<?xml version="1.0" encoding="UTF-8"?>
<opml version="1.0">
  <head>
    <title>cmdln.net_2008-06-22</title>
    <expansionState>0,2,3,14,19,37,38,62,74,82,88,104,113,132,133,146,161,162,170</expansionState>
  </head>
  <body>
    <outline text="Intro" Offset="00:17">
      <outline text="CBC Radio One drops Search Engine"/>
    </outline>
    <outline text="Security Alerts" Offset="02:22">
      <outline text="A couple of Firefox 3 bugs already" Offset="02:41">
        <outline text="http://go.theregister.com/feed/www.theregister.co.uk/2008/06/19/firefox3_bugs/"/>
        <outline text="This is an unspecified flaw, reported by vendor TippingPoint"/>
        <outline text="Apparently received through their zero-day bounty program"/>
        <outline text="No further substantiation of the bug"/>
        <outline text="Flaw apparently allows hostile code injection, so pretty severe"/>
        <outline text="Affects Firefox 2  as well, not just the new 3"/>
        <outline text="TippingPoint withholding details until Firefox developers issue a patch"/>
        <outline text="Also this week, a posting on a security list of a buffer overflow"/>
        <outline text="Unclear if this is the same bug"/>
        <outline text="Posting only mentions Firefox 3, not enough to rule out it also affects 2"/>
        <outline text="High risk vulnerability in Firefox 3 already">
          <outline text="http://feeds.downloadsquad.com/~r/weblogsinc/downloadsquad/~3/316338151/"/>
          <outline text="More details on bug from TippingPoint"/>
          <outline text="To be at risk, need to visit a malicious site and click an infected link"/>
          <outline text="Mozilla already planning to include a fix in 3.0.1 update"/>
        </outline>
      </outline>
      <outline text="Listening to encrypted VoIP without decrypting it" Offset="05:17">
        <outline text="http://technology.newscientist.com/channel/tech/dn14124-compressed-web-phone-calls-are-easy-to-bug.html"/>
        <outline text="New Scientist article"/>
        <outline text="Encryption in VoIP has been touted as a means to protect against illegal wire tapping"/>
        <outline text="Many services use or plan to use compression"/>
        <outline text="Help offset bandwidth consumption"/>
        <outline text="According to research at John Hopkins VBR compression is a problem"/>
        <outline text="Detectable patterns survive encryption"/>
        <outline text="The variation in bits used for spoken words is regular and predictable"/>
        <outline text="Research isn't up to recovering conversations"/>
        <outline text="Can detect phrases, though, by building a comparison phrase, compressing and encrypting"/>
        <outline text="Average detection rate is only about 50%, jumps to 90% with longer keywords, like jargon"/>
        <outline text="Says to me that there may be significant challenges to full recognition or arbitrary filtering"/>
        <outline text="Still, this is similar to frequency analysis for simple text ciphers"/>
        <outline text="Makes you wonder that it hadn't been identified sooner"/>
        <outline text="Still, a risk worth being aware of"/>
        <outline text="Using constant rate compression would eliminate the possibility"/>
        <outline text="Would be good to see VoIP vendors include that in security considerations"/>
      </outline>
    </outline>
    <outline text="News" Offset="09:27">
      <outline text="Top woman coder explains gender inspired differences in code" Offset="09:41">
        <outline text="http://blogs.wsj.com/biztech/2008/06/06/men-write-code-from-mars-women-write-more-helpful-code-from-venus/"/>
        <outline text="Emma Grattan, VP of Engineering at Ingres"/>
        <outline text="Ingres is venerable database started at Berkeley"/>
        <outline text="Now a commercially supported open source database"/>
        <outline text="Spawned may other databases, included SQL Server and PostgreSQL"/>
        <outline text="Believes men and women write code differently"/>
        <outline text="Women are more considerate of others who will read, follow"/>
        <outline text="Leave directions, explanations; better capture intent"/>
        <outline text="Thinks men want to show how clever they are"/>
        <outline text="Write more cryptic code"/>
        <outline text="Says she can see the difference and accurately guess gender 70%-80% of the time"/>
        <outline text="Institute standards to run out gender differences"/>
        <outline text="Include file or type level comment"/>
        <outline text="Also detailed history"/>
        <outline text="Isn't that what revision management software is for?"/>
        <outline text="I am unconvinced this is entirely a gender issue"/>
        <outline text="I think less seasoned developers fixate on cleverness, ignore good comments"/>
        <outline text="More experienced start to appreciate that roadmap affect"/>
        <outline text="If women are more open to the latter style of development, then the industry should preferentially hire"/>
        <outline text="Coding standards are only a partial answer"/>
        <outline text="Need to mentor developers to appreciate enlightened self interest"/>
        <outline text="You will need to maintain your own code"/>
        <outline text="After several months away, you will appreciate better guidance, explanation of intent"/>
      </outline>
      <outline text="UCITA sneaking back inside anti-spyware bill" Offset="13:53">
        <outline text="http://www.gripe2ed.com/scoop/story/2008/6/16/1219/71034"/>
        <outline text="UCITA was a federal bill considered in the late 90s"/>
        <outline text="http://en.wikipedia.org/wiki/UCITA"/>
        <outline text="On the surface, seems like an acceptable idea"/>
        <outline text="Would introduce standards around software licenses, sales and other commercial practices"/>
        <outline text="Problem is that the bill, as proposed, allowed vendors to remotely disable their software"/>
        <outline text="Justification was self-help when piracy was suspected"/>
        <outline text="Bill was ultimately defeated but passed in two states, MD and VA"/>
        <outline text="This &quot;self-help&quot; appears to be sneaking back in inside an anti-spyware bill"/>
        <outline text="Counter Spy Act, introduced by Senator Mark Pryor, D-AZ"/>
        <outline text="US Senate Committee for Commerce and Transportation held a hearing on the 11th to discuss issues, hear testimony about bill"/>
        <outline text="Very similar to poor Can-Spam act, article itemizes problems">
          <outline text="Basically, consumer isn't given any additional tools"/>
          <outline text="Doesn't really change what is and is not illegal"/>
        </outline>
        <outline text="Troubling part is section 6a"/>
        <outline text="Grants exemptions to vendors when using remote monitoring for several purposes"/>
        <outline text="Includes network security, troubleshooting but also explicitly states for addressing issues of unauthorized use"/>
        <outline text="Representatives of BSA are lauding this section, in particular"/>
        <outline text="Raises the question of the real goal of the bill; anti-piracy or pro-privacy?"/>
        <outline text="Americans for Fair Electronic Commerce Transactions, AFFECT">
          <outline text="Organization that helped defeat UCITA"/>
          <outline text="Speaking out on section 6a, too"/>
          <outline text="Points of ambiguities of authorized use, that this is more suitable for judicial review"/>
        </outline>
        <outline text="Article also points out that spyware authors often try to claim legitimacy"/>
        <outline text="Further muddies the waters as they may claim what they are doing is legal"/>
      </outline>
      <outline text="AP to discuss guidelines, compromise with bloggers" Offset="18:42">
        <outline text="http://feeds.wired.com/~r/wired/topheadlines/~3/313791659/AP_BLOGGERS"/>
        <outline text="Story started with AP claiming copyright infringement over a blogger quoting their stories"/>
        <outline text="Specifically sent a legal notice to Rogers Cadenhead, the author of The Drudge Retort"/>
        <outline text="Cadenhead complied with notice, citing hassles for a small player to deal with a potential court case"/>
        <outline text="My impression is AP wants to exclude bloggers unilaterally, or at least control who can use what"/>
        <outline text="Sounds like a fair use case to me, at best AP would need to file specific complaints"/>
        <outline text="Would be up to a judge to decide infringement vs. fair use"/>
        <outline text="Another case of a business feeling threatened, wanting the law to protect them from change, in this case bloggers as distributors of news"/>
        <outline text="Now trying to craft guidelines for use"/>
        <outline text="Problem is, such guidelines still should and cannot trump fair use"/>
        <outline text="Idea is not entirely novel, Creative Commons is a general license, conditions for use without explicit consent"/>
        <outline text="CC doesn't go against copyright, however, actually relies on it"/>
        <outline text="AP claims concern over both dilution of business and journalistic integrity, i.e. risk of material quoted out of context"/>
        <outline text="This is not novel, should be legal, other recourse"/>
        <outline text="Cadenhead and representative from bloggers group were positive about guidelines from AP"/>
        <outline text="More details on bloggers association">
          <outline text="http://feeds.feedburner.com/~r/boingboing/iBag/~3/315315588/who-are-the-media-bl.html"/>
          <outline text="Some question of just how much the Media Bloggers Association represents general interests"/>
          <outline text="Teresa Nielsen Hayden did some research, seems to indicate the group is one blogger"/>
          <outline text="Right wing attack blogger"/>
          <outline text="However, commenter claims other key bloggers have been involved with MBA"/>
          <outline text="Says the associations involvement in past instances has been helpful"/>
          <outline text="Her post also clarifies that Cadenhead requested MBA's involvement"/>
          <outline text="And that news stories are misrepresenting participation of MBA"/>
        </outline>
      </outline>
      <outline text="House passes telecom immunity bill" Offset="23:42">
        <outline text="http://www.eff.org/press/archives/2008/06/20"/>
        <outline text="Bill positioned as a much needed update to FISA procedures"/>
        <outline text="Rushed to a vote after introduction"/>
        <outline text="Never a good sign"/>
        <outline text="Passed by over a two-thirds majority"/>
        <outline text="Requires dismissal of existing suits against telcos"/>
        <outline text="Allows telcos to be given immunity with a simple memo from the executive"/>
        <outline text="Unclear if this would only apply to existing activities or apply in the future"/>
        <outline text="EFF correctly identifies certain risk"/>
        <outline text="Will lose ability to discover full scope of domestic wire taps"/>
        <outline text="Goes to vote in the Senate next week"/>
        <outline text="Use EFF action center to ask your senators to vote no"/>
        <outline text="Requires a call, so act promptly"/>
        <outline text="I intend to call tomorrow morning"/>
        <outline text="Read elsewhere that Obama supports the bill though he opposes the immunity provision"/>
        <outline text="Says he will fight to remove the provision"/>
        <outline text="Will vote yes even if he cannot get the provision removed, though"/>
        <outline text="Why are otherwise sane Congress critters so willing to give up?"/>
      </outline>
    </outline>
    <outline text="tail -f" Offset="26:56">
      <outline text="Dodgy interview with Prentice on C-61" Offset="27:16">
        <outline text="http://www.cbc.ca/searchengine/blog/2008/06/jim_prentice_unlocked_the_sear.html#more"/>
        <outline text="The impression I get is that Prentice doesn't fully understand the bill"/>
        <outline text="Made his question to Jesse about him reading it a bit hypocritical"/>
        <outline text="Legal scholars, like Geist, are still reading it"/>
        <outline text="Was genuinely evasive on issues of DRM trumping user rights"/>
        <outline text="A bit naive about market sorting things out"/>
        <outline text="Suggested at one point that music industry is abandoning DRM"/>
        <outline text="Then why legislate anti-circumvention measures?"/>
        <outline text="Was a bit rude, but did say he only had ten minutes"/>
        <outline text="Warned repeatedly he had to go before he did hang up"/>
        <outline text="The fact that he could not articular a simple set of goals, principles suggest to me he just adopted what industry asked"/>
        <outline text="Kept saying it was complicated, didn't even re-iterate the simple view expressed in the backgrounder"/>
      </outline>
      <outline text="Professors back Thomas on flawed jury instruction" Offset="29:37">
        <outline text="http://feeds.wired.com/~r/wired/topheadlines/~3/315047726/professors-sidi.html"/>
        <outline text="When Judge Davis said he erred on the jury instruction about making available, invited comment"/>
        <outline text="Will hold a hearing in August"/>
        <outline text="So far, first and only responders are a group of ten copyright scholars"/>
        <outline text="Not any I recognize, either, so its not just the usual suspects"/>
        <outline text="Strongly state proof of transfer is required"/>
        <outline text="Based on review of the statute"/>
        <outline text="One of the scholars even stepped forward on the issue of RIAA downloads as proof"/>
        <outline text="Said verdict could stand on 24 downloads"/>
        <outline text="Rejects that these count as they are authorized by industry"/>
        <outline text="Article admits that proving a genuine, 3rd party transfer is technologically infeasible"/>
        <outline text="How does that square with unquestionable rights against real piracy, then?"/>
        <outline text="The constructive answer is it is moot"/>
        <outline text="Industry needs to spend those resources competing with P2P, not stifling it"/>
      </outline>
    </outline>
    <outline text="Outro" Offset="33:20">
      <outline text="Contact me">
        <outline text="Email to feedback@thecommandline.net"/>
        <outline text="Web site at http://thecommandline.net/"/>
        <outline text="IM to command.line@skype"/>
        <outline text="Listener comment line is 240-949-2638"/>
        <outline text="del.icio.us tag is &quot;for:cmdln&quot;"/>
        <outline text="http://twitter.com/cmdln"/>
      </outline>
      <outline text="I'd like to thank libsyn.com for AAC hosting and Wouter de Bie for MP3 hosting"/>
      <outline text="These notes and the show audio and music are covered by a Creative Commons license">
        <outline text="http://creativecommons.org/licenses/by-nc-sa/3.0/us/"/>
        <outline text="Attribution, non-commercial, share alike"/>
      </outline>
    </outline>
  </body>
</opml>
