其實睇下張舊卡, 就知道原來我兩年先捐得五次... 數量什少 =.=... (男性一年可以捐四次的呢)
玩開 FB 的朋友, 可以加 此App 留意紅十字會最近消息
.jpg)
Saturday, May 08, 2010
香港紅十字會的來信
內容: 請繼續支持捐血救人 :) 下為你新的捐血卡 :P
其實睇下張舊卡, 就知道原來我兩年先捐得五次... 數量什少 =.=... (男性一年可以捐四次的呢)
玩開 FB 的朋友, 可以加 此App 留意紅十字會最近消息
其實睇下張舊卡, 就知道原來我兩年先捐得五次... 數量什少 =.=... (男性一年可以捐四次的呢)
玩開 FB 的朋友, 可以加 此App 留意紅十字會最近消息
Tuesday, April 13, 2010
Given a sequence of increasing values, find ...
The rationale of this post is hoping to find someone give me hints on a problem: Given a sequence of increasing values, find the first value which has a significant change in the sequence.
To visualize the problem: consider this sequence [1, 1, 2, 4, 6, 14, 24]
the "value" that has a significant change may be 14.
This can be plotted in a chart.
The slope in between value 6 and 14 gives a significant change, obviously.
Indeed, this is a problem that i encountered when implementing the DBScan algorithm.
DBScan algorithm is a "density based" clustering algorithm. It takes two parameters - radius of a circle (eps), and the number of points in the circle which the circle can be considered as dense (minPts).
You may think DBScan as simple as... Taking any point, a "sphere" is formed with the radius (eps) center at that point. The circle may cover other points in a N-dimensions space. If the number of points covered by the "sphere" is larger than minPts, it is dense enough to form a cluster. And that cluster further expands with the points covered by that "sphere".
Finally ... points that are "closely" distanced will form a cluster and all points in the N-dimension space will form "many" cluster.
An important parameter in DBScan algorithm is the radius. From the wikipedia, the radius can be estimated by k-distance graph. First, let's define what is k-distance. Given a point, k-distance is distance between the k-th closest point of the given point. A k-distance graph is plotted by getting k-distance of all points in the N-dimension space, sorting them and plot it out as shown above. From the graph, it is simple to get the sharp change k-distance as the eps and using k as the minPts.
But, my concern is raised since it's not practical to plot 100 graph and read them all if i wanna try out k from 1 to 101. As consequence, i wanna have a algorithm to get the k-distance without looking into a visual graph.
One idea flow to my mind is to compare the slopes of neighbouring k-distance. If k-distance of pt-b is much larger than that of pt-a (the point just before pt-b), then k-distance of pt-b may probably be the selected sharp change k-distance. However, what is "much larger than" in this method? A parameter of floating point? Thus, i think this method is not that practical.
Another idea is to use the statistics - mean and standard deviation. Mean is the average while standard deviation is the square root of the variance. Variance is the average difference from the mean value of every point. So, standard deviation split the k-distance graph piece by piece fairly. If this is the case, I can compute the mean and make use of standard deviation to obtain a k-distance in several split away from the mean. By this method, the parameter is the number of split away from the mean value. An integer that can loop nicely :]
My implementation of this method is hosted on github #line23. Anyway, i believe there must be better method to obtain k-distance "automatically"... please comment :]
To visualize the problem: consider this sequence [1, 1, 2, 4, 6, 14, 24]
the "value" that has a significant change may be 14.
This can be plotted in a chart.
The slope in between value 6 and 14 gives a significant change, obviously.
Indeed, this is a problem that i encountered when implementing the DBScan algorithm.
DBScan algorithm is a "density based" clustering algorithm. It takes two parameters - radius of a circle (eps), and the number of points in the circle which the circle can be considered as dense (minPts).
You may think DBScan as simple as... Taking any point, a "sphere" is formed with the radius (eps) center at that point. The circle may cover other points in a N-dimensions space. If the number of points covered by the "sphere" is larger than minPts, it is dense enough to form a cluster. And that cluster further expands with the points covered by that "sphere".
Finally ... points that are "closely" distanced will form a cluster and all points in the N-dimension space will form "many" cluster.
An important parameter in DBScan algorithm is the radius. From the wikipedia, the radius can be estimated by k-distance graph. First, let's define what is k-distance. Given a point, k-distance is distance between the k-th closest point of the given point. A k-distance graph is plotted by getting k-distance of all points in the N-dimension space, sorting them and plot it out as shown above. From the graph, it is simple to get the sharp change k-distance as the eps and using k as the minPts.
But, my concern is raised since it's not practical to plot 100 graph and read them all if i wanna try out k from 1 to 101. As consequence, i wanna have a algorithm to get the k-distance without looking into a visual graph.
One idea flow to my mind is to compare the slopes of neighbouring k-distance. If k-distance of pt-b is much larger than that of pt-a (the point just before pt-b), then k-distance of pt-b may probably be the selected sharp change k-distance. However, what is "much larger than" in this method? A parameter of floating point? Thus, i think this method is not that practical.
Another idea is to use the statistics - mean and standard deviation. Mean is the average while standard deviation is the square root of the variance. Variance is the average difference from the mean value of every point. So, standard deviation split the k-distance graph piece by piece fairly. If this is the case, I can compute the mean and make use of standard deviation to obtain a k-distance in several split away from the mean. By this method, the parameter is the number of split away from the mean value. An integer that can loop nicely :]
My implementation of this method is hosted on github #line23. Anyway, i believe there must be better method to obtain k-distance "automatically"... please comment :]
Wednesday, March 31, 2010
Future Chromium bundles Flash ... Why.
There's a breaking news this morning from google's chromium blog - Bringing improved support for Adobe Flash Player to Google Chrome
In the post ... it mentioned..
The 1st two points are trivial, but the 3rd? This is the reason why i'm writing this post.
The 3rd generated my interest in knowing more about the sandbox model of Chrome and thus leading me to read their "technical report".
In the following paragraph, i will briefly explain the architecture of Chromium based on reading their "technical report". (Note: I didn't read any source code of the beautiful Chromium project and their "report" was published quite a while ago. Thus, some info. below may be inaccurate or outdated but fairly enough for u to get understand with their sandbox model.)
---
Here we go.
---
In the chromium architecture, the web browser is separated into two core components: the rendering engine and the browser kernel.
Here is the task assignments mentioned in the report.
Rendering Engine: HTML parsing, CSS parsing, Image decoding, Javascript interpreter, Regular expressions, Layout, Document object model, Rendering, SVG, XML parsing, XSLT
Browser Kernel: Cookie database, History database, Password database, Window management, Location bar, Safe browsing blacklist, Network stack, SSL/TLS, Data cache, Download manager, Clipboard
And, both of the components can carry URL parsing and Unicode parsing.
From their design philosophy, the rendering engine is always subjected to a bunch of known / unknown vulnerabilities. Thus, they decided to grant limited privileges to the rendering engine while letting the browser kernel to have the user's privileges.
These two components are communicating with IPC (Inter-Process communication) from a "big" picture in the report and the browser kernel provides API for the rendering engine to use its services.
Before i continue, here is a remark. Their report mentioned:
Where is the rest 30%? You will, perhaps, know later.
Whenever a user create a new tab in Chrome, the browser kernel fork() a new rendering engine with a sandbox. What is the sandbox? On windows, it's the Windows Security Manager. The rendering engine runs with a "restricted security token", that is used by the security manager, on a Windows Job Object. Whenever some action is performed by the rendering engine, the manager will check for privileges.
It sounds work ... but some known limitations in this M$ windows sandbox.
[1] FAT32 - FAT32 does not support the access control list and thus user's USB thumb with FAT32 format may be read or write by a compromised rendering engine.
[2] Misconfigured objects - Some application create objects with NULL DACLs. This will let security manager ignore the security token owned by rendering engine. (But NTFS mitigated that)
[3] TCP/TP - Theoretically, rendering engine can create any socket as it wishes... (But Win API require a "handle", which the rendering engine will not hv, to open a socket ... a bug in Win API?? or a feature??)
As a result of using the sandbox, even a rendering engine is compromised by buffer overflow of HTML parser, integer overflow of regex, or what-so-ever related to attack against rendering engine... [a] the attack can only use the restricted sandbox to do the bad ... [b] or invoke the IPC with Chrome's browser kernel ... [c] or if m$ security manager hv bug, sandbox broke too
You may noticed that [a] is assumed to be secured and [c] has nothing to do at all since m$ is "closed". The only problem left is [b] ... attacker insert code to invoke browser kernel to do bad.
Now, let's see how's kernel work.
Browser kernel API handles a few things. User interaction, persistent storage, and networking.
User interaction includes - rendering and user input.
Rendering is handled by the rendering engine. Unparsed HTML is sent to the engine and a bitmap is returned to the browser kernel. The kernel uses the trick like "double-buffering" for the bitmap and presents it onto screen.
User input either occurs on Chrome's body (they call it browser chrome) like location bar or within the web page. For former case, kernel will handle it. For latter case, kernel asks rendering engine to render the input as bitmap again. Even rendering engine is compromised, it cannot receives keyboard signals.
Persistent storage includes - upload and download.
Upload is handled by kernel. When user selects certain file, kernel will ask to render the selection path and keeps records of which file the user granted to the web (engine) to access. Even compromised, the engine cannot touch those files which are not granted yet.
Download is also handled by kernel. Kernel API provides method to invoke a download action which the kernel will blacklist some filename like desktop.ini (M$ vulnerable feature). Even a rendering engine is compromised, the engine cannot ask the kernel to download some file to anywhere on user's disk.
Networking includes URL requests.
Rendering engine itself is allowed to fire requests for protocol like http, https, ftp, etc. But not the file://
File opening is handled by browser kernel when user type in file:// in the location bar. The file is rendered in a dedicated rendering engine.
After the long boring things... you will noticed that ... Chrome actually deals with 3 security threats. [1] Persistent Malware, [2] Transient Keylogger, and [3] File Theft. Other threat like phishing, origin isolation, firewall circumvention, and website vulnerabilities are not in scope of Chromium written in the "technical report".
Last but not least ... why bundle Flash (a "the most widely used web browser" plugin?) There is a small paragraph in the report talks about plug-in. From historical reason, plug-in is a separate host process which execute outside the browser.
So... you know why "With Adobe's help, we plan to further protect users by extending Chrome's “sandbox” to web pages with Flash content." (Flash player like m$ is "closed")
The chromium team phoned adobe and says... let's work together to secure Flash and silent those who against Flash coz of security concern in unknown implementation flaws. H.264 video codec will keep on our Utube. (this paragraph is some "bs" that comes to my mind)
In the post ... it mentioned..
We believe this initiative will help our users in the following ways:
* When users download Chrome, they will also receive the latest version of Adobe Flash Player. There will be no need to install Flash Player separately.
* Users will automatically receive updates related to Flash Player using Google Chrome’s auto-update mechanism. This eliminates the need to manually download separate updates and reduces the security risk of using outdated versions.
* With Adobe's help, we plan to further protect users by extending Chrome's “sandbox” to web pages with Flash content.
The 1st two points are trivial, but the 3rd? This is the reason why i'm writing this post.
The 3rd generated my interest in knowing more about the sandbox model of Chrome and thus leading me to read their "technical report".
In the following paragraph, i will briefly explain the architecture of Chromium based on reading their "technical report". (Note: I didn't read any source code of the beautiful Chromium project and their "report" was published quite a while ago. Thus, some info. below may be inaccurate or outdated but fairly enough for u to get understand with their sandbox model.)
---
Here we go.
---
In the chromium architecture, the web browser is separated into two core components: the rendering engine and the browser kernel.
Here is the task assignments mentioned in the report.
Rendering Engine: HTML parsing, CSS parsing, Image decoding, Javascript interpreter, Regular expressions, Layout, Document object model, Rendering, SVG, XML parsing, XSLT
Browser Kernel: Cookie database, History database, Password database, Window management, Location bar, Safe browsing blacklist, Network stack, SSL/TLS, Data cache, Download manager, Clipboard
And, both of the components can carry URL parsing and Unicode parsing.
From their design philosophy, the rendering engine is always subjected to a bunch of known / unknown vulnerabilities. Thus, they decided to grant limited privileges to the rendering engine while letting the browser kernel to have the user's privileges.
These two components are communicating with IPC (Inter-Process communication) from a "big" picture in the report and the browser kernel provides API for the rendering engine to use its services.
Before i continue, here is a remark. Their report mentioned:
Chromium's security architecture mitigates approximately 70% of critical browser vulnerabilities that let an attacker execute arbitrary code.
Where is the rest 30%? You will, perhaps, know later.
Whenever a user create a new tab in Chrome, the browser kernel fork() a new rendering engine with a sandbox. What is the sandbox? On windows, it's the Windows Security Manager. The rendering engine runs with a "restricted security token", that is used by the security manager, on a Windows Job Object. Whenever some action is performed by the rendering engine, the manager will check for privileges.
It sounds work ... but some known limitations in this M$ windows sandbox.
[1] FAT32 - FAT32 does not support the access control list and thus user's USB thumb with FAT32 format may be read or write by a compromised rendering engine.
[2] Misconfigured objects - Some application create objects with NULL DACLs. This will let security manager ignore the security token owned by rendering engine. (But NTFS mitigated that)
[3] TCP/TP - Theoretically, rendering engine can create any socket as it wishes... (But Win API require a "handle", which the rendering engine will not hv, to open a socket ... a bug in Win API?? or a feature??)
As a result of using the sandbox, even a rendering engine is compromised by buffer overflow of HTML parser, integer overflow of regex, or what-so-ever related to attack against rendering engine... [a] the attack can only use the restricted sandbox to do the bad ... [b] or invoke the IPC with Chrome's browser kernel ... [c] or if m$ security manager hv bug, sandbox broke too
You may noticed that [a] is assumed to be secured and [c] has nothing to do at all since m$ is "closed". The only problem left is [b] ... attacker insert code to invoke browser kernel to do bad.
Now, let's see how's kernel work.
Browser kernel API handles a few things. User interaction, persistent storage, and networking.
User interaction includes - rendering and user input.
Rendering is handled by the rendering engine. Unparsed HTML is sent to the engine and a bitmap is returned to the browser kernel. The kernel uses the trick like "double-buffering" for the bitmap and presents it onto screen.
User input either occurs on Chrome's body (they call it browser chrome) like location bar or within the web page. For former case, kernel will handle it. For latter case, kernel asks rendering engine to render the input as bitmap again. Even rendering engine is compromised, it cannot receives keyboard signals.
Persistent storage includes - upload and download.
Upload is handled by kernel. When user selects certain file, kernel will ask to render the selection path and keeps records of which file the user granted to the web (engine) to access. Even compromised, the engine cannot touch those files which are not granted yet.
Download is also handled by kernel. Kernel API provides method to invoke a download action which the kernel will blacklist some filename like desktop.ini (M$ vulnerable feature). Even a rendering engine is compromised, the engine cannot ask the kernel to download some file to anywhere on user's disk.
Networking includes URL requests.
Rendering engine itself is allowed to fire requests for protocol like http, https, ftp, etc. But not the file://
File opening is handled by browser kernel when user type in file:// in the location bar. The file is rendered in a dedicated rendering engine.
After the long boring things... you will noticed that ... Chrome actually deals with 3 security threats. [1] Persistent Malware, [2] Transient Keylogger, and [3] File Theft. Other threat like phishing, origin isolation, firewall circumvention, and website vulnerabilities are not in scope of Chromium written in the "technical report".
Last but not least ... why bundle Flash (a "the most widely used web browser" plugin?) There is a small paragraph in the report talks about plug-in. From historical reason, plug-in is a separate host process which execute outside the browser.
In order to maintain compatibility with existing web sites, browser plug-ins cannot be hosted inside the rendering engine because plug-in vendors expect there to be at most one instance of a plugin for the entire web browser. If plug-ins were hosted inside the browser kernel, a plug-in crash would be sufficient to crash the entire browser... each plug-in runs outside of the sandbox and with the user's privileges... For example, the Flash Player plug-in can access the user's microphone and webcam, as well as write to the user's file system (to update itself and store Flash cookies).
...
Chromium also contains an option to run existing plug-ins inside the sandbox. To do so, run the browser with the --safe-plugins command line option. This setting is experimental and might cause instability or unexpected behavior.
So... you know why "With Adobe's help, we plan to further protect users by extending Chrome's “sandbox” to web pages with Flash content." (Flash player like m$ is "closed")
The chromium team phoned adobe and says... let's work together to secure Flash and silent those who against Flash coz of security concern in unknown implementation flaws. H.264 video codec will keep on our Utube. (this paragraph is some "bs" that comes to my mind)
Thursday, February 11, 2010
My 1st jQuery plugin - jQuery.fn.timeSink
My first contact with jQuery was last summer when i was exploring Django. Indeed, i just used jQuery autocomplete plugin only. In this month, I have another project aimed to explore ESAPI and MongoDB. The project is in its very early stage that just allows student submission for a course assignment. As i don't want to use any framework that may distribute my experience with ESAPI and MongoDB, I opt to use pure Servlet and JSP. (Although i prefer python, but my "boss" prefer java anytime.)
This project has a JSP to list out all submissions from student. My first intuition is to provide a keyword filter (jquery-livesearch-plugin that uses quicksilver algorithm for filtering) to assist information lookup. Then my boss ask me.. in a run long, can it be filtered by time? Then, django admin page comes to my mind.
Django admin page has a very nice time-based filter on the right to filter out entries. So, my question is, can I have a time-based filter to work with the nice quicksilver filter? I did a brief search on google and find none such time-based filter for jQuery. Thus... I have to create one for my purpose.
You may goto github to obtain a copy of the so called "time sink" plugin. I call it a "sink" because it uses a time sieve... (a sink always has a sieve to prevent big particles entering the pipe... right?) There is a demo html and you will see how can the plugin be used with two separate html-list.
You may also checkout the JSP that actually migrates the two different filters applying on the same set of items. They cooperate with each other using custom events dispatched from those filters.
This project has a JSP to list out all submissions from student. My first intuition is to provide a keyword filter (jquery-livesearch-plugin that uses quicksilver algorithm for filtering) to assist information lookup. Then my boss ask me.. in a run long, can it be filtered by time? Then, django admin page comes to my mind.
Django admin page has a very nice time-based filter on the right to filter out entries. So, my question is, can I have a time-based filter to work with the nice quicksilver filter? I did a brief search on google and find none such time-based filter for jQuery. Thus... I have to create one for my purpose.
You may goto github to obtain a copy of the so called "time sink" plugin. I call it a "sink" because it uses a time sieve... (a sink always has a sieve to prevent big particles entering the pipe... right?) There is a demo html and you will see how can the plugin be used with two separate html-list.
You may also checkout the JSP that actually migrates the two different filters applying on the same set of items. They cooperate with each other using custom events dispatched from those filters.
Friday, January 29, 2010
耍盲雞@Dialogue-in-the-Dark
耍盲雞 - 兒時玩意. 其中一人矇住雙眼, 其他人以叫聲或其他行動引導之, 矇眼者只要抓到任何一人, 遊戲結束.
(電視劇裡, 通常被抓到的是位美女)
昨夜有幸到 Dialogue-in-the-Dark 的體驗館 (brochure在這 ). 那裡不是跟你玩耍盲雞, 而是分組在一個完全黑暗的地方, 嘗試去感受一下失明人士的生活.
每組人, 都有一根盲公竹以及一位失明人士作嚮導. 在進入第一間房間之前, 到了一個跟嚮導會合的地方. 嚮導說: "我在這裡, 你們聽著聲音來找我吧". 這應該就是我們第一個 "training" 吧. 這裡, 小弟隨了靠聲音"導航"外, 沒其他法子吧...
到了第一個房間, 那裡是一個公園的擺設吧.. 有一些小樹放了在那裡.. 嚮導說: "試找一下有什麼在這, 摸到人也不怕, 這一刻你摸他, 下一刻他摸你呢..." 其實, 只靠摸又怎樣知道是什麼樹呢... 小弟到這一刻都不知道是什麼樹... 可能是鐵樹吧 :p 大家都說了些樹的名字吧.. 嚮導說: "其實我都不知道是什麼呢.." 他從來沒有機會看過樹. 接著, 那房間要走過一條小橋... 大家走上橋時, 嚮導"可惡的"搖晃小橋... well ... What's Happening!? 0rz... 小弟只知道...很暈呢-.-
房間跟房間之間, 有一條小道連接... 嚮導說: "摸著你們左邊的牆一直走" ... well, 左邊是人呢 lol... 當一直摸著牆走時... 手跟我說牆不見了.... 唯一的"導航"工具突然失去 -.- 汗! 嚮導說: "摸清楚少少..." 原來是個 左彎 =]
第二個房間, 到了"馬路"旁... 那裡有間雜貨店吧... 嚮導說: "摸下有什麼"... 除了一些熟悉的水果, 其他東西的不知道是什麼呢 ... 雜貨店對面有一架單車, 組友們說了有單車, 但我找了很久才找到呢 :p 人笨也~ 之後走到 "馬路旁" .... 那盲人輔導線是他媽的難感受得到呢-.- 馬路旁有輛車, 有賣公仔的店, 及有個電話... 嚮導說: "試下打電話" =] 0rz
第三間房間, 是一個音樂廳吧... 坐著就是聽音樂... 但其實... 其間小弟的緊張心情只有些許改善, 因為.. 座著聽的時候... 很期待會有什麼發生呢...
最後一個房間很深感受... 要買賣呢... 那裡有些飲品賣... well 小弟沒有散紙, 摸出銀包時... 摸著頭腦問... 10蚊 or 20蚊紙 收唔收 -.-" 事實上我都不知道自己的紙幣是 10蚊 or 20蚊 =.=..... 憑著自己放錢的習慣... 拿了一張"疑似" 10蚊紙出來 .. 店員肯定的跟我說, 那的確是 10蚊紙, 他拿了包 維x奶 給我.. 完成交易!! 之後找了個座.. 跟嚮導聊聊天... 因嚮導是先天的視力障礙, 自小看不清東西, 要東西放到很近才有些許影像... 小弟又一次發揮白痴精神.. 問了題白痴問題: "你看東西是朦還是黑?" 嚮導: "我根本不知道什麼是朦" ...
過後... 跟友人研究著... 紙幣有什麼 token 給失明人士呢 ~.~
(電視劇裡, 通常被抓到的是位美女)
昨夜有幸到 Dialogue-in-the-Dark 的體驗館 (brochure在這 ). 那裡不是跟你玩耍盲雞, 而是分組在一個完全黑暗的地方, 嘗試去感受一下失明人士的生活.
每組人, 都有一根盲公竹以及一位失明人士作嚮導. 在進入第一間房間之前, 到了一個跟嚮導會合的地方. 嚮導說: "我在這裡, 你們聽著聲音來找我吧". 這應該就是我們第一個 "training" 吧. 這裡, 小弟隨了靠聲音"導航"外, 沒其他法子吧...
到了第一個房間, 那裡是一個公園的擺設吧.. 有一些小樹放了在那裡.. 嚮導說: "試找一下有什麼在這, 摸到人也不怕, 這一刻你摸他, 下一刻他摸你呢..." 其實, 只靠摸又怎樣知道是什麼樹呢... 小弟到這一刻都不知道是什麼樹... 可能是鐵樹吧 :p 大家都說了些樹的名字吧.. 嚮導說: "其實我都不知道是什麼呢.." 他從來沒有機會看過樹. 接著, 那房間要走過一條小橋... 大家走上橋時, 嚮導"可惡的"搖晃小橋... well ... What's Happening!? 0rz... 小弟只知道...很暈呢-.-
房間跟房間之間, 有一條小道連接... 嚮導說: "摸著你們左邊的牆一直走" ... well, 左邊是人呢 lol... 當一直摸著牆走時... 手跟我說牆不見了.... 唯一的"導航"工具突然失去 -.- 汗! 嚮導說: "摸清楚少少..." 原來是個 左彎 =]
第二個房間, 到了"馬路"旁... 那裡有間雜貨店吧... 嚮導說: "摸下有什麼"... 除了一些熟悉的水果, 其他東西的不知道是什麼呢 ... 雜貨店對面有一架單車, 組友們說了有單車, 但我找了很久才找到呢 :p 人笨也~ 之後走到 "馬路旁" .... 那盲人輔導線是他媽的難感受得到呢-.- 馬路旁有輛車, 有賣公仔的店, 及有個電話... 嚮導說: "試下打電話" =] 0rz
第三間房間, 是一個音樂廳吧... 坐著就是聽音樂... 但其實... 其間小弟的緊張心情只有些許改善, 因為.. 座著聽的時候... 很期待會有什麼發生呢...
最後一個房間很深感受... 要買賣呢... 那裡有些飲品賣... well 小弟沒有散紙, 摸出銀包時... 摸著頭腦問... 10蚊 or 20蚊紙 收唔收 -.-" 事實上我都不知道自己的紙幣是 10蚊 or 20蚊 =.=..... 憑著自己放錢的習慣... 拿了一張"疑似" 10蚊紙出來 .. 店員肯定的跟我說, 那的確是 10蚊紙, 他拿了包 維x奶 給我.. 完成交易!! 之後找了個座.. 跟嚮導聊聊天... 因嚮導是先天的視力障礙, 自小看不清東西, 要東西放到很近才有些許影像... 小弟又一次發揮白痴精神.. 問了題白痴問題: "你看東西是朦還是黑?" 嚮導: "我根本不知道什麼是朦" ...
過後... 跟友人研究著... 紙幣有什麼 token 給失明人士呢 ~.~
Wednesday, January 27, 2010
五區總辭, 你知多少?
其實, 小弟身邊不斷有人問, 五區總辭, 為何變相"公投"? 小弟現以自己有限知識, 跟各位說一下, 如有錯誤, 請插之!
源由: 泛民眾認為, 立法會議席一天仍有功能組別, 一天沒有"真普選".
原因: 功能組別是由某一群界別人士推選出來的代表人, 就是這樣, 立法會不會是一人一票得出來, 有些人可以多投一票在功能組別 (功能組別好壞, 請各位自行研究, 這就是"公投"的目標)
政府最近提出的"政改"方案, 把地方議席增加了, 同時因要維持比例不變, 功能組別議席相對亦增加. 泛民眾則認為此方案, 根本沒有進步. 因而流出... 五區總辭, 變相"公投" 的說法
到底, 如何"公投"呢? 社民、公民眾訂了一些"準則", 認為補選中, 社民、公民五人得票量總和 少於 其餘黨派中五位最高得票的總和, 社民、公民眾便視之為 大眾市民支持那 "政改"方案, 社民、公民仍留在議會的便支持其方案. 否則, 反對之. (社民、公民眾訂的"準則", 請看wiki)
民建聯那群"禮義廉"則否認此仍"公投"... 因為"公投"結果只是由社民、公民眾自編自導自演. 社民、公民眾則認為, 這"公投"相對一般按比例的民意調查"更科學" (事實只有科學不科學, 沒有更科學... 這意思是更有說服力).. "禮義廉"眾則認為此乃浪費公帑. 而事實上, 這個普選只需要全港 700萬 市民, 每人花 20$ ... (其實 $20 是很多, 足夠小弟在城大兩餐 10$飯 =D)
其實, 那群"禮義廉"何不像自由黨眾.. 表決不參與補選... 而在大費周章?? 大家都明白, 只要沒有人跟社民、公民眾參與補選, 他們很自然是浪費公帑的"罪人" ... 借此大費周章提高自己政治身價的一眾, 真是禮義廉!
小弟個人意見: "政改"的表決, 認同需要廣泛參與的表決.. 而一般按比例的民意調查 (即 statistics 中的 random sampling by population ratio), 不能代表廣泛意見及參與. 如果沒有一個比 變相"公投" 更好的參與方法, 小弟只有支持 "公投".
人是需要有選擇的, 沒有其他更好的選擇時, 選擇那唯一的選擇, 比默默接受更好.
---
要清楚更多更多五區總辭的資訊... 請看 wiki
源由: 泛民眾認為, 立法會議席一天仍有功能組別, 一天沒有"真普選".
原因: 功能組別是由某一群界別人士推選出來的代表人, 就是這樣, 立法會不會是一人一票得出來, 有些人可以多投一票在功能組別 (功能組別好壞, 請各位自行研究, 這就是"公投"的目標)
政府最近提出的"政改"方案, 把地方議席增加了, 同時因要維持比例不變, 功能組別議席相對亦增加. 泛民眾則認為此方案, 根本沒有進步. 因而流出... 五區總辭, 變相"公投" 的說法
到底, 如何"公投"呢? 社民、公民眾訂了一些"準則", 認為補選中, 社民、公民五人得票量總和 少於 其餘黨派中五位最高得票的總和, 社民、公民眾便視之為 大眾市民支持那 "政改"方案, 社民、公民仍留在議會的便支持其方案. 否則, 反對之. (社民、公民眾訂的"準則", 請看wiki)
民建聯那群"禮義廉"則否認此仍"公投"... 因為"公投"結果只是由社民、公民眾自編自導自演. 社民、公民眾則認為, 這"公投"相對一般按比例的民意調查"更科學" (事實只有科學不科學, 沒有更科學... 這意思是更有說服力).. "禮義廉"眾則認為此乃浪費公帑. 而事實上, 這個普選只需要全港 700萬 市民, 每人花 20$ ... (其實 $20 是很多, 足夠小弟在城大兩餐 10$飯 =D)
其實, 那群"禮義廉"何不像自由黨眾.. 表決不參與補選... 而在大費周章?? 大家都明白, 只要沒有人跟社民、公民眾參與補選, 他們很自然是浪費公帑的"罪人" ... 借此大費周章提高自己政治身價的一眾, 真是禮義廉!
小弟個人意見: "政改"的表決, 認同需要廣泛參與的表決.. 而一般按比例的民意調查 (即 statistics 中的 random sampling by population ratio), 不能代表廣泛意見及參與. 如果沒有一個比 變相"公投" 更好的參與方法, 小弟只有支持 "公投".
人是需要有選擇的, 沒有其他更好的選擇時, 選擇那唯一的選擇, 比默默接受更好.
---
要清楚更多更多五區總辭的資訊... 請看 wiki
Sunday, January 17, 2010
Welcome to "China"
Just half an hour ago, i was going back to school. I met a foreign couple. They asked me: "How to go to Wong Tai Sin Temple?" The first sentence I smile and spoke: "Welcome to China". Yes! There is no typo. Welcome to "China".
譚惠珠在今天城市論壇把大家可能忽略的事實再一次翻出來 - "香港的主權不在於民, 中國才是香港的主權國..."
譚惠珠在今天城市論壇把大家可能忽略的事實再一次翻出來 - "香港的主權不在於民, 中國才是香港的主權國..."
