Posts by copsewood

Keep your PC clean - or we'll shut you down

Monitoring how

Your ISP is inherently capable of knowing if your machine is doing what a spam zombie does by monitoring internal client port 25 connections to external servers bypassing its smart host or by measuring traffic through the smart host. It is feasible that your infected computer is being used by it's controllers very lightly, but unlikely because criminals tend to be greedy, so will generally try to earn using their zombies before they have herded millions of them.

The same goes for DDOS attacks. If an ISP knows which addresses are currently in receipt of these it is inherently capable of knowing which machines within their network are sending how many packets to these victims. Since when does a legitimate user request the same webpage or site 100 times a second ?

@Mark65

Most of the abuse coming from infected hosts is unencrypted and would make no difference if it were encrypted because encryption doesn't prevent traffic analysis. It's inherently feasible for an ISP, if knowing that an external address 1.2.3.4 is getting DDOSed right now, to measure that a host within their network requested pages from this victim 100 times in the last minute and that they are spoofing their originating IP address. It's also inherently feasible for an ISP to know that a host within its network has got itself onto various DNSBLs due to thousands of port 25 connection attempts bypassing the smart host provided by the ISP per day. I agree that compiling such metrics will cost the ISP something.

I personally am very much opposed to ISPs disconnecting or limiting customers based upon 3rd party information which they can't verify for themselves, e.g. based upon allegations of copyright infringement or on the alleged content of encrypted communications. As far as spam/UBE is concerned it doesn't matter what you or I are in favour of anyway, because ISPs which tolerate this from their customers will find other ISPs offering them much less favourable peering terms, and in extreme cases refusing to accept traffic from them.

As to whether ISPs intend to improve their services, once a market saturates (and we're nowhere near that yet) ISPs that don't improve services within a competitive environment go out of business. I've been told the ISP environment in Australia is very different from here in the UK, in the sense that you have widely dispersed populations with only 1 ISP able to offer a service (if any) across wide regions.

If your ISP is a monopolist, this imposes an entirely different set of obligations upon them than if they are one of many competing for the same customer's business. Kicking a user off the network for infringing an AUP is different if the user can go elsewhere tomorrow and can sue the previous ISP for breach of contract. If there is only 1 ISP, the terms of service and regulations to ensure fairness and non-discrimination have to become something the politicians and regulators need to get involved with to a greater and less welcome degree.

How do you tell?

I think you are confusing:

a . The command and control channels used by malware and criminals, which are not directly harmful to anyone other than to the real world owner (and users) of the system taken under virtual control by this means, with

b. The use to which the malware infected system is put, including fake money transfers, sending out spam email and creating high traffic levels on websites or using other protocols as part of a DDOS. Because criminals are greedy, usage b. will likely result in higher volume traffic, ( unless the infected machine is part of a very, very large and stealthy botnet, individual hosts of which are only used very lightly). Note that it is the unusual volume of activity (e.g. in relation to persistent requests for the same webpages or abnormally high outgoing email count) that makes an infected machine detectable to the ISP.

ISPs are only justified in taking down protocols (e.g. BT, IRC etc. ) typically used for C&C (relevant to activity a.) if they detect activity b. Activity b. while difficult to detect reliably, is relatively easier for an ISP to detect compared to activity a. Detecting activity b. does need some fairly advanced packet monitoring and firewall rules likely to need updating routinely, but occasional and intermittent encrypted C&C activity could be made almost indistinguishable from other traffic.

The ISPs could certainly get better at detecting malicious patterns of activity by forming better collaboration channels for data sharing with other ISPs, e.g. so information about current DDOS endpoints and attack characteristics are more widely publicised, enabling more accurate idenfication of zombies participating in DDOSs. But better data sharing requires better trust metrics amongst ISPs to enable criminal ISPs to be disconnected sooner rather than later and this hasn't proved achievable in such a rapidly expanding 'wild west' business environment.

As to transparent reporting of problems with individual hosts, spamhaus.org do a good job here (they keep between 600 and 1400 spams out of my network per week), but you only discover a problem when something gets blacklisted by them. ISPs are not transparent because they don't like to give too much information away about the details of the monitoring they are carrying out. The reasons for this reticence seem obvious; they don't want to give attackers the information needed in real time to get around their defences, e.g. by enabling attackers to slow down a DDOS to prevent this getting blocked one infected machine at a time.

ISP Acceptable Usage Policies (AUPs)

This should be seen as a civil law (i.e. contractual) matter between an ISP and their customer, which the customer agrees to as a condition of using a service provided by the ISP. If you read a few of these you will see that they all attempt to prevent the customer from using the connection for sending out spam or UBE (Unsolicited Bulk Email).

ISPs all have such AUP provisions, but take different responses to this issue in practice, with some rate limiting their own email smart hosts and others going further by also blocking port 25 connections from clients within their network to anything other than their own smart host. Anyone who wants to bypass them on such a network should operate their own smart host on port 587 which ISPs should not block - the external smart host and network provider have to establish and maintain their own external reputations to avoid DNS blacklisting.

The reason ISPs do this is because no ISP is obliged to peer with them or provide upstream transit services, so ISPs providing a cover for spammers and other criminals will eventually get disconnected.

So in my view no new laws are needed, but ISPs do need to review their AUPs and enforce these. What this means is that a customer whose network is detected as a persistent source of abuse should be progressively limited in relation to outbound services, until given information on how to disinfect.

This creates an issue for someone with access to only one ISP, which in my view should operate the minimum ISP industry abuse limitation based upon peering requirements and blacklist avoidance for legitimate uninfected customers. Those with a choice of ISPs should read the AUPs and choose which one they prefer.

Lone Android dev 'almost brought down T-Mobile'

wrong layer

Personally I doubt T-mobile or any other operator working on their own could fix a problem in relation to technology they implement but didn't themselves develop. This seems more like a standards issue to me. Perhaps the standards developers didn't foresee this potential mobile application usage pattern. Given the difficulty and cost of transitioning from 2-3-4G and the time taken, or of industry-wide retrofitting of existing platforms, maybe this is one that will have to be patched in less optimal but more feasible places, i.e. within the applications which exercise this platform bug.

This one isn't an issue of network neutrality as far as I am concerned, more a question of pragmatism and muddling through.

iPad tethering does disappearing trick

Tethering is none of their business

We used to have to put up with this kind of crap in contracts for fixed line domestic ISP use, e.g. telling us the connection could be used for a single computer only. So when I first configured a router on my connection to serve multiple computers I cloned the ethernet card MAC address on the router interface so the ISP couldn't tell any difference. Nowadays they don't bother, and even go so far as to throw in a router when you order a fixed connection.

It seems we now have to educate the mobile data carriers that we also don't appreciate them telling us how to use the data capacity they supply. Sure 500MB/month should mean that, and let them provide different rates at different prices and rate limit to keep you minimally connected if you use your allowance too quickly. But for a mobile operator to tell us what we can and can't use the bandwidth we pay them for is unwelcome interference in matters which are none of their business.

Gov axes £35bn Severn Barrage tide-energy scheme

subsidy to carbon burners

There was a snippet on Radio 4 this morning saying how 1/6th of UK homes are flood vulnerable, and that an agreement to keep insurance costs down by sharing costs around the industry is not being renewed, so the cost of home insurance of these houses at risk is set to increase 4 fold or cover will be refused. Of course the insurance industry are trying to use this threat to get the taxpayer to spend more on flood defences.

http://www.bbc.co.uk/iplayer/episode/b00vcn9j/You_and_Yours_18_10_2010/

However the subsidy is paid for, privately by those unfortunate enough not to be able to afford this insurance who take flood losses upon themselves, and by those fortunate enough to be able to afford it, and by the public purse through increased flood defence requirements, subsidies to carbon burning are being paid one way or another.

So perhaps the genuine believing GW deniers should setup a competitive home insurance business, pledging all their assets like Lloyds names do to underwrite this business, and if their scientific claim is correct, they would make a profit by offering lower premiums because flooding, damages and claims will go back to what these were 20 - 30 years ago. The fact that they won't tells me that what the GW deniers really believe is they want to have current carbon burning subsidies continue but they are not honest enough to admit it.

Very happy to get rid of subsidies to renewables when these are on a level playing field. But if they were we'd see the prices of untaxed carbon fuel (e.g. for electricity, heating, agricultural and aircraft fuel) a great deal more expensive than we've ever known them.

WTF is... DLNA?

I run MiniDLNA to Bravia

http://sourceforge.net/projects/minidlna/ . This server works most of the time with a limited range of media formats. It took a bit of hacking to get it installed and working on Ubuntu (doesn't have an Ubuntu package and had to hack init.d scripts and a cronjob to restart it if that fails).

In practice the main issue is having to convert Video prior to streaming to support the limited formats accepted on the Bravia TV (Mpeg2 works OK but uses lots of disk space). So might be OK for hackers, definitely not workable for those without computing skills. Works OK with photos and music, but I store these in .jpg and .mp3 formats.

BT blasts hundreds of would-be customers' data into Infinity

If you use their MSA you accept their header

I'd be surprised, and you would have genuine cause for complaint, if those on this BT network using their own non-BT MSA (Mail Submission Agent) for relaying outgoing mail to the rest of the world get this header added through packet modification. Similar issue if they modify your incoming email packets without relaying these to you. But in general if you don't like your ISPs outgoing relay policies, then run your own outgoing relay (I run my own and am on Virgin Media's network who don't modify my incoming or outgoing emails) or find a third party to run your MSA whose policies you prefer.

The SMTP standards require relays in the delivery chain to identify themselves in a Received: header, see RFC 2821 section 3.8.2 : "When forwarding a message into or out of the Internet environment, a gateway MUST prepend a Received: line, but it MUST NOT alter in any way a Received: line that is already in the header."

See also: http://en.wikipedia.org/wiki/Mail_transfer_agent .

Dead baby taunting troll feels wrath of law

Free speech rights don't cover psychosis

Free speech rights are needed because we are not a perfect society, because without free speech those with power and influence have no accountability. But free speech rights don't extend in our imperfect society to shouting 'Fire!' in a crowded theatre, or certain kinds of incitement to hatred or to psychotic behaviour like this.

Someone who frequented a cemetery to hurl abuse at those mourning their departed loved ones would probably be sectioned under mental health legislation. So maybe this response to him would be more appropriate than using the criminal law to curb his online equivalent behaviour, which seems equally psychotic, disturbed and unacceptably hurtful to those in grief.

Facebook leaked users' real names with advertisers, suit says

What else does FB have to sell ?

Anonymisation has to be reduced to a very transparent fig leaf so they can pretend not to be selling on your personal data while getting the maximum amount of money for it.

High-speed asteroid pile-up prompts X-File

chances of life developing ?

"Now what are the chances of life developing without the intervention of a god? About the same?"

It doesn't work that way. A smart and powerful enough God can formulate the laws of physics in such a manner as to make the spontaneous occurrence of life inevitable or probable. Which is more logical: a to conceive of laws of nature without a legislator or b. to conceive of laws of nature with a legislator ?

I reject your puny and stupid straw god as much as you do. This particular theological rot (god of the gaps) started with William Paley. The God of the Bible is responsible for what we do understand as much as what we don't.

Windows to Linux defections to outpace Unix shifts in 2011

GUIs and servers

One reason not to have them is that the server is better located elsewhere than the company, person or organisation that uses it, i.e. in a data centre designed and serviced to provide redundant connections to the internet backbone, on site power generation and specialised staff in server maintenance and maintaining hardware. Another is the memory soaked up in this expensive environment by GUIs. A third reason is that sharing the cost of hosted servers works well with virtualisation, but this also limits memory available to a single virtual server instance.

For those not liking command line administration there are a couple of options. Many server applications can be administrated using web applications these days, and file managers on Linux desktops work very well over SSH, so you can drag and drop files over the network and edit them locally on something that has a GUI if you wish.

Hefty physicist: Global warming is 'pseudoscientific fraud'

simple and complicated

How global warming is driven is very simple. Put a couple of clear glass demijohns, one with more C02 than the other into sunlight with thermometers in them. The one with more C02 gets hotter than the one with less C02. It's a simple experiment anyone skeptical about GW can do for themselves.

How this heating effect works through the climate and weather systems is much more complicated because of the inherently chaotic nature of climate and weather and other cyclical variables e.g. solar activity. The difficult science isn't figuring out what drives GW, it's eliminating all the other variables to identify which changes come from GW and which don't. For example I saw what to me seemed an apparently a very well researched TV program that suggested without manmade dust and soot generation GW would have a much greater effect than it does.

Ubuntu 10.10: date with destiny missed

@David Gosnell

I currently use Ubuntu Netbook Remix 10.04 on an AA1 with SSD and this seems pretty stable. I did have problems with Ubuntu 8.04 on the same hardware which worked OK for quite a while and then there was a degree of data corruption. I suspect the problem was hardware related. I only use this system somewhat lightly (travel and holidays or network testing). I'm not convinced these SSD hardwares are as stable and reliable yet as rotating disks. Not sure why you can't test a bootable USB stick with operating system of choice on this hardware, I was able to try this before installing, though the USB is slower than the SSD.

Microsoft plans biggest ever Patch Tuesday

@ac Monday 11th October 2010 08:15 GMT

"Incidentally, it's the second time *this month* I've installed Ubuntu updates that have requested a reboot"

We are likely to be on different Ubuntu versions or variants running different kernels. The openssl bugs would have applied across various security-supported versions, and these of themselves shouldn't require a reboot. But maybe your kernel updated as well at the same time and mine didn't. You'll probably find that Ubuntu needs to reboot fewer times than Windows for automated security related patches. Also depending upon the kernel problems fixed, the extent to which you understand these and your relative degree of firewalling and the services you are running and providing, not all kernel updates require an immediate reboot. But if you don't understand what a kernel fix was for, you are better off rebooting than not when the update system suggests this course of action. If you daily shutdown and restart your system there is probably no need to worry about this, as your kernel patches will be effective within 24 hours anyway.

get used to it

I've just applied the openssl updates on my Ubuntu workstation. A popup window, a description of the problem, and a password prompt because I had to authorise the fix before it applied. No reboot needed on this one, as it wasn't a kernel update so I just kept on working. Come to think about it it's a month or so since I did reboot it.

Any useful desktop operating system contains so many million lines of code (MLOC) that at any given time some of these will be risky, and the rate of discovery of faults and fixes in these seems to increase in proportion to the MLOC count. Alas a proportion of these faults will be zero day vulnerabilities which are not widely known about or patched yet, but your computer is vulnerable to a much greater number of attackers the longer you delay patching after these faults are discovered and published and fixes made available.

So go elsewhere by all means as I have, and you may find things less bad as I have, but don't expect to find perfection elsewhere because you won't, and whichever system you use you do need to keep up with the patches. But you are likely to find things better than what you are used to. Much of the trouble on the Net comes from compromised computers belonging to people using cracked and unlicensed versions of Windows, for which Microsoft has no obligation or incentive to provide patches and updates. That and the fact that most Windows users need to obtain software from 3rd party sites to get basic stuff done, where there is no integrated supply-chain quality-assurance and integrity verification of the kind you get with an open-source/free software Linux distribution repository and package management system.

Youth jailed for not handing over encryption password

rubber hose cryptanalysis

I can't really see any difference in principle between the use of torture to obtain a password or the use of imprisonment. Many will argue that he must have been doing something wrong, but nothing has been proven against him other than breaking the controversial law on which he has been imprisoned. There is a wealth of legal tradition that he should not be obliged to provide evidence to be used against himself which this provision of the RIPA ignores, including the US 5th ammendment, the right to remain silent, innocent until proven guilty, and ECHR convention articles concering fair trial and privacy rights.

Black people in the southern US who sat on the wrong seats on segregated buses in the sixties and earlier were also breaking bad laws which did not stand up once finally tested against the US Bill of Rights. This case is little different.

http://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis

Android is turning a profit for Google

I also suspect Google's making money claim is true

Many commerce areas of the Internet, once it started becoming commercial, were also self referential. If people are paying real money for mobile apps in what sense is advertising for these not genuine commerce ?

Aspects of accounting in connection with assets resulting from recent investment are also speculative e.g. "goodwill", meaning the probability that someone who has seen your adverts will buy something on the basis of such. But accountants do have to quantify such nebulous and virtual realities in annual reports. I and I suspect others didn't believe Google was profitable on such accounting bases in its early days as a free search provider until the reality that they were taking a lion's share of the genuine Internet advertising revenue became undeniable.

Hull man guilty of snooping on hundreds of medical records

who does what with who's medical record has to be logged

He didn't have to look at very many records he had no reason to view before the logs left behind of his illegal access caught up with him. And of course validity of these logs all depends upon cutbacks not cheapening systems to the point where it becomes feasible and routine for NHS person A to authenticate using NHS person B's credentials.

Goldman downgrades Microsoft stock to 'neutral'

Maybe MS should buy a Windows-antivirus company

Another one ? They bought a company (GeCAD, product RAV antivirus) which removed Windows viruses from Linux servers in 2003. And then they killed the product.

http://www.macobserver.com/tmo/article/Microsoft_Acquires_Linux_Company_Then_Discontinues_Its_Popular_Linux_Antivi/

Penguin in the picture: top video editors for Linux fans

@Robert Forsyth

"You can install several window managers on the same machine, and choose which one you use at login time."

This is true, and I've used all of Xfce, KDE and Gnome like this. But it isn't needed just to use a KDE app on Gnome or a Gnome app on KDE, all of which just seem to intall and work with little noticeable difference other than minor cosmetics. There is slight overhead installing an app on an alien desktop using .deb archives which will result in automatically pulling in the base libraries needed, without the entire desktop option.

@Ralph 5

While it is true that computers are there to get a job done, if your computer software minimises what you learn in the process because it does this "with a minimum of additional technical know-how" then it will help you put your career into one involving less knowledge than you would have acquired otherwise.

I'm not just interested in using computers to get a job done. For me knowledge is the business I develop and sell.

Baby Boomers committing suicide at unprecedented rates

In Christian terms suicide == the ultimate self centredness

@Daniel Evans

If your conceptual world just centres around you and if the rest of your consequently tiny world no longer seems to worship you, then why should someone who thinks and lives this way see any point in continuing ? Christians view suicide quite simply as a rejection of the gift of life - if life is a gift then it must still have good purposes and possibilities whatever bad stuff may happen along the way. Atheists see no gift of life because they can see no giver.

And as to going straight to hell, what makes you imagine that as you go beyond death you should then become more capable of choosing to have a relationship with a God whom you chose to dislike and reject so completely during your life ? Isn't it probable that as we become more set in our ways we perhaps find it more difficult to think, choose and behave differently ? Did I hear that this was supposedly God's fault for giving you genuinely free will, with all of the consequences of free will, rather than making you a happy robot that follows His program ? Well if that's your excuse, then your understanding of God as someone who 'should have made you into a happy robot' is a lot less creative than how I understand God. Come to think of it I don't think much of a god limited to creating automatons either.

Is it perhaps conceivable that previous generations which fought through world wars for our freedom were less centred upon themselves, and that their Christian faith had something to do with this ?

ACS:Law's mocking of 4chan could cost it £500k

unsupported assumption

The fact that ACS Law stored and published highly sensitive data unencrypted on their own web server doesn't imply or mean that this data wasn't sent to them securely by ISPs who provided this data, presumably because it would have been illegal not to do so because a court warrant was obtained.

Feds want backdoors built into VoIP and email

Bit like the RIPA

In one sense this genie was out of the bottle when Phil Zimmerman published GPG, source code and all on the Net, regardless of US export regulations in force at that time. It was further out of the bottle when the case against him collapsed. But just as with the RIPA, control freaks in government still want to put as much of this genie back into the bottle as they can. Staying outside this regime is optional for those willing to run their own email servers, especially in privacy friendly countries, and VPNs between themselves and their email servers.

For most of the population who have not got a clue what an email server or VPN is, they will get the taps installed. Those who want to opt out for reasons of corporate or criminal privacy or principle will do just that. Perhaps the FBI know this and are only really bothered about being able to tap the 98% of communications of those who care about these privacy rights very little. Chances are also likely that the FBI won't bother with the smaller ISPs, due to higher costs per email user of providing and securing the tapping equipment. They are more interested in the low hanging fruit.

So in my view the GNU telephony and related privacy projects (e.g. for secure filesharing involving family and friends) will only really succeed in this if they can create software which compiles to a very simple download on the platforms which those who don't care very much use and which self configures and just works thereafter. Creating networking software which can load onto minimal plug in hardware which can be bought for a very small price and which can provide reliable services is also relevant see http://plugcomputer.org/ .

Facebook on the blink for second time in two days

Expect a baby boom

In around 9 months time.

Über-zombie cookies give us the fear

Not very practical

There simply are too many sites that won't work without it. If you really feel that blocking untrusted Javascript will help, then use the Firefox NoScript plugin. You'll then get to decide which site's Javascript you really want to run by denying access to the rest. But if you visit more than a few sites you'll then have many decisions to make. I tried this, got fed up and found that most of the really bad and unwelcome stuff seems to be blocked by Adblocker plus which takes a few moments to setup and then just does its job.

Critical Internet Resources not so critical

naming and addressing of objects ?

Is anything else really "governed" on the Internet ? If no, is that maybe, why the subject gets boring ? My political self may be able to see very well in principle why this should all be done under the auspices of the ITU rather than a company registered in the State of California, but doesn't my engineering self generally tend to take the view that if something isn't broken then why waste time trying to fix it ? Would a UN committee and bureaucracy not take more tax from top level domain registrars and regional address space carve-up registrars than a private company that can't begin to be able to justify its own monopoly status ?

Indiana judges dismiss girl's nipple exposure appeal

the place and context is relevant here

It seems reasonable to me for different places to have different standards determined by local bylaws. I don't want to see either men or women going topless in meetings or premises of my Church. But I don't have any problem with either gender going topless in a park or on a beach on a sunny day.

The fact she was exposing her breasts next to a major road creates a probability of drivers taking their eyes off the wheel, creating a risk of accidents. I suspect some men going topless here could create a similar risk amongst some women or gay motorists, so in this context it seems reasonable for local bylaws to apply equally to both genders. I don't think local bylaws can realistically discriminate against people for being young slim and beautiful or old fat and ugly, and I also can't see any reason why these bylaws need to discriminate based upon gender.

Harrow flicks pirate thrown in slammer

Way over the top

I could understand the sentence if he had _sold_ copies illegally rather than just shared them because he could. But I think this sentence will do the copyright extremists no good at all, by making Emmanual into a martyr, and making themselves even more disliked than they previously were. A hundred hours community service and a small fine might have been appropriate. As to asking us to spy on our neighbours in case they are secretly filming when I go to the flics, frankly the idea makes me feel sick.

Code for open-source Facebook littered with landmines

Distributed social networking is a hard problem

Good on them for having a go and sharing where they have got to so far. At this stage (and this may be surprising to some) security probably isn't the main factor holding things back. Installing a standalone social networking server which you can invite a few relatives and friends onto doesn't necessarily open you up to attacks from world + dog. Having an invitation on a particular server instance to create accounts open to entire world + dog almost certainly does.

They'll need a process in which many more interested developers can participate, and creating that isn't easy. I participated in an invitation/recommendation only experiment with facilities similar to FB but used by about 100 people several years before FB existed. What killed this wasn't security issues which were never investigated to this extent, but the lead developer not open-sourcing the code so that other interested parties could continue it when he ran out of money.

The hardest part is going to be how very many independently-operated social networking servers (possibly implemented differently) talk to each other, so that friend of friend relationships can be used to enable easier cross authentication and communication of shared interest between different servers. If open source social networking developers don't achieve some kind of useful and secure federation protocol people won't migrate from a single global social networking platform to an archipelago of isolated social networking islands just because they don't like having a single company running the show and deciding all the policies.

Sony net-connected HD TVs get BBC iPlayer access

existing customers

Given I bought a Sony Bravia networked telly nearly a year ago it would be nice to know which models the firmware that provides this functionality runs on. It would also be helpful for reviewers by stating this to encourage manufacturers to try harder to make new firmware features available to existing customers.

Microsoft wins court order crushing mighty spam botnet

not so simple

"Shouldn't ICANN be pulling domain names used to control botnets without anyone having to tell it to do so?"

How would you like that if you had invested years of you life and thousands of £ in developing a site to find it on a large list of names which spammers program into a bot and which will enable the zombies to be controlled by malware if such were to run in future on your clean and legitimate site ? Sorry, it sounds like a nice idea, but you would make every legitimate and honest site potentially blackmailable or capable of being DOSed by those with criminal intent regardless of anything they could do about it.

Change that to a policy of having a domain name capable of being temporarily suspended if provably misused for long enough without the WHOIS registered domain owner responding to complaints to remove the malware e.g. command and control software active on their website, and this is more likely to be supported by domain owners who have invested greatly in their brands and Internet presence. But that is not going to be an instant process.

Even that isn't simple, because supposing there are a million sites hooked off different subdomains of example.com each seperately managed and one of these, averybadone.example.com is used as a Botnet C&C server, are you going to suspend the entire domain: example.com or have some process where the owner of example.com is asked to suspend averybadone.example.com within a given response period ?

Also, supposing each DNS zone in a label chain of say a.b.c.d.e.f.example.com were given a reasonable response period of say 2-3 weeks, doesn't that give an arbitrarily long time for the spammers to relocate ?

Coalition launches extradition treaty review

alleged and real seriousness of Gary's offence

Whether he did it isn't in dispute, but there is dispute over the seriousness and cost of what he did. The US claims he broke into a great number of computers at very substantial cost. Gary's defenders will claim that Gary shouldn't be charged with the cost of basic security work which should have been done in the first place but wasn't. Bit like having someone try a couple of locks in a hall of residence and wonder in through a couple of open doors to look around then being charged with the cost of changing all the locks throughout the complex and for the cost of other crimes which occurred in the insecure establishment and for putting a security guard in the lobby.

The point about extradition is that this is totally over the top when viewed against a less serious interpretation of what Gary did. This means that for the treaty to be balanced, the country wanting extradition of a UK citizen from the UK should have to present very good evidence before a UK court that the offence can't be adequately handled by the UK courts and criminal justice system. For minor computer unauthorised access a sentence of more than a year would be wildly excessive.

Sony Oz mod chip dongle ban hearing delayed

human rights versus copyrights

The freedom to tinker and to express views on technical discoveries made through tinkering may be exercised legitimately by fewer than those who are interested in using similar techniques for copyright infringment. But that doesn't justify criminalising ownership and use of tools which have legitimate uses. It also doesn't justify criminalising expressions of knowledge gained using such tools, because freedom of expression is guaranteed by the supreme levels of law: the US Bill of Rights and the ECHR. Copyright has a lower legal status, so protection of copyright e.g. by banning devices whose main but not sole purpose is copyright infringement doesn't justify laws which suppress technical tinkering and expressions of knowledge gained from this, e.g. in the form of silicon chips.

For a story making this issue more accessible see: http://www.gnu.org/philosophy/right-to-read.html

OED goes the way of all flesh paper

Political will and chaords ?

The Internet isn't subject to political will any more than the continuation of a significant and internationally-used language (e.g. English) is. That's because the Internet is less a physical thing and more a language for interconnecting physical things. Close down any major part of the Net, even all of it, and it will naturally reconnect itself, as people with access to components of what it used to be find these to be more useful connected than otherwise.

See: http://www.chaordic.org/definitions.html

You could argue that the mainstream naming and addressing of objects on the Internet are subject to political will. Without this, naming and addressing would be fragmented, as was the case with the non-Internet networks (e.g. UK Janet, UUCP, Bitnet etc. which had application gateways into the Internet until the early nineties.

Paul Allen launches patent broadside on world+dog

does he intend to win ?

Obtaining revenue from patents usually involves deals done to keep the dispute out of court, rather than by bankrupting one of the protagonists. This works a bit like protection money paid by a shopkeeper to a gangster to prevent "bad things from happening". A bankrupt patent protagonist doesn't pay license fees, just as a burned out shop doesn't pay protection money - they serve as a warning to the others.

license to print money

That's what a patent is, a monopoly granted upon the wording of an idea, which may be turned into licensing revenue by the successful applicant. So the office which grants patents has a license to print money.

To see how this works in practice, supposing you run a patent office which is funded based upon how many applications are made. The number of applications will always be a multiple of the number of patents granted, because if the chance of successful application are low, customers won't invest much time and money in applications, but if the chance of successful application are high, customers will increase the number of applications. So as a patent officer, are you going to grant very few, high-quality patents, in which case your funding and empire will be cut down to size, or are you going to grant many poor-quality ones, in which case your bureaucratic empire grows without limit ?

Solution: the patent examination office should not be able to spend patent application fees which should go to general taxation. Road license fees go to general taxation and road maintenance comes out of a separate budget so there is a precedent. Funding of the examination process should be assessed independently based upon the sampled quality of patents granted and excluded independently of how many patents are granted. This should require a change in the style of patent writing so that the language and presentation of these becomes clearer to engineers, as opposed to documents intelligible only to patent lawyers.

That and legislation restricting patents to exclude mathematical, business methods and software ideas better protected using copyright.

ARM server chip startup gets big backers

good for cutting cost of professionally hosted servers

I'm not aware of any software on the current shared X86 servers split into virtual machines which I administrate which doesn't compile to run on ARM. This kind of thing could put a dedicated server within my small hosting budget. The applications are more likely to be RAM bound than CPU bound. Also a large part of the machine rental relates to the power requirement. So bring it on, as far as I am concerned.

Open source's ardent admirers take but don't give

fork avoidance saves money improving bottom line

Red Hat are paid to participate in the community by customers who need software merging upstream but don't have the time or knowledge to do this themselves. If you don't have your code changes to something merged upstream then you will have to recreate your code changes repeatedly, as often as the mainstream version you want to ship downstream with your changes is significantly improved. When you do get your changes merged upstream you'll still have to maintain these, but this is going to be much cheaper as part of the mainstream version than it will be maintaining these changes as a fork.

The idea that Red Hat and similar companies employ so many engineers doing this work full time out of altruism for community relations purposes rather than to make an honest profit by doing something cost effective for their paying customers is ill informed.

All opensource users contribute to it in a way

Even if it is used briefly by someone who will only commit to using an open source program in a decade's time, the critical review they give it is likely to be vital information to developers if they can receive this feedback. Those who rely on open source will start to need to obtain specialist support services for it, and it will often be the specialist support business that contributes changes - in order to keep their customers happy.

You can't admire open source without advocating it which is a significant contribution, so the title of this article is incorrect. Apart from that, thanks for an excellent and well-informed article.

Alleged pirate fingered for filming film at Harrow flicks

being told to spy on our neighbours

I remember going to see a film a couple of years ago and we were told to spy on other members of the audience. If they were seen secretly recording, we were supposed to report them to the copyright police. It reminded me of what my mum said everyone was told to do by the Nazis when she was a teenager in Germany.

The similarity left a nasty taste in my mouth and left me less supportive of copyright policing than I was before I saw the film.

15K Wikileaks docs 'potentially more explosive,' US frets

whistleblowers' clearing house

Without whistleblowers those making corporate/military/government decisions can do what they like, bully the timid, cover it up and avoid accountability. Whistleblowers are those who become aware of the pathology of decisions made by the corporations, organisations and departments they are working within, (some with personal and malicious axes to grind pretend to be doing this) and are taking big personal risks of being attacked by rich and powerful people who got where they are by making it as expensive as they can get away with for whoever would oppose them.

So what to do with information coming from whistleblowers ? Publish it regardless of the consequences ? Well that is generally the free-speech right of a news organisation or private individual, but It seems in this case that Assange of Wikileaks is taking a more responsible view, recognising that some of the information Wikileaks have been given could compromise the safety of innocent people, and enlisting the help of those who can help them sanitise it prior to publication.

Server-based botnet floods net with brutish SSH attacks

haven't noticed any change over last couple of months

I get an email every time Denyhosts on one of the 4 machines on different networks which I administrate using SSH locks out a password-guessing attacker. Seems to be about a dozen a day between these 5 machines, 3 of which are servers on 24x7, the other 2 are desktops only on when their users are online. Most of the hosts denied are from the distributed database shared with other Denyhosts users, but the rate of a dozen a day new attackers which my machines are identifying themselves doesn't seem to have varied very much.

As to keys and passwords, I use strong enough SSH passwords to handle the amount of guessing which occurs before a host gets locked out and the number of attacking hosts logged, assuming the attackers are coordinating password guesses. Keeping keys online would be less secure, and having keys kept offline e.g. on a USB stick, would be too much hassle, and I'd probably not have a copy in the very unlikely event of one of my servers going down and I get an SMS to that effect while away on holiday.

HP boffin claims million-dollar maths prize

@LINCARD1000

I think your question can be answered by a few examples. The problem is that at the time the pure maths is conceived, formulated and proven or conjectured (i.e. without current application) mathematicians probably have no way of knowing what, if any, the future applications will be.

E.G. I think that the problem of factorising products of pairs of large primes would probably have been considered an entirely theoretical area of maths without application prior to the development of public-key cryptography. Without this problem having been considered from a theoretical standpoint first, application for this purpose would not have been conceivable. Various other examples exist, including the use of complex numbers in electrical engineering. Group theory is an area of maths which I think also started as an entirely theoretical mind game yet which now has significant application areas in atomic and subsequently in molecular modelling. Graph theory was also pure maths which was later applied in network routing.

UK scraps Fibre Tax review

Wrong standard of accountability

If these were Conservative promises in what sense are the Conservative part of the coalition expected to keep these without our Lib-Dem support ? Do please hold the coalition to promises made in both the Lib-Dem and the Conservative manifestos. Hold the government to the coalition agreement as published. As far as I am concerned everything else is negotiable, based on what I would hope and expect, is believed in the best public interest in consideration of the fact that individual party memberships can be cancelled at any time - mine's a monthly subscription. But don't hold us to what just one of the coalition parties wants without majority support from the electorate please.

Nothing succeeds like XSS

Tried it, bit tricky

I used NoScript for a while, and now rely more on Adblock to block content from pushy sites because NoScript involves too much time making decisions for which you have too little information to make these fully reliably. Adblock and NoScript do different jobs. I know that without NoScript that I'm more vulnerable to XSS, but it still wouldn't protect me against a bad script I've wrongly chosen to trust.

As far as my online banking is concerned, I use a virtual machine kept on a USB stick, on which the web browser and accessible files have never been used and won't be used for any other purpose. This, as far as I can tell, protects me against XSS and many other threats far better than NoScript could.

Germany bans BlackBerrys and iPhones on snooping fears

Who said the second quote ?

The German Government funded the development of the GPG program, presumably because someone with the budget used for this had more concern for security of state communications and privacy of individual's and corporate communications than the ability of state security agencies to monitor and decrypt such communications.

If the second quote was from a German Government source perhaps it was from another agency or department of the same government. A corporate entity does not have a single view especially over multiple contexts, never did and never will. You will find many different views within any organisation.

O2 offers Pay & Go BlackBerry basket

Slightly dodgy last couple of days

I use the Orange PAYG £5/month Blackberry Service. Generally works OK for very light data and email use, but it's been a bit unstable the last couple of day, not entirely sure whether it's the service or my ancient Blackberry handset.