* Posts by Ray Simard

146 publicly visible posts • joined 4 Jan 2008

Page:

Jobsian fondle-slab in SEXY FILTHGRAM CRACKDOWN

Ray Simard
WTF?

The mind boggles

Someone, somewhere (in fact, here at El Reg, I think) speculated, tongue-in-cheek, that Apple was patenting the wheel, Beethoven, air, etc., to shine light on the absurdity of the U. S. patent system. I'm about half-willing to consider moving the tongue in this case to its normal position.

And if they aren't, this case and the many others like it should have that effect anyway, if some sufficiently prominent and respected voices can pipe up and cite them collectively in a suitably loud and blistering attack on the system.

(The film Patent Absurdity is a nice start, but I fear its audience is not getting very far beyond those who already understand the problem and don't need convincing.)

Sex offender tagging system crashes

Ray Simard

@Julius Deane

I think you meant 4-octet, not 4 bit, whose upper (signed) limit is 7.

Apple in 873-page legal claim to word 'Pod'

Ray Simard
Joke

Thanks to @Greemble, and...

...I was just about to deliver a very swift kick to Mr. Jobs and all others guilty of this insanity, but my foot is sore and I cannot find a foot doctor since the Apple lawsuit forced them to change the name of their specialty.

(Thanks to Greemble for reminding me of that brilliant Groucho Marx letter to WB.)

Software re-sale restricted by US Court of Appeals

Ray Simard
Thumb Down

@bitmap animal

If you buy a copy secondhand, that does not alter the fact that the manufacturer has been paid for that copy.

If the original purchaser has installed that program from that copy and has not removed it before reselling it, that is be a different story; there are now two users of one copy. Otherwise, once the publisher has gotten their nickel from that copy, the payer of that nickel should be free to do what they please with it as long as it does not involve duplication for others' use, and whoever is in legitimate possession of that copy should receive as much support as the original purchaser did.

I cannot understand how this court could fail to recognize this as first sale.

Bill would let feds block pirate websites worldwide

Ray Simard

Repeating history instead of learning from it

Before network file sharing it was CD/DVD ripping that was going to destroy the industry.

Before CD/DVD ripping it was VCRs that were going to destroy the industry.

Before VCRs it was audio tape that was going to destroy the industry.

Before audio tape it was broadcast TV that was going to destroy the industry.

Before broadcast TV it was radio that was going to destroy the industry.

Before radio it was the phonograph that was going to destroy the industry.

Before the phonograph it was the player piano that was going to destroy the industry.

Every one of these technologies was decried as a threat to the entertainment establishment at the time, and every one save the most recent has instead enriched it, once it stopped wasting time fighting it and found ways to monetize it instead. There's no reason why that trend can't continue.

Ray Simard
Thumb Down

Criteria, and other questions

1. What are the criteria for determining if a site is "dedicated" to piracy? A particular percentage of its offerings falling into that category? Someone going to sit around and count them? What legal definition of "dedicated" applies here?

This is an all-or-nothing kill; there are no degrees of impairment of a site's function. Any site that meets whatever threshold of alleged piracy applies is off the air completely (or as completely as the technology allows) regardless of how much of its stock in trade is legitimate.

2. Who determines if any particular item infringes? Sure, most would be fairly obvious, but when it comes to killing a site in toto (and the liability that implies), you need more than just assumptions and impressions.

3 How long before there are miles-long queues of other interests clamoring for similar protection of their interests?

4. Who pays for all of this?

5. Fair use?

6. Isn't this effectively enlisting the government to participate in what amounts to a civil dispute on behalf of one side? Or if it's criminalizing whatever activity is found on a particular site that can be called infringement, where is due process?

7. What about cases where something infringes under U.S. law but not the laws of other countries?

8. If a site is registered using a U.S. based registrar, and gets spiked, its operators need only re-register elsewhere, and then it's only interference with DNS to worry about, which shouldn't be much of a problem.

9. In the cases where offshore sites get blocked by DNS: who will troll the net to ensure that providers everywhere are complying?

The entertainment industry is getting to the panic stage and enlisting the help of its sympathizers in legislatures to float ever more ridiculous ideas. I really doubt that this thing is going to go anywhere, or that even if it does, the courts will not kill it at the first opportunity.

Microsoft: IE9 will never run on Windows XP

Ray Simard
Thumb Down

All browsers? Really?

"'You don't want to differentiate on HTML5 - [as a coder] I want to be able to write this mark up once and it runs across all browsers,' Gavin said."

Uh...

Presumably the famous <VIDEO> tag is not an exception to this lofty goal. With that in mind, said browser independence can't very well achieved without a codec acceptable to all the browser makers.

Are this fellow and his employer assuming that Mozilla and Google will cave in get behind it (and Apple's) obstinate insistence upon supporting only the patent-encumbered (and to its advantage) H.264 codec and the desecration of the history and philosophy of Internet vendor-independent standards that entails?

Governments mull net censorship grab

Ray Simard
Thumb Down

This way lies madness

The DNS does not need, nor even benefit from, a TLD for every niche, interest and societal sector. Technically, the system would work fine with no TLDs at all. They were conceived to help organize the DNS around the purpose and function of the domains under them, but aside from .GOV and .EDU, for which you still have to provably qualify (and setting aside the country-code domains for the moment), the rest have been stripped of their meaning entirely.

Remember when .com, .net and .org meant something? To get a domain you had to include a short written justification (and $100 USD) wth the application, and that had to match up with the TLD you requested. Strictly, you got .NET if you were a part of the Internet itself, .ORG if you were a non-profit or .COM otherwise (granted, the was a lot of play in the system, but that was the goal). If .com, .org and .net were merged into a single TLD there would be no harm in that at all; they mean nothing any more. Even USENET's top-level groups are more meaningful.

TLDs are not directories; they are not browseable; being part of .autopartsdealers* isn't going to get anyone to your store's site any faster than if it's www.south-booswah-autoparts.com--in fact, less so. I see no reason to waste time and trouble over this; it's headed in the wrong direction. These new "niche" TLDs will soon be full of inappropriate domains just as .COM .NET and .ORG are now, if we imagine for a moment that those old standards still existed. It's just complicating the DNS and creating illusory significance to the domains under them.

(I was going to say .hamster-duct-tape, but that would be lost on most people.)

Man charged with malware 'sextortion' plot

Ray Simard

Why not...?

They probably need more time to secure and process evidence before they're confident that they have a strong case they can bring to trial.

Sunny Spain suspends solar subsidy scam

Ray Simard

@Hole in the ground

or a lawyer.

Jobs drops hint on Google open video codec

Ray Simard

How it got to this?

W3C has a history as one of the staunchest defenders of thorough, well-conceived and well-developed standards free from contamination by self-interested outside parties. As such, it's a bit surprising that they would let pressure from the likes of Apple deflect them from their stated intention to specify a particular codec for the official HTML5 video tag, chosen, in part, because it's not proprietary. It might be another story if concerns about Ogg/Theora's performance led to a decision to hold off on the spec while they kept looking for a better solution, but I'm sure they must have realized that the decision to omit the codec from the spec altogether would leave the door open to abuses such as the standoff that Google appears to have finally broken, particularly given the long and well-established history of the two 800-pound gorillas in the scene of using their muscle for just this kind of advantage.

If they aren't doing so already, agencies with the responsibility to issue specifications like this one need to dedicate some amount of time and effort to look for flaws like this one that could be exploited by certain parties for lock-in or some other advantage, and make that very clear to any and all who might be tempted to twist things their way that they will do so.

Most browsers silently expose intimate viewing habits

Ray Simard

HTTP response code, non-Javascript exploit

I'm trying to think of a way an HTTP response could be used as an exploit. This is all I can think of:

Rogue site includes some object from page it's testing for, maybe a graphic with width and height set to 1, like a web bug. Perhaps many of them. (It would probably be mandatory to do that; too many users would smell a rat if they regularly saw graphics unrelated to the site they're visiting.) If the browser comes back with 304, Not Modified, then that object is in the cache, disclosing that the user has been there, and probably recently, depending on the lifetime of items in the cache. This would work for any page at the site being tested that includes that object, no only the one the user actually visited, so a visitor to some page deep inside a domain which happens to include a logo that is included in most or all pages there would be detected simply by testing for the site's home page.;

If that's anything like the exploit, perhaps the browser could check for URLs pointing to objects at other domains with attributes in the link that seem designed to hide their presence from the user, and could then toss up a warning dialog. Google or kindred could add that kind of sign to the criteria they use to find dodgy sites for which they link to their "dangerous site" warning.

Google open sources $124.6m video codec

Ray Simard
Thumb Up

Raise your glasses (and thumbs) high!

If, as it is, VP8 is covered by the BSD license, then it's a done deal: it's open and royalty-free.

As for patent encumbrances: It's pretty well known by now that the wind blows where the money goes. MS and Apple can't play the intimidation game with Google that patent-holders have learned to use to threaten smaller firms into unwarranted settlements and cross-licensing agreements.

Theoretically, Google could change their minds and strap YouTube with H.264 or something, but now, why should they? They'd have one hell of a firestorm to deal with and no justification to claim. Adobe's newly-announced support for VP8 is one more reason.

It will be interesting to see how VP8 performs against H.264. I doubt there will be a problem with that. Theora may have lagged somewhat behind H.264 in that department, but not by all that much, and Theora is practically VP8's ancestor. It being so, one could realistically, if a bit loosely, refer to VP8 as the improved Theora many hoped for.

This isn't just a victory for web video: it's a victory for the Internet itself. MS and Apple can still refuse to support anything but H.264, but now it will be a whole lot harder to get away with it. They'll be on the defensive without a defense.

Chalk up a big one for the good guys!

'Bulletproof' ISP for crimeware gangs knocked offline

Ray Simard

No--and yes

(The following is my best understanding of the subject and I am not an expert; corrections requested as needed.)

You're on target to say that there is no central routing table that anyone controls or maintains. However, there is (by name, anyway) a global routing table which is defined as the set of Autonomous Systems which are connected such that they can reach anywhere else on the net without the need for a default route.

This table doesn't actually exist anywhere in particular. The Default-Free zone, which may look on the surface like a central reference, is actually nothing like that. As I understand it, routers in this set of ASes by definition know about every other AS in that set and can route directly to each of them (though, unless I have that wrong, doesn't necessarily mean that they are directly connected), and that collection of information is what is called the global routing table. Therefore, the global routing table is generated and maintained in a distributed and independent manner by Border Gateway Protocol (BGP) implemented by those routers (I don't think there are other protocols involved, but that might be wrong too), and it can change continuously when events on the net cause changes in the way BGP and router implementations determine the optimal routes from one point to another.

So, in reference to the original question: there is indeed no place where such a table exists that could be manipulated to cut off a rogue service.

Ray Simard

@flybert

Theoretically, yes, but it would require the cooperation of a lot of parties and a lot of risk.

Sure, if their records were removed from the root zone, that would kill their entire network, including their legitimate users, if any. There are lots of reasons why that's not likely to happen.

After that, it's all about routing. Just as John Gilmore said, the net interprets censorship as damage and routes around it. Blocking all of the possible paths that could keep their network afloat while not crippling other, proper services would be one hell of a task, even if all the parties involved were willing, which is unlikely, not only for strictly technical reasons, but also philosophical ones--and, of course, the politics.

Ray Simard
Alert

Could this work?

Suppose a team could be assembled comprising some highly skilled analysts of bot code and a large array of volunteers with systems on residential and similar ADSL networks with dynamic addresses, just the kind the crims seek out to host single- and double-flux botnets.

The idea is, the analyst/coders, once they've gotten the inner details of a given bot, create a decoy, one that behaves exactly like the real one, but which also communicates everything it can that might be useful to the white hats while hiding that behavior from anything the crims can get from their real bots behind dummy data. The bots would be hosted on volunteers' machines, avoiding the thorny issue of a white-hat infection of unknowing botnet system owners, and also allowing the installation of other, separate services to monitor activity and help keep the subterfuge hidden from the bad guys without having to necessarily build all of that into each new bot design itself. Perhaps services and daemons like this could even be made to mimic bots simply by updating scripts rather than necessarily coding and compiling new binaries.

These volunteer decoys would be able to give analysts real-time information on motherships, not necessarily just addresses, but everything the "bad" bots would have to know and be able to communicate in order to function.

Of course, the bad guys would catch on very quickly and try to add features to each new generation of bot to foil this, so the analysts would have to really stay on top of each new strain. Still, this might be workable given sufficient resources and talent.

Microsoft defends death of free video in IE 9

Ray Simard

@It's not just the encoding.

"If Ogg Theora was a viable competitor to H.264 then I could understand the concern about the lack of support..."

How well Ogg/Theora/Vorbis stands up technically next to H.264 is really not at all the issue. The difference is pretty slim and could change overnight.

"... but today a lot of companies have invested time and money in making H.264 a well rounded solution."

Now we're getting warmer. Certainly, anytime individuals or companies want to spend bucks to develop a product and put it on the market, that's enterprise, and that's as it should be. However...

This issue pivots on one crucial difference: HTML5 is not a part of a free and competitive market. If it's accepted, it will be an Internet standard, binding upon any and all who would create web browsers that would be standards-compliant and work to the satisfaction of end users.

Among the fundamental, bedrock philosophies underlying the design of the Internet are openness, indifference to the whims and wishes of any party or faction, and ubiquity and consistency of its functionality. Perhaps the realization of those goals in the real world is less than perfect, but in the standards that define and govern it, it's damn close.

Now, for the first time, a formal Internet standard would put those wishing to comply with it at the mercy of a private entity with the power to impose restrictions and demand payment. It doesn't matter if it's a little or a lot, or tomorrow or in ten years; it's trashing the most sacred principles that have served to make the Internet the phenomenon that it is and centralizing a staggering amount of power in a small number of entities with no accountability to anyone but themselves.

Ray Simard

@OTRHead

Hmm... No.

Time Warner and the others you mention do not control web video availability. The Internet is open and free; providers such as you mention merely connect you to it and charge to do so. They have nothing whatsoever to say about what happens on it or what you may expect if you find some other way to connect; the most they can do is interfere in some way with the connectivity they provide their own customers (as Comcast did with BitTorrent). That's all.

To an end user it might seem just fine to lump all of the costs together as you do and look at the bottom line only. It might not seem all that important that, for the first time (to the best of my knowledge) it may become inherently, if indirectly, necessary to pay some fee to be able to use a standard Internet protocol. That is a very, very disturbing threat.

Up till now, there was never a way that any party could put a stranglehold, or impose a fee, on anyone creating a software product which uses the Internet for some benefit. Now it looks like anyone creating a web browser will risk being charged a fee simply for supporting and complying with the HTML5 specification with a product that can satisfy users' expectations. A browser that supports only Ogg/Theora would be compliant; but that's not much good if much of the web video out there is H.264 encoded for the benefit of IE and Safari.

On top of all the other valid concerns about this expressed here and elsewhere, this blithe willingness on the parts of Microsoft and Apple to trample on the nature and spirit of the Internet's design is selfish, exploitative and downright immoral.

Ray Simard
Linux

Ogg/Theora/Vorbis "patent landscape"

Just how much time, money and human-power would it take to research Ogg/Theora's patent vulnerability well enough to either find the infringements these folks are claiming or put the issue to rest? Anybody savvy enough on the subject to venture a guess?

This has that same FUDdish quality as Microsoft's never-substantiated claim that Linux violates some 200-odd patents of theirs. If they won't put up or shut up, it would be damn nice if we could shut them up for them.

I grabbed the Ogg/Theora/Vorbis-encoded HD version of Patent Absurdity (http://patentabsurdity.com) and, while I can't compare it to an H.264-encoded version side by side, I find the quality excellent. Whatever other objections may apply, I can't see how anyone could consider its quality inadequate for web video.

Steve Jobs: mystery patent pool to attack Ogg Theora

Ray Simard
Thumb Up

Movie: "Patent Absurdity"

http://patentabsurdity.com/

Downloadable directly or with Bit Torrent. The HD version is a pretty good demonstration of the performance of Ogg/Theora/Vorbis.

The MPAA and kindred won't like you getting this by P2P either...but for reasons quite different from the usual.

Ray Simard
Grenade

From wariness to antagonism

There seems to be rather little notice here of the change in tone from Jobs' earlier objections to Ogg/Theora/Vorbis. The "uncertain patent landscape" concern sounded like caution--on the surface, anyway. This sounds more like open antagonism. "Going after" it? Sounds like this bunch intends to sink it, or at least try. Why?

US gov cries foul on MPAA piracy claims

Ray Simard
Grenade

Treat people like criminals...

...and they'll behave like criminals.

The industry alarmists' attitudes annoy and insult the many who ride the fence between the temptation to pirate and the willingness to pay the bucks out of a sense of integrity. It's pretty hard to quantify the extent of piracy triggered by such irritation, but I'll bet it amounts to a pretty fair chunk of change.

What really chaps my hide, though, is the industries' attempts to effectively grab regulatory power over the design and functionality of consumer electronics, demanding limitations aimed ostensibly at frustrating the transfer of material by users to their own systems and media, but with no regard for legitimate kinds of copying and the cost imposed on consumers whose equipment would no longer work because of them. The idea of an industry with no accountability to the public acquiring de facto regulatory control of another industry's designs and innovations is pretty scary, the more so when they're choking off useful features because they might--MIGHT--be used for piracy--sometimes.

I have a goodly number of purchased items which were purchased because I first grabbed a pirated copy for a preview. I can't be the only one. The numbers might not be all that impressive, but has anyone considered that--that some purchases came about because of interest triggered by a pirated copy of something they might otherwise not have considered interesting enough to buy? Yes, there's a temptation to just keep the illegitimate copy and pass on the purchase, but when there's the willingness to buy what can be pirated, there's at least some willingness to buy what has been pirated.

I also see a bit of irony in one case of my own, an Italian movie I "stole" via Bit Torrent. I had first combed the net in search of a copy, and found only one for sale--from Italy. Region 2. Useless.

Telegraph trips over the Large Hardon Collider

Ray Simard
Coffee/keyboard

No surprise

What do you expect when you excite atoms?

Body of James Brown disappears from family tomb

Ray Simard
Megaphone

Mary Shelley's story...

...made into a movie with Boris Karloff, mike in hand, shouting "I feel good!"

Man sets mice on musophobic ex-missus

Ray Simard
Pirate

Take heed

When mice are outlawed, only outlaws will have mice.

Google and MS sued over links to file-sharing site

Ray Simard
Thumb Down

Wicket adhesion factors

They're called fences here in in the US too.

I suppose it wouldn't be the ultimate tragedy (though it might be expensive) if the likes of Google and Bing are routinely hit with DMCA takedowns, but it does look like things might get dicey when you throw in the elements of jurisdiction, legitimate distribution, fair use (can a copyright holder use a DMCA takedown to prevent linking to a parody it doesn't like, leaving the search engine only the options to comply automatically or to review the content manually?), hit-and-run takedowns by parties who don't hold copyrights, or perhaps use of the search engine to locate such content for reasons other than piracy?

This looks like the system is batting on an increasingly sticky wicket.

(We don't use that phrase in the US.)

Google strips Pirate Bay homepage from search results

Ray Simard
Thumb Down

Back to normal?

At this moment a Google search for "torrent tracker" brings up the TPB top-level page third, after the Wikipedia article describing trackers and torrentking.org. The DMCA notice isn't there.

As far as the original censorship goes, I frankly don't care if TPB is naughty or nice; it's not Google's place, on its own or under pressure, to play moral guardian to the world or any part of it. They might well nix clearly criminal enterprises (malware, kiddie porn, terrorism how-to, Crack Cocaine 'R' Us...), but despite its woes TPB is not in that class. I've got a problem with one industry telling another industry which is in no way violating any law what to do. Yes, Google runs its own shop as it sees fit and has the right to do this if it wants to, but it's a very bad idea, and a worse precedent.

FCC boss moves for stiffer net neut rules

Ray Simard
Paris Hilton

Good reasons for...what?

It's not often that an issue comes up that pits two personal passions of mine against each other. Here's one.

On the one side is a reverence for the freedom of those who own and operate an enterprise to run their own house as they choose, within the bounds of basic business ethics. In the case of connectivity providers, one example of this I'd hate to see lost is the right to use, at their discretion, such things as DNSBLs to fight spam, or block outbound port 25 from users of things like DHCP pools to frustrate direct-to-MX bots. These things inherently chip somethinng away from a neutral net, though in these particular cases, nobody worth listening to is likely to object.

On the other is exactly this matter, preserving to the greatest extent possible the old concept of the end-to-end model, or the spirit anyway, and, in general, keeping an eye to the ideal of making the net blind to the nature of traffic, where any two endpoints of a connection anywhere on the net behave exactly the same as any two others.

Paris, who has lots of conflicting passions.

Critical bug infests newer versions of Microsoft Windows

Ray Simard
Linux

Ports...?

>In the meantime, admins should prevent attacks targeting SMB2 by disabling

> the service. If that's not possible, the two TCP ports used by the service,

>139 and 445, should be blocked at the firewall.

When should any of the SMB-related ports ever be accessible to anything but the specific machines/networks (presumably local) that need them?

BIND crash bug prompts urgent update call

Ray Simard
Linux

@Anon ... Just FEI

http://www.theregister.co.uk/2009/02/28/djbdns_cache_poisoning_vulns/

Tux, just because...

Comcast trials Domain Helper service DNS hijacker

Ray Simard
Thumb Down

A double standard, methinks

From: http://www.theregister.co.uk/2008/10/23/google_and_typosquatting/

"According to a recent study from McAfee and Harvard prof/cyber watchdog Ben Edelman - which relies on web data from May 2008 - at least 80,000 domains are typo-squatting on America's 2,000 most popular web sites, just waiting for innocent web users to misspell or mistype their next url...

"For instance, the study (PDF) says, 742 domains sit just a few misplaced characters from freecreditreport.com, and 327 are shadowing cartoonnetwork.com. "Cartoon Network with three Os. Cartoon Network with two Ts. Cartoon Network that starts with a k. More ways to misspell Cartoon Network than you ever imagined," Edelman tells The Reg. "And almost all of them serve Google ads."

"In the US, typo-squatting is against the law. The 1999 Anti-Cybersquatting Consumer Protection Act (ACPA) prohibits anyone from "registering or using" domains misleadingly similar to a trademark or famous name."

[end excerpt]

So (in the U.S. anyway), it's a crime to register a domain in the hope typo-typers will happen to land on it, but it's fine to diddle (and defile) the DNS to accomplish the same thing--provided you're an ISP in control of the nameservers that nearly all your clients, save those savvy and motivated enough to point their resolvers elsewhere, use.

Someone's not paying attention...

Hmm...

Music labels take (more) Irish ISPs to court

Ray Simard
WTF?

As if the coerced Three Strikes policy weren't enough...

That a major provider should be compelled to become copyright cops under pressure, not from a governmental regulatory agency which is, at least in theory, answerable to the people, but rather a cabal of private interests, is outrageous enough.

But what's even more so is wangling a promise to censor their customers' browsing according to their whims.

I didn't know that the green of Green Dam meant the Emerald Isle.

Website liable for Google-generated page summary

Ray Simard

@Thomas Whipp

It establishes a precedent. Other similarly technically-challenged judges might well cite this one as the basis for a judgment, one which might well result in much harsher penalties.

Linux chief calls for FAT-free Microsoft diet

Ray Simard
Linux

It's not technology; it's attitude.

FAT came about when Billy designed the DIsk Extended BASIC for the Altair 8800 (on 8-inch, single-sided, single-density floppies, capacity 256kb). It was simple and compact enough for such small volumes, not to mention drivers simple and small enough to share elbow room with the rest of the system in a box with 16Kb of RAM. (Yes, hard to believe it. The 8080A and Z-80 had 16-bit memory addressing, hence a maximum of 64Kb of RAM accessible directly, but memory was expensive and lots of systems ran with 16K.)

I'm not sure what kind of filesystem CP/M-80 had, but when Microsoft edged out Digital Research for the contract to provide operating systems for the new IBM PC (sad story about Gary Kildall there), FAT came along with it. Quarters were still cramped. The 8086/8088 could address more RAM but still not a lot (640K I believe, hence Billy's embarrassing quote that nothing would ever need more than that), and double-sided double-density 5-1/4" floppies held somewhat less than a standard floppy does now.

So, FAT made sense then, but it's a living fossil now.

So, why not, as said here by many, scrap it for something better?

Look at Linux and NTFS. M$ has stubbornly refused to disclose even the minumum information about that filesystem needed to design a third-party driver for it. Why? It's not the kind of technology that others would seize upon and exploit competitively. It seems to me that they want to frustrate any attempt to access their media with anything not their own.

Sure, drivers for other OSes can be had, but that's only useful for user-created volume (granted, the most common case). Microsoft is not likely to start supporting any non-M$ filesystems and wherever they control the design of things, if history repeats, they will go out of their way to avoid using anything they can't control.

There are people who are pathological control freaks. The same can be true of corporations.

Microsoft eyes metered-PC boondoggle

Ray Simard
Gates Horns

Not patenting the wheel, but getting close...

Hmm... It's New Year's, not April Fool's day. Did ElReg get the date wrong or is this a serious proposal?

Unless I read this wrong, this patent has nothing to do with what software is on the computer, much less anything to do with online access. It's right at the hardware level, right? You have to pay a fee just to turn the damn thing on... LInux won't make any difference if the thing won't start marching in the first place.

"'Beyond simple activation, the user may be able to select a level of performance related to processor, memory, graphics power, etc. that is driven not by a lifetime maximum requirement, but rather by the need of the moment,' Microsoft's shameless patent application continues."

Buy the machine, then buy the right to use it?

Again, is this serious, am I reading it all wrong, or...what?

Shocker DNS spoofing vuln discovered three years ago by a student

Ray Simard

@Eric Pinkerton

> In my understanding it follows that if the UDP transaction ID is predictable, > the default TCP transaction ID is likely to follow suit, thus it is still vulnerable, > allbeit to a slighlty more sophisticated attack.

The transaction ID is part of the DNS query/response, therefore application-layer, unrelated to the underlying transport-layer protocol.

The benefit I'm suggesting is that using TCP instead of UDP, the user's computer must actually connect to the legitimate name server* and exchange the query and response with it. An attacker spewing a barrage of bogus A and Additional records from his machine located at some arbitrary IP address won't fly even if the attacker knows or guesses the transaction ID and victim's source port; the victim is not connected to it and therefore not paying any attention to it.

Also, using TCP for DNS does not require any new development; the capability has always been there. Doing this would mean simply turning off DNS via UDP.

> Better to come up with a fix tha[n] a workaround.

No disagreement there. My suggestion is far from ideal, and has costs. The plus side is that it requires no overhaul of the DNS and can be done quickly.

* This presuming the attacker does not have sufficient control of the victim's network to impersonate these connections, something very unlikely.

Ray Simard
Linux

Use TCP?

If this exploit calls for the rogue to fire bogus DNS "responses" to (possibly unrelated) queries from the rogue's machine to the victim's, then wouldn't turning DNS over to TCP exclusively go a long way toward closing up this hole?

Presuming we're talking about a victim's machine that has not already been compromised in some way, the query and response travel over a connection which must be established between the user's machine and a machine at the IP address to which the user's machine sent the query. Unless the man in the middle can proxy the victim's queries by impersonating name servers at any arbitrary addresses over the net, which implies more or less complete complete control of the victim's routing, the most he can do is observe the traffic, but not monkey with it. Or am I mistaken?

TCP does mean more overhead, but that may be a reasonable price to pay to avoid this problem. It may also be possible to restrict DNS to TCP only where attacks like this are possible, leaving trustworthy networks free to use UDP in the conventional way. I don't think the extra time to an end user whose workstation is querying DNS only by TCP is going to amount to much.

Tux, just because.

Judge grants Viacom 12TB of YouTube user records

Ray Simard
Thumb Down

Am I missing something here, or are THEY missing something?

From the article:

" 'We will ask Viacom to respect users' privacy and allow us to anonymize the logs before producing them under the court's order.'

"And it looks like Viacom will give the OK. 'The Court's recent decision has triggered concern about what information will be disclosed and how it will be used,' according to a canned statement from the company. 'Viacom has not asked for and will not be obtaining any personally identifiable information of any user.

" 'Any information that we or our outside advisors obtain - which will not include personally identifiable information - will be used exclusively for the purpose of proving our case against YouTube and Google, will be handled subject to a court protective order and in a highly confidential manner.'"

Well, then...

If all that is to be believed, then what POSSIBLE use would anyone have for IP addresses and logins? Logins would be used for...what? To identify users, what else?

IP addresses have no intrinsic relevance to content, therefore no relevance to piracy unless and until they are used to...what? To identify offenders, what else?

But then, is it that are they intending to identify only those actually guilty of illegal uploading? There's no exception for that case mentioned in the article or any of the newspaper articles I've seen. But let's suppose that is what they intend to do. Well, then...

Within 12 Terabytes of logging data there are...hmm...how many logins? And what fraction of those are the miscreants Viacom is supposedly interested in finding? And of that staggering number, what fraction do they intend to actually try to chase down? Unauthorized uploads are hardly the work of a handful of evil syndicates; they are the work of multitudes of average Joes and Janes typically connecting via residential ADSL with dynamic IP addresses. How many court orders will have to be prepared and delivered to how many ISPs, who must then retrieve records of who was using what IP address at this or that time, which means...

...once again, user identities. What else?

Sure, piracy is a serious matter. But what is YouTube? Short, low-resolution, low-quality fragments of things. Is Viacom so utterly out of touch as to really believe people who would otherwise be paying for content are going to pass on the purchase when they can see a tiny bit of it on YouTube? If anything, YouTube-type excerpts probably create more interest in buying products than interfering with it.

What on earth does Viacom plan to do with 12 Terabytes of data that won't cost them hundreds of times over what they have lost due to YouTube uploads, according to the most outlandish estimates they could possibly get away with claiming?

This has all the signs of muscle-flexing and chest-pounding, hoping to mount a high-profile case, widely reported to the masses, to intimidate the net-using public. There's no doubt some ego-driven wish on Viacom's part to prove they're bigger and badder than something like Google which, good or bad, is big stuff to be bigger and badder than. (Screw the grammar.)

Shakespeare was right. (Henry IV, Act IV, Scene 2)

[ Another thought: If Viacom can get their mitts on all this, can the RIAA, the MPAA and other similar groups on other countries be far behind? How many more times will YouTube, and perhaps others, have to fork over these data? And once that avalanche is triggered, what's all of this going to cost?]

AP may have to take on entire blogosphere

Ray Simard

79 words? Looks like fair use to me.

Such short excerpts, if properly attributed, should fit the letter and spirit of fair use nicely.

The 'blem wit' error messages

Ray Simard

Progress

So very fortunately, those days of constricted memory and disk storage are far behind us. I have not see messages like these:

"Failed to open file" (or any of numerous equally uninformative variants)

"The parameter is incorrect"

"Your socks don't match"

since, oh, last Saturday, though in all honesty, that may be because I wasn't doing anything here yesterday.

Anti-spammer fined $60K for DNS lookup 'hack'

Ray Simard
Thumb Down

Let's get real, here

Anti-spammers:

1. "Force people off hosting providers?"

How? By providing evidence of abuse to the provider resulting in the provider (the responsible ones, anyway) terminating the account under the provider's TOS?

I have yet to see evidence that an anti-spammer was able to terminate anyone's account without the consent and cooperation of the account's provider, exercising its right to decide how their own services can and cannot be used.

2. DDoS and death threats?

Well, you'll find a handful of out-of-control renegades in any cause, whatever its merit.

3. From your site: " SpamHaus is a power-controlling website that has servers set up and blocks a large percentage of spam through out the internet."

Spamhaus does not block anything. As your words are suggesting, that is not physically possible; nothing can reach out onto the Internet beyond its own systems to disturb what others are doing. The only way anything is blocked by being listed on Spamhaus is when someone CHOOSES to use Spamhaus' data to block connections to his/her OWN systems, which is their prerogative, or use filtered BGP feed, again, by choice, applied to their own domains only.

4. "also i get spam all the time to my box, its not hard to delete it :)"

Looking at the mail log on my primary MX, I see that over the past three days, zen.spamhaus.org has recognized 12,975 connection attempts from known spam sources, which were blocked because I chose to do so. And that's just the primary MX. I have yet to encounter any evidence of a false positive in the time I've used it. And I'm just a guy hosting a half-dozen domains for friends, gratis, no mega-operation, and even my pipsqueak network still gets that many bogus connection attempts.

My personal spam load, AFTER that blocking, is on the order of 400-700 items PER DAY. It IS "hard to delete it." I have much better things to do with my time.

5. "let the authorities handle the spammers..."

I can understand such notions from net newbies and non-savvies, but you don't appear to be among that number. Do you really think anyone is going to buy that?

I'm afraid you're doing more here to advance the case against yourself than anything else.

(For the record, I have no association with Spamhaus other than that I'm a satisfied and grateful user.)

Ray Simard
Thumb Down

Some items from the ruling

1. (3) "...Ritz issued a variety of commands, including host-l, helo and vrfy."

HELO? And of what kind of nefarious use is VRFY here?

2. (4) "Ritz...accomplished his access...accessing the servers via a Unix operating system and using a shell account..."

Use UNIX, go to jail. It's the law. (And it's life without parole if you use a shell account.)

"...disguised himself as a mail server..."

Meaning he conducted SMTP dialogues by hand? Machines do it; it's legal. Fingers on a keyboard do it, and it's a sin.

(5) and (6) are a bit smelly, though I don't see what kind of evil use that internal information could be used for.

(7) is mostly redundant, saying nothing new except that he acted intentionally, as if anyone might suspect he did it under control of extraterrestrials or while sleepwalking.

(8) describes the typical use of zone transfers and suggests that, since what Ritz did was not that kind of typical use, it must be bad.

(9) expands on (8) and tries to make law out of intentions: if something wasn't designed for a particular purpose, using it for that purpose must be evil.

(10) "...the literature available on the subject refers to access attempts such as the host-l command...as 'unauthorized'"

What literature? I suppose that information is available somewhere, but whatever it is, I question its validity. ESPECIALLY considering the next part of the paragraph:

"...Microsoft itself, as well as other authorities, all refer to zone transfers as...unauthorized"

"Microsoft itself?" Microsoft is an "authority," ostensibly a particularly dependable authority as implied by the "itself?" If that's this court's idea of where to look for reliable guidance in a case like this, its clue supply is woefully deficient.

Other things in this ruling are more worthy of consideration, although the description of the UDP includes three elements of which two only apply if another party is persuaded to take action at its own discretion. The sending of USENET cancel messages is more substantial.

Overall, even given the parts of this that make sensible claims against the defendant, the ignorance that pervades this ruling is appalling.

AT&T to crush copyrighted network packets

Ray Simard
Thumb Down

Self-fulfilling prophecies

With threats like this, DRM litigation feeding-frenzies, debacles like the Sony BMG rootkit, bizarre tricks ostensibly intended to restrict pirating of material and the like but actually limiting people's choices of what they can and cannot do with their own systems, people will increasingly consider themselves presumed criminals. Quite a few of those who would otherwise choose to purchase materials legitimately by their own sense of right and personal integrity will resent the label and live down to the expectations already laid upon them. Why choose to respect the monoliths that have already scorned you?

Absurdities like the $220,000-plus judgment against the woman who put some music up on file-sharing systems will polarize the public against the industries.

Treat someone like an adversary and you will make him one.

Ray Simard

Playing God

What a can of rattlesnakes this is likely to become.

Fingerprinting packets at the network level looking for the appearance of copyrighted material? Never mind if someone happens to have the right to transfer something; never mind if it's covered by fair use; never mind if the copyright claim (or conclusion of same by the fingerprinting algorithm) doesn't meet legal requrements; never mind that the accuracy of detection of "bad" traffic is likely to be highly uneven...

That old aphorism, that power corrupts and absolute power corrupts absolutely seems at work here: this reeks a lot more of lust for power and control than anything else.

Oh, to be able to resurrect the end-to-end model...

Microsoft readies Hal 9000

Ray Simard
Gates Horns

"...I"m half crazy..."

>>>> Yes, at least David Bowman knew where the key was to pull all those memory blocks. Someone, please find Microsoft's key. <<<<

Unlike Bowman, you cannot disconnect parts of the system selectively because it's all integrated with the OS. HAL has learned a new song:

"All, or nothing at all..."

Page: