<?xml version="1.0" encoding="UTF-8"?>
<opml version="1.0">
  <head>
    <title>cmdln.net_2008-04-13</title>
    <expansionState>0,1,10,11,16,17,44,57,58,78,82,106,133,164,165,175,185,186,194</expansionState>
  </head>
  <body>
    <outline text="Intro" Offset="00:17">
      <outline text="Star Wars exhibit at the Franklin">
        <outline text="Smaller than I expected"/>
        <outline text="Enjoyed getting a close look at designs"/>
        <outline text="Took plenty of photos"/>
        <outline text="Kids showed no bias between two trilogies"/>
        <outline text="Adults mostly favored original trilogy"/>
        <outline text="Recorded some audio for Voice of Free Planet X"/>
        <outline text="http://planetx.libsyn.com"/>
        <outline text="Probably had more fun at The Franklin as a whole, spending time with friends"/>
      </outline>
    </outline>
    <outline text="Listener Feedback" Offset="05:08">
      <outline text="Dave LaMorte">
        <outline text="Teaching for the Future podcast"/>
        <outline text="http://www.teachingforthefuture.com/"/>
        <outline text="Weighing in on the editing vs. timeliness question"/>
        <outline text="Disagreeing with multimode"/>
      </outline>
    </outline>
    <outline text="Security Alerts" Offset="08:29">
      <outline text="Kraken surprises Storm worm in size at over 400K affected PCs" Offset="08:48">
        <outline text="http://go.theregister.com/feed/www.theregister.co.uk/2008/04/07/kraken_botnet_menace/"/>
        <outline text="400K PCs infected, including ones within 50 Fortune 500 companies"/>
        <outline text="Only 20% of PCs were accurately detecting the worm"/>
        <outline text="Low recognition apparently due to Kraken's ability to change its own code"/>
        <outline text="Talked about evolutionary, changing code in the past"/>
        <outline text="Far and away the biggest example of malware using this trick"/>
        <outline text="Apparently alters itself when the payload is activated"/>
        <outline text="Even in the original file is detected, can re-infected from altered file on disk"/>
        <outline text="Doubles odds of escaping detection"/>
        <outline text="Also receive updates through command channel once PC is infected"/>
        <outline text="Infected machines sending high volumes of spam"/>
        <outline text="As much as 500K per machine by some measurements"/>
        <outline text="Royal at security firm Damballa thinks it may grow up to 600K"/>
        <outline text="No one is sure why it remains so elusive, infectious"/>
        <outline text="http://blog.washingtonpost.com/securityfix/2008/04/kraken_creates_a_clash_of_the.html"/>
        <outline text="More details, including the accuracy behind Damballa's numbers"/>
        <outline text="Kraken uses DynDNS, as do others"/>
        <outline text="Includes code to identify new control sites in case host, domain names are yanked"/>
        <outline text="Damballa reversed some of the code in Kraken"/>
        <outline text="Registered the names ahead of the infection, create sinkholes"/>
        <outline text="Claims no traffic is going back out to infected nodes reporting to them"/>
        <outline text="Does give them a good idea of rate of infection, other details"/>
        <outline text="Still keep the kimono closed on how they pulled this off"/>
        <outline text="Looks like Damballa has re-classified a pre-existing baddy, Bobax"/>
        <outline text="Points out problems in classifying, standardizing recognition, names"/>
        <outline text="An alternate analysis identifies Kraken as Bobax, only at 185K PCs"/>
      </outline>
      <outline text="Security researcher develops Trojan counter hack" Offset="13:31">
        <outline text="http://feeds.wired.com/~r/wired/topheadlines/~3/268656293/researcher-demo.html"/>
        <outline text="Work by Joel Eriksson, at Swedish firm Bitsec"/>
        <outline text="Reverse engineers hacking software, looking for exploitable security holes"/>
        <outline text="Sort of like using phages against super bacteria"/>
        <outline text="In particular targets the control software for trojans on remote client"/>
        <outline text="Demoed his technique at RSA conference on Friday"/>
        <outline text="Leverages the same mistakes, short cuts programmers of all stripes commits"/>
        <outline text="Eriksson has demonstrated his technique a few times before"/>
        <outline text="Even yielded a security patch, not effective, in one case"/>
        <outline text="May be a bit legally dubious but effective when traditional approaches are losing ground"/>
        <outline text="What would make this legally sustainable?"/>
        <outline text="Keeping it to just investigation, identification to be followed by arrest, prosecution?"/>
      </outline>
    </outline>
    <outline text="News" Offset="15:49">
      <outline text="Gmail being throttled, blocked by some antispam vendors" Offset="16:03">
        <outline text="http://feeds.arstechnica.com/~r/arstechnica/BAaf/~3/265413535/20080406-gmail-being-throttled-blocked-by-some-anti-spam-vendors.html"/>
        <outline text="Talked about spammer's cracking Google's captcha"/>
        <outline text="http://thecommandline.net/2008/03/02/news_133/"/>
        <outline text="Success ratio was small, but apparently enough to have an effect"/>
        <outline text="Ars has verified that anti-spam vendors are recommending slowing, blocking Gmail"/>
        <outline text="On vendor, MessageLabs, is trying to be surgical"/>
        <outline text="Attempting to block only relays from which spam is being sent"/>
        <outline text="Affected relays change as spammers move around"/>
        <outline text="Delays vary between none, to between 4 and 24 hours"/>
        <outline text="Doesn't affect client side, Bayesian filters"/>
        <outline text="Postini, acquired by Google recently, also unaffected"/>
        <outline text="Really only impacts IP based back lists"/>
        <outline text="This mostly means anti-spam services that mail providers use"/>
        <outline text="Pressure is on for Google to deal directly with captcha problems"/>
        <outline text="Ars did not talk to Google, apparently"/>
        <outline text="Couldn't find any press release, other materials from Google on the issue"/>
        <outline text="Google spends a good deal of time blogging about technology"/>
        <outline text="Even launched a public policy blog some time ago"/>
        <outline text="Why do they not have a security blog?"/>
      </outline>
      <outline text="Google application hosting" Offset="18:54">
        <outline text="http://arstechnica.com/news.ars/post/20080408-analysis-google-app-engine-alluring-will-be-hard-to-escape.html"/>
        <outline text="Contrasts to Amazon'e services which are loosely coupled"/>
        <outline text="App Engine is a one stop shop"/>
        <outline text="Details direct from Google">
          <outline text="http://code.google.com/appengine/docs/whatisgoogleappengine.html"/>
          <outline text="Free accounts available initially"/>
          <outline text="Ability to purchase more space, bandwidth to follow"/>
          <outline text="Only supports Python but looking to add more languages"/>
          <outline text="Some limits on Python standard libs, some additional Google specific libs"/>
          <outline text="Includes Django but doesn't uses a relational data store"/>
          <outline text="Notes this may make some Django components harder to use"/>
          <outline text="Provides some help to work with Django"/>
          <outline text="Other frameworks should work"/>
          <outline text="Provides own framework, webapp"/>
          <outline text="Wonder how they can make promises of scalability when the app code could technically prevent that?"/>
          <outline text="Use a sandbox security model, limit access to underlying OS"/>
          <outline text="Data store is transactional, sounds like an object database"/>
          <outline text="Uses optimistic locking"/>
        </outline>
        <outline text="Initial language choice may be a huge limiter"/>
        <outline text="In my experience, hackers either love or hate Python"/>
        <outline text="Lock-in is another concern"/>
        <outline text="This is not standardized web app hosting, with simple database, language support"/>
        <outline text="No clean way to port code in or out"/>
        <outline text="By Google's language, they seem to expect people to start, stay"/>
        <outline text="Have to admit despite Ars' objections that Google's ability to scale infrastructure is attractive"/>
        <outline text="Google may be banking on that"/>
        <outline text="Also don't know the premium price point yet, may be very competitive"/>
      </outline>
      <outline text="How introversion may lead to reluctance about tech even among geeks" Offset="25:15">
        <outline text="http://db.tidbits.com/article/9544"/>
        <outline text="Author examines self as a geek who favors tech, disfavors IM"/>
        <outline text="Avoids a diatribe against IM as evil"/>
        <outline text="Willing to consider it is a personal, psychological question"/>
        <outline text="Is it a consequence of a certain temperament?"/>
        <outline text="Acknowledges IM is an important tool many use for communcation"/>
        <outline text="Clearly a self aware exercise to reconcile with IM"/>
        <outline text="Admits to being an introvert"/>
        <outline text="Explains it is not lack of social skill but choice, preference for asocial activity"/>
        <outline text="Affects choice in social setting, is not itself a choice"/>
        <outline text="Gives some good background"/>
        <outline text="Jung's definition of introversion, extroversion as a continuum"/>
        <outline text="Gives a good, short bibliography for further reading"/>
        <outline text="Looks at specific traits of introverts and how they don't mesh well with IM"/>
        <outline text="For example, introverts don't deal well with distraction, multitasking"/>
        <outline text="Contrasts the experience of IM, Twitter interrupting with email"/>
        <outline text="Can take time for responses, doesn't demand immediate attention"/>
        <outline text="Makes a good point about that and voice mail making interruptions manageable"/>
        <outline text="Genuinely has tried to find ways to make IM workable"/>
        <outline text="Clearly concedes its usefulness and integral part of online norms"/>
        <outline text="Find the Twitter conundrum less compelling"/>
        <outline text="Description admits this is more of a social concern"/>
        <outline text="Good suggestions for introverts to work with IM, Twitter"/>
        <outline text="Overall, makes me more sympathetic to more introverted friends"/>
        <outline text="Allowed me to recognize the online habits of some friends as introversion"/>
        <outline text="Reminder that as generally positive some progress may be, benefit not always spread evenly"/>
      </outline>
      <outline text="Recent court decisions eroding ISP liability protection" Offset="29:25">
        <outline text="http://www.news.com/8301-10784_3-9911501-7.html?tag=nefd.lede"/>
        <outline text="At risk is section 230 of the 1996 Telecommunications Act"/>
        <outline text="Immunizes site operators from many complaints"/>
        <outline text="One form of safe harbor"/>
        <outline text="Articles gives a brief background"/>
        <outline text="Listen to episodes 9, 10 of Rules for the Revolution for more on 230"/>
        <outline text="http://www.rulesfortherevolution.com/2007/03/20/episode-009-section-230/"/>
        <outline text="http://www.rulesfortherevolution.com/2007/04/20/episode-010-section-230-continued/"/>
        <outline text="Kurt Opsahl of the EFF is the guest in these two episodes"/>
        <outline text="First case involved an operator of a variety of dating sites"/>
        <outline text="Complaint was over a bogus, sexually explicit profile"/>
        <outline text="Judge dismissed most of complaints, except for issues around rights of publicity"/>
        <outline text="Seems like rights of publicity coming more into question"/>
        <outline text="Think back to the Virgin Mobile case"/>
        <outline text="Sites, services encourage more info, which may be attractive for ads, press"/>
        <outline text="Not a privacy question, per se, or even an IP question, where copyright is waived or CC is used"/>
        <outline text="CDT's Sophia Cope concerned that this could be used to reframe defamation complaints"/>
        <outline text="Cope admits there is not much case law on publicity"/>
        <outline text="A potential loophole, doesn't mean generally weakening of 230, per se"/>
        <outline text="Defending lawyer optimistic about appeal, though"/>
        <outline text="Roommates.com the other case"/>
        <outline text="Allegations it violated fair house act with questionnaire"/>
        <outline text="Successfully defended but circuit court divided on appeal"/>
        <outline text="Is the site an &quot;information provider&quot;, except from section 230?"/>
        <outline text="Structure, presuppositions of questions seem to be the core issue"/>
        <outline text="Also ability to search, filter specifically on preset answers"/>
        <outline text="Open ended questions, where users could say anything, allowed since questions were deemed neutral"/>
        <outline text="May narrow 230 but may also stall critics"/>
        <outline text="Also not sure that this ruling applies broadly, given the specifics of the case"/>
        <outline text="Even for another operator with a questionnaire, merits, biases of questions need to be decided, then only if complaint is raised"/>
      </outline>
    </outline>
    <outline text="tail -f" Offset="34:20">
      <outline text="Another museum joins Flickr commons project" Offset="34:39">
        <outline text="http://creativecommons.org/weblog/entry/8190"/>
        <outline text="The Commons was started in collaboration with LoC"/>
        <outline text="Talked about this on the 1/20 news show from this year"/>
        <outline text="Goals are to share, invite collective tag, annotation"/>
        <outline text="At the time it was announced, Smithsonian immediately showed interest"/>
        <outline text="Powerhouse Museum in Sydney, Australia"/>
        <outline text="First museum to participate"/>
        <outline text="Contributing 200 photos from its Tyrell Collection, publicly held photos"/>
        <outline text="Will continue to add photos from this almost 8K collection"/>
      </outline>
      <outline text="Carriers to argue P4P means regulation unnecessary" Offset="36:11">
        <outline text="http://feeds.arstechnica.com/~r/arstechnica/BAaf/~3/268086748/20080410-big-isps-push-p4p-as-substitute-for-fcc-regulation.html"/>
        <outline text="In latest filings from Comcast, AT&amp;T to the FCC, argue P4P lessens need to regulation"/>
        <outline text="Original work published was with Verizon's participation"/>
        <outline text="Pando, only developer of P4P, has since broadened to include AT&amp;T, Comcast, others"/>
        <outline text="Still following other arguments about abuse by P2P users, definitions of reasonable network management"/>
        <outline text="Problem is Pando is the only implementation"/>
        <outline text="Until we see competitors able to use the same underlying protocol, then skepticism is due"/>
        <outline text="An open P4P with many clients, competitors, but working with carriers cooperatively may lessen argument for regulation"/>
        <outline text="It is way too early to seriously consider this point"/>
      </outline>
    </outline>
    <outline text="Outro" Offset="38:21">
      <outline text="Contact me">
        <outline text="Email to feedback@thecommandline.net"/>
        <outline text="Web site at http://thecommandline.net/"/>
        <outline text="IM to command.line@skype"/>
        <outline text="Listener comment line is 240-949-2638"/>
        <outline text="del.icio.us tag is &quot;for:cmdln&quot;"/>
        <outline text="http://twitter.com/cmdln"/>
      </outline>
      <outline text="I'd like to thank libsyn.com for AAC hosting and Wouter de Bie for MP3 hosting"/>
      <outline text="These notes and the show audio and music are covered by a Creative Commons license">
        <outline text="http://creativecommons.org/licenses/by-nc-sa/3.0/us/"/>
        <outline text="Attribution, non-commercial, share alike"/>
      </outline>
    </outline>
  </body>
</opml>
