MySpace Worm Creator Sentenced

Found on Slashdot on Saturday, 03 February 2007
Browse Legal-Issues

Remember Samy? The creator of the infamous worm was unfortunate enough to be the the target in MySpace's latest litigation. As was said in the earlier story, the script was "written for fun" and caused no damage. The source and technical explanation for the "attack" was not even released until after MySpace had patched the vulnerability. Apparently this was enough to get the 20 year old (19 at the time of writing the worm) three years of probation, three months of community service, pay restitution to MySpace and is also banned from the Internet. Clearly, disclosing security vulnerabilities doesn't pay.

Now this article is a little misleading: it wasn't a traditional disclosure. Instead, Samy released a (basically) harmless worm. Nevertheless, this raises questions about how companies handle disclosures, workaround and such. Some simply ignore those reports while others hand out DMCA papers to gag the researchers. Obviously all this won't make their code more secure; if anything, those who find bugs might consider selling them to phishers, scammers and spammers instead.

Confidential Microsoft Emails Posted Online

Found on Slashdot on Friday, 02 February 2007
Browse Various

From the class action 'Comes et al. v. Microsoft' suit, some very enlightening internal Microsoft emails are now made public. Emails to and from Bill Gates, Steve Ballmer, Jim Allchin, etc all make for some mind blowing reading. One of my favorites is from Jim Allchin to Bill Gates, entitled 'losing our way,' in which Allchin states 'I would buy a Mac today if I was not working at Microsoft.

Nice quote, just like "Screw Sun, cross-platform will never work. Let's move on and steal the Java language". Makes you wonder what goes on in those big companies.

Microsoft lists Vista high points

Found on The Inquirer on Thursday, 01 February 2007
Browse Software

Vista is shiny and its maker can't even come up with a decent list as to why you should care. May I suggest you take your $400 and pick a new hobby using this as seed money? You won't get a DRM infection, you won't sell your soul to licensing agreements, and you will have a computer that is actually more functional. What more do you want?

Those "7.5" arguments are the reasons why people should buy Vista? IE7: I've seen two Vista upgrades where IE didn't work, so Firefox was installed instead. Windows Sidebar: I already hated the Channels in Windows 98. Windows Aero: nothing fancy. Linux delivers transparent windows and such if you need that. Mahjong Titans: like Solitaire and Minesweeper wasn't sad enough already. Start menu search: keep your stuff organized and you won't have to search. Stay, Start menu: again, keep it organized. Control Panel Search: uhm, hello? It's totally messed up now. Windows Photo Gallery: never used that one (or Picasa for that matter). I've got other software to keep pictures organized and it's way more powerful than those two. You have to follow the links on the Inquirer's site to MS, because I didn't want to link to them.

Intel sues man over Intel name

Found on The Inquirer on Wednesday, 31 January 2007
Browse Legal-Issues

INTEL filed a legal action against Mr Sean Torongeau. Torongeau, it said, is trading as PROINTELL and that might confuse people and devalue Chipzilla's mark.

"By combining Intell with the generic and laudatory term 'pro', Defendant has caused and is likely to continue to cause confusion that Intel is the source of sponsor of Defendan'ts computer services, or that there is an association or relationship between the companies."

PROINTELL repairs computers, designs websites, hosts websites. Intel lawyers think PROINTELL will "tarnish, blur, or dilute, or likely tarnish, blur or dilute the distinctive quality of the famous Intel mark."

Intel is well known for sending out armies of lawyers if someone else uses "their" five letters. I'm waiting for the lawuit against the CIA, since "users might be confused and mix it up with the 'Central Intel-i-chance Agency'" (perhaps Apple might jump in too because of the "iChance").

Son fights back against RIAA

Found on Ars Technica on Tuesday, 30 January 2007
Browse Legal-Issues

After the RIAA dismissed its file sharing suit against Patti Santangelo last year, it decided to go after her children. Both Michelle Santangelo, age 20, and Robert Santangelo, 16, were targeted by the RIAA after the record labels determined that they were responsible for whatever file-sharing went on in the Santangelo household.

In his answer, Robert Santangelo denies the charges and demands a trial by jury, while accusing the record labels of engaging in a "wide-ranging conspiracy to defraud the courts of the United States." Santangelo also calls the labels a "cartel" that acts in collusion, violating US antitrust laws by "entering into an unlawful agreement among themselves to prosecute and to dispose of all cases in an identical manner and through common lawyers."

Indeed, Santangelo and his attorneys appear to be using every entry in the file-sharing defense playbook in this case. They argue that making music available does not constitute infringement; that the statute of limitations on the alleged infringement (which supposedly occurred five years ago) has expired; that the music industry has "enticed and encouraged children to download music for free," and that the damages sought by the RIAA are unconstitutionally excessive.

Good luck to Robert. It would be awesome if he wins against those outdated media cartels.

Vista makes me sad

Found on The Inquirer on Monday, 29 January 2007
Browse Software

MS will tell you that Vista is the next great thing in every way, it took billions of dollars to develop, millions of man-hours, and undoubtedly will be the best selling OS ever launched. The problem is that Vista brings almost nothing to the table that can't be described by as three year old as "shiny".

Let's look at it this way, ask yourself what good new features Vista brings to the table. Most will respond that it has Aero Glass, a really pretty UI. How may other things does it bring that are positives? I can't honestly think of one, and I'll bet if you ask the next ten people you run into, they won't be able to tell you any either.

Repeat the same exercise in the negative, what bad new things does Vista bring? Massive crushing DRM infections, unacceptable licence terms, bloated hardware requirements, and a list of cut features long enough to paper your bathroom.

That pretty much sums it up.

VMware releases new Converter software

Found on CNet News on Sunday, 28 January 2007
Browse Software

VMware on Monday released version 3 of Converter, its application to move software from ordinary physical computers onto virtual machines. The new version of Converter permits the process to be automated so many servers can be converted at once, lets customers clone a machine's configuration as it runs, and understands Microsoft's virtual-machine storage format so those virtual machines can be imported as well.

A new toy to play with. Although you can migrate XEN images to VMware quite easily, pushing a Windows into a virtual machine can be really tricky; but once you figured out how to mount image partitions and fix bluescreens it's not that scary anymore.

Google Blurring Sensitive Map Information

Found on Slashdot on Saturday, 27 January 2007
Browse Internet

While viewing my school (the University of Massachusetts Lowell) with Google Maps, I noticed that a select portion of the campus was pixelated: the operational nuclear research facility on campus. Curious, I attempted to view the Pilgrim Nuclear Power Plant in Plymouth, Massachusetts. It too was pixelated. What or who is compelling Google to smudge out these images selectively? Will all satellite images of facilities that the government deems 'sensitive' soon be subject to censoring?

Yesterday, Google admitted that censoring in China was a bad idea, and now this. Terrorists who are unsure if an object is worth to be bombed, they simply have to check Google; if it's blured, hit it.

Intel succumbs to the allure of Vista Aero Glass

Found on The Inquirer on Friday, 26 January 2007
Browse Software

We had a chance to chat with Josh Newman, Intel's chipset product marketing director, and he claimed that G965 as well as 945G and 945GM run Vista Aero "beautifully".

Intel believes that Aero Glass is an "exciting new user interface". It is supported by Intel 945 and 965 products and has "the highest quality drivers available" to run "Aero interface beautifully today".

Sometimes we wonder whether the poor hardware vendors are all being led by the nose in some sort of Microsoft cattle market, but that's just a view.

I guess I'll never understand why everybody seems to freak out about a simple user interface. Especially when it seems to be the main sale argument for a new OS.

MySpace Allegedly Kills Security Website

Found on Wired on Thursday, 25 January 2007
Browse Censorship

Computer security guru Fyodor (pictured) reports waking up yesterday to find his website SecLists.org essentially removed from the web by his domain registrar, GoDaddy. After a bunch of phone calls to GoDaddy, he eventually got them to explain why: Because MySpace asked them too.

MySpace was apparently unhappy with a post that crossed Full Disclosure earlier this month, in which the author attached the spoils of a phishing attack against MySpace users, consisting of 56,000 user names and passwords.

These lists have surfaced in the security community before, allowing the white hats to see the data that the black hats have swindled out of unsuspecting users. Bruce Schneier did a fascinating analysis of an earlier MySpace password list in his Wired News column last month.

That was totally wrong on so many levels. It's not GoDaddy's business to block domains just because MySpace sends them an email. What happens if all the other "I don't like that posting" trolls start doing the same? Will GoDaddy roll over again or ignore them because they aren't a big player? MySpace might have good intentions, but the passwords are out. Those who want them already have them; they won't need to copy them from a website. They have to do damage control, and that does not mean to force down websites. It means notifying the affected users, blocking those accounts until the owners re-activate them from their personal email and educate them more about phishing. Additional material can be found at Seclist and another Wired entry.