<?xml version="1.0" encoding="UTF-8"?>
<opml version="1.0">
  <head>
    <title>cmdln.net_2008-09-28</title>
    <expansionState>1,2,16,32,42,43,65,90,113,147,148,153,161,174,175,183</expansionState>
  </head>
  <body>
    <outline text="Intro" Offset="00:17"/>
    <outline text="Security Alerts" Offset="05:20">
      <outline text="Security suite running on an OpenMoko phone" Offset="05:39">
        <outline text="http://rss.slashdot.org/~r/slashdot/eqWf/~3/MNBvFgC-9lg/article.pl"/>
        <outline text="Similar to BackTrack Linux, Live CD distro built with security testing in mind"/>
        <outline text="http://en.wikipedia.org/wiki/BackTrack"/>
        <outline text="Existing security software customized to take advantage of Neo's hardware"/>
        <outline text="neopwn sells OpenMoko phone's pre-installed"/>
        <outline text="Also sells software bundle"/>
        <outline text="Looking to build a wiki, a support community"/>
        <outline text="Also added automation to make running tests easier"/>
        <outline text="To help overcome limitations of touchscreen keyboard"/>
        <outline text="Project also offers a netbook loaded with similar tools"/>
        <outline text="Clearly hiding the phone makes attackers less conspicuous"/>
        <outline text="Like software tools, should encourage organizations to take security very seriously"/>
        <outline text="For professionals, lowers cost, complexity"/>
      </outline>
      <outline text="New browser exploit, &quot;clickjacking&quot;" Offset="08:15">
        <outline text="http://blogs.zdnet.com/security/?p=1972"/>
        <outline text="Affects all major browsers, latest versions"/>
        <outline text="Was going to be presented about recently but canceled at behest of vendors"/>
        <outline text="Researchers, Robert Hansen and Jeremiah Grossman, have released some info, anyway"/>
        <outline text="Has nothing to do with JavaScript"/>
        <outline text="An attacker can pretty much take over what links your browser clicks"/>
        <outline text="Some vendor patches are starting to come in, issue is deep, though"/>
        <outline text="You have to click for the attacker to redirect, though"/>
        <outline text="Flash and JavaScript make it easier"/>
        <outline text="Sounds like a flaw in DHTML, maybe event bubbling in the DOM?"/>
        <outline text="Researchers say turning off all plugins, scripts is only protection"/>
        <outline text="Author of NoScript, Giorgio Maone, offered some good news"/>
        <outline text="http://blogs.zdnet.com/security/?p=1973"/>
        <outline text="Default NoScript config will foil most attacks"/>
        <outline text="Check Plugins|Forbid iFrames for complete protection"/>
        <outline text="Cause of clickjacking remains unknown">
          <outline text="http://feeds.arstechnica.com/~r/arstechnica/BAaf/~3/94ahC-pI7ME/20080926-new-clickjacking-affects-all-browsers-cause-remains-unknown.html"/>
          <outline text="Researchers pulled own talk after learning Adobe product may be affected"/>
          <outline text="Trying to be responsible in disclosure"/>
          <outline text="Only pure text browsers, like lynx, unaffected as they have no click events"/>
          <outline text="Attack is not new, apparently, but risk is not being fully appreciated"/>
          <outline text="Lack of details leads author to speculate exploits in the wild may be thin"/>
          <outline text="Zero Day does cite some proof of concept code, though"/>
          <outline text="At least Adobe is aware of it and working of fix"/>
          <outline text="Hopefully browser developers are as well"/>
        </outline>
      </outline>
    </outline>
    <outline text="News" Offset="11:58">
      <outline text="German developer strips privacy concerns from Chrome to produce Iron" Offset="12:13">
        <outline text="http://feeds.downloadsquad.com/~r/weblogsinc/downloadsquad/~3/401972241/"/>
        <outline text="Even though Google removed copyright license from EULA"/>
        <outline text="Still likely to he collecting some anonymous statistics"/>
        <outline text="In particular for location bar auto complete"/>
        <outline text="German government issued a warning against Chrome for privacy concerns"/>
        <outline text="SRWare, a German developer, modified Chromium"/>
        <outline text="Stripped out identifying information"/>
        <outline text="Disabled info being sent to Google, even crash reports"/>
        <outline text="Took out Google updater"/>
        <outline text="Otherwise seems to work just fine"/>
        <outline text="Clearly an advantage of open source of Chromium"/>
        <outline text="Chrome is not unique with these concerns, though"/>
        <outline text="I am unaware of an altered build of Firefox for this reason"/>
        <outline text="There are extensions to accomplish those, though"/>
        <outline text="Stealther, for one, also 3.1 will come with a private mode"/>
        <outline text="I think the pressure for Google, others to collect data is only going to grow"/>
        <outline text="Some sort of compromise is going to be necessary"/>
        <outline text="Especially with the collector now subsidizing a browser"/>
        <outline text="The key question is how do users audit that collectors are being honest"/>
        <outline text="Thankfully, there is a motivated hacker community that can and will do so"/>
        <outline text="Tech press also likely to shed light on results, good or bad"/>
      </outline>
      <outline text="Muxtape may be another pirate's dilemma" Offset="16:20">
        <outline text="http://feeds.arstechnica.com/~r/arstechnica/BAaf/~3/NjjQu1an6XA/20080923-muxtape-may-be-dead-but-it-lives-on-through-its-children.html"/>
        <outline text="Muxtape started by hosting playlists"/>
        <outline text="The idea was like exchanging mix tapes back when cassettes were really only writable audio media"/>
        <outline text="Got shut down by RIAA when started hosting actual audio files"/>
        <outline text="Has inspired imitators looking to fill the need, avoid the trap"/>
        <outline text="MixTube uses YouTube infrastructure"/>
        <outline text="Pushes logistics, legal worries onto YouTube"/>
        <outline text="Favtape hosts playlists, imports from last.fm, Pandora"/>
        <outline text="Uses seeqpod to find tracks all over the public internet"/>
        <outline text="seeqpod also in trouble with labels"/>
        <outline text="Favtape, seeqpod try to evade issues by claiming to be just search engines"/>
        <outline text="Like PirateBay, do not host anything, just help users find it elsewhere"/>
        <outline text="Labels think returning infringing material as majority of results is comparable to directly hosting"/>
        <outline text="Songza mixes both approaches, serving from YouTube"/>
        <outline text="Finds songs elsewhere when YouTube doesn't have track"/>
        <outline text="Pays to collecting societies, unlike MixTube, FavTape"/>
        <outline text="Hard to see any of these as replacements for downloads"/>
        <outline text="Are all streaming, cannot take music with you"/>
        <outline text="Like Pandora, serving a need the industry is under serving"/>
        <outline text="The quick appearance of clones reinforces the point"/>
        <outline text="Similar to Napster and its work-a-likes"/>
        <outline text="Labels could control their own online destiny"/>
        <outline text="If any of them offered similar capabilities out of their massive catalogs"/>
        <outline text="Could drive download sales"/>
      </outline>
      <outline text="Open source life streaming" Offset="21:20">
        <outline text="http://www.hackszine.com/blog/archive/2008/09/sweetcron_open_source_lifestre.html?CMP=OTC-7G2N43923558"/>
        <outline text="Life streaming has emerged as a way to consolidate social network services"/>
        <outline text="Provides a single place for people to read all your updates"/>
        <outline text="Some also provide an additional conversation channel"/>
        <outline text="In my experience, some people like, some hate"/>
        <outline text="Enough prefer it that many have popped up"/>
        <outline text="Sweetcron is the first open source one"/>
        <outline text="Can self host, own your own your own lifestream data"/>
        <outline text="You have to self host, at the moment"/>
        <outline text="If it is well received, providers may start to offer, like WordPress"/>
        <outline text="You can also modify appearance, function to suit"/>
        <outline text="Part of what I dislike about FriendFeed is the network on top of lifestream"/>
        <outline text="See way to much cross chatter"/>
        <outline text="In my view, doesn't make it easy enough to ignore FoaF data"/>
        <outline text="Sweetcron seems to eschew network, is more like a single author blog"/>
        <outline text="With separate RSS feeds for each friend, would seem easier to manage"/>
        <outline text="Licensed under GPL v3, but not Affero GPL"/>
        <outline text="Regardless, could enable new uses closed lifestream apps do not"/>
        <outline text="Should make it easier to adopt new sources to pull in"/>
        <outline text="Has a plugin architecture, as well as supporting explicit themes"/>
        <outline text="With slow adoption of OpenSocial, data portability, this seems like a good workaround"/>
        <outline text="Let users self host, make installation, customization simple enough for folks used to hacking on WordPress or MT"/>
      </outline>
      <outline text="Adobe's reasoning for keeping Flash closed" Offset="25:54">
        <outline text="http://go.theregister.com/feed/www.theregister.co.uk/2008/09/26/adobe_google_mozilla_tensions/"/>
        <outline text="Flash is ubiquitous, whether you like it or not"/>
        <outline text="Google seems to like it put isn't backing it, outside of YouTube"/>
        <outline text="Their open web advocate, Dion Almaer, cites the closed source of the player"/>
        <outline text="Adobe's response has been that the tools, Flex, are now open"/>
        <outline text="The file format, SWF, is also open"/>
        <outline text="Says it is unlikely the player will be opened"/>
        <outline text="Adobe's McAllister cites proprietary codecs as one reason"/>
        <outline text="Adobe licenses them then gives them away"/>
        <outline text="They don't think this would work with an open source player"/>
        <outline text="McAllister also points out there is an open, transparent community around Flash"/>
        <outline text="Everything but the source, basically"/>
        <outline text="McAllister thinks Java's decision, success had more to do with a slowing market"/>
        <outline text="Implication is Flash is anything but slowing"/>
        <outline text="Sun did show that codec licenses could be cleared or re-written"/>
        <outline text="Linux kernel has straddled proprietary device drivers"/>
        <outline text="Not ideal, but another model that could be explored for codecs"/>
        <outline text="Cites others taking advantage of open source, to Adobe's detriment"/>
        <outline text="Using a share-alike license could ensure Adobe benefits as much as anyone from work of others"/>
        <outline text="Seems like Adobe's problematic efforts could have done with a better license choice"/>
        <outline text="The case in point is TraceMonkey, which is surprising"/>
        <outline text="Still sounds like this is a specific negotiation, license failure than a general flaw of open source"/>
        <outline text="Mozilla also sees the collaboration differently, that they are contributing back"/>
        <outline text="Final reason is fragmentation, compares it to state of browsers"/>
        <outline text="That one may be the most fair as the sole benefit of closed source is Flash is the same everywhere"/>
        <outline text="With competitive offerings like SilverLight and JavaFX, though, some fragmentation is being attempted"/>
        <outline text="If Adobe maintains the gold standard, there may be little reason for this to change"/>
        <outline text="With Microsoft's reluctance around open source, unlikely they'd try to build their own Flash just for MSIE"/>
        <outline text="If end users had to install Flash in MSIE, though, it would seriously erode the appeal"/>
        <outline text="Could work with WHATWG to get Adobe ideas, technology adopted as part of HTML 5"/>
        <outline text="Would only work if they were willing to open the relevant parts of Flash"/>
        <outline text="Canvas tag and SVG have been trying to provide an open replacement to Flash for a while"/>
        <outline text="Could cooperate with that rather than compete"/>
      </outline>
    </outline>
    <outline text="tail -f" Offset="32:03">
      <outline text="DoJ enforcement dropped from IP Enforcement bill" Offset="32:22">
        <outline text="http://www.eff.org/deeplinks/2008/09/doj-agrees-ip-enforcement-bill-bad-idea"/>
        <outline text="DoJ sent a letter echoing concerns of EFF, other groups"/>
        <outline text="Despite fast tracking of bill, civil enforcement provisions have been dropped"/>
        <outline text="Bill has been unanimously passed by the Senate in this form"/>
        <outline text="More on IP bill passing Senate">
          <outline text="http://feeds.arstechnica.com/~r/arstechnica/BAaf/~3/YQec21fjHic/20080926-ip-bill-passes-senate-no-civil-enforcement-power-for-doj.html"/>
          <outline text="Creation of copyright czar within the White House remains"/>
          <outline text="Oddly enough, White House objects to this"/>
          <outline text="House version of the bill passed in May"/>
          <outline text="With latest changes, the two bills largely match"/>
          <outline text="Much remains else remains, especially increase in penalties"/>
          <outline text="House will have to pass the new Senate language, not much resistance is expected"/>
        </outline>
      </outline>
      <outline text="Senate updates rules on members use of internet services" Offset="33:55">
        <outline text="http://feeds.arstechnica.com/~r/arstechnica/BAaf/~3/uuQg6yPh7aE/20080925-senate-boldly-advances-to-2005-with-updated-web-linking-rules.html"/>
        <outline text="Only amends policy to allow linking"/>
        <outline text="Not as comprehensive as what Culbertson called for"/>
        <outline text="No authorization of third party services"/>
        <outline text="Unclear how this will work with embedding such as YouTube"/>
        <outline text="Former ban was largely ignored, anyway"/>
        <outline text="If the changes still don't track use, well, may still be ignored"/>
        <outline text="Understand concerns about commercial, political influence"/>
        <outline text="Government should look into open source solutions"/>
        <outline text="laconica.gov.us and sweetcron.gov.us"/>
        <outline text="Would provide channels without influence"/>
        <outline text="Government, congress critters would own data"/>
      </outline>
    </outline>
    <outline text="Outro" Offset="36:28">
      <outline text="Contact me">
        <outline text="Email to feedback@thecommandline.net"/>
        <outline text="Web site at http://thecommandline.net/"/>
        <outline text="IM to command.line@skype"/>
        <outline text="Listener comment line is 240-949-2638"/>
        <outline text="del.icio.us tag is &quot;for:cmdln&quot;"/>
        <outline text="http://twitter.com/cmdln"/>
      </outline>
      <outline text="I'd like to thank libsyn.com for AAC hosting and Wouter de Bie for MP3 hosting"/>
      <outline text="These notes and the show audio and music are covered by a Creative Commons license">
        <outline text="http://creativecommons.org/licenses/by-nc-sa/3.0/us/"/>
        <outline text="Attribution, non-commercial, share alike"/>
      </outline>
    </outline>
  </body>
</opml>
