Visitors to the US have to register online

Found on The Inquirer on Monday, 12 January 2009
Browse Various

Visitors to the former British colony of Virginia will have to undergo a further humiliation of registering online.

Normally they would be able to visit under the US Visa Waiver Program but now they will have to apply online for an Electronic System of Travel Authorisation before boarding a plane to the Land of the Free.

I wonder how much this helps. After all, some of the 9/11 terrorists had their flight training inside the US. Plus, as a terrorist, you don't go around and put your name onto every "do not let pass" list. Those sleepers had perfectly normal lives; even today they still could get tickets to the US.

RIAA Just Can't Seem To Stop The Momentum On Filing Lawsuits

Found on Techdirt on Sunday, 11 January 2009
Browse Legal-Issues

On December 19th, it was announced that the RIAA was giving up on its legal strategy of suing individual file sharers, and instead was going to go with some mysterious agreements with ISPs.

Of course, now it's looking even worse, as on December 26th, well after it announced an end to the lawsuits, and insisted no more were going to be filed, a new lawsuit was served on an individual for file sharing.

As if they ever said the truth before. They are nothing much more than a bunch of liars; that's not even an insult since it has been proven numerous times.

Reply-all e-mail storm hits State Department

Found on Associated Press on Saturday, 10 January 2009
Browse Internet

Many "reply all" fiascos result in mere embarrassment, but American diplomats have been told they may be punished for sending mass responses after an e-mail storm nearly knocked out one of the State Department's main electronic communications systems.

He said the result was "effectively a denial of service as e-mail queues, especially between posts, back up while processing the extra volume of e-mails."

MTAs have an option to set a limit for CC/BCC for some reason. For the admin, it's just a simple setting and it won't happen again. Plus, deactivating CC might also be a really good idea since most people are not aware of the problems they create by mailing the latest "joke" to everybody they know; pumping all your friends addresses through the net raises the chances for them to get spam drastically.

Storm Worm botnet meets its match

Found on The Inquirer on Friday, 09 January 2009
Browse Internet

Georg Wicherski, Tillmann Werner, Felix Leder and Mark Schlösser have developed software which they have partially disclosed claiming that they can rapidly eliminate the Storm Worm botnet.

However, there is a problem with this discovery. The team has not yet tested this on a real Storm Worm botnet because it might face legal issues in doing so.

Although legal issues would only come up if someone complained, which no one likely would, they are still unable at present to go ahead with eliminating the botnet.

Sometimes you're simply baffled by the twisted ways of law and order.

6-Year-Old Says Grand Theft Auto Taught Him To Drive

Found on Slashdot on Thursday, 08 January 2009
Browse Various

A six-year-old who recently stole his parents' car and drove it into a utility pole has passed the buck onto a familiar scapegoat: the video game, Grand Theft Auto.

However, not as of yet has anyone under the age of, oh, ten, blamed the game for a car theft.

So far, nobody has thought about sueing the parents for letting their kid play a game that's restricted to adults only? Of course it is easier to blame someone else, but seriously.

Microsoft begins Windows 7 push

Found on BBC News on Wednesday, 07 January 2009
Browse Science

The first public trial, or beta, version of Windows 7 has been released.

Although Windows 7 was a trial version it was, said Mr Ballmer, almost "feature complete" and would help to re-define the way people thought of the software.

Instead of it being an operating system mainly associated with a PC, he said, Windows was becoming a "connected platform and experience".

What a quick death for Vista, after being on the market for just two years.

Google Named No. 3 Spam Provider

Found on eWEEK on Tuesday, 06 January 2009
Browse Internet

New forms of spam and similar abuse find a welcome home at Google, and the company doesn't yet seem up to the security task of fighting them.

Spammers have had success cracking the CAPTCHA tests and creating Gmail accounts from which to spam. Because the spam comes from a domain reputation systems can't block because it's so popular, spam from these accounts has an advantage in getting past many anti-spam systems.

Spamhaus should treat Google like every other email provider: if too much spam comes from the systems, list it. Yes, Gmail is large, but Google will be forced to act when it has to realize that it cannot be a safe place for spammers.

NIN's CC-Licensed Best-Selling MP3 Album

Found on Creative Commons on Monday, 05 January 2009
Browse Filesharing

Aside from generating over $1.6 million in revenue for NIN in its first week, and hitting #1 on Billboard's Electronic charts, Last.fm has the album ranked as the 4th-most-listened to album of the year, with over 5,222,525 scrobbles.

Even more exciting, however, is that Ghosts I-IV is ranked the best selling MP3 album of 2008 on Amazon's MP3 store.

NIN fans could have gone to any file sharing network to download the entire CC-BY-NC-SA album legally. Many did, and thousands will continue to do so.

The next time someone tries to convince you that releasing music under CC will cannibalize digital sales, remember that Ghosts I-IV broke that rule, and point them here.

I'm already awaiting the RIAA statements on this one...

Police set to step up hacking of home PCs

Found on Times Online on Sunday, 04 January 2009
Browse Legal-Issues

The Home Office has quietly adopted a new plan to allow police across Britain routinely to hack into people's personal computers without a warrant.

The strategy will allow French, German and other EU forces to ask British officers to hack into someone's UK computer and pass over any material gleaned.

Police might also send an e-mail to a suspect's computer. The message would include an attachment that contained a virus or "malware". If the attachment was opened, the remote search facility would be covertly activated. Alternatively, police could park outside a suspect's home and hack into his or her hard drive using the wireless network.

Setting aside that this is a drastic violation of personal freedom and privacy, it won't really help much and just adds more surveillance to the Orwellian nation. Bot-herders and the VX scene have been using the attachment trick for so long enough that everybody should realize the dangers of opening every attachments (I wonder how they plan to infiltrate Linux desktops). Also, secure your wireless network if you really need it. Most people use wireless (because it's oh so cool) when a piece of CAT5 cable would do the same (in fact it does better); and a cable is a tad harder to sniff.

MD5 Hack Interesting, But Not Threatening

Found on SecurityFocus on Sunday, 04 January 2009
Browse Computer

Considering that it took the original researchers four tries over at least a month to successfully accomplish their attack against the RapidSSL brand, we're fully confident that no malicious organization had the opportunity to use this information against RapidSSL, or any other certificate authority authorized by VeriSign.

As it happens the most expedient and safest method of mitigating the attack was to switch it out for SHA-1. We had been planning this migration to occur on RapidSSL in January 2009 anyway, so we had a high degree of confidence in accelerating that deployment.

For a migration that's been planned for years, several things are surprising: first of all, the switch to SHA-1, which has already been broken in theory and is not recommended as a secure hashing algorithm since 2005. Instead, they could have switched to the highest level of the SHA-2 class, SHA-512. Also, VeriSign was able to switch from MD5 to SHA-1 "about four hours later". Impressive for a migration that took years of planning. If it was so complex and scheduled for the end of January, how come it was so fast to switch? Especially on a rather sudden notice. I'm not saying that VeriSign is lying, but things like these just catch your attention. No matter if that's just PR talk or really a lucky coincidence: switching was good. Not perfect, but good.