Caught in the Network

Found on Chronicle.com on Thursday, 08 February 2007
Browse Internet

At 9:15 one Thursday morning, there came a polite knock on my mostly closed office door.

I recognized the speaker as a network-security technician in my university's office of information-technology services. The other men were not familiar, but a quick glance at their cards told me they were detectives on our campus police force. They closed my office door behind them, sat down, took out notepads and pens, and asked if I had a few minutes to speak with them about Tor.

My reason for downloading and installing the Tor plug-in was actually simple: I'd read about it for some time, was planning to discuss it in two courses I teach, and figured I should have some experience using it before I described it to my students. The courses in question both deal with controlling technology, diffusing it throughout society, and freedom and censorship online.

When I cover online censorship in countries with no free press, I focus on how those countries rely on hardware, software, and phalanxes of people to make sure citizens can reach only government-approved media. Crackdowns on independent journalists, bloggers, and related dissidents all too often result in their being beaten, incarcerated, or worse. Technologies like Tor represent a beacon of freedom to people in those countries, and I would be doing my students a disservice if I didn't mention it.

Nonetheless, my visitors made two requests: that I stop using Tor, and that I avoid covering it in class.

Officials should not be surprised. After all, more and more laws try to remove your privacy, turning you into a glass citizen. Naturally, quite a few people are not happy with that. Today, you're already suspicious if you keep your life private. Quite scary.

GOP revives ISP-tracking legislation

Found on CNet News on Wednesday, 07 February 2007
Browse Internet

All Internet service providers would need to track their customers' online activities to aid police in future investigations under legislation introduced Tuesday as part of a Republican "law and order agenda."

Employees of any Internet provider who fail to store that information face fines and prison terms of up to one year, the bill says. The U.S. Justice Department could order the companies to store those records forever.

Rep. Lamar Smith of Texas, the top Republican on the House Judiciary Committee, called it a necessary anti-cybercrime measure. "The legislation introduced today will give law enforcement the tools it needs to find and prosecute criminals," he said in a statement.

Because there is no limit on how broad the rules can be, Gonzales would be permitted to force Internet providers to keep logs of Web browsing, instant message exchanges, or e-mail conversations indefinitely.

That broad wording also would permit the records to be obtained by private litigants in noncriminal cases, such as divorces and employment disputes. That raises additional privacy concerns, civil libertarians say.

"Law and Order Agenda"? Sounds more like a police state. You're suspicious by default, especially when you use security measures such as SSL encryption, TOR routing, PGP/GnuPG email or crypto plugins for your IM client. Fact is that ridiculous regulations like that only make people want to use encryption more and more. There may be nothing to hide, but that doesn't mean that everybody can snoop around in your life.

Google Blurring Sensitive Map Information

Found on Slashdot on Saturday, 27 January 2007
Browse Internet

While viewing my school (the University of Massachusetts Lowell) with Google Maps, I noticed that a select portion of the campus was pixelated: the operational nuclear research facility on campus. Curious, I attempted to view the Pilgrim Nuclear Power Plant in Plymouth, Massachusetts. It too was pixelated. What or who is compelling Google to smudge out these images selectively? Will all satellite images of facilities that the government deems 'sensitive' soon be subject to censoring?

Yesterday, Google admitted that censoring in China was a bad idea, and now this. Terrorists who are unsure if an object is worth to be bombed, they simply have to check Google; if it's blured, hit it.

Spam is back, and worse than ever

Found on Red Tape Chronicles on Sunday, 21 January 2007
Browse Internet

Not long ago, there seemed hope that spam had passed its prime. Just last December, the Federal Trade Commission published an optimistic state-of-spam report, citing research indicating spam had leveled off or even dropped during the previous year.

Instead, it now appears spammers had simply gone back to the drawing board. There's more spam now than ever before.

There are 62 billion spam messages sent every day, IronPort says, up from 31 billion last year. Now, spam accounts for three of every four e-mails sent, according to another anti-spam firm, MessageLabs.

Image spam is a big part of the resurgence of unwanted e-mail. By using pictures instead of words in their messages, spammers are able to evade filters designed to detect traditional text-based ads.

Spotting spam before you open it is a plus -- sometimes spam messages contain small images that report back to the sender as soon as a message is opened, teaching the spammer that your e-mail address is valid. More spam is sure to follow.

There's always the option to create a "temporary failure" during email transfer (or simply break the transmission) when your mailserver realizes it's receiving an email including an image that is less than 100kB. Spammers have to pump out as much as possible and cannot afford to deal with error messages, unlike valid mailservers. They also can't make the images too big, since this will also slow down their system. Personally, I think about simply rejecting everything with an inline image; attachements don't seem to be interesting for a spammer so far (only for trojan spams, but good virus filters take care of that).

Senators aim to restrict Net, satellite recording

Found on CNet News on Sunday, 14 January 2007
Browse Internet

Satellite and Internet radio services would be required to restrict listeners' ability to record and play back individual songs, under new legislation introduced this week in the U.S. Senate.

The rules are embedded in a copyright bill called the Platform Equality and Remedies for Rights Holders in Music Act, or Perform Act, which was reintroduced Thursday by Sens. Dianne Feinstein (D-Calif.), Lindsey Graham (R-S.C.), Joseph Biden (D-Del.) and Lamar Alexander (R-Tenn.).

But the measure goes further, taking aim at portable satellite radio devices, such as XM Satellite Radio's Inno player, that allow consumers to store copies of songs originally played on-air. The proposal says that all audio services--Webcasters included--would be obligated to implement "reasonably available and economically reasonable" copy-protection technology aimed at preventing "music theft" and restricting automatic recording.

The Recording Industry Association of America applauded the effort and urged Congress to make passing the legislation a top priority this year.

"We love satellite radio," RIAA CEO Mitch Bainwol said in a statement. "But this is simply no way to do business. It's in everyone's best interest to ensure a marketplace where fair competition can thrive."

Oh yes, I bet they love satellite radio. In fact, they love it so much that they sued XM. Hopefully this bill won't make it; and if it does (after all, the industry pressures it) perhaps streaming services will move out of the US into more friendly and less restrictive nations.

BitTyrant questions assumptions about BitTorrent

Found on Linux.com on Monday, 08 January 2007
Browse Internet

The theory around BitTorrent is that all peers upload as well as download, in roughly equal amounts. The more upload capacity you contribute, the more download capacity you enjoy, in effect leveling the playing field for folks on high-speed and slow-speed connections.

The UW researchers studied real-world BitTorrent swarms, and found the field anything but level. Peers on high-speed connections contribute considerably more than they receive. And we are not talking about generosity of spirit or continuing to seed a torrent after the download has completed; the study shows that -- using typical client settings -- faster peers do not download data as fast as they upload it.

By modifying the popular GPLed client Azureus, the authors of the study created a BitTorrent client named BitTyrant. BitTyrant tries to choose peers intelligently instead of randomly, favoring those that are already operating at an upload/download equilibrium and attempting to maintain connections with active peers.

Nevertheless, it has been described as a "selfish" client, leading some bloggers to denounce it in terms usually reserved for malicious hacks and hostile attacks. By not treating all members of the swarm equally, BitTyrant does offer personal gain at the expense of others.

But wait, says the UW team, the study data shows that without BitTyrant, high-speed users are the ones getting the unfair treatment. So you can't just say "we should ban BitTyrant because it behaves unfairly."

Yes, it really matters so much if I'd have to wait 5 more minutes to finish a download of several gigabytes. Life is so unfair. Let's face it: most of those who complain about unfair treatment are those leechers who want to get a "backup" of the latest DVD releases. In the end it's up to the tracker operators to decide if they want to ban this client.

Microsoft bans Scroogle

Found on The Register on Sunday, 07 January 2007
Browse Internet

Microsoft's MSN Messenger service doesn't want you talking dirty - and its definition of dirty talk is quite peculiar.

If you send an instant message containing the word "scroogle.org" via the Microsoft service, the message never arrives. The sender doesn't know it was discarded, and the recipient has no indication that it was ever sent, as the original message remains in the chat window and history.

Scroogle.org is Daniel Brandt's Google scraping proxy. Scroogle scrapes Google's website to return its search results without ads - bypassing the Google cookie, and protecting the user's privacy. Google is unable to match the searches to any other information. Scroogle makes around 50,000 scrapes per day. As Google has failed to challenge the legality of the service, it's an odd choice of domain for Microsoft to ban.

Or perhaps Microsoft thinks its protecting us from filth - the company has made strange and arbitrary decisions before.

So perhaps "scroogle" refers to some bizarre sexual practice, or, in some arcane vernacular, is a term for the genitalia. If that's true, it's not in Roger's Profanisaurus [probably NSFW], which we regard as the definitive resource in these matters.

MSN isn't the only one here. A few months ago, ICQ refused to deliver any URL I tried to send. However, it was limited to a short time and one recipient only, so who knows what caused it.

Department of Defense Blocking HTML Email

Found on Slashdot on Saturday, 23 December 2006
Browse Internet

The Department of Defense (DoD) has taken the step of blocking HTML-based email. They are also banning the use of Outlook Web Access email clients. The DoD is making this move because HTML messages can easily be infected with spyware and executable lines of code that enable hackers to access DoD networks, according to an article in Federal Computer Week by Bob Brewin .

Although it's a bit weird that DoD employees don't know how to deal with emails it still isn't a bad idea.

Thinking ahead of the spammers

Found on The Inquirer on Tuesday, 19 December 2006
Browse Internet

Chasin's background is in computer security; he was also founder, in 1995, of usa.net, the first Web-based email provider. He has spent 11 years watching the spam battles. This last round, the spammers have clearly won. Spam volume always takes a leap upward in late autumn, but this year seems particularly bad.

This year's big innovation: "pump-and-dump image stock spam". You've seen them: inline GIFs above a lot of useless text. The real spam message is the words in the GIF, which advise you to buy some stock or other.

Some 80 percent of spam originates from botnets – megagangs of virus-infected PCs controlled remotely. "This is probably the biggest threat to the Internet since it was created and commercialised. I say this because the botnets have multipurpose payloads. They're polymorphic. We're seeing queen bots, where they can essentially infect a PC and then monitor the anti-virus signature engines and time their propagation."

Sooner or later we need a new email protocol. The current one was never designed to deal with spam.

Yahoo's IM update: A Trojan horse of surprises

Found on CNet News on Saturday, 16 December 2006
Browse Internet

Yahoo said late Friday that it has fixed a bug in its newest version of Yahoo Messenger that changed a user's mail preferences without his or her consent.

By default, the software also inserts the Yahoo Toolbar into the user's Web browser and changes the user's personalized home page and search settings to Yahoo.com. In the original download alert, people could choose to customize the installation under "options" and then uncheck these default settings. What users couldn't change, however, was that the software was adding a Yahoo Mail icon to the system tray and changed their default mail settings to Yahoo Mail.

Yahoo's Karlsten had said the engineering team was not aware of the Yahoo Mail issue and was actively working on a fix.

That's why you should use multi-protocol clients. You may not get each and every function, but it saves you resources and unwanted installs.