Security flaw turns Gmail into open-relay server

Found on Ars Technica on Saturday, 10 May 2008
Browse Internet

A recently-discovered flaw in Gmail is capable of turning Google's e-mail service into a highly effective spam machine.

An e-mail from johdoe@awinnerisyou.com (or the corresponding IP address block) may be automatically blocked by any given e-mail service, while an e-mail from a trusted, authenticated source such as Gmail is automatically allowed through the gateway.

E-mail sent to Yahoo and Hotmail from a blacklisted IP didn't even necessarily reach the account's spam box, while forged e-mail sent via Gmail always arrived in the intended account's inbox.

The question is why to trust Gmail more than others at all. If large volumes of spam originate from Google servers, put them on RBL's, just like every other spam source.

China behind recent hack attacks, says Indian government

Found on Ars Technica on Monday, 05 May 2008
Browse Internet

The Times of India has accused Chinese hackers, allegedly backed by the Chinese government, of systematically attacking Indian online assets over the past 18 months.

India's relatively friendly relationship with China may have grown a bit more tense of late thanks to the recent Chinese crackdown in Tibet. India is home to the largest group of Tibetan refugees in the world, including the Dalai Lama's government-in-exile.

I didn't know hacking was part of the olympic games.

Radiohead won't repeat 'In Rainbows' giveaway

Found on CNet News on Tuesday, 29 April 2008
Browse Internet

Radiohead made it official: the band won't be giving away music like it did with the album In Rainbows.

Many music fans had hoped that the band's now famous pay-what-you-want promotion was an attempt by the group to discover a new way to sell music. Now it appears Radiohead at best was after publicity.

Nine Inch Nails, led by Trent Reznor, followed Radiohead by offering the digital version of the album Ghosts I-IV for free as well as charging for premium versions. Reznor said last month that to that point the album had generated 781,917 transactions and $1.6 million.

"I think the way (Radiohead) parlayed it into a marketing gimmick has certainly been shrewd," Reznor said.

Funny, they offererd their work for free and now complain that a lot of people did not pay anything. Welcome to reality.

US Department of Justice banned from Wikipedia

Found on The Register on Monday, 28 April 2008
Browse Internet

Wikipedia has temporarily blocked edits from the US Department of Justice after someone inside the government agency tried to erase references to a particularly-controversial Wiki-scandal.

The DoJ did not respond to our requests for comment. But odds are, the edits were made by a single individual acting independently. Wikipedia's ban on the department's IP is due to be lifted today.

Political warfare on Wikipedia. Probably just one of the rare cases where it was noticed.

Hand-coding HTML is still hip says NY Times Design Director

Found on CNet News on Sunday, 27 April 2008
Browse Internet

It warmed my heart to see Khoi Vinh, Design Director for the NY Times state that they still write HTML code by hand.

It's our preference to use a text editor, like HomeSite, TextPad or TextMate, to "hand code" everything, rather than to use a wysiwyg (what you see is what you get) HTML and CSS authoring program, like Dreamweaver. We just find it yields better and faster results.

My point exactly. Today people try to click together something in whatever CMS system and end up with sloppy bloated code.

China becomes world's largest Internet population

Found on Reuters on Thursday, 24 April 2008
Browse Internet

China has surpassed the United States to become the world's largest Internet-using population, reaching 221 million by the end of February, state media said on Thursday.

Internet censorship is common in China, where the government employs an elaborate system of filters and tens of thousands of human monitors to survey surfing habits, surgically clipping sensitive content.

News from China? Seriously, who will believe anything the state media says? It's just a ministry of propaganda, pardon me, "Ministry of Truth".

FBI wants to move hunt for criminals into Internet backbone

Found on Ars Technica on Thursday, 24 April 2008
Browse Internet

But while Fusion Centers centralize law enforcement efforts, they do not centralize the criminal activity. There are places, however, where such activity is centralized: the backbone hubs located in hosting facilities across the country. All of the Internet's activity, legal and illegal, flows through these "choke points," and the feds, of course, are already tapping those points and siphoning off data.

What Mueller wants is the legal authority to comb through the backbone data that is already being siphoned off by the NSA in order to look for illegal activity.

I want to point out that this centralization of legal and illegal activity at network hubs will be a persistent part of all of our lives as we live more and more of them online. Thus the government's desire to tap those hubs and filter them for criminal and hostile activity will never go away.

Of course, and if you put a GPS sender on every civilian, you'll be able to hunt criminals more efficiently because you always know where everybody is and was. However, at the same time, you put million of people under suspicion. You have to treat every single person as a possible criminal; in essence, you need to create a police state. Everybody agrees that China violates the basic rights for personal freedom and expression, but in the end, the FBI plans to do the same: monitoring everything what the people it should protect are doing. In the beginning, they will justify it with the fight against terrorism and child porn. Then drug trafficking. Then murder. Then fraud. Then speeding tickets. This would be the birth of Mutivac (from Isaac Asimov).

BT's 'illegal' 2007 Phorm trial profiled tens of thousands

Found on The Register on Sunday, 13 April 2008
Browse Internet

BT's covert trial of Phorm's ISP adware technology in summer 2007 involved tracking many thousands more customers without their knowledge than previously reported, it's emerged.

Today Phorm said the 2007 trial was actually performed on "tens of thousands" of lines. It refused to provide a specific figure, but at the absolute least there are 38,000 BT Retail customers unaware their communications have been allegedly criminally intercepted in the last two years. The number could be as high as 108,000.

Don Foster MP, a Liberal Democrat who has taken a lead in parliament over the Phorm controversy, has called on BT to reveal the details of its allegedly illegal action.

Phorm and BT say their lawyers told them the trials were legal, but won't say why.

I wonder where BT and Phorm got their so-called lawyers from. Even if you only grew up with daily-soap criminal series you should know by now that it's not really that legal to eavesdrop on people. The fact that even law enforcement needs a judge to permit tapping into a line should have made them think a little.

Network Solutions hijacks customer sub-domains for ad fest

Found on The Register on Thursday, 10 April 2008
Browse Internet

Shameless domain registrar and web hoster Network Solutions is hijacking its customers' sub-domains, filling these pilfered pages with a sea of money-making ad links.

Betteridge hosts GotGame with "NetSol," and somewhere along the way, he realized that his unused GotGame sub-domains resolved to ad-infested "parking" pages.

Yes, you can opt out this questionable program. But first you have to know about it. The EULA housing the above paragraph is 59,000 words long.

Of course, this isn't nearly as bad the company's domain front running scam. Which it continues to call a "security measure."

Just get a decent registrar and hoster. It's not that complicated to move a domain and the webspace around these days. Any slightly intelligent provider should be able to do this.

ISPs Using "Deep Packet Inspection" on 100,000 Users

Found on Slashdot on Friday, 04 April 2008
Browse Internet

Some Internet Service Providers (ISP) have been using deep-packet inspection to spy on the communications of more than 100,000 US customers. Deep packet inspection allows the ISP to read the content of communications including every Web page visited, every e-mail sent and every search entered, in short every click and keystroke that comes down the line. The companies involved assert that customers' privacy is protected because no personally identifying details are released, but they make money from advertisers who use the information to target their online pitches.

Goodbye trust, hello encryption. It would be interesting to know if this is legal at all. Basically it's as if the postman reads your letters and tells everybody about what you send and receive, just without mentioning your name. They should ask AOL about "no personally identifying details"; they released a list of search queries where the usernames had been replaced with numbers. However, it turned out that it was possible to find out who was behind some of those numbers, thanks to the content of the queries. So much for privacy.