Search
Found this photo on my phone. Who did this every time rushing out from home?! Luckily I got few pairs of sneaker in my car lol. Have no idea why I can wear it wrongly lol. The color looks super diff but yet, I still wear this out. 😂 #jialat liaoooo
It's not often you find a proper piece of 神戸牛 Kobe Beef Wagyu, & a "Chateaubriand" cut too with such beautiful fine marbling 綺麗なサシ.. The Lunch Set for this cut also starts in the HKD $4xx only.
This Shop is very well priced with great pieces of meat, the Prime cuts are proper graded Kobe Beef ™️, not just any 兵庫 但馬牛. The butchers cuts like Karubi/Galbi or Akami are Kyushu Wagyu, which are also good as standards are set by Kobe 神戸 flagship store.
In HK, there is no doubt that on a good day when they have it, Nikushou has the best Wagyu offerings by far, if u know it u will, it's on a totally diff grading horizontal plane sourced by @meatchelin . I find Great to be slightly less satisfying as before despite the beautiful butchering, sometimes it's not defrosted as well plus their Wagyu cuts don't leave as much flavor impact as at the beginning. JA direct run Yakiniku Wagyu Pure 和牛燒肉純 is under rated. Jumbo is fairly heavily Marinated & garlicky in HK shop, making it taste like a mid tier audience shop, except even Futago or Ichiro has a better sophisticated marinade.
Here it's definitely a game changer with their quality Meats vs CP value! 😬
本篇文章探討的也是資安系列問題，而這次的目標主角則是 MAC 系統上廣為流傳的 Homebrew 系統。
結論:
作者透過觀察 Homebrew 的 Github Action 流程，成功得上傳一個會列印一行的程式碼到 iterm2 套件中，讓所有安裝的使用者都會於 Terminal 上看到一行作者客製化的訊息。
本次的漏洞是作者刻意從 Homebrew 的 Vulnerability Disclosure Program 專案中去嘗試尋找可能的問題，所有的操作都有跟官方專案的人探討過流程，並且一切的 PoC 都是單純證明該攻擊的可行性，所以有興趣研究的人請遵循一樣的想法去做，不要認真的想攻擊。
原因:
1. Homebrew 透過 Github Action 執行 CI/CD 動作
2. Homebrew 撰寫了一個自動合併 Pull Request 的 Action
3. CI 內會透過一個Ruby的 Git Diff 第三方函式庫來驗證，只要符合下列條件就可以自動合併
- Modifying only 1 file
- Not moving/creating/deleting file
- Target filepath matches \ACasks/[^/]+\.rb\Z
- Line count of deletions/additions are same
- All deletions/additions matches /\A[+-]\s*version "([^"]+)"\Z/ or - -\A[+-]\s*sha256 "[0-9a-f]{64}"\Z
- No changes to format of versions (e.g. 1.2.3 => 2.3.4)
作者一開始想要從該規則下手，找尋有沒有可能塞入惡意攻擊並且騙過系統讓其自動合併，然而這些規則看起來沒有什麼太多問題，於是作者轉往其他領域去找尋問題，其中一個想法就是到底該 Ruby 的 Git Diff 是如何實作，也許從實作下手更有辦法去欺騙這一切。
很順利的是，作者真的於該函式庫中找到問題，對於一個 Git Diff 的結果來說，該函式庫會透過 +++ "?b/(.*) 這樣的正規表達式來判別檔案路徑的資訊而並非程式修改內容，譬如下列 diff
```
diff --git a/source file path b/destination file path
index parent commit hash..current commit hash filemode
--- a/source file path
+++ b/destination file path
@@ line information @@
Details of changes (e.g.: `+asdf`,`-zxcv`)
```
作者就開始思考，如果讓程式碼可以符合 +++ "?b/(.*) 的規則，是否有辦法讓程式碼不被視為一個檔案的修改，因此就可以修改多行程式碼但是讓 CI 系統認為只有一行程式碼於是進行自動合併
作者最初的想法如下，第一行用來放惡意程式碼，第二行用來偽裝檔案路徑，經過一番嘗試後作者真的成功塞入了類似 PRINTF 的程式碼到環境中並觸發自動合併。接者各地使用者透過 brew 安裝 iterm 版本都會看到使用者塞入的程式碼。
```
++ "b/#{Arbitrary codes here}"
++ b/Casks/cask.rb
```
原文還有更多作者的思路過程，有興趣的不要錯過
原文:
https://blog.ryotak.me/post/homebrew-security-incident-en/#fn:7
測試用PR:
https://github.com/Homebrew/homebrew-cask/pull/104191
For more details on winning the HKD$1000 voucher??
App link: https://bit.ly/3gUlLgG
* Join the #BastilleDayChallenge with an exclusive promo code “VCXTINAW” and take HK$200 off your first order on the app (min. spend of $1,000)
* Make a purchase on the app and recreate your version of the French look!Post your photos with the following tags for a chance to win a HK$1,000 to spend on your next order (no minimum).
* #BastilleDayChallenge
* #VestiaireCollectiveHK
* Tag and follow @tinawzq @vestiaireco
The winner will be decided and contacted by Vestiaire Collective on 31 July. Vestiaire Collective shall have the right, at its sole discretion and at any time, to change or modify these terms and conditions.
☾LET'S BE FRIENDS☽
჻INSTAGRAM | http://instagram.com/tinawzq
჻FACEBOOK | https://www.facebook.com/tinawzq
჻BLOG | http://www.tinawzq.com/
჻WEIBO | tinawzq
჻RED | tinawzq
჻TWITTER | http://twitter.com/tinawzq
჻SHOP | http://instagram.com/tinaswardrobe
჻LOOKBOOK | http://www.lookbook.nu/tinaswardrobe
჻TUMBLR | http://tinawzq.tumblr.com
?Outfit links?
-look 1-
Top(similar) | https://rsnap.it/d-251ys4o
Bottom(similar) | https://rsnap.it/d-251ys4p
Bag | https://rsnap.it/d-251ys4q
Shoes | https://rsnap.it/d-251ys4r
-look 2-
Top | https://rsnap.it/d-251ys4s
Bottom | https://rsnap.it/d-251ys4t
Bag(diff colors) | https://rsnap.it/d-251ys4u
Shoes(diff colors) | https://rsnap.it/d-251ys4v
-look 3-
Jumpsuit | https://rsnap.it/d-251ys4w
Bag(diff colors) | https://rsnap.it/d-251ys4x
Shoes | https://rsnap.it/d-251y2Pp
-look 4-
Top(similar) | https://rsnap.it/d-251ys4z
Bottom | https://rsnap.it/d-251ys4y
Bag | https://rsnap.it/d-251ys4A
Shoes(similar) | https://rsnap.it/d-251ys4B
-look 5-
Top(similar) | https://rsnap.it/d-251ys4D
Bottom(similar) | https://rsnap.it/d-251ys4C
Bag | Dior @Vestiaire Collective
Shoes(similar) | https://rsnap.it/d-251y2Mr
-look 6-
Outer | https://bit.ly/2SLpZxu
Dress(similar) | https://rsnap.it/d-251ys4E
Bag(similar) | https://rsnap.it/d-251ys4F
Shoes(similar) | https://rsnap.it/d-251ys4B
♫ Music♬
Music by Mr. Chase - Wild Cherry - https://thmatc.co/?l=7ADCABFE
Music by Fiji Blue - Butterflies - https://thmatc.co/?l=ED27E618
☊ Equipment☋
Canon 5D
Final Cut Pro x
✍For business and other inquiries please email me at info@tinawzq.com
❝This video is sponsored by Vestiaire Collective. As always, all opinions are 100% honest and my own❞
THANKS FOR WATCHING
BIG LOVE X
TINA
今回はアイドリングがおかしくなってきたので、スロットルのお掃除とVCDSで微調してみました。
おまけがついてDSGの不具合が消えた・・！
▼【Twitter】
https://twitter.com/vwfixlife
▼メインページ詳細とチャンネル登録はこちらからお願いいたします。
https://www.youtube.com/channel/UCIbAqtL-987UnwFfwQiZGqA
▼今回使ったグッズはこちらにあります。
KURE(呉工業) クリーナーキャブ (420ml) キャブレタークリーナー [ 品番 ] 1014 [HTRC2.1]
https://www.amazon.co.jp/gp/product/B000TGLT7S/ref=as_li_tl?ie=UTF8&camp=247&creative=1211&creativeASIN=B000TGLT7S&linkCode=as2&tag=masumasu02-22&linkId=12466eb1dafa48fff9ad760a70b2afc8
【Amazon.co.jp 限定】【まとめ買い】 スクラビングバブル ガラス用洗剤 激泡ガラスクリーナー エアゾールタイプ 3本セット 480ml×3本 お掃除用手袋つき
https://www.amazon.co.jp/gp/product/B08241V7DC/ref=as_li_tl?ie=UTF8&camp=247&creative=1211&creativeASIN=B08241V7DC&linkCode=as2&tag=masumasu02-22&linkId=8227bd610182e9f4c9732db9c271a1a8
モデルローブ No.1100 メカニックグローブ Mサイズ ブラック 50枚
https://www.amazon.co.jp/gp/product/B01MPY96X0/ref=as_li_tl?ie=UTF8&camp=247&creative=1211&creativeASIN=B01MPY96X0&linkCode=as2&tag=masumasu02-22&linkId=835c36bb0ee5b47fb765356507a600f5
トップ(TOP) ヘビーポンププライヤ HP-300
https://www.amazon.co.jp/gp/product/B001D35GFW/ref=as_li_tl?ie=UTF8&camp=247&creative=1211&creativeASIN=B001D35GFW&linkCode=as2&tag=masumasu02-22&linkId=3435dbd527d45db36650e6478d1f0d78
▼関連動画
VW・AUDI ハルデックスカップリングオイル デフオイル 交換の仕方 How to change Haldex oil & diff oil for VW/AUDI ?
https://youtu.be/ilRDlNkjhEs
お悩みDSG(ダイレクト・シフト・ギアボックス）の不調は、フィルターチェンジとオイル追加で簡単診断 How to solve mal function of DSG?
https://youtu.be/HbD16U2TO1k
外車のオイル交換はポイントわかれば簡単！
https://youtu.be/cuMj6uE8mes
エンジンうるさくなったら、サーペンタインベルトとアイドラーを交換で静音化！
https://youtu.be/GX6fXEw6UHg
エンジンルームは激泡で新車の輝き！樹脂対応洗浄が有効！
https://youtu.be/Qg4Ulons9xo
冠水ブレーキ・鳴きには理由あり 前編・・・トラブルは突然に・・・大雨の後は早めの点検を！
https://youtu.be/Vq5Pjf7NMHI
冠水ブレーキ・鳴きには理由あり 後編・・ブー音は安物パッドの得意技！ USB充電器でEPB付きリア・ブレーキも楽々メンテ！
https://youtu.be/j5JdrUFwHvs
#スロットル掃除 #キャブクリーナー #VCDS
if you TLDW, here's the simple version:
1. Watch Cantonese#3 Greeting Phrases in CNY, leave a greeting comment (can be written in casual eng pronuncation or jyutping, you can even be creative and make your own greeting! no right or wrong ans ^ ^ ) and you will enter our lucky draw
2. Our first live-chat which will happen during the CNY, but since we're in diff time zones and im not sure whether you want it on FB or Youtube, please go to the event page below and vote for your preferred time-slot & "venue"
https://www.facebook.com/events/236520633464132/?ti=cl
Please kindly give a thumbs up and SUBSCRIBE + comments so I can improve o . _ . o
THANKs for watching, PEACE OUT & I'LL SEE YOU SOON ◕‿◕ //
Youtube: OHSHOOTRandom || https://www.youtube.com/channel/UC2oB9QCXs-RKtaKChrz4dKg
Facebook: OSRandom 文記士多 || https://www.facebook.com/OSRandom/
Instagram: mtzcherry || https://www.instagram.com/mtzcherry/
