<?xml version="1.0" encoding="UTF-8"?>
<opml version="1.0">
  <head>
    <title>cmdln.net_2008-08-10</title>
    <expansionState>0,1,5,6,16,24,38,39,50,66,70,76,86,92,103,128,129,140,155,156,164</expansionState>
  </head>
  <body>
    <outline text="Intro" Offset="00:17">
      <outline text="Closure on Reiser case">
        <outline text="What did the reporting leave out?"/>
        <outline text="What if he had revealed the location of the body earlier on?"/>
        <outline text="The fact that he knew that changes the geek defense"/>
      </outline>
    </outline>
    <outline text="Security Alerts" Offset="05:18">
      <outline text="Big reveal of DNS flaw" Offset="05:38">
        <outline text="http://go.theregister.com/feed/www.theregister.co.uk/2008/08/06/kaminsky_black_hat/"/>
        <outline text="The problem stems from a limit in a safety measure"/>
        <outline text="DNS requests contain a random token"/>
        <outline text="The tokens are 16 bit, though, meaning they max at 65K or so"/>
        <outline text="A brute force attack can overcome these tokens because of the limited number"/>
        <outline text="His talk has apparently convinced many skeptics of the real danger"/>
        <outline text="Kaminsky also speculated on the variety of exploits the vulnerability made possible"/>
        <outline text="http://voices.washingtonpost.com/securityfix/2008/08/kaminsky_details_dns_flaw_at_b.html"/>
        <outline text="More details on the attack scenarios described in the talk"/>
        <outline text="Regression vulnerability in DNS patch">
          <outline text="http://www.nytimes.com/2008/08/09/technology/09flaw.html?_r=1&amp;hp&amp;oref=slogin"/>
          <outline text="Written up by a physicist, Evgeniy Polyakov"/>
          <outline text="Claims he can reliable cause an invalid return for a DNS query"/>
          <outline text="Other critics think the fix for the cache poisoning is just a band aid"/>
          <outline text="The attach was conducted against BIND"/>
          <outline text="This according to author's own blog"/>
          <outline text="Don't know if it applies to other implementations"/>
        </outline>
      </outline>
      <outline text="Hackers kicked out of Black Hat for hacking" Offset="09:10">
        <outline text="http://blog.wired.com/27bstroke6/2008/08/french-reporter.html"/>
        <outline text="Three french reporters were sniffing logins on the press network"/>
        <outline text="Tried to convince organizers to post on Wall of Sheep"/>
        <outline text="This is a shame based display, started at DefCon"/>
        <outline text="Started running it at Black Hat for the first time this year"/>
        <outline text="Wall of Sheep sniffs general conference network for non-secure login data"/>
        <outline text="Press network is supposed to be off limits, though"/>
        <outline text="Wall of Sheep is legal because attendees are notified"/>
        <outline text="Reporters actions are technically illegal since they monitored the private network unbeknownst to its users"/>
        <outline text="Press network private to wall them off from the free for all that occurs on regular network"/>
        <outline text="Three reports were from a media sponsor, had covered the conference before"/>
        <outline text="Apparently were honest about what they had done, don't appear to be malicious per se"/>
        <outline text="Still, for violating the rules, were ejected from the conference"/>
      </outline>
    </outline>
    <outline text="News" Offset="11:42">
      <outline text="A software solution to bad hard drives" Offset="11:57">
        <outline text="http://rss.slashdot.org/~r/slashdot/eqWf/~3/354985871/article.pl"/>
        <outline text="Author, Thanassis Tsiodras, concerned about problem of media failure"/>
        <outline text="Even with a robust backup strategy, using same fallible media"/>
        <outline text="Points out residual problems with other strategies from RAID to revision control"/>
        <outline text="Suggests using error correcting codes, like Reed-Solomon"/>
        <outline text="Store additional data, a checksum or error check value"/>
        <outline text="With his scheme, need 16 errors in a smallish block to destroy the block"/>
        <outline text="Describes some clever data layout based on physical sectors on disk"/>
        <outline text="This interleaving of protected blocks means hitting that 16 error limit is very unlikely"/>
        <outline text="Hacked some existing code"/>
        <outline text="rsbep utility on Debian, part of the dvbackup software">
          <outline text="dvbackup lets you use your DV based camcorder as a backup device"/>
          <outline text="rsbep is the error correction utility for the package"/>
        </outline>
        <outline text="Offers sources, including assembly for x86"/>
        <outline text="Describes what he changed on rsbep and why"/>
        <outline text="Has a screenshot of using the tool, very compelling"/>
        <outline text="Need to bundle up files of interest, as a tar or similar file"/>
        <outline text="Then use utility to create protected version"/>
        <outline text="When restoring, adds an extra step, undoing the shield to be able to open restored file"/>
        <outline text="Author claims this utility has saved his data repeatedly"/>
        <outline text="Are there file systems that use this?"/>
        <outline text="Could someone use this idea to write one or a module for FUSE?"/>
        <outline text="Rather than building a UI, is it worh just making it transparent?"/>
        <outline text="Portable C version built just fine on my OS X box"/>
        <outline text="Simple test worked fine"/>
        <outline text="Need to think about how to incorporate this into critical backup needs"/>
      </outline>
      <outline text="HEA finalized in both House, Senate" Offset="18:55">
        <outline text="http://www.eff.org/deeplinks/2008/08/congress-bows-big-content-scapegoats-higher-ed"/>
        <outline text="This is a large package of reforms"/>
        <outline text="Buried in it is a very contentious provision about policing infringing materials"/>
        <outline text="Stipulates that universities must use technological deterrents">
          <outline text="Traffic shaping and monitoring"/>
          <outline text="Content filtering"/>
        </outline>
        <outline text="Universities must also promote legal alternatives"/>
        <outline text="ACM, others have identified these technologies as often not working and always increasing cost for universities to operate"/>
        <outline text="Students don't care for DRM in legal alternatives, adopting to date has been poor even when free to students"/>
        <outline text="Based on flawed assumptions">
          <outline text="That universities have a higher rate of piracy"/>
          <outline text="That their network managers are not already dealing with the issue"/>
        </outline>
        <outline text="Universities hardly differ from the average, MPAA copped to flawed study data last year"/>
        <outline text="Network managers do more than typical ISP, including user education and active punishment for proven offenders"/>
        <outline text="Bills still needs to pass"/>
        <outline text="Time to act"/>
        <outline text="EFF is recommending voluntary collective licenses as an alternative"/>
        <outline text="Universities pay a blanket license fee"/>
        <outline text="Students get unrestricted access but artists still get compensated"/>
      </outline>
      <outline text="EFF educating, protecting hackers at Black Hat" Offset="22:47">
        <outline text="http://www.eff.org/press/archives/2008/08/05-0"/>
        <outline text="EFF has started a new project, Coders' Rights Project"/>
        <outline text="As part of the launch, they provided access to a staff attorney"/>
        <outline text="To answer questions about reverse engineering, vulnerability reporting, copyright, etc."/>
        <outline text="Meant to help ease researchers concerns from bogus legal threats"/>
        <outline text="Continues their work against the provisions of the DMCA that act to restrict legitimate research">
          <outline text="Think about the security implications of the Sony rootkit"/>
          <outline text="Also some claims of DMCA violation on e-voting systems"/>
        </outline>
        <outline text="Will expand the scope of their work under this project to computer crimes acts"/>
        <outline text="Looking to narrow the scope of these laws"/>
        <outline text="Also looking at tackle some issues with EULAs"/>
        <outline text="EFF doesn't clarify but I will, this is not just a legal defense fund"/>
        <outline text="Specifically for legitimate research"/>
        <outline text="The project page collects of a lot of education material"/>
        <outline text="Also press releases and relevant news stories"/>
        <outline text="Two FAQs prominently placed, for reverse engineering, vulnerability research"/>
      </outline>
      <outline text="Ubiquitous data in the cloud" Offset="26:14">
        <outline text="http://arstechnica.com/news.ars/post/20080806-stateless-computing-the-future-of-the-cloud.html"/>
        <outline text="A presentation by Merril Lynch's CTO, Jeffrey Birnbaum, at LinuxWorld"/>
        <outline text="Uses the term stateless in a new way"/>
        <outline text="What he means is a ubiquitous file system"/>
        <outline text="Thinks part of the key to scaling cloud computing is accessing through this FS"/>
        <outline text="Stateless seems to refer to lacking local state"/>
        <outline text="Posits this will lead to a decoupling of software, data from physical machines"/>
        <outline text="Like other cloud computing advocates, envisions discussing applications in terms of abstracted units of computation"/>
        <outline text="Thinks this will ease deployment issues"/>
        <outline text="Not so sure of that, think you need standards on VMs and cloning like Joyent post discussed"/>
        <outline text="Specifically discusses regional mirroring and caching for network wide storage"/>
        <outline text="ML has already partially implemented"/>
        <outline text="Sounds like the applications in question are not just web applications"/>
        <outline text="Sounds like some of what they are doing is traditional client and server apps"/>
        <outline text="That's what I take away from his discussion of problems with Windows"/>
        <outline text="Specifically that they use RDP to solve Windows not working well with network file systems, like NFS under Linux"/>
        <outline text="Sees much of ML's hardware going under utilized"/>
        <outline text="Early goal for their own plans is to see better utilization by being able to run any apps on any available hardware"/>
        <outline text="Their focus is on the technology to place work on hardware"/>
        <outline text="Obviously if they are successful means they can be cheaper hardware but more of it, especially as needed"/>
        <outline text="Reminds me a bit of a recent article in CACM on Google's Map/Reduce"/>
        <outline text="Much of what makes that work is the task coordination across the cloud, as much as the separation of mapping and reducing tasks"/>
        <outline text="Birnbaum's talk matches trends I am seeing discussed in more places"/>
        <outline text="That a traditional player like ML is adopting says something about the staying power of these trends"/>
      </outline>
    </outline>
    <outline text="tail -f" Offset="31:33">
      <outline text="Thomas trial may end in mistrial, retrial" Offset="31:52">
        <outline text="http://feeds.arstechnica.com/~r/arstechnica/BAaf/~3/356491442/20080805-judge-in-jammie-thomas-p2p-case-sounds-open-to-retrial.html"/>
        <outline text="Judge Davis' hearing was this week"/>
        <outline text="RIAA made same arguments about difficulties to prove infringement"/>
        <outline text="Judge remained opposed to their interpretation"/>
        <outline text="Observers think Davis was inclined towards granting a re-trial"/>
        <outline text="RIAA seemed confident it could produce the require evidence it didn't submit in the original trial"/>
        <outline text="Defense attorney work to have &quot;authorized&quot; downloads by RIAA investigators excluded"/>
        <outline text="Judge's ruling to appear in another month or so"/>
        <outline text="This is turning into anything but the slam dunk case the RIAA must have thought"/>
        <outline text="Irony is if they hadn't fought so hard over the making available argument, then they'd only be having standard appeal instead of mistrial"/>
      </outline>
      <outline text="Blizzard seeking to block opening of Glider sources" Offset="33:57">
        <outline text="http://virtuallyblind.com/2008/07/29/blizzard-seeks-permanent-injunction/"/>
        <outline text="After winning summary judgement, seeking permanent injunction"/>
        <outline text="Wants to keep Glider off its servers, which makes sense"/>
        <outline text="Also trying wants injunction against MDY releases sources"/>
        <outline text="It is an unusual injunction to seek, though their reasoning makes a certain sort of sense"/>
        <outline text="This is likely to be fought much more strenuously"/>
        <outline text="The implications of the summary judgement are bad enough"/>
        <outline text="Erosion of first sale doctrine as applies to software"/>
        <outline text="But establishing precedent for preventing open source sharing"/>
        <outline text="Scary thing is it may be granted"/>
        <outline text="The summary judgement was on a copyright basis, not license or contract"/>
        <outline text="Same judge may see open source release as further copyright infringement or inducement to infringe"/>
        <outline text="Programmer developed on their own, without any proprietary knowledge"/>
        <outline text="Shouldn't it fall under reverse engineering protections?"/>
      </outline>
    </outline>
    <outline text="Outro">
      <outline text="Contact me">
        <outline text="Email to feedback@thecommandline.net"/>
        <outline text="Web site at http://thecommandline.net/"/>
        <outline text="IM to command.line@skype"/>
        <outline text="Listener comment line is 240-949-2638"/>
        <outline text="del.icio.us tag is &quot;for:cmdln&quot;"/>
        <outline text="http://twitter.com/cmdln"/>
      </outline>
      <outline text="I'd like to thank libsyn.com for AAC hosting and Wouter de Bie for MP3 hosting"/>
      <outline text="These notes and the show audio and music are covered by a Creative Commons license">
        <outline text="http://creativecommons.org/licenses/by-nc-sa/3.0/us/"/>
        <outline text="Attribution, non-commercial, share alike"/>
      </outline>
    </outline>
  </body>
</opml>
