Category Archives: Security

Digg takes a stand

Kevin Rose has announced the pressure from savvy users is a greater threat than that of the financial powerhouses and their lawyers:

Occasionally we step in to remove stories that violate our terms of use (eg. linking to pornography, illegal downloads, racial hate sites, etc.). So today was a difficult day for us. We had to decide whether to remove stories containing a single code based on a cease and desist declaration. We had to make a call, and in our desire to avoid a scenario where Digg would be interrupted or shut down, we decided to comply and remove the stories with the code.

But now, after seeing hundreds of stories and reading thousands of comments, you’ve made it clear. You’d rather see Digg go down fighting than bow down to a bigger company. We hear you, and effective immediately we won’t delete stories or comments containing the code and will deal with whatever the consequences might be.

If we lose, then what the hell, at least we died trying.

Interesting to note that the users can take his site down immediately through distributed denial of service that would be hard, if not impossible, to prevent or even trace. However, the courts are far less efficient and might take months or years to force him off-line. But it also sounds good to say that he will take a stand to support dynamic community content against the ancient media moguls.

Edited to add (2 March 2007): Google and YouTube seem to be taking a similar stand, as the Guardian reported today.

In a filing with Manhattan’s district court, YouTube said: “By seeking to make carriers and hosting providers liable for internet communications, Viacom’s complaint threatens the way hundreds of millions of people legitimately exchange information, news, entertainment, and political and artistic expression.”

I’m guessing the Viacoms of the world take issue with the terms “legitimately exchange” because it poses a direct threat to their entire operations model. They want to control eyeballs and ears. Once upon a time this was more plausable because only giant companies could afford mass distribution and exchange of information, spreading the cost out accross all their consumers. Back then few individuals could afford the overhead of “discovering” talent, maintaining manufacturing and warehousing systems, or keeping an army of lawyers employed to fight against the competition. Today, however, consumers benefit from dynamic ranking/rating systems and virtually free distribution channels that requires minimal overhead. The only thing that really remains is the giant company single-contact relationship with advertisers. So the big (billion dollar) question is: what will regulators decide really constitutes a legitimate exchange of information?

Incidentally, I can’t pass up the chance to throw in the news that even the UN is facing a lawsuit related to this topic. A group of Congolese polio victims claim they were not fairly compensated for a song played on radio and TV:

Let’s Go and Vote was played repeatedly in the run-up to last year’s historic polls on radio and TV stations.

In a country where a third of the population is illiterate and with crumbling infrastructure, the song is credited with boosting turn-out to 70%.

But the eight members of the Staff Benda Bilili band were paid $50 each.

The UN has denied any responsibility for paying royalties.

[…]

“It is thanks to our song that people went and voted but Monuc [UN Mission in DR Congo] did not pay us and we are still forced to sleep and beg in the streets. This is slavery,” said band leader Nzale Makembo.

I searched but couldn’t find a copy of their video on YouTube.

Comcast replaces Disney with porn

I am hardly a fan of Disney, but this still sounds like a nightmare scenario for parents who do not want (sexual) porn broadcast into their homes:

Children here got more than they bargained for when they tuned in to “Handy Manny” on the Disney Channel this week — hard-core pornography.

Cable giant Comcast is investigating how the porn was broadcast during the popular cartoon, which is about a bilingual handyman, Manny Garcia, and his talking tools.

Talking tools? Ahem…

Could this generate new interest in content monitoring and in-line restrictions? I am sure many of us would like to be able to block content from being broadcast through our home devices. Imagine if you could detect and block spam-like product advertisements before they hit the screen, for example…kind of like firewalls and anti-malware on the consumer router.

Locksmith hired by police to break into jail

Here is an unusual story about a simple control failure:

Police in Germany had to call in a locksmith to break into jail when the lock on a cell broke, trapping a prisoner inside, authorities said Wednesday.

Police in the Bavarian town of Zwiesel near the Czech border locked up the 18-year-old at the police station after he was accused of smashing a car window during May day festivities on Tuesday.

I guess it is fortunate there was no immediate danger to the prisoner. Wonder what kind of lock it was and why/how there was no emergency override options. Was it a design failure?

Why regulate?

The Cutter Consortium has a brief interview with one of their own consultants about risk management. It took me a little effort to get beyond the awkward context, but I found this nugget. It is supposedly based on real data:

I would say that the external drivers of risk management were much stronger than I had expected. In 2002, organizations responding to our survey indicated that neither Y2K nor 9/11 pushed them to take on risk management.

However, in our 2006 survey, it seems pretty clear that the changes in corporate governance requirements like Sarbanes-Oxley as well as changes in the external risk environment have strongly influenced organizations to practice risk management. I would guess that the events of the past four years, as well as future risks like the possibility of a pandemic have been traumatic enough to convince organizations that they need to actively manage their risks.

So it is not the catastrophe itself that becomes a driver to mitigate risks, but regulation created as a result of the catastrophe. That makes a lot of sense, especially when you consider that much of the risk from a lack of regulation does not directly impact the companies themselves but the citizens that live near the meadows and waterways filled with waste or to the shareholders left holding the bag when a CEO/President is a crook…