Hello, Gevanni: 2017

Sep 11, 2017

May 22, 2017

Ryzen1700 + NVIDIAでフリーズした場合の対処法

症状としては

システムが応答しなくなる。
ログにはlockup ErrorがCPUコアから届いている。

ちょっと困っていたのですが、NVIDIA用のnouveauドライバを抜けばこの問題を解決するようです。アップストリームにバグが届いたらそのうち解決されるんだろうか。暇ができたらおってみたい。

引用

https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1690085

対処サンプル

                                                                                                                          
% cat /etc/modprobe.d/nvidia_nouveau.conf                                                                                                      
# to check if https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1690085                                                                     
blacklist nouveau                                                                                                                              
blacklist lbm-nouveau                                                                                                                          
options nouveau modeset=0                                                                                                                      
alias nouveau off                                                                                                                              
alias lbm-nouveau off

Ryzen-1700-freeze problem

New computer annoyed me for a month but now it works by a work-around solution. The problem was that system suddenly freezed.

it looks similar to this report:

https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1690085

removing nouveau seems to fix the problem.

here is a sample conf for modprob

                                                                                                                          
% cat /etc/modprobe.d/nvidia_nouveau.conf                                                                                                      
# to check if https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1690085                                                                     
blacklist nouveau                                                                                                                              
blacklist lbm-nouveau                                                                                                                          
options nouveau modeset=0                                                                                                                      
alias nouveau off                                                                                                                              
alias lbm-nouveau off

Mar 31, 2017

problem

org default priority is usually [B] and it's hard to control. i want to set it into lowest.

what is expected

For me, this is nice

[A]
[B]
[C]
default

solution

You can change the range of allowed priorities by setting the options org-highest-priority, org-lowest-priority, and org-default-priority. For an individual buffer, you may set these values (highest, lowest, default) like this (please make sure that the highest priority is earlier in the alphabet than the lowest priority):

(setq org-highest-priority 65)
(setq org-lowerst-priority 68)
(setq org-default-priority 68)

effect

now i'm happy :) it reduce 50% of my time to organize TODO-list

Mar 16, 2017

Malcious Ad is now removed by Media Math

Rapid reaction by Media Math

Here is an update for the previous article.

@CampariJet Thank you for sharing! We definitely want to look into this. Can we discuss over DM?
— MediaMath (@MediaMath) March 12, 2017

and in 3days, they also told this problem is resolved.

try to visit the page again, and now it's safer!

go to the Nikkei's article where the problem happened
check XHR (here is the zipped one)

It still shows mathtag in Rubicon Project's partner area

{
    "pingdom_id": "399231",
    "ttl": 7,
    "img": "http://sync.mathtag.com/sync/img?mt_exid=9",
    "priority": 10,
    "secure": {
 "img": "https://sync.mathtag.com/sync/img?mt_exid=9&redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4222%26nid%3D1512%26put%3D%5BMM_UUID%5D"
    },
    "resync": 1,
    "partner": "mediamath"
}

AND I confirm NO REQUEST to malcious server happens now. Yeah!
Thank you for the Media Math team! Now I can continue browsing safer Internet and My grandmother as well.

Mar 12, 2017

How Advertisement Hijack Ads-owner's contents

Overview

(update: they fixed the problem )

When I tried to read article in Nikkei, chrome in Android move without any notification to strange website. (caution: please don't access URLs in the pics)

What I tried to read (Japanese only): http://trendy.nikkeibp.co.jp/article/col/20030924/106051/?ST=trnmobile_f

This advertisement just hurt the brand image of owner website (this case it's Nikkei). And other users also have met the same problem: https://productforums.google.com/forum/#!msg/chrome/AzyvOJ1xcYg/L354tQk1BAAJ

Here is also interesting comment (https://productforums.google.com/d/msg/chrome/AzyvOJ1xcYg/6R8cSVk8BwAJ)

TNTBrian said:
Even if it is an advertiser, Chrome is still being exploited.
Also it does not happen on an older version of Chrome -- At least for me. Would love to see if the same is true for others.

After reading, I have two questions.

How it works?
Why does Chrome allow the problematic script to run?

track requests to know how it works

here is recorded *.HAR in Google Chrome when I read trendy.nikkeibp.co.jp
HAR.zip

In the response, one amazon ec2 instance sent response with javascript that includes the domain "comumx[dot]site" that is the original site of the above picture.
It does move webpage forcely to comumx[dot]site.

function(){top.window.location='http://comumx[dot]site/lpde1/index.php?s1=mas_jiami_de&pubid=B22CD7E7954F3EED828B3172748A31FA&bid=354163f6a3a632c304e2b91277de2f3b';}

After checking a bit, I realized this script was triggered in the following steps:

trendy.nikkeibp.co.jp
www.googletagservice.com
securepubads.g.doubleclick.net
ads.rubiconproject.com
optimized-by.rubiconproject.com
tags.mathtag.com
ec2-52-23-195-173.compute-1.amazonaws.com ( this responses with problematic javascript )

Now it's clear why it happens :)

why Chrome allowed this script to run?

According to the registory information in WHOIS, the domains belonged as follows.

NIKKEI (trendy.nikkeibp.co.jp)
Google (www.googletagservice.com)
Google (securepubads.g.doubleclick.net)
Rubicon project (ads.rubiconproject.com)
Rubicon project (optimized-by.rubiconproject.com)
MediaMath (tags.mathtag.com)
ec2-52-23-195-173.compute-1.amazonaws.com ( this responses with problematic javascript )

NIKKEI is a user of google advertisement network in their website.
Unfortunately I haven't heard anything about "Rubicon project" and "MediaMath". After googling, I realized they are advertise network company / agency.
Rubicon Project seems to belong to the IAB. Thus they should not allow such an advertisement generally. https://www.iab.com/news/iab-names-googles-jonathan-bellack-rubicon-projects-jay-sears-advertising-technology-council-co-chairs
MediaMath is described in crunchbase. (https://www.crunchbase.com/organization/mediamath#/entity) Their codebase also includes the requests against "*.mathtag.com" i.e. https://github.com/search?utf8=%E2%9C%93&q=org:MediaMath+mathtag.com&type=Code&ref=searchresults
HTTP response from Rubicon Project includes the following

{
    "pingdom_id": "2117306",
    "ttl": 7,
    "img": "http://pixel.mathtag.com/sync/img?redir=http%3A%2F%2Ftap.rubiconproject.com%2Foz%2Ffeeds%2Fmediamath-pub%2Ftokens%3Fafu%3D%5BMM_UUID%5D",
    "secure": {
 "img": "https://pixel.mathtag.com/sync/img?redir=https%3A%2F%2Ftap.rubiconproject.com%2Foz%2Ffeeds%2Fmediamath-pub%2Ftokens%3Fafu%3D%5BMM_UUID%5D"
    },
    "partner": "mediamath-pub"
}

Thus naturally MediaMath is a business partner of Rubicon Project.
NOTE:
this domain, "pixel[dot]mathtag[dot]com" has already raised some discussions before:

Now we know which companies related to this problem and their relations.

Google shows advertisement from partner company, Rubicon Project
Rubion Project loads some script from partner company, MediaMath
MediaMath loads some (unfortunately malicious) scripts from their clients.

From the viewpoints of typical business contracts, MediaMath should take responsibility to check the codes from their client.
And I guess it's fatal if advertisement can hijack the contents of owner of the advertisement.

If you have any feedbacks, please leave a comment.

アドネットワークを使ってハイジャックする話

概要

追記：MediaMathさんが解決してくれたよ！

なんとなく日経さんの昔の記事を読みたくなってアンドロイド上で読もうとしたら2秒程して変なページに飛ばされた。危うくクリックするところだった。
昔の記事：http://trendy.nikkeibp.co.jp/article/col/20030924/106051/?ST=trnmobile_f
変なページ

珍しいなーと思ってちょっと調べてみたら、アメリカの大手広告代理店経由で変なスクリプトを実行されていたというお話。
広告が広告主のコンテンツを食うなんて下克上みたいですね。ブランドイメージを毀損されてしまうので、広告主からしたら大問題だと思うのですが、それなりに放置されているのでまとめてみました。
なお、ユーザーリポートは飛んでるようです。 https://productforums.google.com/forum/#!msg/chrome/AzyvOJ1xcYg/L354tQk1BAAJ
「そもそもなんで飛ばされるの？」「なんでChromeはブロックしないの?」という2点について調べたり考えてみたりしました。

リクエストを追って何が起きているか確認してみる

該当ページを見たときのHARはこちら。
ざっとみると上記画像の「COMUMXドットSITE」さんを含むEC2インスタンスからのレスポンスがありまして。下記のJSなんかが問題を引き起こしているようです。

function(){top.window.location='http://comumx[dot]site/lpde1/index.php?s1=mas_jiami_de&pubid=B22CD7E7954F3EED828B3172748A31FA&bid=354163f6a3a632c304e2b91277de2f3b';}

詳しく見ると下記の順で各ドメインへリクエストを投げているようです。

trendy.nikkeibp.co.jp
www.googletagservice.com
securepubads.g.doubleclick.net
ads.rubiconproject.com
optimized-by.rubiconproject.com
tags.mathtag.com
ec2-52-23-195-173.compute-1.amazonaws.com ( this responses with problematic javascript )

どうしてページ遷移が発生しているかはこれで明らかになりました。わーい。ページ遷移自体はJavascriptで完結する話なのでこれだけで危険なコードを実行されているわけではないと認識してます。

Chromeがスクリプトを実行してしまう理由

さて、とりあえずドメインをWHOISベースで調べて会社名をマッピングしてみます。

NIKKEI (trendy.nikkeibp.co.jp)
Google (www.googletagservice.com)
Google (securepubads.g.doubleclick.net)
Rubicon project (ads.rubiconproject.com)
Rubicon project (optimized-by.rubiconproject.com)
MediaMath (tags.mathtag.com)
ec2-52-23-195-173.compute-1.amazonaws.com ( this responses with problematic javascript )

NIKKEIは日経でGoogle ADのユーザーさん。
Rubicon ProjectはADnetworkのパートナーみたいなもんですね。IABにも参加しているようですので、こういう広告を配信してしまうのはどうなのかなと思いますが。 https://www.iab.com/news/iab-names-googles-jonathan-bellack-rubicon-projects-jay-sears-advertising-technology-council-co-chairs
MediaMathは広告代理店のようです。 (https://www.crunchbase.com/organization/mediamath#/entity) 実際ここが"*.mathtag.com"の所持者のようですね。 i.e. https://github.com/search?utf8=%E2%9C%93&q=org:MediaMath+mathtag.com&type=Code&ref=searchresults
Rubicon Project のHTTP responseを覗くとMedia Mathとの関係が見えてきます。

{
    "pingdom_id": "2117306",
    "ttl": 7,
    "img": "http://pixel.mathtag.com/sync/img?redir=http%3A%2F%2Ftap.rubiconproject.com%2Foz%2Ffeeds%2Fmediamath-pub%2Ftokens%3Fafu%3D%5BMM_UUID%5D",
    "secure": {
 "img": "https://pixel.mathtag.com/sync/img?redir=https%3A%2F%2Ftap.rubiconproject.com%2Foz%2Ffeeds%2Fmediamath-pub%2Ftokens%3Fafu%3D%5BMM_UUID%5D"
    },
    "partner": "mediamath-pub"
}

どうやら取引先のようですね。MediaMathが入稿してRubicon Projectのネットワークに載せる感じでしょうか。
ちなみにこのpixel[dot]mathtag[dot]com経由で、以前から色々と問題があるケースがあったようです。（注：「ちなみにこのpixel[dot]mathtag[dot]comは色々以前からやらかしているようです。」という表現を修正しました。）

まとめます。

悪意ある広告製作者がスクリプトをEC2上に設置
悪意ある広告製作者がMediaMathを通じて上記スクリプトを入稿
RubiconProjectがGoogle Adnetworkを通じて上記スクリプトをばらまく
NikkeiがGoogleAdnetworkを使うことにより日経Trendyの記事を読みにきたユーザーを変なサイトに無条件で飛ばす

恐らくGoogle-Rubicon Project, Rubicon Project - MediaMath間はCORSでもホワイトリスト方式で通してしまうんだろうなーと。つまりMediaMathがスクリプトをきちんと確認しない限りどうしようもないんじゃないだろうか。というわけで近日中に問い合わせてみます。

おわりに

この分野はシロウトなので、もし間違い誤解などがあったらコメントなりに残していただければ幸いです。

Feb 26, 2017

通院後の事後処理

病気になると証明書をもらうのでそれを保険会社に送る。たいていArbeitsunfähigkeitsbescheinigungないしKrankmeldungと表記されている。

TKさんにもその辺が明記されている。 https://www.tk.de/tk/beratung/mitgliederservice/krankmeldung-an-die-tk-senden/200686

なお、勤務先に出さない方には病名コードが書かれていて、こちらから検索可能。 http://www.icd-code.de/

Feb 4, 2017

Steuererklärung

background

a employee in a "GmbH". and whose partenr is not in the company
the motivation is to get pay-back by our marriage this year

required document

Mantelbogen
Anlage N: you can submit "cost" (i.e. fee to commute or Ausbildung class, university Tuition & Fee … )
Anlaeg Vorsorgeaufwand

download document

go to https://www.formulare-bfinv.de/
choose "Mantelbogen EST 2016"
choose "Einkommensteuer 2016 mit allen Anlagen"

tips

ignore "Steuernummer" as long as you work only in one GmbH
don't scared to submit and People in Finanzamt friendly point out when you do some mistakes.

Hello, Gevanni

page_list