering the correct element, the next step is do guide the client on how to use it to boost their energies in all aspects, from external clothing and living environment to what they eat so as to attract good tidings and ward off misfortunes. Frankly, if the client is uncooperative, the whole of point of Bazi analysis would have been lost.

To know how your future will unfold but behave like a sitting duck? That’s just like buying a movie ticket to watch a preview of your life drama, isnt it?

I had this thought after seeing so many clients: if one’s life is seemingly smooth sailing but one remains unhappy, such zombie-like existence is very painful.

During a typical Bazi analysis session, I would always recommend the client certain colours favourable to him or her to boost the luck. Never underestimate the power of colours. Each colour has its own elemental nature. I have used this successfully several times to help clients succeed at their job interviews, even during this pandemic period.

However as soon as I mentioned the red colour, reactions from my clients tended to be bigger than usual.

Why?
Such a bright colour?
My wife said she’s not used to me in this colour!
That’s like Chinese New Year everyday!
The previous master I consulted said so too, but I did not heed the advice.

My answer: if you have been wearing your same old colours for the past many years and getting not much favours from Lady Luck, why not give my suggestion a try?

There are many tones and shades of Red. Nobody is asking you to dress like a big red ang bao (red packet) everyday. Dressing black everyday doesn’t make you Justice Bao either.

Attached are testimonies from Miss A and Mr B after they went red.

Mr B. came to me in September for a follow-up consultation. When I saw him from afar, I was thinking why there wasn’t any sign of change in him. He even sported a sour face.

He told me that after seeing me in March, he had just bought some clothes in colours that were unfavourable to him. He couldn’t bear to throw them away, and his wife didn’t really support him wearing red either. He said his colleagues were all wearing darker colours.

I told him that those clothes he bought had already served him for several months and he could donate them away. That would not constitute wastage. His wife may have good intentions but your destiny is your own business and only you know your sufferings.

We ought to treat our destiny with the spirit of a scientist. If you don’t experiment, you will never know if my methods work. This experiment is a simple one, ask your wife to support you this once.

It’s only changing the colour of your clothes, not asking to change your wife. 😂

Rather than getting oneself in knots, I will always choose to take the first step. Never try, never know.

My life’s journey has been that of ups and downs. Frankly speaking, when the winds begin blowing in your sails, and lift your spirit, those emotions are exhilarating. Don’t believe me? Try it out yourself.

相似詞語辨析 a, one

a源出於 one,故有數詞的作用,也能表示“一”或“一個 之意。然而,a和one 的涵義和用法有所不同。a指某類事物 或人物中的一個,相當於漢語裏不強調數日觀念的“一”,譯成 漢語時,常省略不譯,one 雖然也作“一個”解,但涵義比a更 為確切,有強調數目觀念的意味。因此,在表示類別的場合用 a;在強調數目觀念時用 one。

就詞性而言,a只能作冠詞; one 除作數詞外,還可用作 名詞或代詞。試看下例:

A whale is not a fish any more than a horse is. 鯨之非鱼如同馬之非魚。

Society demands that graduates have a good knowledge of the subjects they have studied as well as good communication skills, language fluency and problem-solving skills. 社會要求大學畢業生對已學習的學科有良好知識,亦要有良好的交際 技巧、流暢的語言表達和解決問題的能力。

但請注意,在某些表示數量、重量、長度和時間的詞組 中,a要譯成“一”。例如,apiece of paper (一張紙); a cup of tea(一杯茶);a packet of cigarettes(一包煙); a cake /a bar of Soap (一塊肥皂); a ray of hope(一線希望); a catty(一 斤); a dozen(一打);a mile(一英里); at a time(每一次); a day or two(一兩天)等。在其他一些詞組裏,則往往無需譯。如:to a great extent(在很大程度上); as a whole(從整體目); at a respectful distance(敬而遠之); with a view to(以.........為目的).........。

通過下列句子的比較,我們可以從另一角度將a和one的差異分辨清楚:

A child cannot do it. (1) One child cannot do it. (2)

(1)句之涵義是:小孩沒有能力做這種工作,要大人才做得了。(2)句的涵義是:一個小孩做不了,要兩個或兩個以的孩子才做得了。

There is a novel on the desk. (3) There is one novel on the desk. (4)

(3)句之意是:桌上放的是小說,不是雜誌、辭典或其他的東西。(4)句的意思是:桌上只有一本小說,不是兩本或二本。

同樣,從深層結構看,下面兩句的涵義也不一樣:

A shotgun is no good. (5) One shotgun is no good. (6)

(5)句的内涵是:It is the wrong Sort of thing. (6)句之意 「為:I need two or three shotguns.

值得注意的是,在下列短語中,a和one 的涵義亦不相同

more than a month 一個多月(如一個月零三日) more than one month 不止一個月(如兩個月或三個月)

at a time 每一次, at one time 從前有個時期。

as a man 就他的性格而言as one man 大家一致地;共同協力地

有時,One 作不定代詞時,表示“人們”之意,不作“一個人”解。例如:

One should point out that only by enacting good laws can social peace and order be preserved. 人們(或我們)應當指出,只有制訂良好的法律,才能維持社會的安寧和秩序。

在俗語中,a可以和one 連用,表示“怪人”、“怪物”之意。

如:

You are a one! 你真是個怪人!

#高雄人 #學習英文 請找 #多益達人林立英文

#高中英文 #成人英文

#多益家教班 #商用英文

#國立大學外國語文學系講師

#相似詞語辨析

#遊戲加速 #降ping #lag
遊戲加速! Ping | 抖動 | 丟包 這些線上遊戲的參數代表什麼 有沒有方式可以優化? - Wilson說給你聽

時間軸
00:00 開場 網路遊戲概說
01:25 FPS
03:07 Ping 延遲
04:46 Deviation 抖動
05:51 Packet loss (Drop) 丟包
07:19 PC端QoS
09:45 區域網路QoS
12:03 Middle mile 封包優化