<?xml version="1.0" encoding="UTF-8"?>
<opml version="1.0">
  <head>
    <title>cmdln.net_2008-08-17</title>
    <expansionState>1,2,17,33,34,51,59,66,69,76,88,95,102,106,112,136,157,158,169,180,181,189</expansionState>
  </head>
  <body>
    <outline text="Intro" Offset="00:17"/>
    <outline text="Security Alerts" Offset="02:12">
      <outline text="Gmail cookie stealing tool" Offset="02:31">
        <outline text="http://voices.washingtonpost.com/securityfix/2008/08/new_tool_automates_cookie_stea.html"/>
        <outline text="Based on a talk at DefCon"/>
        <outline text="Problem is that your session cookie may be sent in the clear"/>
        <outline text="This can happen even if you use https for access to Gmail"/>
        <outline text="If an attacker forces a view of an image or page from Gmail in the clear, cookie gets sent in the clear"/>
        <outline text="Presenter, Mike Perry, also had code to automate this attack"/>
        <outline text="Other popular services are vulnerable in the same way"/>
        <outline text="Problem is actually at last a year old"/>
        <outline text="Google finally added a setting to Gmail to force secure cookies only"/>
        <outline text="Should appear under outgoing message encoding in settings"/>
        <outline text="Must use this setting, secure login is not enough as it doesn't constrain cookies to https only"/>
        <outline text="Also, logging out rather than allowing these cookies to linger can help"/>
        <outline text="Good advice for other sites that may be vulnerable"/>
        <outline text="May not be available for domain users, other google apps yet"/>
      </outline>
      <outline text="Passwords resets less secure than re-using old passwords" Offset="05:55">
        <outline text="http://www.itworld.com/tech-society/54193/beware-meta-password-reuse"/>
        <outline text="Big problem is using same password for multiple sites, services"/>
        <outline text="Magnifies scope, scale of someone else discover password"/>
        <outline text="Users can do better, though"/>
        <outline text="For common password recovery, same problem seems to occur"/>
        <outline text="People use same meta information to confirm identity to invoke a reset"/>
        <outline text="Sites, services constraint choices, though, usually in form of a question"/>
        <outline text="Deducing answers are not hard, especially with public searches, databases"/>
        <outline text="Worse, questions can be obscure, change, or difficult to answer consistently"/>
        <outline text="Shares an example of a different way to go"/>
        <outline text="System prompts for preferences"/>
        <outline text="Psychology says preferences are mostly static"/>
        <outline text="Would have liked to see a bit more on minimum preferences for confidence"/>
        <outline text="Seems like two choices, like and dislike, could be attacked randomly"/>
        <outline text="Would have to be coupled with limits, timeouts"/>
      </outline>
    </outline>
    <outline text="News" Offset="09:43">
      <outline text="EFF stepping in to defence MIT hackers against transit authority" Offset="09:57">
        <outline text="http://www.infoworld.com/article/08/08/11/EFF_to_appeal_court_order_halting_subway_hacker_talk_1.html"/>
        <outline text="Students were going to present at DefCon on vulnerabilities in MBTA system"/>
        <outline text="Consistent with hacks in other fare card systems, like London's Oyster and DC's paper fare cards"/>
        <outline text="Even heard tell of an ancient exploit in BART's old mag swipe cards, similar to the recent exploit of DC's mag strip cards"/>
        <outline text="MBTA sought and won a temporary injunction"/>
        <outline text="Anderson, Ryan, Chiesa presenting based on class project work"/>
        <outline text="MIT also named as a defendant, probably because they knew about the material"/>
        <outline text="Court cites computer crime law as basis of ruling, classifying fare system as computer"/>
        <outline text="EFF disagrees, fight the injunction on the students behalf"/>
        <outline text="EFF's Opsahl claims information on talks published previously in regular press"/>
        <outline text="Thinks this erodes the MBTA's case and hence the reasoning behind the injunction"/>
        <outline text="Slides of talk already distributed to DefCon attendees on CD, MBTA also inadvertently released further details through court records"/>
        <outline text="Again, eroding the argument about disclosure critical information"/>
        <outline text="Student's work look at entire system, not just the fare cards"/>
        <outline text="Special focus on those, though, as a non-secure RFID application"/>
        <outline text="MBTA uses Mifare cards, same vendor having problems elsewhere"/>
        <outline text="MIT students response to transit authority over pulled talk">
          <outline text="http://www.eff.org/deeplinks/2008/08/mit-students-response-mbta-statements"/>
          <outline text="MBTA is misrepresenting the sequence of events"/>
          <outline text="Trying to make out that the students were uncooperative"/>
          <outline text="Students in fact contacted them first"/>
          <outline text="Supplied them with plenty of information"/>
          <outline text="Students, their professor Rivest thought early discussions had settled the issue"/>
          <outline text="MBTA went to court before notifying students they would be doing so"/>
        </outline>
        <outline text="Transit official supports students">
          <outline text="http://www.eff.org/deeplinks/2008/08/mbta-transit-official-supports-mit-students-story"/>
          <outline text="Confirms their version"/>
          <outline text="Supports that they delivered the requested information and then some"/>
          <outline text="Also that students claimed they had never exploited the system"/>
          <outline text="Further that they never would nor would they teach others to do so"/>
          <outline text="Jibes with initial story, that they left key pieces out of the presentation"/>
        </outline>
        <outline text="Many support MIT students">
          <outline text="http://www.groklaw.net/article.php?story=2008081309502119"/>
          <outline text="A group of CS professors and computer scientists support the students"/>
          <outline text="Claim TRO should be vacate for three reasons">
            <outline text="The order is unconstitutional prior restraint on the free speech"/>
            <outline text="Computer Fraud and Abuse Act doesn't prohibit discussions of computer security"/>
            <outline text="The publishing of info by MBTA itself erodes their claims for injunctive relief"/>
          </outline>
          <outline text="Reiterates and bolsters claims of EFF"/>
          <outline text="Prior restraint, form of censorship, prohibits students from telling their side of the story"/>
          <outline text="MBTA is under no such restriction, spreading misinformation"/>
        </outline>
        <outline text="MIT students still under gag order">
          <outline text="http://feeds.wired.com/~r/wired/topheadlines/~3/365157129/mit-students-su.html"/>
          <outline text="Second judge upheld original TRO"/>
          <outline text="Considering requests for modifications from both parties"/>
          <outline text="MBTA is seeking to get more information from students, including emails and copies of their original paper"/>
          <outline text="EFF keeping their strategy under wraps"/>
          <outline text="Seem to be focusing on pre-publication review, prior restraint, though"/>
        </outline>
        <outline text="This is the question of responsible disclosure, but with a system non-technical people can appreciate"/>
        <outline text="What is clear is much of the vulnerability information is already available"/>
        <outline text="If the MBTA showed better evidence of wanting to address problems, perhaps prior restraint, non-disclosure would be warranted"/>
        <outline text="Public discussion seems to be the only alternative in the face of unwillingness to really solve problems"/>
        <outline text="Problems affect honest riders, raising fares, adding restrictions, limits"/>
      </outline>
      <outline text="Court supports open source license as conditions on copyright" Offset="17:49">
        <outline text="http://www.eff.org/deeplinks/2008/08/condition-or-covenant-and-why-should-you-care"/>
        <outline text="Recent activity on appeals in Jacobsen case"/>
        <outline text="Talked about this when SFLC was suing for GPL breaches"/>
        <outline text="This is the case that had gotten the farthest in court testing an open source license"/>
        <outline text="License in question is the Artistic License, over some model railroad code"/>
        <outline text="Judge vacated a ruling that AL was just an issue of contract"/>
        <outline text="Upheld that it is a condition on a copyright">
          <outline text="Governed by federal, not state law"/>
          <outline text="Stiffer potential penalties, arguably greater protection"/>
          <outline text="EFF article does a good job of explaining the difference"/>
        </outline>
        <outline text="Opinion was surprisingly broad, clueful speaking to benefits of public licenses generally"/>
        <outline text="Unfortunately, supporting conditions on copyright opens abuses in EULAs, too"/>
        <outline text="Those could be contested, tested separately though"/>
        <outline text="GrokLaw on Jacobsen case">
          <outline text="http://www.groklaw.net/article.php?story=20080814141638469"/>
          <outline text="Basically, she thinks licenses now care more weight, for good and ill"/>
          <outline text="Time to involve more legal experts both in crafting and choosing licenses"/>
        </outline>
        <outline text="PK on Jacobsen case">
          <outline text="http://feeds.publicknowledge.org/~r/publicknowledge-fulltext/~3/366044421/1712"/>
          <outline text="Points out the key difference between open source and EULA conditions"/>
          <outline text="EULA typically conditions just use"/>
          <outline text="Uses Blizzard v. MDY as an example, EULA governs use of game, service"/>
          <outline text="Open licenses govern copyright actions, copy, remix and distribute"/>
        </outline>
      </outline>
      <outline text="Using CAPTCHAs to help scanning texts" Offset="21:26">
        <outline text="http://feeds.arstechnica.com/~r/arstechnica/BAaf/~3/364993719/20080814-captchas-workfor-digitizing-old-damaged-texts-manuscripts.html"/>
        <outline text="Starts describing one archival problem"/>
        <outline text="Texts most often in need of digital preservation are already damaged"/>
        <outline text="Makes them that much harder for an imperfect technology to handle"/>
        <outline text="CMU researchers saw similarities between digitization problem, CAPTCHAs"/>
        <outline text="Launched a project a year ago to turn problem text into CAPTCHAs"/>
        <outline text="Called reCAPTCHA"/>
        <outline text="Get humans to help recover damaged text"/>
        <outline text="Have just shared their results"/>
        <outline text="Had over 40K sites participate"/>
        <outline text="Use control words to help weed out spam bots"/>
        <outline text="Also have multiple human guesses per word, weighting improves accuracy"/>
        <outline text="Tested with 250 NYT articles form different eras"/>
        <outline text="Already had reliable transcriptions"/>
        <outline text="OCR along achieve 84% or so, with reCAPTCHA, went up to 99.1%"/>
        <outline text="Comparable to professional, expert human services"/>
        <outline text="Turns out reCAPTCHA images are also more resistant to machine attacks"/>
        <outline text="Guess that is a result of them not being generated by smooth math transforms"/>
        <outline text="Time for real users to guess also not significantly different from traditional CAPTCHAs"/>
        <outline text="Some issues with sites in non-English speaking countries or ESL"/>
        <outline text="An intangible social benefit, too, that users like that they are contributing to a larger project"/>
        <outline text="There is an API and a PHP library if you are interested in using"/>
        <outline text="http://recaptcha.net/"/>
      </outline>
      <outline text="Renewed push for next version of JavaScript" Offset="25:48">
        <outline text="http://feeds.wired.com/~r/wired/topheadlines/~3/365104855/JavaScript_2_Looking_Good_Thanks_to__Harmony__Project"/>
        <outline text="Talked about Eich's thoughts on ECMAscript 4.0/JavaScript 2"/>
        <outline text="Microsoft and Yahoo balked at ambitions of 4/2"/>
        <outline text="Split off to work on ECMAscript 3.1, as a practical step towards 4"/>
        <outline text="Two groups have reached an accord"/>
        <outline text="Agreed on project for release, Harmony"/>
        <outline text="Among other things, drops packages and namespaces"/>
        <outline text="Looks like these, along with early binding, dropped permanently"/>
        <outline text="Harmony focusing on release next year and plans beyond"/>
        <outline text="Article points out also affects Adobe's ActionScript"/>
        <outline text="May also place Tamarind, Screaming Monkey in jeopardy"/>
        <outline text="I am concerned that packages are completely gone"/>
        <outline text="I don't think JavaScript intensive applications will scale well without"/>
        <outline text="I doubt that web applications are going to stop getting larger, more complex"/>
        <outline text="Already have several competing libraries, how to handle when there are inevitable collisions?"/>
        <outline text="Libraries aren't complete interchangeable so foolish to suggest using just one"/>
        <outline text="More concerned that Microsoft derailed this effort"/>
        <outline text="The web continues to be fractured by them even as more and more applications move into the cloud with web interfaces"/>
        <outline text="Despite seeming consensus on 3.1, how compatible will their implementation really be?"/>
        <outline text="JavaScript is also only part of the picture, if their rendering, object model and style support continues to be different, just as bad as ever"/>
      </outline>
    </outline>
    <outline text="tail -f" Offset="29:32">
      <outline text="Pandora about to close up shop" Offset="29:51">
        <outline text="http://www.readwriteweb.com/archives/pandora_on_the_verge_of_closing_shop.php"/>
        <outline text="I have raved about Pandora before"/>
        <outline text="Uses music genome project, database of traits of music for identifying similarities"/>
        <outline text="Has come under fire abroad"/>
        <outline text="Forced by license costs, inability to negotiate licenses to close shop anywhere but the US"/>
        <outline text="Company is now facing a decision to shut down altogether"/>
        <outline text="This is a long range consequence of web royalty hike from last year"/>
        <outline text="Read somewhere that Pandora pays a huge chunk of its revenue to SoundExchange"/>
        <outline text="Company is hoping Rep. Berman can negotiate a more sane rate"/>
        <outline text="They are not optimistic"/>
      </outline>
      <outline text="RIAA pays Andersen's legal fees" Offset="31:17">
        <outline text="http://rss.slashdot.org/~r/slashdot/eqWf/~3/365655967/article.pl"/>
        <outline text="Not only did she win in the labels' case against her"/>
        <outline text="She has been paid"/>
        <outline text="Not just the judges order, court creditors have confirmed labels paid over 100K in lawyers fees plus interest"/>
        <outline text="May encourage others to fight back, it is possible"/>
        <outline text="While she hasn't recovered any damages, she also doesn't have to cover her own fees"/>
        <outline text="Has already launched a counter suit for malicious prosecution"/>
        <outline text="Andersen v. Atlantic could settle the questions over investigatory practices"/>
        <outline text="Whether agents are legal to investigate where and how they do"/>
        <outline text="Question of wether downloads by investigators is sufficient evidence or constitutes an authorized use"/>
      </outline>
    </outline>
    <outline text="Outro" Offset="33:27">
      <outline text="Contact me">
        <outline text="Email to feedback@thecommandline.net"/>
        <outline text="Web site at http://thecommandline.net/"/>
        <outline text="IM to command.line@skype"/>
        <outline text="Listener comment line is 240-949-2638"/>
        <outline text="del.icio.us tag is &quot;for:cmdln&quot;"/>
        <outline text="http://twitter.com/cmdln"/>
      </outline>
      <outline text="I'd like to thank libsyn.com for AAC hosting and Wouter de Bie for MP3 hosting"/>
      <outline text="These notes and the show audio and music are covered by a Creative Commons license">
        <outline text="http://creativecommons.org/licenses/by-nc-sa/3.0/us/"/>
        <outline text="Attribution, non-commercial, share alike"/>
      </outline>
    </outline>
  </body>
</opml>
