From November 19th to the 24th, 2009 Palden Dorje a.k.a. Ram Bahadur Bomjan will be giving blessings in Ghadi Mai. He plans this appearance in order to protest the sacrificing of tens of thousands of animals before they take place on the 25th at the Ghadi Mai Festival near Nijgad in Bara District. This Ancient Nepali Festival has taken place once every five years over several millennia.

I completely support him on this one.

More about Gadimai

For my RSS readers – wanted to let you know that Nirlog.com just got a facelift as well. I’ve changed my theme to Simple Balance 2.2, it’s a free theme loaded with pro features. I just love it. After testing around 20+ themes I settled for Simple Balance. It has a very clean look, options to choose different colors, supports widgets and has a built-in banner ads management system. It’s just perfect! Thanks Blogsessive for making such a nice theme and giving it for free. I’ve also tweaked the ads placement (hopefully this will give a better reading experience for those who read directly on the site). I’m displaying my last 5 tweets using a twitter widget, which is kinda cool. BTW, you can follow me on Twitter at http://twitter.com/nirlog

I’ve also moved my domain nirlog.com and this blog to hostmonster (affiliate link). They seem to have quite nice reviews and was recommended by my friend Mahesh. It’s pretty cheap too. One of the most important feature for me was the SSH access, which they have. So far so good, let’s see how it goes…

I would like to thank ISL (my previous employer in Hong Kong) for hosting my blog for free for such a long time

It was a life changing experience being at the the operating theatre during her birth (I wasn’t allowed in the labour ward when my son was born in Hong Kong in 2000). Words can’t explain it! I’m sure all the dads who’re present at their child birth understand what I mean. The pain women has to go through and courage, love, care and tenderness that they show throughout pregnancy and birth is one of many things that make them so special. I think that’s one of the reasons mothers are so special in our life.

Here’re few photos I’ve taken.

Minutes after birth

With her mum

With her brother

With her dad

D90 is the very first DSLR to do HD video. I’ve taken few pictures and video with it and I’m impressed. The crisp quality pictures you get when you hook it up with your HD TV using hdmi connection is just breathtaking! I’ve bought few photography books and am reading all about ISOs, whitebalance, lenses, Aperture, Shutter speed, etc…

I’ve taken some pictures of my D90, enjoy…

Click on the photo for larger image.

He’s now 8 and half. Here’s a masterpiece he made when he was 5 and half.

I was keeping my eye on the price of D90 in UK at Camera Price Buster (very useful site indeed!). When I was ready to buy it from Currys (it was £709.00 at that time), just decided to do a last minute check on Amazon (I prefer buying from Amazon because never had any problems in the past) and to my surprise Nikon D90 Digital SLR Camera, 18-105 VR Kit was there for just £649.99 by a seller called “rodneyjwillis”. Almost £60 cheaper, Excellent – I thought. Checked the sellers profile/review – it had 100% positive feedback from the buyers, nice comments and seller was with Amazon for almost a year. So, ordered it from Amazon marketplace. I didn’t see anything phisy at that time and anyway I was aware that paying via Amazon will guarantee my purchase with their A-to-z guarantee scheme.

When all other stuff I ordered together with D90 arrived (camera bag, sd card and d90 book), but there was no sign of my D90 being dispatched, let alone delivered. I sensed something was wrong. Went back and checked the seller’s profile – there was one new feedback saying

“BEWARE! This account is being used in a scam – items don’t arrive!”

That got me worried. Sent seller an email and alerted Amazon that this might be a scam. The storefront of the seller was immediately taken off (I guess by Amazon)

Contacted the seller for the status of my delivery – got an email next day saying, the item was dispatched (without any details):

I then replied asking when was it dispatched, if he was sending it from UK and if he could give me the tracking number. In reply I received another copy of exactly the same email. Called Amazon several times and sent several emails. By now I had no doubt in my mind that it was a scam and I wanted my money back, but amazon was sticking to it’s policy of waiting for the 3 days to pass after the seller’s advertised delivery date, which was 11 to 23 June ( I actually placed the order in 5th June). That meant I could only file a-to-z claim after 26th June (which is 3 weeks after my order), and would have to wait for amazon’s investigation (one to two weeks), then when they transfer the money back, it can take up to another 10 days to end up in your account. Almost 2 months before you get your money back in worst case scenario.

I think it’s totally unacceptable for a clear fraud case like this!

When I sent a last email to the seller (June 16) – got this auto-reply saying his amazon account was closed.

After a week of persistent complaining Amazon finally filed the a-to-z claim on my behalf. All in all it was a very dreadful experience. What a waste of time! I’ve spent most of my last week just checking the sellers profile, reading other victims comments, contacting Amazon and worrying…

Here’s the link to scammer’s amazon profile, at the time of this writing more than 70 people have fallen victim to this scam.

I’m sure everyone who paid via amazon will get their money back but Amazon has failed here in a big way. Looks like the seller has duped Amazon more than the buyers. At the end of the day buyers will get their money back. Amazon is the real loser here – the lost customer confidence is more costly for them than the refund they’ll have to make. Amazon should have been more proactive to refund the money to customers since it was a clear fraud case, which happened due to weaknesses in their Marketplace system, but they kept on dragging.

Every amazon’s email had this signature:

“We’re Building Earth’s Most Customer-Centric Company”

But I wasn’t convinced. You couldn’t reply to any emails they sent you because the emails were sent from addresses that cannot accept incoming emails. There might be a valid security reason for doing that but as a customer it was quite difficult to track my email conversation with them (the online contact form didn’t keep any record of my previous emails to them either). I found Amazon’s telephone support to be better than their email.

This just shows that it’s not all safe and well on online purchases. The scammers can trick not only innocent users but successfully dupe big companies like Amazon.

Finally the money refunded by Amazon has appeared in my account. I’m off to local Argos store to get my D90.

After Googling a for a while I found about MacBook Pros with faulty Nvidia GPU.

Apple has determined that some MacBook Pro computers with the NVIDIA GeForce 8600M GT graphics processor may be affected. If the NVIDIA graphics processor in your MacBook Pro has failed, or fails within two years of the original date of purchase, a repair will be done free of charge, even if your MacBook Pro is out of warranty.

Good – I thought, if that’s the case it’ll be a free repair. My MacBook Pro fitted all the descriptions, but I decided to do some further troubleshooting myself as per apple’s recommendation, tried external display and even changed the RAM (I had the original 2GB RAM, which I’d upgraded few months back to 4GB). Finally called apple, and the support guy asked me to take my MBP to apple store to be seen by a Genius.

I made an appointment with a Genius in Apple Store, Bentall Centre. A friendly Genius took my MBP in to do some test (they’ve a special test for nvidia issue) and came back to tell me that the logic board was faulty. I told him that the OS is actually booting, only the display is not working. Showed him that the volume key works, but he told me that volume key actually works without the OS (but I was not so sure). So, finally he gave me a £771.65 repair estimate quotation for the logic board replacement. I came back with my MBP and was already thinking about buying a new one.

Back at home, I turned on the MBP again and left it on for a while, I could see it joining the wireless access point and could even ping it’s ip address from another pc. At this point I was pretty much convinced that it’s not the logic board but only display problem. I booked another session with Apple Genius, but this time in a different store at White City. Showed my MBP to this Genius, explained him what happens. He said – he’ll need to do one test, booted my MBP using an external hard disk and told me “Yes, it’s a NVIDIA issue, we’ll repair it free of charge”.

So, apple took exactly 2 weeks to repair my MBP, the logic board was replaced. The receipt shows £771.65, but with payment method – “No Charge”. I’m glad to have this fixed free of charge (was nearly duped into paying £771.65 or even buying a new MBP).

If you have a MacBook Pro with display problem it’s very likely to be a NVIDIA issue even if one Genius says it’s not!

First briefly about the company – Sourcerfire was founded by the author of Snort (an open source network intrusion prevention and detection system). Snort is the most popular and widely deployed IDS/IPS and has become the de facto standard for the industry.

So, why do we need Sourcefire (very expensive) if Snort is the best and free?

Right, Snort is the best and free out there but it’s implementation, management and maintenance is not a piece of cake for everyone; that’s where sourcefire comes into play. Sourcefire uses snort at it’s heart to utilize it’s powerful IDS/IPS techonology, with added benefit of plug-n-protect simplicity (the purpose-built appliance is easy to install, maintain and manage), and it comes with tons of extra features that make it very powerful. Sourcefire adds an Adaptive IPS and Enterprise Threat Management (ETM) on top of the Snort IPS. It is managed via user-friendly and intuitive web interface, of course you can always do your advanced config from the shell because it’s a snort installed in a linux box anyway.

Components of Sourcefire 3D System

Sourcefire 3D System is comprised of two appliances (Sourcefire Defense Center and Sourcefire 3D Sensor).

Sourcefire Defense Center (DC) is a centralized management console to manage the sensors, centralized event aggregation and sensor policy administration.

Sourcefire 3D Sensors are purpose-built network security appliances that passively aggregate network and user intelligence while defending the network against internal and external threats.

3D Sensor Modules

Each Sourcefire 3D Sensor is capable of running any combination of the following four software components (you need to buy them separately):

Sourcefire IPS (Intrusion Prevention System) it’s the mighty snort running in background, where you can use rules-based detection engine and utilize the acclaimed Vulnerability Research Team (VRT) to protect your network. The IPS component is included in the base system.

Sourcefire RNA (Real-time Network Awareness) passively monitors real-time network traffic and gathers network intelligence, it can detect operating systems, services, applications, protocols, and potential vulnerabilities that exist on your network. This is a very useful component of Sourcefire but you’ll need to buy the RNA license separately.

Sourcefire RUA (Real-time User Awareness) helps to identify the user identity and contact information, it pairs Active Directory and LDAP usernames with host IP addresses involved in security and compliance events. You’ll need to buy the RUA license separately.

Sourcefire NetFlow Analysis is an optional component of Sourcefire’s Network Behavior Analysis (NBA) solution. It gives additional insight to network threats by aggregating and analyzing NetFlow from routers and switches.

Sourcefire 3D System deployment with Master Defense Center

OK that was about sourcefire. Here’s how you go about getting certified.

Training Course

Sourcefire offers several instructor-led classroom training for Sourcfire 3D systems, out of which SF3D 360 Bundle is the one I took.

Sourcefire 3D™ 360 Bundle Includes:

• Instructor-led Training Sourcefire 3D™ (4 days)
• Sourcefire Certified Professional (SFCP) Certification Exam
• Sourcefire Guarantees
• CPE Credits 32 (for CISSPs)

Course Outline

• Sourcefire 3D System Sensor Deployment and Communications Architecture
• Sourcefire 3D System Overview & Product Installation
• Interface Navigation and Dashboard views
• Sensor Configuration and Management with the Defense Center
• Configuring Interface Sets and Detection Engines
• Administration, Maintenance and System Policy
• System Health Monitoring and Alerting
• Real-time User Awareness
• Adaptive Profiles
• User Account Management
• IPS & RNA Detection Policy Configuration
• Compliance Policy, White Lists and Host Attributes
• Event Analysis and Reporting
• End-Point Intelligence
• Flow Data Analysis and Network Profiling
• Nmap and Nessus Scanning
• Basic Rule Structure and Syntax
• IPS Features and Configuration
• Trouble Shooting and Behind-The-GUI Navigation and Architecture

Certification Exam

The following products and skill areas are assessed through this process:

• Intrusion Management System
• Intrusion Sensors
• Defense Center
• RNA Sensor
• Installation and Deployment
• Administration and Management
• Policy Configuration and Management
• Policy Non-compliance and Remediation
• User Administration and Management
• Reporting Creation and Management
• Effective and Performance Oriented Rule Writing

The certification exam itself consists of 200 multiple choice questions, which you’ll have to complete within 4 hours. Passing score is 75%, you’ll immediately know whether you pass or fail and if you pass the exam certificates are available online for you to print.

I found the instructor-led course very helpful. I have worked with snort before but this was my first introduction to Sourcerfire. After the 4 day course, you’ll have 60 days to prepare and take the exam. Every student is given a second attempt if a passing grade of 75% or better is not achieved on the first attempt.

To prepare for the exam, I went through the training material (page by page) one more time. I also had an access to sourcefire boxes installed in our office lab so, it was very useful. It’s an open book exam, you’ll have slightly more than a minute to answer each question, so you won’t have enough time to go through your materials during the exams. You’ll need to know your stuff to pass it, but having an access to sourcefire box at the time of exam will be very handy (for the user interface questions).

A Hong Kong police constable shot dead an unarmed homeless Nepali man.

A life was lost unnecessarily.

Why?

Because a policeman couldn’t subdue a single suspect with pepper spray and baton, then gave him warning in Cantonese (possibly the suspect didn’t understand) and decided to shoot him twice (one in the head) from a very close range.

Investigation is underway, but looking at the mobile phone video footage, shooting was absolutely unnecessary. If the officer was so unfit to subdue a single suspect he should have left him alone and waited for a backup support instead of shooting in the head, after-all he wasn’t a fugitive or a terrorist.

Shame on you Hong Kong Police!

Update: Latest News about the incident from HKNepal.com

I’ve to say that I’ve been quite reluctant to install third-party apps and post family photos due to privacy concerns, but this new terms of service makes it worse. Now anything you post or upload can be used by facebook even after you close your account. In previous terms of service, facebook’s rights on your content would expire after you closed your account, but not any more.

via: Consumerist

Update (17Feb09): facebook ceo, Zuckerberg has written a blog post about the issue, trying to explain why they need this TOS.

Our philosophy that people own their information and control who they share it with has remained constant. A lot of the language in our terms is overly formal and protective of the rights we need to provide this service to you. Over time we will continue to clarify our positions and make the terms simpler.

Update (18Feb09): After a global complain facebook has returned to previous terms of service (until they find a new language to clarify their position). Zuckerberg explains it in his Update on Terms

We concluded that returning to our previous terms was the right thing for now. As I said yesterday, we think that a lot of the language in our terms is overly formal and protective so we don’t plan to leave it there for long.

Update (27Feb09): Finally, democracy has come to facebook, it’s allowing users to review comment and vote over it’s future policies. That the way to go, well done facebook!