<?xml version="1.0" encoding="UTF-8"?>
<opml version="1.0">
  <head>
    <title>cmdln.net_2008-02-10</title>
    <expansionState>0,1,9,10,13,14,29,31,37,46,47,50,55,62,77,89,96,114,127,138,139,152,166,167,175</expansionState>
  </head>
  <body>
    <outline text="Intro" Offset="00:17">
      <outline text="Farpoint coming up, 2/15-17">
        <outline text="Will be reprising my copyright, creative commons, legal issues panel"/>
        <outline text="Will be working with the video folks to show some relevant material"/>
        <outline text="May also show some or all of Steal This Film"/>
        <outline text="Mid-Atlantic Podcasters Roundtable Saturday 10:00 AM"/>
        <outline text="Intellectual Property - The Oil of the 21st Century Saturday 3:00 PM"/>
        <outline text="All The News Thats Fit Not to Print Sunday 12:00 AM"/>
        <outline text="What's on Your Mind? Blogging, Audio Blogging and Podcasts Sunday 3:00 PM"/>
      </outline>
    </outline>
    <outline text="Listener Feedback" Offset="04:06">
      <outline text="Jed on AOP">
        <outline text="Thinking of it as a pre-compiler, macro language"/>
        <outline text="Logging for debugging"/>
      </outline>
    </outline>
    <outline text="Security Alerts" Offset="06:39">
      <outline text="Antivirus inventor questions security best practices" Offset="06:58">
        <outline text="http://rss.slashdot.org/~r/slashdot/eqWf/~3/231094886/article.pl"/>
        <outline text="Peter Tippett, chief scientist at ICSA and inventor of what became NAV"/>
        <outline text="Presentation at computer forensics show"/>
        <outline text="Says one third of practices are based on outdated information"/>
        <outline text="Thinks time is wasted on vulnerabilities unlikely to be exploited"/>
        <outline text="Takes disclosure, vulnerability and patch management to task in particular"/>
        <outline text="Problem with that is his analogy is limited by laws of physics"/>
        <outline text="Many rare exploits are only rare because of attacker inattention"/>
        <outline text="Cost to fix may be higher than he'd like, but not the same as fixing a physical safety defect"/>
        <outline text="The exercise of asking, though, is worthwhile"/>
        <outline text="Automation can and does reduce cost of patch management, my favorite the auto update channel/feature"/>
        <outline text="His criticism seems to be more on the research, knowledge management side"/>
        <outline text="Acknowledges that resources are limited, need to be best prioritized"/>
        <outline text="His sole point seems to boil down to that, best security dividend for investment, like security awareness training for employees"/>
      </outline>
      <outline text="Firefox update includes ten security fixes" Offset="10:51">
        <outline text="http://go.theregister.com/feed/www.theregister.co.uk/2008/02/08/firefox_update/"/>
        <outline text="Top three most critical fixes">
          <outline text="History browsing disclosure"/>
          <outline text="Privilege escalation that could be used by CSS attacks"/>
          <outline text="A memory corruption bug"/>
        </outline>
        <outline text="Also includes fix directory traversal via chrome handling, previously discussed here"/>
        <outline text="Available through built-in update mechanism"/>
        <outline text="Already vulnerable">
          <outline text="http://rss.slashdot.org/~r/slashdot/eqWf/~3/232385359/article.pl"/>
          <outline text="Another directory traversal"/>
          <outline text="Also appears to be exposed via protocol handling"/>
          <outline text="This time through resource handler"/>
          <outline text="Author suggests it is due to an incomplete fix of the chrome protocol handler"/>
          <outline text="This is a risk of all such expedited fixes, that they are incomplete"/>
          <outline text="Author has posted a proof of concept"/>
          <outline text="NoScript will stop this exploit, too"/>
        </outline>
      </outline>
    </outline>
    <outline text="News" Offset="13:59">
      <outline text="Issues with Internet voting" Offset="14:13">
        <outline text="http://feeds.freedom-to-tinker.com/~r/freedom-to-tinker/~3/229012933/"/>
        <outline text="Internet voting arises more and more"/>
        <outline text="This past week was primary vote, Super Tuesday">
          <outline text="Libertarian part of AZ is conducting its entire vote online"/>
          <outline text="Democratic parting experimenting with overseas voting"/>
          <outline text="Military experimented with SERVE but was roundly criticized"/>
          <outline text="SERVE was abandoned"/>
        </outline>
        <outline text="Some EU states also experimenting">
          <outline text="Good anecdote about friend from Estonia"/>
          <outline text="Estonian system allows for vote overriding"/>
          <outline text="Helps address voter coercion"/>
        </outline>
        <outline text="Voter confidentiality/coercion, security bigger concerns"/>
        <outline text="Libertarian system doesn't even use SSL"/>
        <outline text="Dan Wallach didn't experiment far enough to find if allowed vote overriding"/>
        <outline text="Democrats fair little better">
          <outline text="Use SSL but has similar problems besides"/>
          <outline text="Vice chair of Democrats abroad gave a non-answer to security questions"/>
          <outline text="Primary vote online is public so don't have to address privacy"/>
          <outline text="Cite use of expert vendor but no concern over track record, specifics"/>
        </outline>
        <outline text="Privacy key to general election, though"/>
        <outline text="Could try public publishing of voters, votes but unconvinced this is a good idea"/>
        <outline text="Assumption is knowledge of vote could form basis of discrimination"/>
        <outline text="Citizen should feel free to vote their conscience without being penalized"/>
        <outline text="Nothing else forces someone to reveal political leanings"/>
        <outline text="Biggest limiter, yet to be addressed anywhere, is security of PC"/>
        <outline text="Easiest attack is a worm, malware, see success of Storm"/>
        <outline text="Impossible to prove after the fact that the vote is genuine"/>
        <outline text="Cost of distributing dedicate voting machines defeats the point"/>
        <outline text="No software on a general computer will ever be free of security concerns"/>
      </outline>
      <outline text="Life of a software engineer" Offset="21:11">
        <outline text="http://rss.slashdot.org/~r/slashdot/eqWf/~3/229068544/article.pl"/>
        <outline text="Clearly states the problem of family, friends not understanding job"/>
        <outline text="I had long since given up on trying to explain"/>
        <outline text="Lays out the basics of the process well"/>
        <outline text="In particular, when talking about requirements and design, well expresses human factors"/>
        <outline text="Some of what he says should be considered by programmers, too"/>
        <outline text="I have seen too much evidence of programmers ignoring customers and/or usability"/>
        <outline text="Uses art forms as metaphors throughout"/>
        <outline text="Also captures the fluidity of software"/>
        <outline text="At any point, it may need to change for a variety of reasons"/>
        <outline text="Some revision in other art forms, but there is usually a final form"/>
        <outline text="Software changes even after this final form, patches and upgrades">
          <outline text="Is an upgrade like a sequel in fiction?"/>
          <outline text="Maybe a director's cut"/>
        </outline>
        <outline text="A good balance of non-coding activities, too"/>
        <outline text="Documenting and teaching, as well as requirements and customer wrangling"/>
        <outline text="Not sure this accomplishes the end goal, explaining to non-coders"/>
        <outline text="A beautiful insight into professional programming, regardless"/>
      </outline>
      <outline text="Study shows online gap between parents, children widening" Offset="24:48">
        <outline text="http://rss.slashdot.org/~r/slashdot/eqWf/~3/229353279/article.pl"/>
        <outline text="The gap is between what parents thinks kids do and what they actually do online"/>
        <outline text="Study conducted by Prof. Lemish of Tel Aviv University"/>
        <outline text="Local study of Jewish, Arab families"/>
        <outline text="Wonder what cultural biases, if any, are affecting results?"/>
        <outline text="Study covers privacy, interaction with strangers, and circumventing monitors, filters"/>
        <outline text="Lemish points to poor media literacy on part of parents"/>
        <outline text="Suggests this is no different than before the internet"/>
        <outline text="Parents not necessarily aware of what goes on at clubs, school or parties"/>
        <outline text="Gives same advice as has always been helpful"/>
        <outline text="Parents should talk to their children"/>
        <outline text="Should educated, enforce the same safety rules as offline"/>
        <outline text="She thinks internet is worth the risk and parents can close the gap"/>
        <outline text="Give her credit for a constructive response, not just more chicken little reactions"/>
        <outline text="I worry a little that the potential for danger is a bit greater online"/>
        <outline text="As a parent, I suppose I can see increased risk in a number of activities"/>
        <outline text="The challenge really is the same, regardless, equip kids to keep themselves safe"/>
      </outline>
      <outline text="RIAA chief wants users' PC's to filter for infringement" Offset="28:50">
        <outline text="http://feeds.arstechnica.com/~r/arstechnica/BAaf/~3/231091674/20080207-riaa-boss-spyware-could-solve-the-encryption-problem.html"/>
        <outline text="Cary Sherman, RIAA boss, admits network filtering need not be mandated"/>
        <outline text="Also admits it may encourage crypto arms race"/>
        <outline text="Suggests end users should install local filters"/>
        <outline text="Language is admittedly loaded with &quot;could&quot;, &quot;would&quot;"/>
        <outline text="Regardless, in the absence of requirement, users would not install"/>
        <outline text="If mandating filtering is out for the ISP, why would they consider for end user?"/>
        <outline text="Also considered installation in modem or router"/>
        <outline text="This is no better than in the ISP's network"/>
        <outline text="Even more ludicrous, in the P2P applications themselves"/>
        <outline text="Filtering is solving the wrong problem"/>
        <outline text="RIAA needs to understand why users turn to P2P and build competitive business models"/>
        <outline text="RIAA chief was just speculating">
          <outline text="http://feeds.arstechnica.com/~r/arstechnica/BAaf/~3/231748769/20080208-riaa-president-simply-musing-about-filters-on-your-pc.html"/>
          <outline text="RIAA spokesperson specifically said they have no such agenda"/>
          <outline text="Explained Sherman was just speculating"/>
          <outline text="A few more points to consider"/>
          <outline text="No law enforcement technique is 100% percent, why should we expect different from IP enforcement?"/>
          <outline text="The point at which any filter scheme is effective is way beyond user inconveience"/>
          <outline text="Most telling, that this is what RIAA execs come up with when brain storming"/>
          <outline text="Need to work harder to get them past control, to understand real opportunities"/>
          <outline text="Labels, other players seem more receptive"/>
          <outline text="Do trade organizations profit less when labels operate smoothly?"/>
        </outline>
      </outline>
    </outline>
    <outline text="tail -f" Offset="33:22">
      <outline text="Prentice re-introducing Canadian DMCA" Offset="33:42">
        <outline text="http://feeds.feedburner.com/~r/boingboing/iBag/~3/229426563/urgent-canadians-nee.html"/>
        <outline text="This law was tabled last term amidst protests"/>
        <outline text="Prof. Michael Geist has the best coverage"/>
        <outline text="http://www.michaelgeist.ca/"/>
        <outline text="Points out Prentice's contradictions of own party's policies"/>
        <outline text="http://feeds.feedburner.com/~r/boingboing/iBag/~3/229426563/urgent-canadians-nee.html"/>
        <outline text="One of the most concerning issues is lack of consultation"/>
        <outline text="Citizens, researchers, consumer groups being left out in the cold"/>
        <outline text="Fair dealings also under represented"/>
        <outline text="Much misleading propaganda has also been published in response to protests"/>
        <outline text="Geist is also doing a good job of taking that apart"/>
        <outline text="Story has opportunities for action, including online groups, events and lists of MPs that constituents can and should contact"/>
      </outline>
      <outline text="EFF trying to stem tide of spurious legal wrangling by RIAA" Offset="35:24">
        <outline text="http://www.eff.org/deeplinks/2008/02/arista-v-does-1-21-getting-riaa-play-rules"/>
        <outline text="RIAA prosecutors asking judges to accept controversial legal theory"/>
        <outline text="Not saying this theory is bad, on the face"/>
        <outline text="Problem is push bypasses usual deliberation"/>
        <outline text="Risk is may be distorting the law in the process"/>
        <outline text="Making available argument is a telling example"/>
        <outline text="Jury instruction in Thomas case, Atlantic v. Howell"/>
        <outline text="EFF is filing an amicus brief in Arista v. Does 1-21"/>
        <outline text="Also looks to balance first amendment protection for anonymous speech"/>
        <outline text="RIAA trying to bypass consideration of merits of case before issuing subpoena"/>
        <outline text="EFF has fought for preliminary inquiry, to stall baseless suits just to unmask critics"/>
        <outline text="Nice to note acknowledgement that RIAA can meet constitutional limits, that is valid"/>
        <outline text="Simply trying to prevent distortion, preserve standards, limits"/>
      </outline>
    </outline>
    <outline text="Outro" Offset="38:35">
      <outline text="Contact me">
        <outline text="Email to feedback@thecommandline.net"/>
        <outline text="Web site at http://thecommandline.net/"/>
        <outline text="IM to command.line@skype"/>
        <outline text="Listener comment line is 240-949-2638"/>
        <outline text="del.icio.us tag is &quot;for:cmdln&quot;"/>
        <outline text="http://twitter.com/cmdln"/>
      </outline>
      <outline text="I'd like to thank libsyn.com for AAC hosting and Wouter de Bie for MP3 hosting"/>
      <outline text="These notes and the show audio and music are covered by a Creative Commons license">
        <outline text="http://creativecommons.org/licenses/by-nc-sa/3.0/us/"/>
        <outline text="Attribution, non-commercial, share alike"/>
      </outline>
    </outline>
  </body>
</opml>
