Skip to main content

Home/ Future of the Web/ Group items tagged must-read

Rss Feed Group items tagged

Filter: All | Bookmarks | Topics Simple Middle
Gary Edwards

The WHATWG Blog » Blog Archive » The Road to HTML 5: character encoding - 0 views

blog.whatwg.org/d-to-html-5-character-encoding

character-encoding html5 whatwg

shared by Gary Edwards on 13 Feb 09 - Cached
  • Gary Edwards on 13 Feb 09
     
    To sum up: character encoding is complicated, and it has not been made any easier by several decades of poorly written software used by copy-and-paste-educated authors. You should always specify a character encoding on every HTML document, or bad things will happen. You can do it the hard way (HTTP Content-Type header), the easy way ( declaration), or the new way ( attribute), but please do it. The web thanks you. Good post, lots of links to other "MUST READ" commentaries and explanations of character encoding. Including Joel Spolsky and Tim Bray.
Gary Edwards

Clouds Should Be Open, Not Proprietary - 0 views

openwebdeveloper.sys-con.com/...613436

Cloud-Computing joyent

shared by Gary Edwards on 17 Nov 08 - Cached
  • Gary Edwards on 17 Nov 08
     
    The nine essential considerations of cloud computing. This may be the best article yet written about cloud computing. A must read! ,,, ""What sort of cloud computer(s) should we be building or expecting from vendors? Are there issues of lock-in that should concern customers of either SaaS clouds or PaaS clouds? I've been thinking about this problem as the CEO of a PaaS cloud computing company for some time. Clouds should be open. They shouldn't be proprietary. More broadly, I believe no vendor currently does everything that's required to serve customers well."
Paul Merrell

Rapid - Press Releases - EUROPA - 0 views

europa.eu/...pressReleasesAction.do

Intel antitrust DG Competion

shared by Paul Merrell on 13 May 09 - Cached
  • The Commission found that Intel engaged in two specific forms of illegal practice. First, Intel gave wholly or partially hidden rebates to computer manufacturers on condition that they bought all, or almost all, their x86 CPUs from Intel. Intel also made direct payments to a major retailer on condition it stock only computers with Intel x86 CPUs. Such rebates and payments effectively prevented customers - and ultimately consumers - from choosing alternative products. Second, Intel made direct payments to computer manufacturers to halt or delay the launch of specific products containing competitors’ x86 CPUs and to limit the sales channels available to these products.
  • Intel awarded major computer manufacturers rebates on condition that they purchased all or almost all of their supplies, at least in certain defined segments, from Intel: Intel gave rebates to computer manufacturer A from December 2002 to December 2005 conditional on this manufacturer purchasing exclusively Intel CPUs Intel gave rebates to computer manufacturer B from November 2002 to May 2005 conditional on this manufacturer purchasing no less than 95% of its CPU needs for its business desktop computers from Intel (the remaining 5% that computer manufacturer B could purchase from rival chip maker AMD was then subject to further restrictive conditions set out below) Intel gave rebates to computer manufacturer C from October 2002 to November 2005 conditional on this manufacturer purchasing no less than 80% of its CPU needs for its desktop and notebook computers from Intel Intel gave rebates to computer manufacturer D in 2007 conditional on this manufacturer purchasing its CPU needs for its notebook computers exclusively from Intel.
  • Furthermore, Intel made payments to major retailer Media Saturn Holding from October 2002 to December 2007 on condition that it exclusively sold Intel-based PCs in all countries in which Media Saturn Holding is active.
  • ...5 more annotations...
  • In its decision, the Commission does not object to rebates in themselves but to the conditions Intel attached to those rebates.
  • Intel structured its pricing policy to ensure that a computer manufacturer which opted to buy AMD CPUs for that part of its needs that was open to competition would consequently lose the rebate (or a large part of it) that Intel provided for the much greater part of its needs for which the computer manufacturer had no choice but to buy from Intel. The computer manufacturer would therefore have to pay Intel a higher price for each of the units supplied for which the computer manufacturer had no alternative but to buy from Intel. In other words, should a computer manufacturer fail to purchase virtually all its x86 CPU requirements from Intel, it would forego the possibility of obtaining a significant rebate on any of its very high volumes of Intel purchases. Moreover, in order to be able to compete with the Intel rebates, for the part of the computer manufacturers' supplies that was up for grabs, a competitor that was just as efficient as Intel would have had to offer a price for its CPUs lower than its costs of producing those CPUs, even if the average price of its CPUs was lower than that of Intel.
  • For example, rival chip manufacturer AMD offered one million free CPUs to one particular computer manufacturer. If the computer manufacturer had accepted all of these, it would have lost Intel's rebate on its many millions of remaining CPU purchases, and would have been worse off overall simply for having accepted this highly competitive offer. In the end, the computer manufacturer took only 160,000 CPUs for free.
  • Intel also interfered directly in the relations between computer manufacturers and AMD. Intel awarded computer manufacturers payments - unrelated to any particular purchases from Intel - on condition that these computer manufacturers postponed or cancelled the launch of specific AMD-based products and/or put restrictions on the distribution of specific AMD-based products. The Commission found that these payments had the potential effect of preventing products for which there was a consumer demand from coming to the market. The Commission found the following specific cases: For the 5% of computer manufacturer B’s business that was not subject to the conditional rebate outlined above, Intel made further payments to computer manufacturer B provided that this manufacturer : sold AMD-based business desktops only to small and medium enterprises sold AMD-based business desktops only via direct distribution channels (as opposed to through distributors) and postponed the launch of its first AMD-based business desktop in Europe by 6 months. Intel made payments to computer manufacturer E provided that this manufacturer postponed the launch of an AMD-based notebook from September 2003 to January 2004. Before the conditional rebate to computer manufacturer D outlined above, Intel made payments to this manufacturer provided that it postponed the launch of AMD-based notebooks from September 2006 to the end of 2006.
  • The Commission obtained proof of the existence of many of the conditions found to be illegal in the antitrust decision even though they were not made explicit in Intel’s contracts. Such proof is based on a broad range of contemporaneous evidence such as e-mails obtained inter alia from unannounced on-site inspections, in responses to formal requests for information and in a number of formal statements made to the Commission by the other companies concerned. In addition, there is evidence that Intel had sought to conceal the conditions associated with its payments.
  • Paul Merrell on 13 May 09
     
    This is an uncharacteristically strong press release from DG Competition. I still must read the order, but the description of the evidence is incredible, particularly the finding of concealment of its rebate conditions by Intel.
Gary Edwards

With faster Chrome browser, Google offers an Android alternative - CNET - 0 views

www.cnet.com/...-offers-an-android-alternative

web-app-framework Chrome Android

shared by Gary Edwards on 27 Jun 14 - No Cached
  • Gary Edwards on 27 Jun 14
     
    "On mobile devices, the Web hasn't lived up to its promise of a universal programming foundation. Google is trying to change that." Android hogged the spotlight at Google I/O, but performance improvements in Google's Chrome browser show that the company hasn't given up on trying to advance its other programming foundation -- the Web. The mobile version of Chrome has become much more responsive since 2013, said Paul Irish, a developer advocate on the Chrome team, speaking at the San Francisco conference. "We've improved the speed of animation by 75 percent and of scrolling 35 percent," Irish told developers Thursday. "We're committed to getting you 60 frames per second on the mobile Web." That performance is crucial for persuading people to use Web sites rather than native apps for things like posting on social networks, reading news, and playing games. It's also key to getting programmers to take the Web path when so many today focus on native apps written directly for Google's Android operating system and Apple's iOS competitor. The 60 frames-per-second rate refers to how fast the screen redraws when elements are in motion, either during games or when people are doing things like swiping among pages and dragging icons. The 60fps threshold is the minimum that game developers strive for, and to achieve it with no distracting stutters, a device must calculate how to update its entire screen every 16.7 milliseconds. Google, whose Android operating system initially lagged Apple's rival iOS significantly in this domain of responsiveness, has made great strides in improving its OS and its apps. But the mobile Web hasn't kept pace, and that means programmers have been more likely to aim for native apps rather than Web-based apps that can run on any device. ............................ Good review focused on the growing threat that native "paltform specific" apps are replacing Web apps as the developer's best choice. Florian thinks that native apps will win
Gonzalo San Gil, PhD.

Software Should Be Free: The FSF's first Annual Report - Free Software Foundation - wor... - 1 views

www.fsf.org/...e-the-fsfs-first-annual-report

software should must be free fsf.org

shared by Gonzalo San Gil, PhD. on 03 Sep 16 - No Cached
  • Gonzalo San Gil, PhD. on 03 Sep 16
     
    "by Georgia Young - Published on Aug 11, 2016 03:58 PM The Free Software Foundation has been fighting for user freedom for more than thirty years with your support. FY2015 Annual Report cover - Software should be free as in freedom Now we are publishing our first Annual Report, which covers the 2015 fiscal year of October 1, 2014 through September 30, 2015. The report offers a look at the Foundation's activities, accomplishments, and financial picture. You will also read about the impact of our programs and FY2015's major events, including LibrePlanet and our thirtieth anniversary. A high resolution version is also available."
  • Gonzalo San Gil, PhD. on 03 Sep 16
     
    "by Georgia Young - Published on Aug 11, 2016 03:58 PM The Free Software Foundation has been fighting for user freedom for more than thirty years with your support. FY2015 Annual Report cover - Software should be free as in freedom Now we are publishing our first Annual Report, which covers the 2015 fiscal year of October 1, 2014 through September 30, 2015. The report offers a look at the Foundation's activities, accomplishments, and financial picture. You will also read about the impact of our programs and FY2015's major events, including LibrePlanet and our thirtieth anniversary. A high resolution version is also available."
Paul Merrell

The Latest Rules on How Long NSA Can Keep Americans' Encrypted Data Look Too Familiar |... - 0 views

justsecurity.org/...s-hold-encrypted-data-familiar

surveillance state NSA IAA-2015 Sect-309 legislation

shared by Paul Merrell on 26 Jan 15 - No Cached
  • Does the National Security Agency (NSA) have the authority to collect and keep all encrypted Internet traffic for as long as is necessary to decrypt that traffic? That was a question first raised in June 2013, after the minimization procedures governing telephone and Internet records collected under Section 702 of the Foreign Intelligence Surveillance Act were disclosed by Edward Snowden. The issue quickly receded into the background, however, as the world struggled to keep up with the deluge of surveillance disclosures. The Intelligence Authorization Act of 2015, which passed Congress this last December, should bring the question back to the fore. It established retention guidelines for communications collected under Executive Order 12333 and included an exception that allows NSA to keep ‘incidentally’ collected encrypted communications for an indefinite period of time. This creates a massive loophole in the guidelines. NSA’s retention of encrypted communications deserves further consideration today, now that these retention guidelines have been written into law. It has become increasingly clear over the last year that surveillance reform will be driven by technological change—specifically by the growing use of encryption technologies. Therefore, any legislation touching on encryption should receive close scrutiny.
  • Section 309 of the intel authorization bill describes “procedures for the retention of incidentally acquired communications.” It establishes retention guidelines for surveillance programs that are “reasonably anticipated to result in the acquisition of [telephone or electronic communications] to or from a United States person.” Communications to or from a United States person are ‘incidentally’ collected because the U.S. person is not the actual target of the collection. Section 309 states that these incidentally collected communications must be deleted after five years unless they meet a number of exceptions. One of these exceptions is that “the communication is enciphered or reasonably believed to have a secret meaning.” This exception appears to be directly lifted from NSA’s minimization procedures for data collected under Section 702 of FISA, which were declassified in 2013. 
  • While Section 309 specifically applies to collection taking place under E.O. 12333, not FISA, several of the exceptions described in Section 309 closely match exceptions in the FISA minimization procedures. That includes the exception for “enciphered” communications. Those minimization procedures almost certainly served as a model for these retention guidelines and will likely shape how this new language is interpreted by the Executive Branch. Section 309 also asks the heads of each relevant member of the intelligence community to develop procedures to ensure compliance with new retention requirements. I expect those procedures to look a lot like the FISA minimization guidelines.
  • ...6 more annotations...
  • This language is broad, circular, and technically incoherent, so it takes some effort to parse appropriately. When the minimization procedures were disclosed in 2013, this language was interpreted by outside commentators to mean that NSA may keep all encrypted data that has been incidentally collected under Section 702 for at least as long as is necessary to decrypt that data. Is this the correct interpretation? I think so. It is important to realize that the language above isn’t just broad. It seems purposefully broad. The part regarding relevance seems to mirror the rationale NSA has used to justify its bulk phone records collection program. Under that program, all phone records were relevant because some of those records could be valuable to terrorism investigations and (allegedly) it isn’t possible to collect only those valuable records. This is the “to find a needle a haystack, you first have to have the haystack” argument. The same argument could be applied to encrypted data and might be at play here.
  • This exception doesn’t just apply to encrypted data that might be relevant to a current foreign intelligence investigation. It also applies to cases in which the encrypted data is likely to become relevant to a future intelligence requirement. This is some remarkably generous language. It seems one could justify keeping any type of encrypted data under this exception. Upon close reading, it is difficult to avoid the conclusion that these procedures were written carefully to allow NSA to collect and keep a broad category of encrypted data under the rationale that this data might contain the communications of NSA targets and that it might be decrypted in the future. If NSA isn’t doing this today, then whoever wrote these minimization procedures wanted to at least ensure that NSA has the authority to do this tomorrow.
  • There are a few additional observations that are worth making regarding these nominally new retention guidelines and Section 702 collection. First, the concept of incidental collection as it has typically been used makes very little sense when applied to encrypted data. The way that NSA’s Section 702 upstream “about” collection is understood to work is that technology installed on the network does some sort of pattern match on Internet traffic; say that an NSA target uses example@gmail.com to communicate. NSA would then search content of emails for references to example@gmail.com. This could notionally result in a lot of incidental collection of U.S. persons’ communications whenever the email that references example@gmail.com is somehow mixed together with emails that have nothing to do with the target. This type of incidental collection isn’t possible when the data is encrypted because it won’t be possible to search and find example@gmail.com in the body of an email. Instead, example@gmail.com will have been turned into some alternative, indecipherable string of bits on the network. Incidental collection shouldn’t occur because the pattern match can’t occur in the first place. This demonstrates that, when communications are encrypted, it will be much harder for NSA to search Internet traffic for a unique ID associated with a specific target.
  • This lends further credence to the conclusion above: rather than doing targeted collection against specific individuals, NSA is collecting, or plans to collect, a broad class of data that is encrypted. For example, NSA might collect all PGP encrypted emails or all Tor traffic. In those cases, NSA could search Internet traffic for patterns associated with specific types of communications, rather than specific individuals’ communications. This would technically meet the definition of incidental collection because such activity would result in the collection of communications of U.S. persons who aren’t the actual targets of surveillance. Collection of all Tor traffic would entail a lot of this “incidental” collection because the communications of NSA targets would be mixed with the communications of a large number of non-target U.S. persons. However, this “incidental” collection is inconsistent with how the term is typically used, which is to refer to over-collection resulting from targeted surveillance programs. If NSA were collecting all Tor traffic, that activity wouldn’t actually be targeted, and so any resulting over-collection wouldn’t actually be incidental. Moreover, greater use of encryption by the general public would result in an ever-growing amount of this type of incidental collection.
  • This type of collection would also be inconsistent with representations of Section 702 upstream collection that have been made to the public and to Congress. Intelligence officials have repeatedly suggested that search terms used as part of this program have a high degree of specificity. They have also argued that the program is an example of targeted rather than bulk collection. ODNI General Counsel Robert Litt, in a March 2014 meeting before the Privacy and Civil Liberties Oversight Board, stated that “there is either a misconception or a mischaracterization commonly repeated that Section 702 is a form of bulk collection. It is not bulk collection. It is targeted collection based on selectors such as telephone numbers or email addresses where there’s reason to believe that the selector is relevant to a foreign intelligence purpose.” The collection of Internet traffic based on patterns associated with types of communications would be bulk collection; more akin to NSA’s collection of phone records en mass than it is to targeted collection focused on specific individuals. Moreover, this type of collection would certainly fall within the definition of bulk collection provided just last week by the National Academy of Sciences: “collection in which a significant portion of the retained data pertains to identifiers that are not targets at the time of collection.”
  • The Section 702 minimization procedures, which will serve as a template for any new retention guidelines established for E.O. 12333 collection, create a large loophole for encrypted communications. With everything from email to Internet browsing to real-time communications moving to encrypted formats, an ever-growing amount of Internet traffic will fall within this loophole.
  • Paul Merrell on 26 Jan 15
     
    Tucked into a budget authorization act in December without press notice. Section 309 (the Act is linked from the article) appears to be very broad authority for the NSA to intercept any form of telephone or other electronic information in bulk. There are far more exceptions from the five-year retention limitation than the encrypted information exception. When reading this, keep in mind that the U.S. intelligence community plays semantic games to obfuscate what it does. One of its word plays is that communications are not "collected" until an analyst looks at or listens to partiuclar data, even though the data will be searched to find information countless times before it becomes "collected." That searching was the major basis for a decision by the U.S. District Court in Washington, D.C. that bulk collection of telephone communications was unconstitutional: Under the Fourth Amendment, a "search" or "seizure" requiring a judicial warrant occurs no later than when the information is intercepted. That case is on appeal, has been briefed and argued, and a decision could come any time now. Similar cases are pending in two other courts of appeals. Also, an important definition from the new Intelligence Authorization Act: "(a) DEFINITIONS.-In this section: (1) COVERED COMMUNICATION.-The term ''covered communication'' means any nonpublic telephone or electronic communication acquired without the consent of a person who is a party to the communication, including communications in electronic storage."       
Paul Merrell

United States v. Cano, No. 17-50151 (9th Cir. 2019) :: Justia - 0 views

law.justia.com/...17-50151-2019-08-16.html

mobile devices border-search-&-seizure litigation

shared by Paul Merrell on 18 Aug 19 - No Cached
  • The Ninth Circuit reversed the district court's denial of defendant's motion to suppress evidence obtained from warrantless searches of his cell phone by a Customs and Border Patrol official. Applying United States v. Cotterman, 709 F.3d 952 (9th Cir. 2013) (en banc), the panel held that manual cell phone searches may be conducted by border officials without reasonable suspicion but that forensic cell phone searches require reasonable suspicion. The panel clarified Cotterman by holding that "reasonable suspicion" in this context means that officials must reasonably suspect that the cell phone contains digital contraband. Furthermore, cell phone searches at the border, whether manual or forensic, must be limited in scope to a search for digital contraband. In this case, the panel held that the officials violated the Fourth Amendment when their warrantless searches exceeded the permissible scope of a border search. Therefore, most of the evidence from the searches of defendant's cell phone should have been suppressed. Finally, the panel held that defendant's Brady claims were unpersuasive. Because the panel vacated defendant's conviction, the panel did not reach his claim of prosecutorial misconduct.
Paul Merrell

Gmail blows up e-mail marketing by caching all images on Google servers | Ars Technica - 1 views

arstechnica.com/...g-all-images-on-google-servers

Google Gmail images antitrust

shared by Paul Merrell on 16 Dec 13 - No Cached
  • Ever wonder why most e-mail clients hide images by default? The reason for the "display images" button is because images in an e-mail must be loaded from a third-party server. For promotional e-mails and spam, usually this server is operated by the entity that sent the e-mail. So when you load these images, you aren't just receiving an image—you're also sending a ton of data about yourself to the e-mail marketer. Loading images from these promotional e-mails reveals a lot about you. Marketers get a rough idea of your location via your IP address. They can see the HTTP referrer, meaning the URL of the page that requested the image. With the referral data, marketers can see not only what client you are using (desktop app, Web, mobile, etc.) but also what folder you were viewing the e-mail in. For instance, if you had a Gmail folder named "Ars Technica" and loaded e-mail images, the referral URL would be "https://mail.google.com/mail/u/0/#label/Ars+Technica"—the folder is right there in the URL. The same goes for the inbox, spam, and any other location. It's even possible to uniquely identify each e-mail, so marketers can tell which e-mail address requested the images—they know that you've read the e-mail. And if it was spam, this will often earn you more spam since the spammers can tell you've read their last e-mail.
  • But Google has just announced a move that will shut most of these tactics down: it will cache all images for Gmail users. Embedded images will now be saved by Google, and the e-mail content will be modified to display those images from Google's cache, instead of from a third-party server. E-mail marketers will no longer be able to get any information from images—they will see a single request from Google, which will then be used to send the image out to all Gmail users. Unless you click on a link, marketers will have no idea the e-mail has been seen. While this means improved privacy from e-mail marketers, Google will now be digging deeper than ever into your e-mails and literally modifying the contents. If you were worried about e-mail scanning, this may take things a step further. However, if you don't like the idea of cached images, you can turn it off in the settings. This move will allow Google to automatically display images, killing the "display all images" button in Gmail. Google servers should also be faster than the usual third-party image host. Hosting all images sent to all Gmail users sounds like a huge bandwidth and storage undertaking, but if anyone can do it, it's Google. The new image handling will rollout to desktop users today, and it should hit mobile apps sometime in early 2014. There's also a bonus side effect for Google: e-mail marketing is advertising. Google exists because of advertising dollars, but they don't do e-mail marketing. They've just made a competitive form of advertising much less appealing and informative to advertisers. No doubt Google hopes this move pushes marketers to spend less on e-mail and more on Adsense.
  • Paul Merrell on 16 Dec 13
     
    There's an antitrust angle to this; it could be viewed by a court as anti-competitive. But given the prevailing winds on digital privacy, my guess would be that Google would slide by.
Paul Merrell

LEAKED: Secret Negotiations to Let Big Brother Go Global | Wolf Street - 0 views

wolfstreet.com/...s-to-let-big-brother-go-global

trade agreements TISA privatization data privacy globalization

shared by Paul Merrell on 29 Dec 14 - No Cached
  • Much has been written, at least in the alternative media, about the Trans Pacific Partnership (TPP) and the Transatlantic Trade and Investment Partnership (TTIP), two multilateral trade treaties being negotiated between the representatives of dozens of national governments and armies of corporate lawyers and lobbyists (on which you can read more here, here and here). However, much less is known about the decidedly more secretive Trade in Services Act (TiSA), which involves more countries than either of the other two. At least until now, that is. Thanks to a leaked document jointly published by the Associated Whistleblowing Press and Filtrala, the potential ramifications of the treaty being hashed out behind hermetically sealed doors in Geneva are finally seeping out into the public arena.
  • If signed, the treaty would affect all services ranging from electronic transactions and data flow, to veterinary and architecture services. It would almost certainly open the floodgates to the final wave of privatization of public services, including the provision of healthcare, education and water. Meanwhile, already privatized companies would be prevented from a re-transfer to the public sector by a so-called barring “ratchet clause” – even if the privatization failed. More worrisome still, the proposal stipulates that no participating state can stop the use, storage and exchange of personal data relating to their territorial base. Here’s more from Rosa Pavanelli, general secretary of Public Services International (PSI):
  • The leaked documents confirm our worst fears that TiSA is being used to further the interests of some of the largest corporations on earth (…) Negotiation of unrestricted data movement, internet neutrality and how electronic signatures can be used strike at the heart of individuals’ rights. Governments must come clean about what they are negotiating in these secret trade deals. Fat chance of that, especially in light of the fact that the text is designed to be almost impossible to repeal, and is to be “considered confidential” for five years after being signed. What that effectively means is that the U.S. approach to data protection (read: virtually non-existent) could very soon become the norm across 50 countries spanning the breadth and depth of the industrial world.
  • ...1 more annotation...
  • The main players in the top-secret negotiations are the United States and all 28 members of the European Union. However, the broad scope of the treaty also includes Australia, Canada, Chile, Colombia, Costa Rica, Hong Kong, Iceland, Israel, Japan, Liechtenstein, Mexico, New Zealand, Norway, Pakistan, Panama, Paraguay, Peru, South Korea, Switzerland, Taiwan and Turkey. Combined they represent almost 70 percent of all trade in services worldwide. An explicit goal of the TiSA negotiations is to overcome the exceptions in GATS that protect certain non-tariff trade barriers, such as data protection. For example, the draft Financial Services Annex of TiSA, published by Wikileaks in June 2014, would allow financial institutions, such as banks, the free transfer of data, including personal data, from one country to another. As Ralf Bendrath, a senior policy advisor to the MEP Jan Philipp Albrecht, writes in State Watch, this would constitute a radical carve-out from current European data protection rules:
Paul Merrell

Shaking My Head - Medium - 0 views

medium.com/...shaking-my-head-5c1b60db9086

surveillance state NSA 702 FISA legislation backdoor-serches stats

shared by Paul Merrell on 29 May 16 - No Cached
  • Last month, at the request of the Department of Justice, the Courts approved changes to the obscure Rule 41 of the Federal Rules of Criminal Procedure, which governs search and seizure. By the nature of this obscure bureaucratic process, these rules become law unless Congress rejects the changes before December 1, 2016.Today I, along with my colleagues Senators Paul from Kentucky, Baldwin from Wisconsin, and Daines and Tester from Montana, am introducing the Stopping Mass Hacking (SMH) Act (bill, summary), a bill to protect millions of law-abiding Americans from a massive expansion of government hacking and surveillance. Join the conversation with #SMHact.
  • For law enforcement to conduct a remote electronic search, they generally need to plant malware in — i.e. hack — a device. These rule changes will allow the government to search millions of computers with the warrant of a single judge. To me, that’s clearly a policy change that’s outside the scope of an “administrative change,” and it is something that Congress should consider. An agency with the record of the Justice Department shouldn’t be able to wave its arms and grant itself entirely new powers.
  • These changes say that if law enforcement doesn’t know where an electronic device is located, a magistrate judge will now have the the authority to issue a warrant to remotely search the device, anywhere in the world. While it may be appropriate to address the issue of allowing a remote electronic search for a device at an unknown location, Congress needs to consider what protections must be in place to protect Americans’ digital security and privacy. This is a new and uncertain area of law, so there needs to be full and careful debate. The ACLU has a thorough discussion of the Fourth Amendment ramifications and the technological questions at issue with these kinds of searches.The second part of the change to Rule 41 would give a magistrate judge the authority to issue a single warrant that would authorize the search of an unlimited number — potentially thousands or millions — of devices, located anywhere in the world. These changes would dramatically expand the government’s hacking and surveillance authority. The American public should understand that these changes won’t just affect criminals: computer security experts and civil liberties advocates say the amendments would also dramatically expand the government’s ability to hack the electronic devices of law-abiding Americans if their devices were affected by a computer attack. Devices will be subject to search if their owners were victims of a botnet attack — so the government will be treating victims of hacking the same way they treat the perpetrators.
  • ...1 more annotation...
  • As the Center on Democracy and Technology has noted, there are approximately 500 million computers that fall under this rule. The public doesn’t know nearly enough about how law enforcement executes these hacks, and what risks these types of searches will pose. By compromising the computer’s system, the search might leave it open to other attackers or damage the computer they are searching.Don’t take it from me that this will impact your security, read more from security researchers Steven Bellovin, Matt Blaze and Susan Landau.Finally, these changes to Rule 41 would also give some types of electronic searches different, weaker notification requirements than physical searches. Under this new Rule, they are only required to make “reasonable efforts” to notify people that their computers were searched. This raises the possibility of the FBI hacking into a cyber attack victim’s computer and not telling them about it until afterward, if at all.
Paul Merrell

Microsoft Says U.S. Is Abusing Secret Warrants - 0 views

theintercept.com/...u-s-is-abusing-secret-warrants

surveillance state Microsoft DoJ litigation 4th-Amendment 1st Amendment gag-orders

shared by Paul Merrell on 16 Apr 16 - No Cached
  • “WE APPRECIATE THAT there are times when secrecy around a government warrant is needed,” Microsoft President Brad Smith wrote in a blog post on Thursday. “But based on the many secrecy orders we have received, we question whether these orders are grounded in specific facts that truly demand secrecy. To the contrary, it appears that the issuance of secrecy orders has become too routine.” With those words, Smith announced that Microsoft was suing the Department of Justice for the right to inform its customers when the government is reading their emails. The last big fight between the Justice Department and Silicon Valley was started by law enforcement, when the FBI demanded that Apple unlock a phone used by San Bernardino killer Syed Rizwan Farook. This time, Microsoft is going on the offensive. The move is welcomed by privacy activists as a step forward for transparency — though it’s also for business reasons.
  • Secret government searches are eroding people’s trust in the cloud, Smith wrote — including large and small businesses now keeping massive amounts of records online. “The transition to the cloud does not alter people’s expectations of privacy and should not alter the fundamental constitutional requirement that the government must — with few exceptions — give notice when it searches and seizes private information or communications,” he wrote. According to the complaint, Microsoft received 5,624 federal demands for customer information or data in the past 18 months. Almost half — 2,576 — came with gag orders, and almost half of those — 1,752 — had “no fixed end date” by which Microsoft would no longer be sworn to secrecy. These requests, though signed off on by a judge, qualify as unconstitutional searches, the attorneys argue. It “violates both the Fourth Amendment, which affords people and businesses the right to know if the government searches or seizes their property, and the First Amendment, which enshrines Microsoft’s rights to talk to its customers and to discuss how the government conducts its investigations — subject only to restraints narrowly tailored to serve compelling government interests,” they wrote.
  • Paul Merrell on 16 Apr 16
     
    The Fourth Amendment argument that people have a right to know when their property has been searched or seized is particularly interesting to me. If adopted by the Courts, that could spell the end of surveillance gag orders. 
Paul Merrell

Catalog Reveals NSA Has Back Doors for Numerous Devices - SPIEGEL ONLINE - 1 views

www.spiegel.de/...numerous-devices-a-940994.html

surveillance state NSA NSA-methods NSA-backdoors routers hard-drives must-read

shared by Paul Merrell on 30 Dec 13 - No Cached
  • Paul Merrell on 30 Dec 13
     
    Oh, great. My router and all of my hard drives have NSA backdoors in them. And my BIOS on the Linux box may be infected with a backdoor. What are the odds that NSA has not developed similar capability for the UEFI on our two newer Windows boxes? 
Gonzalo San Gil, PhD.

EU high court strikes down metadata collection law | Ars Technica - 1 views

arstechnica.com/...s-down-metadata-collection-law

court strikes down metadata collection law Europe legas precedent set

shared by Gonzalo San Gil, PhD. on 08 Apr 14 - No Cached
  • Gonzalo San Gil, PhD. on 08 Apr 14
     
    "Citizens made to feel that they "are the subject of constant surveillance." by Cyrus Farivar - Apr 8 2014, 4:25pm CEST"
  • Paul Merrell on 09 Apr 14
     
    Just finished reading the court's opinion. I can only wish that the U.S. government had such fine-tuned respect for civil rights Not quoted in the linked article, but opinion paragraph 68 is very bad news for U.S. service providers: "In the second place, it should be added that that directive does not require the data in question to be retained within the European Union, with the result that it cannot be held that the control, explicitly required by Article 8(3) of the Charter, by an independent authority of compliance with the requirements of protection and security, as referred to in the two previous paragraphs, is fully ensured. Such a control, carried out on the basis of EU law, is an essential component of the protection of individuals with regard to the processing of personal data (see, to that effect, Case C-614/10 Commission v Austria EU:C:2012:631, paragraph 37).". The Court is holding, in other words, that an E.U. network *must* be created that can prevent user's data from being transported outside the E.U., that user's data retained for law enforcement or national defense purposes cannot be transmitted or stored outside the E.U. It will take awhile for this to be transposed into national laws. But this is very good news for folks in the E.U. and for civil libertarians globally.
Paul Merrell

New White House Petition For Net Neutrality - Slashdot - 0 views

politics.slashdot.org/...se-petition-for-net-neutrality

net neutrality petition white-house

shared by Paul Merrell on 24 Apr 14 - No Cached
  • "On the heels of yesterday's FCC bombshell, there is a new petition on the White House petition site titled, 'Maintain true net neutrality to protect the freedom of information in the United States.' The body reads: 'True net neutrality means the free exchange of information between people and organizations. Information is key to a society's well being. One of the most effective tactics of an invading military is to inhibit the flow of information in a population; this includes which information is shared and by who. Today we see this war being waged on American citizens. Recently the FCC has moved to redefine "net neutrality" to mean that corporations and organizations can pay to have their information heard, or worse, the message of their competitors silenced. We as a nation must settle for nothing less than complete neutrality in our communication channels. This is not a request, but a demand by the citizens of this nation. No bandwidth modifications of information based on content or its source.'"
Paul Merrell

We finally gave Congress email addresses - Sunlight Foundation Blog - 0 views

sunlightfoundation.com/...-gave-congress-email-addresses

U.S. Congress email

shared by Paul Merrell on 18 Jun 14 - No Cached
  • On OpenCongress, you can now email your representatives and senators just as easily as you would a friend or colleague. We've added a new feature to OpenCongress. It's not flashy. It doesn't use D3 or integrate with social media. But we still think it's pretty cool. You might've already heard of it. Email. This may not sound like a big deal, but it's been a long time coming. A lot of people are surprised to learn that Congress doesn't have publicly available email addresses. It's the number one feature request that we hear from users of our APIs. Until recently, we didn't have a good response. That's because members of Congress typically put their feedback mechanisms behind captchas and zip code requirements. Sometimes these forms break; sometimes their requirements improperly lock out actual constituents. And they always make it harder to email your congressional delegation than it should be.
  • This is a real problem. According to the Congressional Management Foundation, 88% of Capitol Hill staffers agree that electronic messages from constituents influence their bosses' decisions. We think that it's inappropriate to erect technical barriers around such an essential democratic mechanism. Congress itself is addressing the problem. That effort has just entered its second decade, and people are feeling optimistic that a launch to a closed set of partners might be coming soon. But we weren't content to wait. So when the Electronic Frontier Foundation (EFF) approached us about this problem, we were excited to really make some progress. Building on groundwork first done by the Participatory Politics Foundation and more recent work within Sunlight, a network of 150 volunteers collected the data we needed from congressional websites in just two days. That information is now on Github, available to all who want to build the next generation of constituent communication tools. The EFF is already working on some exciting things to that end.
  • But we just wanted to be able to email our representatives like normal people. So now, if you visit a legislator's page on OpenCongress, you'll see an email address in the right-hand sidebar that looks like Sen.Reid@opencongress.org or Rep.Boehner@opencongress.org. You can also email myreps@opencongress.org to email both of your senators and your House representatives at once. The first time we get an email from you, we'll send one back asking for some additional details. This is necessary because our code submits your message by navigating those aforementioned congressional webforms, and we don't want to enter incorrect information. But for emails after the first one, all you'll have to do is click a link that says, "Yes, I meant to send that email."
  • ...1 more annotation...
  • One more thing: For now, our system will only let you email your own representatives. A lot of people dislike this. We do, too. In an age of increasing polarization, party discipline means that congressional leaders must be accountable to citizens outside their districts. But the unfortunate truth is that Congress typically won't bother reading messages from non-constituents — that's why those zip code requirements exist in the first place. Until that changes, we don't want our users to waste their time. So that's it. If it seems simple, it's because it is. But we think that unbreaking how Congress connects to the Internet is important. You should be able to send a call to action in a tweet, easily forward a listserv message to your representative and interact with your government using the tools you use to interact with everyone else.
Fabien Cadet

2014-07: Programming Is Not Math « Sarah Mei, article - 1 views

www.sarahmei.com/...programming-is-not-math

programming pragmatic thoughts

shared by Fabien Cadet on 11 May 15 - No Cached
  • The best developers today work on teams, and they do well IFF they know how to communicate – via their code, and directly with other people.
  • As one of my favorite programming books once said, “programs must be written for people to read, and only incidentally for machines to execute.”
Gonzalo San Gil, PhD.

Federal court rules in favor of NSA bulk snooping, White House happy - RT USA - 3 views

www.rt.com/...313740-federal-court-nsa-spy

federal court rules favor nsa bulk data communications snooping spying citizens legal :(

shared by Gonzalo San Gil, PhD. on 28 Aug 15 - No Cached
  • Gonzalo San Gil, PhD. on 28 Aug 15
     
    "Despite the opposition of the US public and lawmakers to NSA surveillance, the courts keep handing the Obama administration the license to snoop. A US appeals court just threw out a 2013 verdict against the NSA, to White House approval. "
  • ...1 more comment...
  • Paul Merrell on 28 Aug 15
     
    I've read the court's decision. The article in RT overstates the breadth of the court's holding very substantially. The court did not throw the case out. Instead, by a 2-1 vote it vacated the district court's grant of a preliminary injunction and remanded the case for further proceedings including for the lower court judge to decide whether discovery should be allowed. The third judge would have thrown the case out. The decision does, however, steepen the slope the plaintiffs must climb to prevail in a renewed effort to obtain an injunction. That is regrettable, in my view. The article states: "The decision vindicates the government's stance that NSA's bulk surveillance programs are constitutional, the White House said Friday." In fact, the court's decision does not even touch on the topic of the program's constitutionality, reaching only the issue of standing. The article should either have omitted the statement or pointed out the error in the government's statement.
  • Gonzalo San Gil, PhD. on 01 Sep 15
     
    # ! thank You, Paul, for the observation. anyway, what it seems is that Citizens worldwide are going to be spied... judges aside, and -I'm afraid- not always with 'security issues' in the Agency's mind...
  • Paul Merrell on 01 Sep 15
     
    I agree, Gonzalo. Most of the "terrorist" groups the U.S. claims to be concerned with were in fact created by the U.S. Terrorism is simply the easiest means for the government to defend these surveillance programs. But the disclosures that the NSA spies for other purposes just doesn't get the coverage in mainstream media that might otherwise force changes. It's the Politics of Fear.
Paul Merrell

Popular Security Software Came Under Relentless NSA and GCHQ Attacks - The Intercept - 0 views

firstlook.org/...nsa-gchq-targeted-kaspersky

surveillance state NSA GCHQ anti-virus-software

shared by Paul Merrell on 23 Jun 15 - No Cached
  • The National Security Agency and its British counterpart, Government Communications Headquarters, have worked to subvert anti-virus and other security software in order to track users and infiltrate networks, according to documents from NSA whistleblower Edward Snowden. The spy agencies have reverse engineered software products, sometimes under questionable legal authority, and monitored web and email traffic in order to discreetly thwart anti-virus software and obtain intelligence from companies about security software and users of such software. One security software maker repeatedly singled out in the documents is Moscow-based Kaspersky Lab, which has a holding registered in the U.K., claims more than 270,000 corporate clients, and says it protects more than 400 million people with its products. British spies aimed to thwart Kaspersky software in part through a technique known as software reverse engineering, or SRE, according to a top-secret warrant renewal request. The NSA has also studied Kaspersky Lab’s software for weaknesses, obtaining sensitive customer information by monitoring communications between the software and Kaspersky servers, according to a draft top-secret report. The U.S. spy agency also appears to have examined emails inbound to security software companies flagging new viruses and vulnerabilities.
  • The efforts to compromise security software were of particular importance because such software is relied upon to defend against an array of digital threats and is typically more trusted by the operating system than other applications, running with elevated privileges that allow more vectors for surveillance and attack. Spy agencies seem to be engaged in a digital game of cat and mouse with anti-virus software companies; the U.S. and U.K. have aggressively probed for weaknesses in software deployed by the companies, which have themselves exposed sophisticated state-sponsored malware.
  • The requested warrant, provided under Section 5 of the U.K.’s 1994 Intelligence Services Act, must be renewed by a government minister every six months. The document published today is a renewal request for a warrant valid from July 7, 2008 until January 7, 2009. The request seeks authorization for GCHQ activities that “involve modifying commercially available software to enable interception, decryption and other related tasks, or ‘reverse engineering’ software.”
  • ...9 more annotations...
  • The NSA, like GCHQ, has studied Kaspersky Lab’s software for weaknesses. In 2008, an NSA research team discovered that Kaspersky software was transmitting sensitive user information back to the company’s servers, which could easily be intercepted and employed to track users, according to a draft of a top-secret report. The information was embedded in “User-Agent” strings included in the headers of Hypertext Transfer Protocol, or HTTP, requests. Such headers are typically sent at the beginning of a web request to identify the type of software and computer issuing the request.
  • According to the draft report, NSA researchers found that the strings could be used to uniquely identify the computing devices belonging to Kaspersky customers. They determined that “Kaspersky User-Agent strings contain encoded versions of the Kaspersky serial numbers and that part of the User-Agent string can be used as a machine identifier.” They also noted that the “User-Agent” strings may contain “information about services contracted for or configurations.” Such data could be used to passively track a computer to determine if a target is running Kaspersky software and thus potentially susceptible to a particular attack without risking detection.
  • Another way the NSA targets foreign anti-virus companies appears to be to monitor their email traffic for reports of new vulnerabilities and malware. A 2010 presentation on “Project CAMBERDADA” shows the content of an email flagging a malware file, which was sent to various anti-virus companies by François Picard of the Montréal-based consulting and web hosting company NewRoma. The presentation of the email suggests that the NSA is reading such messages to discover new flaws in anti-virus software. Picard, contacted by The Intercept, was unaware his email had fallen into the hands of the NSA. He said that he regularly sends out notification of new viruses and malware to anti-virus companies, and that he likely sent the email in question to at least two dozen such outfits. He also said he never sends such notifications to government agencies. “It is strange the NSA would show an email like mine in a presentation,” he added.
  • The NSA presentation goes on to state that its signals intelligence yields about 10 new “potentially malicious files per day for malware triage.” This is a tiny fraction of the hostile software that is processed. Kaspersky says it detects 325,000 new malicious files every day, and an internal GCHQ document indicates that its own system “collect[s] around 100,000,000 malware events per day.” After obtaining the files, the NSA analysts “[c]heck Kaspersky AV to see if they continue to let any of these virus files through their Anti-Virus product.” The NSA’s Tailored Access Operations unit “can repurpose the malware,” presumably before the anti-virus software has been updated to defend against the threat.
  • The Project CAMBERDADA presentation lists 23 additional AV companies from all over the world under “More Targets!” Those companies include Check Point software, a pioneering maker of corporate firewalls based Israel, whose government is a U.S. ally. Notably omitted are the American anti-virus brands McAfee and Symantec and the British company Sophos.
  • As government spies have sought to evade anti-virus software, the anti-virus firms themselves have exposed malware created by government spies. Among them, Kaspersky appears to be the sharpest thorn in the side of government hackers. In the past few years, the company has proven to be a prolific hunter of state-sponsored malware, playing a role in the discovery and/or analysis of various pieces of malware reportedly linked to government hackers, including the superviruses Flame, which Kaspersky flagged in 2012; Gauss, also detected in 2012; Stuxnet, discovered by another company in 2010; and Regin, revealed by Symantec. In February, the Russian firm announced its biggest find yet: the “Equation Group,” an organization that has deployed espionage tools widely believed to have been created by the NSA and hidden on hard drives from leading brands, according to Kaspersky. In a report, the company called it “the most advanced threat actor we have seen” and “probably one of the most sophisticated cyber attack groups in the world.”
  • Hacks deployed by the Equation Group operated undetected for as long as 14 to 19 years, burrowing into the hard drive firmware of sensitive computer systems around the world, according to Kaspersky. Governments, militaries, technology companies, nuclear research centers, media outlets and financial institutions in 30 countries were among those reportedly infected. Kaspersky estimates that the Equation Group could have implants in tens of thousands of computers, but documents published last year by The Intercept suggest the NSA was scaling up their implant capabilities to potentially infect millions of computers with malware. Kaspersky’s adversarial relationship with Western intelligence services is sometimes framed in more sinister terms; the firm has been accused of working too closely with the Russian intelligence service FSB. That accusation is partly due to the company’s apparent success in uncovering NSA malware, and partly due to the fact that its founder, Eugene Kaspersky, was educated by a KGB-backed school in the 1980s before working for the Russian military.
  • Kaspersky has repeatedly denied the insinuations and accusations. In a recent blog post, responding to a Bloomberg article, he complained that his company was being subjected to “sensationalist … conspiracy theories,” sarcastically noting that “for some reason they forgot our reports” on an array of malware that trace back to Russian developers. He continued, “It’s very hard for a company with Russian roots to become successful in the U.S., European and other markets. Nobody trusts us — by default.”
  • Documents published with this article: Kaspersky User-Agent Strings — NSA Project CAMBERDADA — NSA NDIST — GCHQ’s Developing Cyber Defence Mission GCHQ Application for Renewal of Warrant GPW/1160 Software Reverse Engineering — GCHQ Reverse Engineering — GCHQ Wiki Malware Analysis & Reverse Engineering — ACNO Skill Levels — GCHQ
Paul Merrell

GooSoft shapes super White Space database * The Register - 0 views

www.theregister.co.uk/...white_spaces_database

broadcast spectrum White Space Database web politics

shared by Paul Merrell on 05 Feb 09 - Cached
  • The world's largest software and search companies Wednesday announced the formation of the White Spaces Database Group with PC and broadcasting hardware and services specialists Dell, Hewlett Packard, Motorola, Comsearch, and NeuStar.
  • The White Spaces Database Group comes after months of concerted lobbying of the US Federal Communications Commission (FCC) by Microsoft, Google, and the other companies to make unused TV frequencies - white spaces - available for internet access by PCs and other devices.
  • The FCC last November ruled against broadcasters and said it would open up white spaces, but in a concession to their concerns, it stipulated the need for an online database that devices accessing the spectrum must read in order to find out what channels they are allowed to use. The database should be built and run by a third party and will be selected through a "public process."
Paul Merrell

British Prime Minister Suggests Banning Some Online Messaging Apps - NYTimes.com - 0 views

bits.blogs.nytimes.com/...ing-some-online-messaging-apps

surveillance state UK Cameron encryption legislation

shared by Paul Merrell on 19 Jan 15 - No Cached
  • Popular messaging services like Snapchat and WhatsApp are in the cross hairs in Britain. That was the message delivered on Monday by Prime Minister David Cameron, who said he would pursue banning encrypted messaging services if Britain’s intelligence services were not given access to the communications. The statement comes as many European politicians are demanding that Internet companies like Google and Facebook provide greater information about people’s online activities after several recent terrorist threats, including the attacks in Paris.
  • Mr. Cameron, who has started to campaign ahead of a national election in Britain in May, said his government, if elected, would ban encrypted online communication tools that could potentially be used by terrorists if the country’s intelligence agencies were not given increased access. The reforms are part of new legislation that would force telecom operators and Internet services providers to store more data on people’s online activities, including social network messages. “Are we going to allow a means of communications which it simply isn’t possible to read?” Mr. Cameron said at an event on Monday, in reference to services like WhatsApp, Snapchat and other encrypted online applications. “My answer to that question is: ‘No, we must not.’ ” Mr. Cameron said his first duty was to protect the country against terrorist attacks.
  • “The attacks in Paris demonstrated the scale of the threat that we face and the need to have robust powers through our intelligence and security agencies in order to keep our people safe,” he added. Any restriction on these online services, however, would not take effect until 2016, at the earliest, and it remained unclear how the British government could stop people from using these apps, which are used by hundreds of millions of people worldwide.
‹ Previous 21 - 40 of 42 Next ›
Showing 20▼ items per page