Tuesday, May 11, 2010

What? A Supreme that understands Copyright? Expect massive resistance!

http://politics.slashdot.org/story/10/05/11/0229229/Hollywood-Nervous-About-Kagans-Fair-Use-Views?from=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Slashdot%2Fslashdot+%28Slashdot%29

Hollywood Nervous About Kagan's Fair Use Views

Posted by kdawson on Tuesday May 11, @08:09AM

Of the many commentaries and analyses springing up about Obama's Supreme Court nominee, this community might be most interested in one from the Hollywood Reporter. Reader Hugh Pickens notes that Hollywood may have reason to be nervous about the nomination of Elena Kagan to be the next US Supreme Court justice.

"As dean of Harvard Law School from 2003 to 2009, Kagan was instrumental in beefing up the school's Berkman Center for Internet & Society by recruiting Lawrence Lessig and others who take a strongly liberal position on fair use in copyright disputes. And Kagan got an opportunity to showcase her feelings on intellectual property when the US Supreme Court asked her, as US Solicitor General, to weigh in on the big Cablevision case. 'After Cablevision announced in 2006 that it would allow subscribers to store TV programs on the cable operator's computer servers instead of on a hard-top box, Hollywood studios went nuts, predicting that the days of licensing on-demand content would be over,' writes Gardner. Kagan's brief compared remote-storage DVRs to VCRs (PDF), brought up the Sony/Betamax case, and lightly slapped Cablevision on the wrist for not making fair use a bigger issue. 'It sounds to us like Kagan would love the Court to determine when customers have a fair-use right to copy, which should cheer those on the copy-left at the EFF, and worry many in the entertainment industry.' On the minus side, Kagan has surrounded herself with entertainment industry advocates in the Justice Department."



I use these articles in my Risk Management class to provide a rough estimate of the costs of a security failuer.

http://www.databreaches.net/?p=11584

Heartland breach expenses pegged at $140M — so far

May 10, 2010 by admin

Jaikumar Vijayan reports:

The costs to Heartland Payment Systems Inc. from the massive data breach that it disclosed in January 2009 appear to be steadily adding up.

Quarterly financial results released by Heartland last week show that the card payment processor has accrued $139.4 million in breach-related expenses. The figure includes a settlement totaling nearly $60 million with Visa, another of about $3.5 million with American Express and more than $26 million in legal fees.

Read more on Computerworld.


(Related) I might mention this in my Risk Analysis class, but this type of publication is to remind Management that the government really does require a risk analysis.

http://www.databreaches.net/?p=11578

OCR drafts guidelines for security risk analysis

May 10, 2010 by admin

Mary Mosquera reports:

The Health & Human Services Department published draft guidance to help healthcare providers and payers figure out what is expected of them in doing a risk analysis of their protected patient health information.

The security rule of the Health Insurance Portability and Accountability Act (HIPAA) requires that providers, payment plans and their business associates perform a risk assessment, but does not prescribe a method for doing so, according to draft guidance from HHS’ Office of Civil Rights (OCR). The HITECH Act directed that OCR oversee health information privacy.

[...]

More information about risk analysis is online here.

Read more on Government Health IT.



“If ISPs can search for Copyrighted music and video they can search for anything.” But if my prediction of small, neighborhood ISPs is correct, the costs (esp. liability for failure) would make them impossible.

http://www.pogowasright.org/?p=10003

Ca: Government Reintroduces ISP Child Pornography Reporting Bill

May 10, 2010 by Dissent

Michael Geist writes:

The Government has reintroduced a bill designed to require providers of Internet services to report incidents of child pornography. The bill was introduced as Bill C-58 last year. I discussed the bill here. The new bill is Bill C-22.


(Related) Searching everyone's email for evidence of crime. Gosh, next they'll want to frisk you before you get on a plane... Oh, wait...

http://www.pogowasright.org/?p=10000

Data retention challenged by Digital Rights Ireland

May 10, 2010 by Dissent

Jim Kollock writes:

Following rulings in Germany, Bulgaria and Romania that the Data Retention Directive is unconstitutional, Digital Rights Ireland have been given permission to challenge it in the European Court of Justice.

The Directive requires your ISP to record details of what emails you send to whom, along with the IP address given to your Internet account, and what times you connect and disconnect. The information is meant to be stored in case of investigations into serious crime, but groups such as DRI and ORG argue that it amounts to a form of mass surveillance and an abuse of our right to privacy.

Read more on ORG.



Germany used bank records stolen from Switzerland. Looks like that set a bad precedent. (and how do you tell “stolen” documents from “fake” documents? How would you establish a chain of custody?)

http://www.pogowasright.org/?p=10018

Tchenguiz brothers appeal for right to use stolen documents in divorce

May 10, 2010 by Dissent

Divorces are getting really nasty over in the UK. Now in today’s news, another divorce case, this one involving the use of stolen documents. Frances Gibb reports:

Two brothers who stole 20,000 documents to help their sister in her divorce from her multimillionaire husband lodged a landmark appeal yesterday for the right to use them to expose the true state of his finances.

In a keenly-watched test case that will determine the behaviour of divorcing spouses the property tycoons Robert and Vincent Tchenguiz claim that they should not have to hand back the stolen data, which equates to more than 800 lever arch files.

Read more in Times Online.


(Related) This looks to be a new sport for AGs. Pick a technology and claim to be protecting the public by suing them. Easy win (settlement) but does little or nothing to safeguard the public.

http://www.pogowasright.org/?p=10022

Arkansas AG has privacy concerns about Spokeo.com

May 10, 2010 by Dissent

From the press release:

An Internet site that aggregates personal information from public sources is causing privacy concerns for consumers across the country. Spokeo.com displays personal information many people are not comfortable with [but they put it on the Internet themselves... Bob] being publicly available on a widely accessible search site. It is one of many similar web sites. Arkansas Attorney General Dustin McDaniel reminds Arkansans today of the importance in protecting your privacy on the Internet.

Spokeo.com publishes data, including such personal information as an email address, full name, phone number, names of family members and photographs for free. For an additional fee, site users can access home addresses and even aerial photographs of private residences.

“Much of the information posted on web sites such as Spokeo.com is obtained from public sources such as courthouse records. This information is, and always has been public information available to all,” McDaniel said. “The difference with these web sites is that information from a variety of disparate sources is aggregated, collated, and presented in one place. It’s like pieces of a puzzle put together. The result is that consumers enjoy less privacy, [The result is that technology makes gathering this data easier. Bob] and that is understandably shocking.”

According to Spokeo’s privacy policy, all data collected is publicly accessible from outside, original sources. The aggregator matches information it gathers from social networking sites, phone books, real estate listings and other online databases with an e-mail address. It then sells the compiled information to interested parties

While Spokeo does provide personal information on individual consumers, their site is only as reliable as an original information source. [and perhaps therein lies the solution. Bob (or in some cases, Irving, Waldo or George)] Spokeo claims that it does not display original information nor provide social security numbers, bank account information or any other information not already publicly available.

Source: Arkansas Attorney General Dustin McDaniel



A resource for forensics and e-Discovery

http://www.makeuseof.com/tag/10-websites-download-older-versions-software/

10 Websites To Download Older Versions Of Software



For my website students

http://www.webmonkey.com/2010/05/embed-videos-in-your-web-pages-using-html5/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+wired%2Findex+%28Wired%3A+Index+3+%28Top+Stories+2%29%29

Embed Videos In Your Web Pages Using HTML5

Monday, May 10, 2010

Once again I redundantly repeat my reiteration.

http://www.pogowasright.org/?p=9991

No reasonable expectation of privacy in subscriber info with ISP – court

May 10, 2010 by Dissent

From FourthAmendment.com:

An FBI Agent trolling in a Yahoo! child pornography chat room was able to tell that “markie_zkidluv6″ had uploaded child porn. An administrative subpoena was served on Yahoo! for the subscriber information, and information was used to get a search warrant for Bynum’s a/k/a “markie_zkidluv6″’s house. There manifestly is no reasonable expectation of privacy in one’s subscriber information with an internet service provider.

From the opinion:

Bynum voluntarily conveyed all this information to his internet and phone companies. In so doing, Bynum “assumed the risk that th[os]e compan[ies] would reveal [that information] to police.” Smith v. Maryland, 442 U.S. 735, 744 (1979). Moreover, Bynum deliberately chose a screen name derived from his first name, compare “markie_zkidluv6″ with “Marques,” and voluntarily posted his photo, location, sex, and age on his Yahoo profile page.

Even if Bynum could show that he had a subjective expectation of privacy in his subscriber information, such an expectation would not be objectively reasonable. Indeed, “[e]very federal court to address this issue has held that subscriber information provided to an internet provider is not protected by the Fourth Amendment’s privacy expectation.”

The case is United States v. Bynum, 08-4207 (4th Cir. May 5, 2010). Read more about it on FourthAmendment.com.



Wasn't “double think” one of the tools of government in “1984?”

His mind slid away into the labyrinthine world of doublethink. To know and not to know, to be conscious of complete truthfulness while telling carefully constructed lies, to hold simultaneously two opinions which cancelled out, knowing them to be contradictory and believing in both of them, to use logic against logic, to repudiate morality while laying claim to it, to believe that democracy was impossible and that the Party was the guardian of democracy.

http://www.pogowasright.org/?p=9983

UK: Internet cafe surveillance ‘security theatre’

May 9, 2010 by Dissent

David Canton writes:

Internet cafes in the United Kingdom are the latest victims of privacy invasive counter$terrorism measures. Scotland Yard recently asked Internet cafe owners to monitor customers’ use of public computers. The authorities are encouraging owners to check activity on their computers and keep an eye on any suspicious activity.

Yet police say it’s not about asking Internet cafe owners to spy on their customers.

These measures seem unreasonable and privacy invasive, and are likely to be ineffective.

Read more on Canoe.


(Related) A tool in case I ever teach a class like “Stalking for fun and profit?” Another “Facebook Feature?”

http://www.killerstartups.com/Video-Music-Photo/tubin-us-learn-who-watches-what-online

Tubin.us - Learn Who Watches What Online

http://tubin.us/

Has it ever happened to you that you shared a YouTube link full of enthusiasm with somebody only to discover later on that the person didn’t even bother to check it out at all? Well, this website is set to put an end to that. It will empower you to see exactly what it is that your friends on the Social Web are watching. This means that you can now share the latest meme with someone and demand he watches it. If the other person acquiesces you will be able to learn if he is indeed doing it by looking at the list of videos he is currently watching that is displayed on Tubin. Easy. And quite foolproof, too.

And it must be mentioned that the main page of Tubin lets you keep a close watch not only on YouTube but on other video hosting sites, too. These include Vimeo and DailyMotion, arguably YouTube’s closer rivals both in terms of traffic and popularity.

All in all, Tubin rides on the wave of services directly inspired by Facebook’s “Like” furor.



How will Facebook counter government concerns? With their own “government guy!”

http://techcrunch.com/2010/05/10/facebook-tim-muris/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Techcrunch+%28TechCrunch%29

Facebook Hires Former US FTC Chairman Tim Muris



One of my geek-buddies was thinking about using very local WiFi to connect his neighbors to his high speed Internet connection for a very nominal charge (say $5/month), becoming a “neighborhood ISP.” Here is a tool that might make it work. (But unless we have “Net Neutrality” it won't work.)

http://mobile.slashdot.org/story/10/05/10/122253/7Gbps-Wi-Fi-Networking-Kit-Could-Launch-In-2010?from=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Slashdot%2Fslashdot+%28Slashdot%29

7Gbps Wi-Fi Networking Kit Could Launch In 2010

Posted by CmdrTaco on Monday May 10, @08:52AM

Mark.JUK writes

"Wireless Local Area Networking (WLAN 802.11) adapters capable of speeds 'up to' 7Gigabits / per second (Gbps) could be in stores by the end of this year. The Wireless Gigabit Alliance (WiGig), which seeks to advance the worldwide adoption and use of 60GHz wireless networking technology, has published a unified specification for its approach and opened an Adopter Program. The move means that WiGig members can now begin developing Wi-Fi kit that uses the unlicensed 60GHz spectrum."



The world is changing. Is this a move toward a world government or 'anyone can play?”

http://politics.slashdot.org/story/10/05/09/1939222/DNSSEC-and-the-Geopolitical-Future-of-the-Internet?from=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Slashdot%2Fslashdot+%28Slashdot%29

DNSSEC and the Geopolitical Future of the Internet

Posted by timothy on Sunday May 09, @03:37PM

synsynackack writes

"The Register reports that the DNSSEC protocol could have some very interesting geo-political implications, including erosion of the scope of state sovereign powers. The chairman of ICANN, Peter Dengate-Thrush, explained, 'We will have to handle the geo-political element of DNSSEC very carefully.' Experts also explained that split DNS and the DNSSEC protocol don't match very well; technically, it is possible for someone at the interface of the global Internet and a country-wide Internet to strip electronic certificates attached to data and repackage the data with a new one." [Now you can pretend to be the (certified) government! Bob]



This would not only allow smaller organizations to use the code, but would ensure that the entire industry had an example of how the government wanted it done. Strangely, I got shot down rather firmly when I suggested this in a seminar on Privacy in the Health Care industry.

http://www.networkworld.com/community/node/60942

An open-source system for the VA is the next logical step

A committee helping the Department of Veterans Affairs figure out how to modernize its core system unanimously recommends open source. Makes sense.

By Amy Vernon on Fri, 05/07/10 - 2:52pm.

Arguably the gold standard of electric health records management, the federal Department of Veterans Affairs could be "re-engineered" as an open-source project.

That was the unanimous recommendation of the Industry Advisory Council, which was asked to study and suggest ways to modernize and simplify the VA's VistA (VA Health Information Systems and Technology Architecture), which serves about 8 million veterans through 153 medical centers and 768 outpatient clinics across the U.S.

… Fact is, right now the VistA system works great and is comprehensive, everyone agreed. But its roots make it too hard to innovate on the system and deliver new functions or integrate new technology in a timely manner. This issue was addressed, somewhat in the VA's open government plan released recently, which got "middle ground" ratings on the audit by OpenTheGovernment.org.



For my Computer Security students: You're all going to be rich!

http://yro.slashdot.org/story/10/05/09/1543244/The-Boom-Or-Bubble-In-Federal-Cybersecurity?from=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Slashdot%2Fslashdot+%28Slashdot%29

The Boom (Or Bubble) In Federal Cybersecurity

Posted by Soulskill on Sunday May 09, @12:27PM

Hugh Pickens writes

"The Washington Post reports that the increasing number and intensity of cyberattacks has attracted the attention of the Obama administration and Congress, which have begun steering dollars to the problem. Much of that new spending, estimated at $6 to $7 billion annually just in unclassified work, is focused on the Washington region, as the federal government consolidates many of its cybersecurity-focused agencies in the area. 'I think it is a real growth opportunity in coming years,' says David Z. Bodenheimer, a partner at law firm Crowell & Moring in Washington, who leads the firm's homeland security practice and specializes in government contracts. 'The market is still rather fragmented and in flux, but is developing with a speed that it is attracting both the major defense and homeland security contractors who are establishing independent business units to pursue these opportunities, and it is also a real opportunity for the smaller players who have niche products.' One reason the field is attracting so many companies is that the barriers to entry are low — at least, relative to other defense industries. But as start-ups and others rush to stake claims, some wonder if a bubble of sorts is beginning to inflate and recall that many venture firms in the early 2000s chased similar prospects. 'A lot of the early people made significant money,' says Roger Novak, founder of Novak Biddle Venture Partners. 'But there were [also] a lot of "me too" companies.'"



Useful resources for research.

http://www.bespacific.com/mt/archives/024207.html

May 09, 2010

New on LLRX.com - Knowledge Discovery Resources 2010 - An Internet MiniGuide Annotated Link Compilation

LLRX.com: Knowledge Discovery Resources 2010 - An Internet MiniGuide Annotated Link Compilation: Marcus P. Zillman's latest guide is a touchstone from which all researchers seeking comprehensive, reliable and diverse resources for knowledge discovery via the Internet can benefit. The key is to be able to find the important knowledge discovery resources and sites both in the visible and invisible World Wide Web. This guide to selected knowledge discovery resources and sites offers excellent knowledge and information discovery sources to assist you attaining your research goals.



For my website students

http://www.makeuseof.com/dir/hostingreviews-compare-hosting-plans/

HostingReviews: Compare Over 300 Hosting Plans



Caution. Could be limited time trial version or a “crippled” version or could even replace your current version and then “force” you to pay. We'll have to see which they choose.

http://tech.slashdot.org/story/10/05/09/2047236/Microsofts-Free-Online-Version-of-Office-To-Premiere-This-Week?from=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Slashdot%2Fslashdot+%28Slashdot%29

Microsoft's Free, Online Version of Office To Premiere This Week

Posted by timothy on Sunday May 09, @04:42PM

walterbyrd writes

"Microsoft will offer an online version of Office 2010 for free. I have to wonder, will this remain free indefinitely? Or is Microsoft just trying to firmly establish its OOXML standard, then go back to business as usual?"

Probably a harder sell after Google's acquisition of DocVerse.

Sunday, May 09, 2010

Hey! I'm a competitor of the NY Times!

http://www.pogowasright.org/?p=9970

Watchdog Web site is news organization – court

May 8, 2010 by Dissent

The Associated Press had a story earlier this week that I just came across on a court decision out of New Hampshire. In a nutshell, the case involved a watchdog site, Implode-Explode Heavy Industries, Inc. (Implode), that uploaded a confidential document about a mortgage company, Mortgage Specialists, Inc., and an anonymous comment made on the site accusing the mortgage company’s owner of fraud. The background of the case, as summarized in the court’s decision:

In August 2008, Implode published an article that detailed administrative actions taken by the New Hampshire Banking Department against Mortgage Specialists. In this article, Implode posted a link to a document that purported to represent Mortgage Specialists’ 2007 loan figures (Loan Chart). In response to the article, an anonymous website visitor with the username “Brianbattersby” posted two comments regarding Mortgage Specialists and its president.

After Mortgage Specialists became aware of the article and postings, it petitioned for injunctive relief, alleging that publication of the Loan Chart was unlawful because it violated RSA 383:10-b (2006) (mandating confidentiality of all investigative reports and examinations by the New Hampshire Banking Department) and that Brianbattersby’s postings were false and defamatory. Mortgage Specialists requested that Implode immediately remove the Loan Chart and postings from its website. Mortgage Specialists further demanded that Implode disclose both the identity of Brianbattersby and the source of the Loan Chart.

The trial court had granted the relief sought by Mortgage Specialists, but the New Hampshire Supreme Court held that a watchdog web site is a news organization and remanded the case back to the lower court on the issue of whether the site — as a news organization — should have been ordered to reveal the source of a leaked document posted on the site. With respect to the web site being a news organization, the court held:

The fact that Implode operates a website makes it no less a member of the press. In light of the trial court’s implicit findings, we conclude that Implode’s website serves an informative function and contributes to the flow of information to the public. [So I'm a Newsgatherer? Bob] Thus, Implode is a reporter for purposes of the newsgathering privilege.

With respect to whether the site should have been ordered to reveal the identity of an anonymous commenter, the court took this opportunity to endorse the Dendrite standard adopted in other courts and states:

We conclude that the Dendrite test is the appropriate standard by which to strike the balance between a defamation plaintiff’s right to protect its reputation and a defendant’s right to exercise free speech anonymously. Accordingly, we join those courts which endorse the Dendrite test.

The case is The Mortgage Specialists, Inc. v. Implode-Explode Heavy Industries, Inc.. .

Read more on First Amendment Center.



For my students (What else is college for?)

http://techcrunch.com/2010/05/08/brewing-tv-when-homebrewers-attack-the-web/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Techcrunch+%28TechCrunch%29

Brewing TV: When Homebrewers Attack the Web


(Related)

http://www.cantanding.com/

Cantanding

Cantanding is an online karaoke service that can be used by everybody, everywhere, and at no cost whatsoever.



For my singing Math students (Warning! This song could become a Brain Worm.)

http://www.youtube.com/watch?v=_YCwGdiUnKE&feature=related

Y=MX+B



For my Statistics students

http://www.makeuseof.com/tech-fun/is-sosial-media-a-fad-new-video-with-mind-blowing-stats/

“Is Social Media A Fad?” New Video With Mind Blowing Stats

Saturday, May 08, 2010

From the Blog of Google's Global Privacy Counsel. Looks like lots of people are asking these questions.

http://www.pogowasright.org/?p=9968

Which privacy laws should apply on the global Internet?

May 8, 2010 by Dissent

Peter Fleischer ponders the complexities:

Given the nature of the Internet, all web services are inherently global. All companies doing business on the Internet rely on the collection, storage and analysis of information generated by users, and all of them are confronted by the lack of consistency in the applicability and content of privacy laws across jurisdictions. So, I’ve struggled with the following three questions:

What are the current rules establishing the application of privacy laws around the world?

Do the current rules work?

How could we create clearer rules, to provide greater consistency and certainty?

Read more on Peter Fleischer: Privacy…?

[From the Blog post:

Jurisdiction: Cloud computing is directly affected because the dynamic nature of this practice is at odds with the approach based on where the actual processing happens. Part of its agile functionality enables cloud computing to switch between processing data in one location to another location in order that customers are provided with an efficient, affordable and consistent service.



“We absolutely certain that something going to happen, we just don't know what or when.” Sounds like the predictions of a psychic...

http://www.databreaches.net/?p=11571

Visa Warns of Fraud Attack from Criminal Group

May 8, 2010 by admin

Brian Krebs reports:

Visa is warning financial institutions that it has received reliable intelligence that an organized criminal group plans to attempt to move large amounts of fraudulent payments through a merchant account in Eastern Europe, possibly as soon as this weekend.

In an alert sent to banks, card issuers and processors this week, Visa said it “has received intelligence from a third-party entity indicating that a criminal group has plans to execute “a large batch settlement fraud scheme.”

Read the alert and more on KrebsOnSecurity.



Is this a “Mormon thing?” Law based on the morals of a specific religion rather than ethics?

http://www.pogowasright.org/?p=9966

Buy a drink; you’re in a government database

May 8, 2010 by Dissent

Bob Barr writes:

In the state of Utah, if you go into a club and purchase a drink, and if you appear to be “35 years old or younger,” a new state law requires the bartender or waiter to electronically scan your driver’s license in order to verify your age. Of course, scanning your license electronically provides a database of who is purchasing alcoholic beverages, where, when and it what quantities; information then available to the government. All this simply because a person decides to have a drink in a club that sells alcoholic beverages.

Read more on The Barr Code.

[From the article:

According to press accounts, some clubs that have been caught visually checking licenses to verify the age of patrons, instead of the more intrusive mandated electronic verification, are opting now to scan licenses for all patrons who “look under 60.” Failure to produce a driver’s license means a person would be refused service altogether.



Is anonymity possible in the Information Age?

http://www.pogowasright.org/?p=9964

The Navigator: Hotels connect the dots between guests and online reviews

May 8, 2010 by Dissent

Christopher Elliott reports:

Hotels want to know who you are. Especially if you’re reviewing them anonymously.

An increasing number of image-conscious properties have begun connecting the dots between unbylined write-ups that appear on such popular travel sites as TripAdvisor or Yelp, and your personal information, such as your loyalty program preferences.

If you write a positive review, you might expect a reward from the hotel — a gift basket or a discount on your next stay. Pan a property, and you could get a concerned e-mail from the general manager asking you to reconsider your review. Or even a black mark against you in the chain’s guest database.

John Baird, a lodging consultant in Jacksonville, Fla., says that hotels now use locations, dates and usernames that appear online to triangulate a guest’s identity. Once they find a likely match, the review is added to a hotel’s guest preference records, next to information such as frequent-guest number, newspaper choice and preferred room type.

Read more in the Washington Post.


(Related) Esoteric math proves “you have no Privacy!”

http://www.pogowasright.org/?p=9956

The Fundamental Limits of Privacy For Social Networks

May 8, 2010 by Dissent

Can math help us understand the limits of privacy for social network sites? From an article in Technology Review this week:

Today, Aleksandra Korolova at Stanford University with Ashwin Machanavajjhala and Atish Das Sarmait [have] worked out a fundamental limit to the level of privacy that is possible when social networks are mined for recommendations.

That’s quite a task given that there are various different approaches to making recommendations. However, Korolova, Machanavajjhala and Sarmait have come up with a general model that captures the essence of the problem.

Their approach is to consider a general graph consisting of various nodes and the links between them. This may be network in which the nodes are books, say, and a link between two nodes represents the purchase of one book by the owner of another. The team consider all these links to be private information.

Korolova, Machanavajjhala and Sarmait then consider an attacker who wants to work out the existence of a link in the graph from a particular recommendation. So given the knowledge that people who bought book x also bought book y, is it possible to determine a purchase decision made by a specific individual?

To do this, Korolova, Machanavajjhala and Sarmait define a privacy differential as the ratio of the likelihoods that the website makes such a recommendation with the using the private purchase decision in question and without it.

The question they then ask is to what extent can recommendaitons be made while preserving this privacy differential.

It turns out that there is a trade off between the accuracy of the recommendation and the privacy of the network. So a loss of privacy is inevitable for a good recommendation engine.

Read more on Technology Review.

[From the article:

Ref: arxiv.org/abs/1004.5600: On the (Im)possibility of Preserving Utility and Privacy in Personalized Social Recommendations



Extending “stress analysis.” A tool for automated Health Care – or for telemarketers?

http://news.discovery.com/tech/cell-phone-software-emotions.html

Computer Software Decodes Emotions Over the Phone



Is there any indication that users are concerned enough about privacy to leave Facebook? I doubt it. But look at the next article to see how Facebook tries to talk you out of leaving...

http://www.pogowasright.org/?p=9953

Yet another Facebook privacy risk. When is enough, enough?

May 8, 2010 by Dissent

Xeni Jardin reports on BoingBoing:

….Facebook base64-encodes your IP address in every emailed event that you interact with.

Matt C. at Binary Intelligence Blog explains that Facebook’s automated email notifications (which go out when, say, a friend comments on your status or sends you a message) appear to contain the IP address of the user who caused that Facebook email to be sent:

The email headers contain a line similar to:

X-Facebook: from zuckmail ([MTAuMzAuNDcuMjAw]) Copy this line out and feed it to this page: http://www.myiptest.com/staticpages/index.php/trace-email-sender

You will get the IP address of your friend and clicking on it will get a geolocation-based map. This will also show you if your friend used their cell phone to post and who they use as their service provider.

This information is great when a fugitive is taunting law enforcement through their Facebook page, but not when a wife is trying to hide from an abusive husband and assumes Facebook is the best form of communication.

Thanks to the reader who sent in this link..

Elsewhere, the New York Times invites readers to submit privacy questions for Facebook which they will submit to Facebook and then publish Facebook’s response.

And Ryan Singel of Wired declares that Facebook has gone rogue, and calls for an open alternative to Facebook.

The FTC is reportedly taking a complaint filed by 14 privacy groups against Facebook seriously. Because this site is published pseudoanonymously, PogoWasRight.org was not a signatory to the complaint, but this site also calls on the FTC to take firm action against Facebook for its deceptive practices and for unilaterally changing users’ privacy controls without allowing adequate notice and time to consent or not consent to such changes. But even if the FTC does take firm action, perhaps the most effective consequence still resides with users. When enough users start deleting their profiles and stop using the service, maybe then Facebook will “get it.”


(Related) Interesting technique to keep 'customers' Can only happen if you have “friends”

http://www.readwriteweb.com/archives/what_happens_when_you_deactivate_your_facebook_acc.php

What Happens When You Deactivate Your Facebook Account



Interesting that one industry has been given the Okay to change the operation of your hardware. Could this lead to control of your computer?

http://news.cnet.com/8301-31322_3-20004504-256.html?part=rss&subj=news&tag=2547-1_3-0-20

FCC lets movie industry selectively break your TV



Software only, not other “goods” What implications for the Cloud?

http://yro.slashdot.org/story/10/05/07/1858206/In-AU-Court-Rules-Downloaded-Software-Is-Not-Goods?from=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Slashdot%2Fslashdot+%28Slashdot%29

In AU, Court Rules Downloaded Software Is Not "Goods"

Posted by Soulskill on Friday May 07, @03:24PM

bennyboy64 writes

"A court decision ruling that the supply of software through a digital download mechanism is not a supply of 'goods' has been upheld in the Supreme Court of New South Wales in Australia, setting a precedent that software downloaded via the Internet is not protected by the Sale of Goods Act, reports ZDNet. It's a court decision that lawyer Patrick Gunning said attorneys had been waiting to have clarified for some time. What this meant was that 'people who purchase software will have more legal rights if they buy over the counter rather than downloading,' Gunning said."

[From the article:

He [The judge Bob] added that draft legislation amendments to the consumer protection provisions of the Trade Practices Act to the definition of "goods" would soon specifically include computer software, but said that this wouldn't apply to businesses, only consumers.

For a more detailed legal explanation read Gunning's blog about the case.


(Related) Understanding Facebook seems to be an advantage in certain jobs...

http://www.pogowasright.org/?p=9951

Ca: New privacy boss went after Facebook

May 7, 2010 by Dissent

Rob Shaw and Lindsay Kines report that British Columbia has a new Information and Privacy Commissioner:

Canada’s assistant privacy commissioner, whose investigation into Facebook forced the social networking site to improve its privacy policies, has been selected as B.C.’s new privacy watchdog.

Elizabeth Denham was appointed Information and Privacy Commissioner yesterday, after a vote by provincial politicians in the legislature.

Read more in the Times Colonist.


(Related)

http://linux.slashdot.org/story/10/05/07/1948235/Law-Professors-Developing-Patent-License-For-FOSS?from=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Slashdot%2Fslashdot+%28Slashdot%29

Law Professors Developing Patent License For FOSS

Posted by Soulskill on Friday May 07, @04:49PM

Julie188 writes with this quote from a Networkworld article:

"Two law professors from UC Berkeley have come up with a novel idea to protect open source developers from patent bullies. They call it the Defensive Patent License. They hope the DPL can address the objections FOSS developers have with patents the way the GPL addressed them for copyright. The DPL is similar to the concept of a defensive patent pool, but is not the same. The DPL is a bit more radical. It requires a bigger commitment from its members than the typical toe-in-the-water kind of pool, says Jason Schultz, former staff attorney at the Electronic Frontier Foundation. 'The perception is that bigger companies only commit their least-effective, least-important patents to a patent pool,' he says. Schultz isn't pointing fingers at any particular pool. However critics of IBM's open source patent pledge often said it didn't cover the patents most relevant to the FOSS community."



For my Computer Security students (Okay, the hackers too) Two minute Video

http://download.cnet.com/8301-2007_4-20004471-12.html?part=rss&subj=news&tag=2547-1_3-0-20

Force your browser to always start in private mode



Geeky stuff. This might fit into my model for leasing computers to the technologically impaired. It would allow better maintenance and control of the operating system.

http://it.slashdot.org/story/10/05/08/0455244/Diskless-Booting-For-the-Modern-Age?from=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Slashdot%2Fslashdot+%28Slashdot%29

Diskless Booting For the Modern Age

Posted by timothy on Saturday May 08, @05:08AM

An anonymous reader writes

"Ever wonder what happened to PXE? Intel's popular standard for diskless booting hasn't been updated since 1999, and has missed out on such revolutions as wireless Ethernet, cloud computing, and iSCSI. An open source project called Etherboot has been trying to drag PXE into the 21st century. One of their programmers explains how to set up diskless booting for your cloud, using copy-on-write to save space."



In keeping with the 3D craze Avatar started, I've decided to use this site to convert all my lecture notes...

http://alpha.zooburst.com/

ZooBurst

ZooBurst is a digital storytelling tool that is designed to let anyone easily create their own customized 3D pop-up books.



There's a joke in here somewhere...

http://www.killerstartups.com/Video-Music-Photo/in20years-com-this-is-you-in-20-years

In 20 Years

http://www.in20years.com/

This site will let you upload a picture of your face and have it processed into what it will look like in either 20 or 30 years. And the results are too accurate to be comfortable.



For my website class

http://www.hongkiat.com/blog/jquery-image-galleries-sliders-best-of/

jQuery Image Galleries & Sliders – Best Of



Cheap is good, free is better!

http://www.makeuseof.com/tag/top-5-resources-discounted-windows-7-download/

Top 5 Resources To Get A Discounted Windows 7 Download

Friday, May 07, 2010

Someone needs to make a “Movie of the Week” about this and win the Oscar for Best Comedy. Has anyone suggested that the school administration might be as bad at educating students as it is at administering the technology?

http://www.philly.com/philly/education/92943009.html

L. Merion won't block feds in Web-cam case

… Lawyers for the district, some Lower Merion parents, and the Harriton High School sophomore whose lawsuit spotlighted the school system's use of Web-camera monitoring said Wednesday that they wouldn't try to block federal agents from poring over thousands of images secretly captured from students' computers. [“They've got guns!” Bob]

The development came as a federal judge prepared to permanently bar the district from using Web-cam monitoring and as Superintendent Christopher McGinley announced plans to meet with students, overhaul technology policies, and take other steps to repair the district's tattered image.

… The 69-page report [ … ] said investigators had found no proof of intentional spying. [Just 56,000 accidental images... Bob]

… Mark Haltzman, the lawyer for Robbins and his parents, said they had no objection because they didn't believe the photos of Robbins were incriminating. But Haltzman's letter said he was worried about other students.

"Since the government has not agreed to immunize all students and their parents from prosecution for criminality that could possibly be depicted in the data . . . there is concern that the government will target or, worse, prosecute students and parents based on the illegally obtained evidence," his letter said. [So the school has deliberately been covering up the criminal activity they didn't intentionally obtain? Bob]



Update

http://www.databreaches.net/?p=11552

Heartland Breach: Consumer Settlement Proposed

May 6, 2010 by admin

Linda McGlasson reports:

A proposed settlement of the consumer class action suit brought against payments processor Heartland Payments System got preliminary approval from a U.S. District Court judge in late April. The proposed settlement would create a $4 million pool to pay consumers and settle the case.

[...]

In a “fairness hearing” on April 27, U.S. District Court Judge Lee Rosenthal heard from both sides of the class action suit. Several class action suits brought by consumers from around the country were collected into one case in September 2009. The case was heard in the Southern District U.S. Court in Houston, TX.

Read more on BankInfoSecurity.com. The article also provides an update on other Heartland-related litigation:

The financial institutions’ class action case against Heartland gained two more defendants, Heartland’s acquiring banks Key Bank and Heartland Bank. The suit brought against the two banks was consolidated into the class action suit brought against Heartland.



Can we learn something from these guys? Isn't this the equivalent of having your fingerprints on file? (or is it a hint that the DNA is used for more than identification?)

http://www.pogowasright.org/?p=9903

AU: Forensic police who refused to supply DNA sent back to general duties

May 7, 2010 by Dissent

Robyn Ironside reports:

Five police forensics officers have been booted out of their roles for refusing to supply DNA samples to their employer.

The Queensland Police Service had given the officers until March 1 to provide a “voluntary” sample for the purpose of eliminating their DNA from crime scenes.

As many as 50 per cent of officers are believed to have objected to the requirement but only a handful stood their ground out of concern about the lack of safeguards for their genetic blueprint.

Read more in The Courier-Mail.



Introducing the “Double Secret” Library of Congress?

http://www.pogowasright.org/?p=9895

Library of Congress Responds To Privacy Gripes By Making Twitter Archive Less Useful

May 7, 2010 by Dissent

Karl Bode writes:

We recently noted how the Library Of Congress and Twitter made a big deal of the fact that the LOC would now be archiving Twitter conversations. The idea is that researchers may find a mountain of largely-incoherent blathering about the Twilight films useful in providing context as they try to piece together events of the twenty-first century. Late last week a little more detail of the archiving process leaked out, the LOC saying that in response to privacy complaints they wouldn’t store deleted tweets, and they’d also be placing all tweets under embargo for a period of six months (for whatever that’s supposed to accomplish). For good measure, they’re also apparently locking down the Twitter archive to “qualified researchers” and considering further restrictions:

Read more on TechDirt.


(Related) I imagine the employee was surprised too. Are employees subject to a “Caesar's wife” standard?

http://www.inc.com/news/articles/2010/05/nonprofit-fires-woman-for-blogging-about-sex.html

Surprised Employer Fires Sex Blogger

A St. Louis-area nonprofit has fired a 37-year-old office worker – after discovering that in her own time, the woman blogs about her polyamorous escapades.

… TBK, as she's known, refers to what happened to her as a Twitter "glitch." But her webmaster clarified to Inc. that her downfall was really "in the failure of how third party search/archiving sites work." [I don't think that makes any sense... Bob]

… According to TBK, her boss – at the suggestion of top management – searched the web for information about employees, and discovered the sex blog. When she arrived at work April 27, she was fired on the spot.

Per an account TBK posted on another website, Aagablog, her boss was furious. “I need to let you go," the woman said, according to TBK. "Corporate office suggested I Google employees. I typed in your name and it took me two seconds to find your website. How COULD you put that stuff out there? What were you thinking?! I feel like I’m talking to a 14 year old! We’re DONE.”



This will work fine until you have a heart attack and need to call an ambulance...

http://www.macnn.com/articles/10/05/06/biometrics.still.absent.from.real.apple.products/

Future iPhones could identify users by heartbeat

A newly-published Apple patent application proposes identifying iPhone users by their heartbeat, rather than by more conventional means like a passcode.



This is the Information Age equivalent of Toyota telling their dealers to replace a part without notifying their customers that it will keep their brakes from failing.

http://tech.slashdot.org/story/10/05/06/1734250/Security-Firm-Reveals-Microsofts-Silent-Patches?from=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Slashdot%2Fslashdot+%28Slashdot%29

Security Firm Reveals Microsoft's "Silent" Patches

Posted by timothy on Thursday May 06, @03:23PM

CWmike writes

"Microsoft silently patched three vulnerabilities last month, two of them affecting enterprise mission-critical Exchange mail servers, without calling out the bugs in the accompanying advisories, a security expert said on Thursday. Two of the three unannounced vulnerabilities, and the most serious of the trio, were packaged with MS10-024, an update to Exchange and Windows SMTP Service that Microsoft issued April 13 and tagged as 'important,' its second-highest threat ranking. Ivan Arce, CTO of Core Security Technologies, said Microsoft patched the bugs, but failed to disclose that it had done so — which could pose a problem. 'They're more important than the [two vulnerabilities] that Microsoft did disclose,' said Arce. 'That means [system] administrators may end up making the wrong decisions about applying the update. They need that information to assess the risk.'"

"Secret patches are neither new or rare. 'This has been going on for many years and the action in and of itself is not a huge conspiracy," said Andrew Storms, director of security operations at nCircle Security. What is unusual is that Core took Microsoft's silent updates public. Saying that Microsoft 'misrepresented' and 'underestimated' the criticality of MS10-024 because it didn't reveal the two bugs, Core urged company administrators to 'consider re-assessing patch deployment priorities.' Microsoft confirmed this instance and defends the practice, noting that updates can "be destructive to customer environments." But Storms echoed Arce's concern about possible misuse of the practice, which could result in a false sense of security among users."



I doubt we'll ever hear the details if this is true. Imagine a system this vulnerable with this much influence on the economy and you have a near perfect target for terrorists (or cyber warriors) Apparently the “automatic limits” that suspend trading in a stock didn't kick in – perhaps a one time sale is exempt?

http://news.slashdot.org/story/10/05/06/2058245/Stock-Market-Sell-Off-Might-Stem-From-Traders-Fat-Finger?from=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Slashdot%2Fslashdot+%28Slashdot%29

Stock Market Sell-Off Might Stem From Trader's Fat Finger

Posted by timothy on Thursday May 06, @05:36PM

s122604 points out a CNBC story according to which

"the catalyst for today's extraordinary price swing (at one point the Dow lost almost 9 percent in less than an hour) may have been because a trader entered a 'B' for billions instead of an 'M' for millions on a trade of Procter and Gamble: 'According to multiple sources, a trader entered a "b" for billion instead of an "m" for million in a trade possibly involving Procter & Gamble, a component in the Dow. (CNBC's Jim Cramer noted suspicious price movement in P&G stock on air during the height of the market selloff).' Unbelievable there are no safeguards to protect against this."



Interesting formula. Suggests it might be cheaper for a small business to pay for multiple accounts and divide its downloads across several to say in the “sweet spot' Think of a small law firm that need to move the results of a small e-discovery project (1-20 terabytes) from a client to a consulting firm for analysis, then to opposing council... OR is this change for home users only? Comments suggest this is a 70% price increase for customers that hit 80GB (but stay under 300GB) with no change in service. Perhaps they anticipate that more customers will start watching TV over the Internet?

http://news.slashdot.org/story/10/05/07/0148224/CRTC-Approves-Usage-Based-Billing-In-Canada?from=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Slashdot%2Fslashdot+%28Slashdot%29

CRTC Approves Usage Based Billing In Canada

Posted by timothy on Thursday May 06, @11:02PM

qvatch writes with this from CBC News: "The CRTC has approved Bell Canada's request to bill Internet customers, both retail and wholesale, based on how much they download each month. The plan, known as usage-based billing, will apply to people who buy their Internet connection from Bell, or from smaller service providers that rent lines from the company, such as Teksavvy or Acanac. ... Customers using the fastest connections of five megabits per second, for example, will have a monthly allotment of 60 gigabytes, beyond which Bell will charge $1.12 per GB to a maximum of $22.50. If a customer uses more than 300 GB a month, Bell will also be able to implement an additional charge of 75 cents per gigabyte."


(Related)

http://news.cnet.com/8301-30686_3-20004392-266.html?part=rss&subj=news&tag=2547-1_3-0-20

FAQ: The FCC's plan to reclassify broadband

by Marguerite Reardon May 6, 2010 5:19 PM PDT

The Federal Communications Commission released detailed plans Thursday to ensure that it has authority to craft new rules to keep the Internet open.

Figuring out exactly what the FCC is proposing and how it will affect the industry and consumers is confusing. The procedure the FCC has chosen to shore up its authority is complicated and requires some legal gymnastics. To get the skinny on what's being proposed check out this FAQ below:

If the FCC is reclassifying broadband as a Title II service will all the rules under this classification apply to broadband?

The short answer is no. Under this plan, the FCC will reclassify broadband as a regulated service under Title II. But broadband services will be exempt from most of the old rules written for a monopolistic, 100-year-old telephone infrastructure.



Statistics (graphic)

http://www.billshrink.com/blog/7807/mobile-phones-worldwide-by-the-numbers/

Mobile Phones Worldwide – By the Numbers


Statistics (graphic) US is 30th behind places you couldn't find on a map.

http://img256.imageshack.us/img256/7914/ltl2010050601314150096.jpg

Top Countries Ranked by Speed


Statistics (article) Probably not a complete list

http://www.focus.com/fyi/operations/10-largest-databases-in-the-world/

Top 10 Largest Databases in the World



Tool for extracting slides from PDFs

http://www.freetech4teachers.com/2010/05/pdf-to-powerpoint-in-two-steps.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+freetech4teachers%2FcGEY+%28Free+Technology+for+Teachers%29

PDF to PowerPoint in Two Steps



“Oh what a wicked web we weave when first we practice to deceive Mother Nature.” “Fix” one problem, cause two?

http://www.livescience.com/environment/Whatever-Happened-to-the-Hole-in-the-Ozone-Layer-100505.html

Whatever Happened to the Hole in the Ozone Layer?

… First, the good news: Since the 1989 Montreal Protocol banned the use of ozone-depleting chemicals worldwide, the ozone hole has stopped growing.

… Now the bad news: The ozone layer has also thinned over the North Pole. This thinning is predicted to continue for the next 15 years due to weather-related phenomena that scientists still cannot fully explain, according to the same UN report.

… Scientists now understand that the size of the ozone hole varies dramatically from year to year, which complicates attempts to accurately predict the hole's future size.

Interestingly, recent studies have shown that the size of the ozone hole affects the global temperature. Closing the ozone hole actually speeds up the melting of the polar ice caps, according to a 2009 study from Scientific Committee on Antarctic Research.

Thursday, May 06, 2010

Oops, they've done it again...

http://www.pogowasright.org/?p=9821

Video: Major Facebook security hole lets you view your friends’ live chats (Update 1)

May 5, 2010 by Dissent

Steve O’Hear writes:

You’ve got to hand it to Facebook. They certainly know how to do security — not.

Today I was tipped off that there is a major security flaw in the social networking site that, with just a few mouse clicks, enables any user to view the live chats of their ‘friends’. Using what sounds like a simple trick, a user can also access their friends’ latest pending friend-requests and which friends they share in common. That’s a lot of potentially sensitive information.

[...]

The irony is that the exploit is enabled by they way that Facebook lets you preview your own privacy settings. In other words, a privacy feature contains a flaw that lets others view private information if they are aware of the exploit.

Read more on TechCrunch, where Steve posted the following video showing the exploit in action:

[The video on Youtube: http://www.youtube.com/watch?v=ny8ui4delEo&feature=player_embedded

Hat-tip, Rick Forno, who notes that FB chat has been unavailable all morning..

Update: Steve got a response from Facebook hours later that said, in part:

For a limited period of time, a bug permitted some users’ chat messages and pending friend requests to be made visible to their friends by manipulating the ‘preview my profile’ feature of Facebook privacy settings,” Facebook said in a statement.

How limited was the period of time, Facebook? And maybe, as the journalists’ group in the UK asked, you might do a better job of testing things before you release them?


(Related) Even The Atlantic finds this noteworthy.

http://www.theatlantic.com/business/archive/2010/05/facebook-suffers-yet-another-privacy-glitch/56255/

Facebook Suffers Yet Another Privacy Glitch



Dilbert on: Reading employee email.

http://dilbert.com/strips/comic/2010-05-06/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+DilbertDailyStrip+%28Dilbert+Daily+Strip%29



Privacy statistics

http://www.pcworld.com/businesscenter/article/195659/users_are_their_own_worst_enemy_for_online_privacy.html

Users are Their Own Worst Enemy for Online Privacy

Here are some of the key findings of the Consumer Reports survey:

• A projected 1.7 million online households had experienced online identity theft in the past year.

• An estimated 5.4 million online consumers submitted personal information to e-mail (phishing) scammers during the past two years.

• Among adult social network users, 38 percent had posted their full birth date, including year. Forty-five percent of those with children had posted their children's photos. And 8% had posted their own street address.

• An estimated 5.1 million online households had experienced some type of abuse on a social network in the past year, including malware infections, scams, and harassment.



Include the draft bill.

http://techdirt.com/articles/20100504/2319509303.shtml

Draft Of Privacy Bill Introduced... And Pretty Much Everyone Hates It



...and I have the right to laugh at them.

http://news.yahoo.com/s/afp/20100505/wl_uk_afp/britaincrimecourtrightsoffbeat_20100505132209

Teenager's trouser ban 'breaches human rights'



The government will have to get into this business with a lower cost option. “You can hide your identity online as long as we know who you are offline.”

http://it.slashdot.org/story/10/05/05/2142208/Hot-Sales-In-China-For-Wi-Fi-Key-Cracking-Kits?from=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Slashdot%2Fslashdot+%28Slashdot%29

Hot Sales In China For Wi-Fi Key-Cracking Kits

Posted by timothy on Wednesday May 05, @06:19PM

alphadogg writes

"Dodgy salesmen in China are making money from long-known weaknesses in a Wi-Fi encryption standard, by selling network key-cracking kits for the average user. Wi-Fi USB adapters bundled with a Linux operating system, key-breaking software, and a detailed instruction book are being sold online and at China's bustling electronics bazaars. The kits, pitched as a way for users to surf the Web for free, have drawn enough buyers and attention that one Chinese auction site, Taobao.com, had to ban their sale last year. With one of the 'network-scrounging cards,' or 'ceng wang ka' in Chinese, a user with little technical knowledge can easily steal passwords to get online via Wi-Fi networks owned by other people. The kits are also cheap. A merchant in a Beijing bazaar sold one for 165 yuan ($24), a price that included setup help from a man at the other end of the sprawling, multistory building."



For many of my Security classes...

http://tech.slashdot.org/story/10/05/05/2024225/Google-Releases-a-Web-App-Case-Study-For-Hackers?from=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Slashdot%2Fslashdot+%28Slashdot%29

Google Releases a Web-App Case Study For Hackers

Posted by timothy on Wednesday May 05, @04:49PM

Hugh Pickens writes

"The San Francisco Chronicle reports that Google has released Jarlsberg, a 'small, cheesy' web application specifically designed to be full of bugs and security flaws as a security tutorial for coders, and encourages programmers to try their hands at exploiting weaknesses in Jarlsberg as a way of teaching them how to avoid similar vulnerabilities in their own code. Jarlsberg has multiple security bugs ranging from cross-site scripting and cross-site request forgery, to information disclosure, denial of service, and remote code execution. The codelab is organized by types of vulnerabilities."

"In black box hacking, users try to find security bugs by experimenting with the application and manipulating input fields and URL parameters, trying to cause application errors, and looking at the HTTP requests and responses to guess server behavior while in white-box hacking, users have access to the source code and can use automated or manual analysis to identify bugs. The tutorial notes that accessing or attacking a computer system without authorization is illegal in many jurisdictions but while doing this codelab, users are specifically granted authorization to attack the Jarlsberg application as directed."



On my summer reading list..

http://techcrunch.com/2010/05/06/facebook-david-kirkpatrick/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Techcrunch+%28TechCrunch%29

The Age Of Facebook: Excerpts From The New Book By David Kirkpatrick



Tools for ebook users

http://blog.zamzar.com/

Convert eBook formats at Zamzar – free and online