Shadowsocks Go
Download as pptx, pdf0 likes1,173 views
This document discusses Shadowsocks, an encrypted proxy protocol. It provides information on Shadowsocks implementations in various programming languages including Go. It also summarizes the key code aspects for the Shadowsocks Go server, including how it handles incoming connections by parsing them, dialing to remote servers, and piping data between connections.
1 of 10
Download to read offline
![What’s Shadowsocks
? https://shadowsocks.org/en/spec/Protocol.html
? Shadowsocks is a secure split proxy loosely based on SOCKS5.
? client <---> ss-local <--[encrypted]--> ss-remote <---> target](https://image.slidesharecdn.com/shadowsocksgo-170620141335/85/Shadowsocks-Go-2-320.jpg)
Ad
Recommended
如何利用 Docker 強化網站安全
如何利用 Docker 強化網站安全Tim Hsu
?
Tim Hsu is the founder of CHROOT and HITCON. He previously worked as the security manager for Taiwan Mobile and currently works for VARMOUR, an American cybersecurity company. The document discusses AppArmor security profiles for Docker containers, the VulApps tool for testing container vulnerabilities, the Pornhub bug bounty program, Docker security best practices, and links to resources about remote code execution vulnerabilities in WordPress plugins and Apache Struts.gnome-shell on nexus 7
gnome-shell on nexus 7Bin Li
?
BinLi's presentation slides at GNOME Asia Summit 2015
Share some experience on how to work for new device with GNOME.Industroyer: biggest threat to industrial control systems since Stuxnet by An...
Industroyer: biggest threat to industrial control systems since Stuxnet by An...CODE BLUE
?
Industroyer is the first ever malware specifically designed to attack power grids. This unique and extremely dangerous malware framework was involved in the December 2016 blackout in Ukraine. What sets Industroyer apart from other malware targeting infrastructure, such as BlackEnergy (a.k.a. SandWorm), is its ability to control switches and circuit breakers directly via 4 different industrial communication protocols.
In addition to explaining why Industroyer can be considered the biggest threat to industrial control systems since the infamous Stuxnet worm, we will take a look at the 2016 power outage in the context of the other numerous cyberattacks against Ukrainian critical infrastructure in the recent years.
As the protocols and hardware targeted by Industroyer are employed in power supply infrastructure, transportation control systems, and other critical infrastructure systems, like water and gas, worldwide, the malware can be re-purposed to target vital services in other countries. This discovery should serve as a wake-up call for those responsible for security of these critical systems.
Anton Cherepanov
Anton Cherepanov is currently working at ESET as Senior Malware Researcher; his responsibilities include the analysis of complex threats. He has done extensive research on cyber-attacks in Ukraine. His research was presented on numerous conferences, including Virus Bulletin, CARO Workshop, PHDays, and ZeroNights. His interests focus on reverse engineering and malware analysis automation.
Róbert Lipovsk?
Róbert Lipovsk? is Senior Malware Researcher in ESET’s Security Research Laboratory, with 10 years’ experience with malware research. He is responsible for malware intelligence and analysis and leads the Malware Research team in ESET’s HQ in Bratislava. He is a regular speaker at security conferences, including Black Hat, Virus Bulletin, and CARO. He runs a reverse engineering course at the Slovak University of Technology, his alma mater and the Comenius University. When not bound to a keyboard, he enjoys sports, playing guitar and flying an airplane.Defcon Moscow #0x0A - Mikhail Firstov "Hacking routers as Web Hacker"
Defcon Moscow #0x0A - Mikhail Firstov "Hacking routers as Web Hacker"Defcon Moscow
?
This document discusses hacking routers by exploiting vulnerabilities in their web interfaces. It begins by introducing the author and their background in security research. Several common vulnerabilities are then outlined, including default credentials, authentication bypass, XSS, CSRF and command injection issues. The document provides examples of exploiting these flaws in various router models. A methodology is proposed for analyzing router firmware to find and exploit vulnerabilities, potentially achieving remote code execution. It emphasizes chaining multiple issues together for increased access. Finally, the document suggests that support software, internet service providers, and router developers themselves can also be targeted.Down by the Docker
Down by the DockerNotSoSecure Global Services
?
Docker is the new kool kid in town. This presentation covers some of the common goof-ups and what should be kept in mind when dealing with docker configurations.
Download the Vulnerable Docker VM : https://www.notsosecure.com/vulnerable-docker-vm/
Chw00t: Breaking unices’ chroot solutions
Chw00t: Breaking unices’ chroot solutionsPositive Hack Days
?
The document discusses various techniques for breaking out of chroot jail environments on Unix-like operating systems. It begins with background information on the speaker and a brief history of chroot. It then explains what chroot is and common uses before detailing requirements for a reasonably secure chroot. The bulk of the document summarizes different techniques for escaping chroot restrictions like using classic chroot flaws, file descriptor passing, Unix domain sockets, mount, /proc, and moving directories out of the chrooted environment. It provides examples and demonstrates some techniques. It concludes by discussing future work hardening containers and operating systems against these issues.窺探職場上所需之資安專業技術與能力 Tdohconf
窺探職場上所需之資安專業技術與能力 Tdohconfjack51706
?
This document contains an agenda for a presentation that includes topics such as exploit development, web application hacking methodology, SQLMap, vulnerability assessment, malware analysis, reverse engineering, and cybersecurity conferences. It also addresses frequently asked questions about capture the flag events, bug bounty programs, and security certifications. Resources like exploit code examples, tool documentation, hacking forums, and malware repositories are listed.IPv6 for Pentesters
IPv6 for PentestersNotSoSecure Global Services
?
IPv6 is slowly making its way into our environments and we need to be aware of how it impacts the systems we manage. This presentation takes us through a basic review of the protocol from a pentesters perspective[Hackersuli] ?l? sz?vet a fémvázon: Python és gépi tanulás a Zeek platformon![[Hackersuli] ?l? sz?vet a fémvázon: Python és gépi tanulás a Zeek platformon](https://cdn.slidesharecdn.com/ss_thumbnails/2024hackersulimeetupeloszovetafemvazon-240513132412-37dea2e4-thumbnail.jpg?width=560&fit=bounds)
[Hackersuli] ?l? sz?vet a fémvázon: Python és gépi tanulás a Zeek platformonhackersuli
?
?l? sz?vet a fémvázon: Python és gépi tanulás a Zeek platformon
[CB20] Vulnerabilities of Machine Learning Infrastructure by Sergey Gordeychik![[CB20] Vulnerabilities of Machine Learning Infrastructure by Sergey Gordeychik](https://cdn.slidesharecdn.com/ss_thumbnails/sergeygordeychikcb20-210112133639-thumbnail.jpg?width=560&fit=bounds)
[CB20] Vulnerabilities of Machine Learning Infrastructure by Sergey GordeychikCODE BLUE
?
The boom of AI brought to the market a set of impressive solutions both on the hardware and software side. On the other hand, massive implementation of AI in various areas brings about problems, and security is one of the greatest concerns.
In this talk we will present results of hands-on vulnerability research of different components of AI infrastructure including NVIDIA DGX GPU servers, ML frameworks such as Pytorch, Keras and Tensorflow, data processing pipelines and specific applications, including Medical Imaging and face recognition powered CCTV. Updated Internet Census toolkit based on the Grinder framework will be introduced.Basics of ssl
Basics of ssln|u - The Open Security Community
?
This document provides an overview of Secure Sockets Layer (SSL) and Transport Layer Security (TLS). It discusses the evolution of SSL/TLS, the SSL/TLS handshake process, common attacks like man-in-the-middle attacks using tools like SSLStrip, recent attacks on SSL/TLS like BEAST and CRIME, and security guidelines for configuring SSL/TLS on servers.Adventures with Podman and Varlink
Adventures with Podman and VarlinkJeremy Brown
?
With the 'rise of containers' comes also the rise of container platforms. And while Docker is the way to do things for now, Podman has also been gaining traction as the new kid on the block especially after being somewhat embraced by RedHat and Fedora. Being new also comes with lack of heavy scrutiny and audit on the security side of things. Once you start integrating other protocols and pieces that compliment each other, such as Varlink, boundaries become fuzzy. Rather than focus on container breakouts, which are also very important, we'll focus on how Podman and Varlink interoperate and the authentication and security implications as such. We'll look at the remote API capabilities, secure configurations and how certain setups and projects out there by default can be vulnerable to compromise. By the end of the talk, we will have discussed various bugs, issues and hardening techniques around deploying Podman and Varlink together and if you don't know a lot about containers, you'll learn a bit along the way.Case Studies and Lessons Learned from SSL/TLS Certificate Verification Vulner...
Case Studies and Lessons Learned from SSL/TLS Certificate Verification Vulner...JPCERT Coordination Center
?
Recently we’ve seen many vulnerabilities related to improper certificate validation. Those vulnerabilities come from developers’ ignorance or misunderstanding of basic knowledge of certificate validation or insufficient testing of validation code. This presentation starts with the basics of the certificate validation process, surveys several vulnerabilities in the real world, and concludes with lessons learned from real-world vulnerabilities.
This is presented on JavaOne2015.インフラ野郎Azureチーム Night
インフラ野郎Azureチーム NightToru Makabe
?
True to its name, Ananta provides cloud scale load balancing. It addresses limitations of traditional load balancers by supporting 100Gbps per VIP, rapid failover of thousands of VIPs, and tenant isolation to prevent overloads in one tenant from impacting others. Ananta implements load balancing across three tiers - packet-level in routers, connection-level in servers, and stateful NAT - to achieve high scalability, availability, and flexibility.Spark Streamingによるリアルタイムユーザ属性推定
Spark Streamingによるリアルタイムユーザ属性推定Yoshiyasu SAEKI
?
Spark Streaming allows processing of live data streams using Spark. It works by dividing the data stream into batches called micro-batches, which are then processed using Spark's batch engine to generate RDDs. This allows for fault tolerance, exactly-once processing, and integration with other Spark APIs like MLlib and GraphX.Plack on SL4A in Yokohama.pm #8
Plack on SL4A in Yokohama.pm #8Yoshiki Kurihara
?
This document summarizes using Plack and building a simple HTTP server on Android using Perl with the Scripting Layer for Android (SL4A). It discusses installing SL4A and various Perl interpreters, using Plack to install dependencies to run PSGI applications, and provides an example script that mounts a directory and runs a simple HTTP server on port 8080 to serve files from an SD card.SWAT Style – Live Network Crypto Hacking and Exploitation by Kevin Cardwell a...
SWAT Style – Live Network Crypto Hacking and Exploitation by Kevin Cardwell a...EC-Council
?
In todays IT security world, we accept and embrace that the technology is constantly changing, we are very often still amazed at the rapid growth of the technology evolution and how it has far superseded beyond expectations, whilst thinking about the potential uses of this new technology we get excited and then it hits us! What about the security implications for our organization?? Holy Crap what did you say about SS7?
In this presentation, Wayne will take you through some real live demonstrations of Network Crypto Hacking and Exploitation using the latest custom built, SWAT (Special Weapons and Technology) cyber-warfare hacking tools.
To help us defend against the latest threats, that sends our risk rating scores off the chart? We do as we have always done! Research the threat viability, learn and deploy defense and mitigation options. For this very reason its imperative for us to stay up-to date with new emerging threats tactics.Testing Android Security Codemotion Amsterdam edition
Testing Android Security Codemotion Amsterdam editionJose Manuel Ortega Candel
?
This document outlines an agenda for testing Android security. It discusses various stages of the development cycle and security testing approaches, including static and dynamic analysis, component security, and best practices. Automatic and hybrid tools are presented for analyzing apps through decompilation, emulation, and network traffic inspection. Specific tools are explained like Android Lint, QARK, Drozer, and SQLCipher. The document concludes with recommendations around permissions, encryption, input validation, and references.Testing Android Security - Jose Manuel Ortega Candel - Codemotion Amsterdam 2016
Testing Android Security - Jose Manuel Ortega Candel - Codemotion Amsterdam 2016Codemotion
?
The talk would aim to give an overview of the tools we have to increase the security of applications before publishing them on the market or distribute the apk. These could be talking points: -Static and dynamic analysis application code for detecting potential vulnerabilities. -Development security in android components -New permissions model from version 6 where the user can allow or deny permissions in runtime -Libraries that allow encrypted data, for example SQLCipher to encrypt a SQLite database or to encrypt xml preferences files like securePreferencesWebGoat.SDWAN.Net in Depth
WebGoat.SDWAN.Net in Depthyalegko
?
This document summarizes a presentation on SD-WAN security given by Denis Kolegov and Oleg Broslavsky. It discusses the results of an SD-WAN internet census that found thousands of exposed SD-WAN devices, many with known vulnerabilities. Common vulnerabilities found in SD-WAN products include XSS, CSRF, insecure authentication, and the use of hardcoded cryptographic keys. Exploits are demonstrated against several commercial SD-WAN products to highlight real-world risks. The presenters advocate for improving SD-WAN security and responsible vulnerability disclosure.WebGoat.SDWAN.Net in Depth: SD-WAN Security Assessment 
WebGoat.SDWAN.Net in Depth: SD-WAN Security Assessment Sergey Gordeychik
?
Denis Kolegov, Oleg Broslavsky, Power of Community 2018, Seoul, Korea
Today, ?SD-WAN? is a very hot and attractive topic. Software-defined WAN (SD-WAN) is a technology based on software-defined network (SDN) approach applied to wide area networks (WAN) in enterprise networks. According to Gartner’s predictions study, more than 50% of routers will be replaced with SD-WAN solutions by 2020.
In this presentation, we disclose a set of vulnerabilities in widespread and most popular SD-WAN products including Citrix NetScaler and Silver Peak EdgeConnect. We present the new results of our research, consider some technical details of the insecure design and found vulnerabilities, and describe different attack scenarios that may allow an attacker to compromise SD-WAN control and data planes.DevOpSec_DockerNPodMan-20230220.pdf
DevOpSec_DockerNPodMan-20230220.pdfkanedafromparis
?
Docker … Podman are two close but different tools. What are their differences, what are their commonalities? In this presentation, we propose to present the two tools in order to highlight their differences in design and their specificities, their similarities.
The objective is to allow you to know these tools, from their common roots (Cgroup, namespace,...) to their divergence (socket). From ease of use (Socket) to the hassle (proxy), we will address the strengths and weaknesses of each through our uses of them (build, test,...). We will of course mention our friends the CVEs to feed your thoughts on their security.
Outlook and Exchange for the bad guys
Outlook and Exchange for the bad guysNick Landers
?
DerbyCon 2016
Nick Landers @monoxgas
External mail via Exchange is one of the most common services offered by organizations today. The Microsoft Office suite is even more prevalent making Outlook the most common mail client around. This talk focuses on the abuse of these two products for the purpose of gaining code execution inside remote networks. Subjects include E-Mail and password scraping, OWA/EWS brute forcing techniques, and new research into abusing Outlook mail rules for remote code execution. Learn about the capabilities of client side rules, the underlying Windows APIs, and how to modify these rule objects to make phishing attacks obsolete. Security Consultant at Silent Break Security. Professional Hacker for 2 years. Current work involves writing custom malware and researching unique attack vectors that abuse functionality in windows environments.
seminar
seminarSouvik Kolay
?
The document discusses lightweight cryptography for constrained devices. It presents the objectives of designing a lightweight bit-permutation instruction called PERMS to accelerate cryptography in software, and a new lightweight block cipher called Khudra suitable for both FPGAs and ASICs. It also aims to analyze Khudra's security against cryptanalysis techniques. The PERMS instruction is based on bit swapping to achieve permutation efficiently in hardware using control bits.State of Akka 2017 - The best is yet to come
State of Akka 2017 - The best is yet to comeKonrad Malawski
?
Konrad Malawski gave a talk at Scala Days CPH 2017 about the current state and future direction of Akka. He discussed how Akka is moving from the actor model to reactive streams and Akka Streams for better concurrency and distribution capabilities. Akka Cluster provides robust membership and fault tolerance for distributed actors across many nodes, while Cluster Sharding enables easy sharding of data and work across a cluster. The talk outlined Akka's past successes and hinted at upcoming improvements to further "do better than that."Cloud Foundry V2 | Intermediate Deep Dive
Cloud Foundry V2 | Intermediate Deep DiveKazuto Kusama
?
Cloud Foundry uses buildpacks to compile applications and produce executable droplets. A buildpack detects the application type, compiles dependencies and runtimes, and produces metadata to run the application. The DEA executes the buildpack stages - detect, compile, and release - to download the application, run the appropriate buildpack, and build a droplet containing the compiled application and dependencies that can run on Cloud Foundry.Switchdev - No More SDK
Switchdev - No More SDKKernel TLV
?
In this talk Elad Raz from Mellanox Technologies talks about his effort to open source switch development and transition from proprietary SDKs to a standard, in-kernel solution.
使用 Dify 做 AI 应用 - 接触2周的一些小想法小心得分享 Ruby Tuesday Shanghai
使用 Dify 做 AI 应用 - 接触2周的一些小想法小心得分享 Ruby Tuesday ShanghaiEric Guo
?
时间：2025 年 2 月 18 日 (周二) 19:45 - 21:15
地点：上海静安区南京西路 819 号 4 楼 Wework - 4J 会议室 (地铁 2 号线南京西路地铁站)
模型接入
应用展示（没做完）
IT知识库
RAG 知识库 合同审核
API 访问与应用集成
部署 Dify
全本地最小化运行
License问题
Dify的二次开发介绍和未来的一些工作计划二次开发开源项目管理工具 OpenProject by Eric-Guo at RubyConf China 2024
二次开发开源项目管理工具 OpenProject by Eric-Guo at RubyConf China 2024Eric Guo
?
Open Project概述和优劣势分析
Open Project的功能演示（以下简称OP）
OP涉及的技术概述 Rails、Angular、Grape
OP二开的一些例子（提供commit）本地开发演示
OP的展望与未来More Related Content
Similar to Shadowsocks Go (20)
[Hackersuli] ?l? sz?vet a fémvázon: Python és gépi tanulás a Zeek platformon
[Hackersuli] ?l? sz?vet a fémvázon: Python és gépi tanulás a Zeek platformonhackersuli
?
?l? sz?vet a fémvázon: Python és gépi tanulás a Zeek platformon
[CB20] Vulnerabilities of Machine Learning Infrastructure by Sergey Gordeychik
[CB20] Vulnerabilities of Machine Learning Infrastructure by Sergey GordeychikCODE BLUE
?
The boom of AI brought to the market a set of impressive solutions both on the hardware and software side. On the other hand, massive implementation of AI in various areas brings about problems, and security is one of the greatest concerns.
In this talk we will present results of hands-on vulnerability research of different components of AI infrastructure including NVIDIA DGX GPU servers, ML frameworks such as Pytorch, Keras and Tensorflow, data processing pipelines and specific applications, including Medical Imaging and face recognition powered CCTV. Updated Internet Census toolkit based on the Grinder framework will be introduced.Basics of ssl
Basics of ssln|u - The Open Security Community
?
This document provides an overview of Secure Sockets Layer (SSL) and Transport Layer Security (TLS). It discusses the evolution of SSL/TLS, the SSL/TLS handshake process, common attacks like man-in-the-middle attacks using tools like SSLStrip, recent attacks on SSL/TLS like BEAST and CRIME, and security guidelines for configuring SSL/TLS on servers.Adventures with Podman and Varlink
Adventures with Podman and VarlinkJeremy Brown
?
With the 'rise of containers' comes also the rise of container platforms. And while Docker is the way to do things for now, Podman has also been gaining traction as the new kid on the block especially after being somewhat embraced by RedHat and Fedora. Being new also comes with lack of heavy scrutiny and audit on the security side of things. Once you start integrating other protocols and pieces that compliment each other, such as Varlink, boundaries become fuzzy. Rather than focus on container breakouts, which are also very important, we'll focus on how Podman and Varlink interoperate and the authentication and security implications as such. We'll look at the remote API capabilities, secure configurations and how certain setups and projects out there by default can be vulnerable to compromise. By the end of the talk, we will have discussed various bugs, issues and hardening techniques around deploying Podman and Varlink together and if you don't know a lot about containers, you'll learn a bit along the way.Case Studies and Lessons Learned from SSL/TLS Certificate Verification Vulner...
Case Studies and Lessons Learned from SSL/TLS Certificate Verification Vulner...JPCERT Coordination Center
?
Recently we’ve seen many vulnerabilities related to improper certificate validation. Those vulnerabilities come from developers’ ignorance or misunderstanding of basic knowledge of certificate validation or insufficient testing of validation code. This presentation starts with the basics of the certificate validation process, surveys several vulnerabilities in the real world, and concludes with lessons learned from real-world vulnerabilities.
This is presented on JavaOne2015.インフラ野郎Azureチーム Night
インフラ野郎Azureチーム NightToru Makabe
?
True to its name, Ananta provides cloud scale load balancing. It addresses limitations of traditional load balancers by supporting 100Gbps per VIP, rapid failover of thousands of VIPs, and tenant isolation to prevent overloads in one tenant from impacting others. Ananta implements load balancing across three tiers - packet-level in routers, connection-level in servers, and stateful NAT - to achieve high scalability, availability, and flexibility.Spark Streamingによるリアルタイムユーザ属性推定
Spark Streamingによるリアルタイムユーザ属性推定Yoshiyasu SAEKI
?
Spark Streaming allows processing of live data streams using Spark. It works by dividing the data stream into batches called micro-batches, which are then processed using Spark's batch engine to generate RDDs. This allows for fault tolerance, exactly-once processing, and integration with other Spark APIs like MLlib and GraphX.Plack on SL4A in Yokohama.pm #8
Plack on SL4A in Yokohama.pm #8Yoshiki Kurihara
?
This document summarizes using Plack and building a simple HTTP server on Android using Perl with the Scripting Layer for Android (SL4A). It discusses installing SL4A and various Perl interpreters, using Plack to install dependencies to run PSGI applications, and provides an example script that mounts a directory and runs a simple HTTP server on port 8080 to serve files from an SD card.SWAT Style – Live Network Crypto Hacking and Exploitation by Kevin Cardwell a...
SWAT Style – Live Network Crypto Hacking and Exploitation by Kevin Cardwell a...EC-Council
?
In todays IT security world, we accept and embrace that the technology is constantly changing, we are very often still amazed at the rapid growth of the technology evolution and how it has far superseded beyond expectations, whilst thinking about the potential uses of this new technology we get excited and then it hits us! What about the security implications for our organization?? Holy Crap what did you say about SS7?
In this presentation, Wayne will take you through some real live demonstrations of Network Crypto Hacking and Exploitation using the latest custom built, SWAT (Special Weapons and Technology) cyber-warfare hacking tools.
To help us defend against the latest threats, that sends our risk rating scores off the chart? We do as we have always done! Research the threat viability, learn and deploy defense and mitigation options. For this very reason its imperative for us to stay up-to date with new emerging threats tactics.Testing Android Security Codemotion Amsterdam edition
Testing Android Security Codemotion Amsterdam editionJose Manuel Ortega Candel
?
This document outlines an agenda for testing Android security. It discusses various stages of the development cycle and security testing approaches, including static and dynamic analysis, component security, and best practices. Automatic and hybrid tools are presented for analyzing apps through decompilation, emulation, and network traffic inspection. Specific tools are explained like Android Lint, QARK, Drozer, and SQLCipher. The document concludes with recommendations around permissions, encryption, input validation, and references.Testing Android Security - Jose Manuel Ortega Candel - Codemotion Amsterdam 2016
Testing Android Security - Jose Manuel Ortega Candel - Codemotion Amsterdam 2016Codemotion
?
The talk would aim to give an overview of the tools we have to increase the security of applications before publishing them on the market or distribute the apk. These could be talking points: -Static and dynamic analysis application code for detecting potential vulnerabilities. -Development security in android components -New permissions model from version 6 where the user can allow or deny permissions in runtime -Libraries that allow encrypted data, for example SQLCipher to encrypt a SQLite database or to encrypt xml preferences files like securePreferencesWebGoat.SDWAN.Net in Depth
WebGoat.SDWAN.Net in Depthyalegko
?
This document summarizes a presentation on SD-WAN security given by Denis Kolegov and Oleg Broslavsky. It discusses the results of an SD-WAN internet census that found thousands of exposed SD-WAN devices, many with known vulnerabilities. Common vulnerabilities found in SD-WAN products include XSS, CSRF, insecure authentication, and the use of hardcoded cryptographic keys. Exploits are demonstrated against several commercial SD-WAN products to highlight real-world risks. The presenters advocate for improving SD-WAN security and responsible vulnerability disclosure.WebGoat.SDWAN.Net in Depth: SD-WAN Security Assessment
WebGoat.SDWAN.Net in Depth: SD-WAN Security Assessment Sergey Gordeychik
?
Denis Kolegov, Oleg Broslavsky, Power of Community 2018, Seoul, Korea
Today, ?SD-WAN? is a very hot and attractive topic. Software-defined WAN (SD-WAN) is a technology based on software-defined network (SDN) approach applied to wide area networks (WAN) in enterprise networks. According to Gartner’s predictions study, more than 50% of routers will be replaced with SD-WAN solutions by 2020.
In this presentation, we disclose a set of vulnerabilities in widespread and most popular SD-WAN products including Citrix NetScaler and Silver Peak EdgeConnect. We present the new results of our research, consider some technical details of the insecure design and found vulnerabilities, and describe different attack scenarios that may allow an attacker to compromise SD-WAN control and data planes.DevOpSec_DockerNPodMan-20230220.pdf
DevOpSec_DockerNPodMan-20230220.pdfkanedafromparis
?
Docker … Podman are two close but different tools. What are their differences, what are their commonalities? In this presentation, we propose to present the two tools in order to highlight their differences in design and their specificities, their similarities.
The objective is to allow you to know these tools, from their common roots (Cgroup, namespace,...) to their divergence (socket). From ease of use (Socket) to the hassle (proxy), we will address the strengths and weaknesses of each through our uses of them (build, test,...). We will of course mention our friends the CVEs to feed your thoughts on their security.
Outlook and Exchange for the bad guys
Outlook and Exchange for the bad guysNick Landers
?
DerbyCon 2016
Nick Landers @monoxgas
External mail via Exchange is one of the most common services offered by organizations today. The Microsoft Office suite is even more prevalent making Outlook the most common mail client around. This talk focuses on the abuse of these two products for the purpose of gaining code execution inside remote networks. Subjects include E-Mail and password scraping, OWA/EWS brute forcing techniques, and new research into abusing Outlook mail rules for remote code execution. Learn about the capabilities of client side rules, the underlying Windows APIs, and how to modify these rule objects to make phishing attacks obsolete. Security Consultant at Silent Break Security. Professional Hacker for 2 years. Current work involves writing custom malware and researching unique attack vectors that abuse functionality in windows environments.
seminar
seminarSouvik Kolay
?
The document discusses lightweight cryptography for constrained devices. It presents the objectives of designing a lightweight bit-permutation instruction called PERMS to accelerate cryptography in software, and a new lightweight block cipher called Khudra suitable for both FPGAs and ASICs. It also aims to analyze Khudra's security against cryptanalysis techniques. The PERMS instruction is based on bit swapping to achieve permutation efficiently in hardware using control bits.State of Akka 2017 - The best is yet to come
State of Akka 2017 - The best is yet to comeKonrad Malawski
?
Konrad Malawski gave a talk at Scala Days CPH 2017 about the current state and future direction of Akka. He discussed how Akka is moving from the actor model to reactive streams and Akka Streams for better concurrency and distribution capabilities. Akka Cluster provides robust membership and fault tolerance for distributed actors across many nodes, while Cluster Sharding enables easy sharding of data and work across a cluster. The talk outlined Akka's past successes and hinted at upcoming improvements to further "do better than that."Cloud Foundry V2 | Intermediate Deep Dive
Cloud Foundry V2 | Intermediate Deep DiveKazuto Kusama
?
Cloud Foundry uses buildpacks to compile applications and produce executable droplets. A buildpack detects the application type, compiles dependencies and runtimes, and produces metadata to run the application. The DEA executes the buildpack stages - detect, compile, and release - to download the application, run the appropriate buildpack, and build a droplet containing the compiled application and dependencies that can run on Cloud Foundry.Switchdev - No More SDK
Switchdev - No More SDKKernel TLV
?
In this talk Elad Raz from Mellanox Technologies talks about his effort to open source switch development and transition from proprietary SDKs to a standard, in-kernel solution.Case Studies and Lessons Learned from SSL/TLS Certificate Verification Vulner...
Case Studies and Lessons Learned from SSL/TLS Certificate Verification Vulner...JPCERT Coordination Center
?
More from Eric Guo (7)
使用 Dify 做 AI 应用 - 接触2周的一些小想法小心得分享 Ruby Tuesday Shanghai
使用 Dify 做 AI 应用 - 接触2周的一些小想法小心得分享 Ruby Tuesday ShanghaiEric Guo
?
时间：2025 年 2 月 18 日 (周二) 19:45 - 21:15
地点：上海静安区南京西路 819 号 4 楼 Wework - 4J 会议室 (地铁 2 号线南京西路地铁站)
模型接入
应用展示（没做完）
IT知识库
RAG 知识库 合同审核
API 访问与应用集成
部署 Dify
全本地最小化运行
License问题
Dify的二次开发介绍和未来的一些工作计划二次开发开源项目管理工具 OpenProject by Eric-Guo at RubyConf China 2024
二次开发开源项目管理工具 OpenProject by Eric-Guo at RubyConf China 2024Eric Guo
?
Open Project概述和优劣势分析
Open Project的功能演示（以下简称OP）
OP涉及的技术概述 Rails、Angular、Grape
OP二开的一些例子（提供commit）本地开发演示
OP的展望与未来全栈三个月开发绩效系统 using Rails 7.1 to develop people performance evaluation system
全栈三个月开发绩效系统 using Rails 7.1 to develop people performance evaluation systemEric Guo
?
Do people performance evaluation without Vendor/SaaS cost. source code: https://github.com/thape-cn/ppDragon Ruby 孩子的游戏编程.pdf
Dragon Ruby 孩子的游戏编程.pdfEric Guo
?
Dragon Ruby is a game development environment that allows children to learn programming through building games. It uses the Ruby programming language and supports development for multiple platforms. Some key features include input and output support, performance improvements in version 3.0, and the ability to publish games to platforms like Itch.io. Learning Dragon Ruby involves starting with simple examples and gradually building more complex games while reading the official documentation.Rails 6 frontend frameworks
Rails 6 frontend frameworksEric Guo
?
The document discusses frontend frameworks for Rails 6, comparing the asset pipeline and webpack. It covers problems with the asset pipeline like slowness and lack of ES6 support. Webpack solves these issues through its module bundler capabilities and loaders/plugins. Stimulus.js is presented as a simple option to manage state in the browser via data attributes. React with Redux is discussed as another option but challenges mixing their state with Rails are noted. Integrating frameworks like React, Angular, Vue, Stimulus and Svelte with Rails via Webpacker is mentioned. Examples of React/Redux and Stimulus usage are provided.Web TCard - Speed optimization
Web TCard - Speed optimizationEric Guo
?
How to rebuild a manufacturing travel card for mobile age, from Crystal Report to Rails 4 web application.Git extension-training
Git extension-trainingEric Guo
?
The one hours GIT Extension Training focus basic usage and installation for Subversion users.
Given at SDSS - SanDisk as internal training.Ad
Recently uploaded (20)
Trends Artificial Intelligence - Mary Meeker
Trends Artificial Intelligence - Mary MeekerClive Dickens
?
Mary Meeker’s 2024 AI report highlights a seismic shift in productivity, creativity, and business value driven by generative AI. She charts the rapid adoption of tools like ChatGPT and Midjourney, likening today’s moment to the dawn of the internet. The report emphasizes AI’s impact on knowledge work, software development, and personalized services—while also cautioning about data quality, ethical use, and the human-AI partnership. In short, Meeker sees AI as a transformative force accelerating innovation and redefining how we live and work.
Oracle Cloud Infrastructure Generative AI Professional
Oracle Cloud Infrastructure Generative AI ProfessionalVICTOR MAESTRE RAMIREZ
?
Oracle Cloud Infrastructure Generative AI ProfessionalIntegration of Utility Data into 3D BIM Models Using a 3D Solids Modeling Wor...
Integration of Utility Data into 3D BIM Models Using a 3D Solids Modeling Wor...Safe Software
?
Jacobs has developed a 3D utility solids modelling workflow to improve the integration of utility data into 3D Building Information Modeling (BIM) environments. This workflow, a collaborative effort between the New Zealand Geospatial Team and the Australian Data Capture Team, employs FME to convert 2D utility data into detailed 3D representations, supporting enhanced spatial analysis and clash detection.
To enable the automation of this process, Jacobs has also developed a survey data standard that standardizes the capture of existing utilities. This standard ensures consistency in data collection, forming the foundation for the subsequent automated validation and modelling steps. The workflow begins with the acquisition of utility survey data, including attributes such as location, depth, diameter, and material of utility assets like pipes and manholes. This data is validated through a custom-built tool that ensures completeness and logical consistency, including checks for proper connectivity between network components. Following validation, the data is processed using an automated modelling tool to generate 3D solids from 2D geometric representations. These solids are then integrated into BIM models to facilitate compatibility with 3D workflows and enable detailed spatial analyses.
The workflow contributes to improved spatial understanding by visualizing the relationships between utilities and other infrastructure elements. The automation of validation and modeling processes ensures consistent and accurate outputs, minimizing errors and increasing workflow efficiency.
This methodology highlights the application of FME in addressing challenges associated with geospatial data transformation and demonstrates its utility in enhancing data integration within BIM frameworks. By enabling accurate 3D representation of utility networks, the workflow supports improved design collaboration and decision-making in complex infrastructure projectsAI Agents in Logistics and Supply Chain Applications Benefits and Implementation
AI Agents in Logistics and Supply Chain Applications Benefits and ImplementationChristine Shepherd
?
AI agents are reshaping logistics and supply chain operations by enabling automation, predictive insights, and real-time decision-making across key functions such as demand forecasting, inventory management, procurement, transportation, and warehouse operations. Powered by technologies like machine learning, NLP, computer vision, and robotic process automation, these agents deliver significant benefits including cost reduction, improved efficiency, greater visibility, and enhanced adaptability to market changes. While practical use cases show measurable gains in areas like dynamic routing and real-time inventory tracking, successful implementation requires careful integration with existing systems, quality data, and strategic scaling. Despite challenges such as data integration and change management, AI agents offer a strong competitive edge, with widespread industry adoption expected by 2025.Azure vs AWS Which Cloud Platform Is Best for Your Business in 2025
Azure vs AWS Which Cloud Platform Is Best for Your Business in 2025Infrassist Technologies Pvt. Ltd.
?
Azure vs. AWS is a common comparison when businesses evaluate cloud platforms for performance, flexibility, and cost-efficiency.
Agentic AI: Beyond the Buzz- LangGraph Studio V2
Agentic AI: Beyond the Buzz- LangGraph Studio V2Shashikant Jagtap
?
Presentation given at the LangChain community meetup London
https://lu.ma/9d5fntgj
Coveres
Agentic AI: Beyond the Buzz
?Introduction to AI Agent and Agentic AI
?Agent Use case and stats
?Introduction to LangGraph
?Build agent with LangGraph Studio V2Establish Visibility and Manage Risk in the Supply Chain with Anchore SBOM
Establish Visibility and Manage Risk in the Supply Chain with Anchore SBOMAnchore
?
Over 70% of any given software application consumes open source software (most likely not even from the original source) and only 15% of organizations feel confident in their risk management practices.
With the newly announced Anchore SBOM feature, teams can start safely consuming OSS while mitigating security and compliance risks. Learn how to import SBOMs in industry-standard formats (SPDX, CycloneDX, Syft), validate their integrity, and proactively address vulnerabilities within your software ecosystem.If You Use Databricks, You Definitely Need FME
If You Use Databricks, You Definitely Need FMESafe Software
?
DataBricks makes it easy to use Apache Spark. It provides a platform with the potential to analyze and process huge volumes of data. Sounds awesome. The sales brochure reads as if it is a can-do-all data integration platform. Does it replace our beloved FME platform or does it provide opportunities for FME to shine? Challenge acceptedGIS and FME: The Foundation to Improve the Locate Process of Utilities
GIS and FME: The Foundation to Improve the Locate Process of UtilitiesSafe Software
?
Locate requests is an important activity for utility companies to prevent people who are digging from damaging underground assets. At Energir, locates were historically treated by our internal field technicians. It’s a very intensive and time-sensitive task during the summer season and it has a significant financial and environmental cost. Since locate requests tend to increase from year to year, it became clear that improvements were needed to keep delivering a quality service to requestors and keeping Energir’s assets safe. This presentation will explain how transformative projects done in the past years allowed to start sending locate plans to requestors without the intervention of field technicians. The analysis of the GIS data through FME workbenchs allows to filter some locate request types and process them semi-automatically. However, the experience gained so far shows that this process is limited by the fact that Energir’s is missing precise information about the spatial accuracy. Future plans are to precisely locate most of Energir’s gas network and FME will again be a huge help to integrate all the data that will be produced.Your startup on AWS - How to architect and maintain a Lean and Mean account
Your startup on AWS - How to architect and maintain a Lean and Mean accountangelo60207
?
Prevent infrastructure costs from becoming a significant line item on your startup’s budget! Serial entrepreneur and software architect Angelo Mandato will share his experience with AWS Activate (startup credits from AWS) and knowledge on how to architect a lean and mean AWS account ideal for budget minded and bootstrapped startups. In this session you will learn how to manage a production ready AWS account capable of scaling as your startup grows for less than $100/month before credits. We will discuss AWS Budgets, Cost Explorer, architect priorities, and the importance of having flexible, optimized Infrastructure as Code. We will wrap everything up discussing opportunities where to save with AWS services such as S3, EC2, Load Balancers, Lambda Functions, RDS, and many others.Domino IQ – What to Expect, First Steps and Use Cases
Domino IQ – What to Expect, First Steps and Use Casespanagenda
?
Webinar Recording: https://www.panagenda.com/webinars/domino-iq-what-to-expect-first-steps-and-use-cases/
HCL Domino iQ Server – From Ideas Portal to implemented Feature. Discover what it is, what it isn’t, and explore the opportunities and challenges it presents.
Key Takeaways
- What are Large Language Models (LLMs) and how do they relate to Domino iQ
- Essential prerequisites for deploying Domino iQ Server
- Step-by-step instructions on setting up your Domino iQ Server
- Share and discuss thoughts and ideas to maximize the potential of Domino iQWhat is Oracle EPM A Guide to Oracle EPM Cloud Everything You Need to Know
What is Oracle EPM A Guide to Oracle EPM Cloud Everything You Need to KnowSMACT Works
?
In today's fast-paced business landscape, financial planning and performance management demand powerful tools that deliver accurate insights. Oracle EPM (Enterprise Performance Management) stands as a leading solution for organizations seeking to transform their financial processes. This comprehensive guide explores what Oracle EPM is, its key benefits, and how partnering with the right Oracle EPM consulting team can maximize your investment. LSNIF: Locally-Subdivided Neural Intersection Function
LSNIF: Locally-Subdivided Neural Intersection FunctionTakahiro Harada
?
Neural representations have shown the potential to accelerate ray casting in a conventional ray-tracing-based rendering pipeline. We introduce a novel approach called Locally-Subdivided Neural Intersection Function (LSNIF) that replaces bottom-level BVHs used as traditional geometric representations with a neural network. Our method introduces a sparse hash grid encoding scheme incorporating geometry voxelization, a scene-agnostic training data collection, and a tailored loss function. It enables the network to output not only visibility but also hit-point information and material indices. LSNIF can be trained offline for a single object, allowing us to use LSNIF as a replacement for its corresponding BVH. With these designs, the network can handle hit-point queries from any arbitrary viewpoint, supporting all types of rays in the rendering pipeline. We demonstrate that LSNIF can render a variety of scenes, including real-world scenes designed for other path tracers, while achieving a memory footprint reduction of up to 106.2x compared to a compressed BVH.
https://arxiv.org/abs/2504.21627
vertical-cnc-processing-centers-drillteq-v-200-en.pdf
vertical-cnc-processing-centers-drillteq-v-200-en.pdfAmirStern2
?
?????? CNC ????? ?????? ?? ?????? ?????? ?????? ????? ?????? ?????? ??????? ?????? ??????. ???? ???? ????? ??? ?-x ??????? ??? ??????? ?????, ????? ?"? ??? ?????, ?? ???? ???? ???? setup (??????) ?????? ????? ?? ?????. FME Beyond Data Processing Creating A Dartboard Accuracy App
FME Beyond Data Processing Creating A Dartboard Accuracy AppSafe Software
?
At Nordend, we want to push the boundaries of FME and explore its potential for more creative applications. In our office, we have a dartboard, and while improving our dart-throwing skills was an option, we took a different approach: What if we could use FME to calculate where we should aim to achieve the highest possible score, based on our accuracy? Using FME’s Geometry User parameter, we designed a custom solution. When launching the FME Flow app, the map is now a dartboard. The centre of the map is always fixed on the same area of the world, where we pinned a PNG picture of a dartboard as a basemap through a self-created WMS. This visual setup allowed us to draw polygons—each with three points—where our darts landed, using the Geometry parameter. These polygons get processed through an FME workspace, which translates the coordinates from the map into exact X and Y positions on the dartboard. With this accurate data, we calculate all sorts of statistics: rolling averages, best scores, and even standard deviations. The results get displayed on a dashboard in FME Flow, giving us insights into how we could maximize our scores, based purely on where we actually tend to throw. Join us for a live demonstration of the app! The takeaway? FME isn’t just a powerful data processing tool; with a bit of imagination, it can be used for far more creative and unconventional applications. This project demonstrates that the only limit to what FME can do is the creativity you bring to it.Oracle Cloud Infrastructure AI Foundations
Oracle Cloud Infrastructure AI FoundationsVICTOR MAESTRE RAMIREZ
?
Oracle Cloud Infrastructure AI FoundationsData Virtualization: Bringing the Power of FME to Any Application
Data Virtualization: Bringing the Power of FME to Any ApplicationSafe Software
?
Imagine building web applications or dashboards on top of all your systems. With FME’s new Data Virtualization feature, you can deliver the full CRUD (create, read, update, and delete) capabilities on top of all your data that exploit the full power of FME’s all data, any AI capabilities. Data Virtualization enables you to build OpenAPI compliant API endpoints using FME Form’s no-code development platform.
In this webinar, you’ll see how easy it is to turn complex data into real-time, usable REST API based services. We’ll walk through a real example of building a map-based app using FME’s Data Virtualization, and show you how to get started in your own environment – no dev team required.
What you’ll take away:
-How to build live applications and dashboards with federated data
-Ways to control what’s exposed: filter, transform, and secure responses
-How to scale access with caching, asynchronous web call support, with API endpoint level security.
-Where this fits in your stack: from web apps, to AI, to automation
Whether you’re building internal tools, public portals, or powering automation – this webinar is your starting point to real-time data delivery.Developing Schemas with FME and Excel - Peak of Data & AI 2025
Developing Schemas with FME and Excel - Peak of Data & AI 2025Safe Software
?
When working with other team members who may not know the Esri GIS platform or may not be database professionals; discussing schema development or changes can be difficult. I have been using Excel to help illustrate and discuss schema design/changes during meetings and it has proven a useful tool to help illustrate how a schema will be built. With just a few extra columns, that Excel file can be sent to FME to create new feature classes/tables. This presentation will go thru the steps needed to accomplish this task and provide some lessons learned and tips/tricks that I use to speed the process.How Advanced Environmental Detection Is Revolutionizing Oil & Gas Safety.pdf
How Advanced Environmental Detection Is Revolutionizing Oil & Gas Safety.pdfRejig Digital
?
Unlock the future of oil & gas safety with advanced environmental detection technologies that transform hazard monitoring and risk management. This presentation explores cutting-edge innovations that enhance workplace safety, protect critical assets, and ensure regulatory compliance in high-risk environments.
? What You’ll Learn:
? How advanced sensors detect environmental threats in real-time for proactive hazard prevention
? Integration of IoT and AI to enable rapid response and minimize incident impact
? Enhancing workforce protection through continuous monitoring and data-driven safety protocols
? Case studies highlighting successful deployment of environmental detection systems in oil & gas operations
Ideal for safety managers, operations leaders, and technology innovators in the oil & gas industry, this presentation offers practical insights and strategies to revolutionize safety standards and boost operational resilience.
? Learn more: https://www.rejigdigital.com/blog/continuous-monitoring-prevent-blowouts-well-control-issues/Azure vs AWS Which Cloud Platform Is Best for Your Business in 2025
Azure vs AWS Which Cloud Platform Is Best for Your Business in 2025Infrassist Technologies Pvt. Ltd.
?
Ad
Shadowsocks Go
- 1. Source code reading and implementation learning Shadowsocks Go Eric-Guo Github @ericguo Ruby-China @ecguo Twiter 2017-06-20
- 2. What’s Shadowsocks ? https://shadowsocks.org/en/spec/Protocol.html ? Shadowsocks is a secure split proxy loosely based on SOCKS5. ? client <---> ss-local <--[encrypted]--> ss-remote <---> target
- 3. Shadowsocks vs … ? StrongSwan ? OpenVPN ? PPTP ? sshuttle
- 4. SS is abbreviation of ShadowSocks SS vs SSR https://github.com/shadowsocks/shadowsocks https://www.zybuluo.com/yiranphp/note/632579 https://github.com/shadowsocksr/shadowsocksr https://github.com/breakwa11/shadowsocks- rss/issues/38#issuecomment-243106134
- 5. Shadowsocks Implementation ? https://shadowsocks.org/en/spec/Implementations.html ? Python ? C ? Node.js ? Go ? Ruby ? Erlang
- 6. Shadowsocks Enhance ? DNS (UDP) relay ? OTA ? AEAD ? kcptun ? obfsplugin
- 7. Shadowsocks Go ? Client & Server ? Original SS ? OTA (deprecated) ? UDP relay on server side support
- 8. Code Reading - server main ? cmd/shadowsocks-server/server.go:312 run(port, password string) ? To listen the incoming link from ss client ? cmd/shadowsocks-server/server.go:111 handleConnection(conn *ss.Conn) ? Parse incoming conn, Dial to remote, Pipe line both conn and remote ? cmd/shadowsocks-server/server.go:18 PipeThenClose(src, dst net.Conn) ? Read src and Write to dst
- 9. Code Reading - parse incoming conn ? Three type of typeIPv4, typeIPv6 and typeDm. ? typeDm used in browser
- 10. Code Reading - ss.NewConn ? shadowsocks-go/shadowsocks/conn.go ? shadowsocks-go/shadowsocks/encrypt.go