So long as you do not filter, monitor, or read any of your customer's packets, provide due diligence in identification of a customer by records, and only provide info the industry cartels under subpoena (and not just because they ask), then okay - you can be free from liability.
Otherwise, you're rightfully just as culpable and should eat the consequences.
1) What incentive does a "lifetime of income" give to songwriters to write new songs? Will amateurs be the only ones writing songs until their next big hit single?
Well, to be fair, the laws of supply and demand eventually kicks in. The heirs of the folks who wrote Ragtime tunes probably wouldn't be seeing a whole lot of royalty income right now. In fact, I think Disney, Inc. and perhaps a handful of others are the only ones I've seen who are capable of zombifying their old stuff and still make some money off of it.
Given the mass of dreck we see nowadays, the incentive for the sognwriter would be to keep them thar royalty checks not only coming in, but to continually make stuff that gets attention. Sure, things have (in many genres) gotten to the point where it's 'all rehash all the time', but it all has a limited shelf life.
As for #2, I agree with you. The whole point there is a greed-play by corporations who can't stand the thought that their business model isn't quite keeping up with evolution.
I'm personally hoping the make a special category for bubblegum pop music - that crap can be copyrighted for 10,000 years. Sort of like how you lock up radioactive waste based on half-life.
As long as the course also teaches about ethical business practices and fair play, and about how abusive monopolies can create a situation where the consumer receives very expensive and sub-par products.
Somehow I don't quite see that happening. I sincerely doubt that they even get around to mentioning "fair use" (save a quick mention in passing), let alone "fair play".
I have no problems at all with educating kids on copyright law (at about the same time that other civics classes are taught), but this just reeks of propaganda.
But the iris data is no proof of ownership, you could embed your own iris data to the stolen image after you've removed or corrupted (by editing the image) the original watermark. Or if this iris watermark is prof enough, then rip some famous picture that doesn't have iris watermark, add your own iris watermark, sue the publisher/photographer and profit???
By itself, it wouldn't be. But when the original photog has that, plus a a few dozen similar shots under the same lighting conditions, vantage point, etc, plus a lot of other circumstantial evidence that he was there... ?
Even without it, a professional photographer is very likely to have lots of other evidence, including (probably) film negatives, which you can't quite fake as well with a computer. I know a few pros who make it a point to take along a cheap disposable camera and get some incidental shots on it before or after they get their moneymaker shots. It only costs about a buck to develop the roll neagative-only, and good luck refuting it... Photoshop can't edit on silver nitrate.:)
Also, the original image is likely to be shot in raw format, at full rez... 4096xsomething or bigger nowadays. The image you ripped off is already going to have loss artifacts in it if it came off the web, and it'll be in a much smaller resolution. You can try to up-rez it, but, err, the results will still (with today's technology) look yucky.
Because of all this, I doubt the iris thingy would be much more than (at level best) icing on a pro photog's cake.
While you can easily edit EXIF data (GIMP has the ability for certain, and IIRC so does Photoshop), I suspect that it would be a little harder to remove a steganographic image that is embedded into the image file itself (unless of course you save it into a different format, say.raw ->.bmp -or-.tiff ->.jpg (taking the extra step just to be sure you rinsed it all out).
BUT... this doesn't remove the original image, which a photog can take into court proving that it's his... now where's your 2-zillion x 1.5 zillion rez RAW image w/ the steganographic retina scan (and all the other related images showing similar scenery), to match the one he's using in court against you to prove original ownership? (which in turn pretty much tells you that it isn't even halfway useful until/unless somebody sues you for ripping off his work...)
OTOH, I don't think it has much practicality due to the simple fact that not all photographs (especially pro photos) are taken with someone's eyeball right up against the eyepiece. There's a reason that all the decent photo shops sell release cables and tripods, yanno?:)
That's weird... aside from 'competition concerns', I don't quite grok the connection between ship inspectors (I know, but for brevity that's what I'm calling 'em), and the computer industry.
It's like there's some guy in Brussels with a blindfold and a great big dartboard, each segment of it tagged with an industry ripe for legal harassment or something.
I mean, if they're that eager to insure competition and to stamp out anti-competitive behavior, then why not abandon the formal niceties (and periodic fines) and just go raid Microsoft's EU offices outright? Seeing some of that get a public airing would be hella interesting.
Okay, on a serious note, this is 1976(?) tech here. I can understand wanting it real bad in 1979, but, err, 32 year-old-stuff is kinda dated when you consider that we routinely give China techonology that's a whole Hell of a lot newer.
Besides, weren't they going to retire the Shuttle anyway? If China wants one so bad, why not sell 'em a used one for a decent markup?
As someone who has worked in and around certain aircraft projects a very long time ago, I can say for certain that this guy would've never even hoped to get near, say, an F-117 or B-2 project... there's too much compartmentalization (especially between NASA and the USAF/USN, for Hell's sakes...)
Given all of that - unless the guy started hacking mainframes and whatnot @ Boeing, I guess I just don't see where there would be a really huge dent in US national security at this point. He wouldn't have had the clearance, for starters.
BS. That is exactly what security analysts do. They research security problems. Whether it is how to break into your house or how to break into your computer is no different.
So if someone came up to you unannounced, and said they know exactly how to break into your house, but won't tell you unless you pay them some money, you'd have no problems with it?
If I want my house to be secure, I can either secure it myself or I can pay someone to tell me where the vulnerabilities are.
I don't argue against that. It's the unsolicited nature of it that irks.
Therein lies the problem. It's like some guy showing up at your house, saying that he knows exactly how he could break into that house, but he'll tell you how if you only pay him some money.
In short, nobody asked them to research the bug. They did the research unbidden.
If it's a question of fixing bugs for free, then quite simply they could just not do the research.
How does your argument differ from the profession of a lock smith?
I don't have a locksmith soliciting me out of the blue, demanding payment for his knowledge?
...and what if the weak-point is in a window, not a door? What if the weakness is in the garage door, the attic vent, crawlspace, or some other place where you'd not find a keyed lock?
Your locksmith is more akin to a security contractor or consultant - you specifically hire the guy to utilize his knowledge in order to fill a need which you yourself have (e.g. you locked yourself outside of the house or car). You don't have locksmiths coming to your door unbidden demanding payment.
If I knew how to break into your house, then told you that I was able to but won't tell you how unless you paid up a fee?
I'm sure that you'd easily come up with a lot of reasons why it isn't cool.
On certain superficial moral levels, sure - proprietary closed-source shops would have it coming in a fashion. They make money from hidden information, so hiding information from them until a fee is paid sounds a bit like karma.
OTOH, that's not how we're supposed to work as a community, for one simple reason: end-users don't deserve the grief (which they would get in increased costs that would be passed onto them). Morally, a security researcher isn't supposed to hold information hostage and then credibly claim to be part of any ethical hacking community. At level best, they would be called grey hats; many would rightly call them black-hats.
...and what if the info turns out to be bogus, or an attempt to manipulate the best-guess fix into becoming an even bigger security hole?
Sorry, but there's a distinct lack of responsibility and ethics going on here, no matter how much you think the primary target may deserve it.
I suppose. But honestly, not everybody really needs a sysadmin that's going to diddle around for weeks and compile kernels just to set up a mail server and samba, for example. For most things, I'd rather have someone who just gets the work done rather than goofing off compiling kernels, installing ReiserFS and doing god knows what else other than things that really matter.
Agreed, for most instances - you can get a whole lot more performance in an hour's work out of dumping modules and packages you don't need, than out of tweaking the unholy crap out of a kernel for that last 0.001% performance boost. If you're smart you'll already have a minimum build kickstarted, from which you can add only what you need.
Unless I'm trying to squeeze every last CPU cycle out of a VMWare install for one more VM guest OS, or I get tasked to help assemble a custom build environment VM instance or server, I figure why bother?
As a bonus, I don't have to worry so much about patches breaking things.
You'll find that you no longer have the time to check SANS and packetstorm every day
Dunno about you, but it's my job to (among other things) keep abreast of emerging security issues, then decide on their severity and priority. A quickie scan of SANS ISC is just as much a morning habit to me as log reviews and sucking down the morning caffeinated liquid.
Shit, man... a sysadmin who doesn't check at least some source of leading-edge security news daily is IMHO either incompetent or lazy, and tend to be the ones who look really stupid once they get blindsided by a compromise.
I'd much rather be chided for pushing something off by a few minutes, than to have to explain to my boss and his peers why I didn't know about XYZ exploit, and more importantly, why I didn't do anything to prevent it from chowing down on the production servers...
(and no, I don't run Gentoo, and I avoid recompiling any kernel unless absolutely necessary).
I think your argument holds up until you consider that many of the installed Vista userbase probably came from users buying new computers and not having a choice as to which OS they wanted on it. I'd wager that is the easiest and biggest method for MS to push Vista onto customers whether they want it or not.
I agree that those who buy new machinery at the low/budget end don't have much choice. But, consider that OEM's are still selling Windows XP on their more popular computer product lines, and that, as you stated, the majority of Vista's userbase is from folks who have no other choice. This means that uptake is slow among all the other avenues (e.g. upgrading existing machinery, beige-boxers, gamers, and the like). Now how do those in the other avenues get their OS install more often than not? Most aren't going to shell out $499 for Vista Ultimate (or even $99 for the base version) just to discover that it's crap... many want to test it out before payment somehow, and WGA isn't going to let them do that very well. This is where WGA comes in. It's obvious (IMHO) that MSFT is going out of its way to stop alienating those who install copies, so the question arises... why would they?
It's a Sunday morning, and I'm merely idling out thoughts here and there.
You (wrongly) assume that I harbor some sort of hatred or envy of Vista... but in reality I'm only exploring some options as to why MSFT would do this w/ WGA.
When you realize that Windows upgrade adoptions has slowed with each new iteration, coupled with each new iteration having stronger and stronger anti-copy and 'anti-piracy' measures...? Yes, I realize that correlation != causation, but the coincidence is getting a bit too strong in this instance for me (and many others, I suspect) to not notice.
They're desperate to get Vista adoption picked up faster (which ties in with the previous bullet, but kinda deserves its own) What good does it do to get Vista installed on more machines if they don't get paid for those copies? So confused. Your statement sounds like a circa-2000.com business model.
Not really... They didn't get paid the majority of what they would otherwise be rightly owed for Windows 3.1, but they still turn a profit later on.
How? Simple... a lot MSFT's money doesn't come from individual users - it comes from businesses. If users at home are used to Vista and cozy with it, businesses have less resistance to shifting their workstations to it (as a business, you pay the same license fee per seat no matter which OS version you have installed...) After all, how often do you see the BSA get all anal about individual users?;)
Home users (and to a small extent, OEM's) are only part of the pipeline feeding towards the real money: business licensing.
It all makes sense - MSFT going nuts about larger organizations shifting away from Windows, but really giving nearly the same amount of damn about OEM's stubbornly still selling machinery pre-loaded with XP.
As someone who has no use for Vista (and won't see it at work for at least a year due to the fact that his primary desktop there runs Fedora Core 8), I honestly couldn't care less what MSFT does with the thing.
Besides, it only shows one of these factors, none of which are good:
Windows is an empire built on 'six floppies and xcopy'. I'm very willing to wager that the majority of folks (especially home users) who used Windows 3.1, got it "from a friend" on six copied floppies (seven w/ print drivers). MSFT probably realized this and is going back to their, err, 'viral' roots.
They're desperate to get Vista adoption picked up faster (which ties in with the previous bullet, but kinda deserves its own)
WGA is still broken badly enough that they didn't want to alienate the legit users who got trapped any further
In either case, none of this addresses the underlying bloat, bugs, and obviously creaking NT architecture, on an OS version that was allegedly rebuilt from the ground up. With most corporate folks likely holding off now for "Windows 7", and home users nursing XP. Vista likely won't make much difference now in either case...
Slashdot Mirror
Otherwise, you're rightfully just as culpable and should eat the consequences.
Well, to be fair, the laws of supply and demand eventually kicks in. The heirs of the folks who wrote Ragtime tunes probably wouldn't be seeing a whole lot of royalty income right now. In fact, I think Disney, Inc. and perhaps a handful of others are the only ones I've seen who are capable of zombifying their old stuff and still make some money off of it.
Given the mass of dreck we see nowadays, the incentive for the sognwriter would be to keep them thar royalty checks not only coming in, but to continually make stuff that gets attention. Sure, things have (in many genres) gotten to the point where it's 'all rehash all the time', but it all has a limited shelf life.
As for #2, I agree with you. The whole point there is a greed-play by corporations who can't stand the thought that their business model isn't quite keeping up with evolution.
(and maybe something, somewhere, that shows at least some rebel forces who do more than act as synonyms for the Star Trek Red Shirts?)
Somehow I don't quite see that happening. I sincerely doubt that they even get around to mentioning "fair use" (save a quick mention in passing), let alone "fair play".
I have no problems at all with educating kids on copyright law (at about the same time that other civics classes are taught), but this just reeks of propaganda.
By itself, it wouldn't be. But when the original photog has that, plus a a few dozen similar shots under the same lighting conditions, vantage point, etc, plus a lot of other circumstantial evidence that he was there... ?
Even without it, a professional photographer is very likely to have lots of other evidence, including (probably) film negatives, which you can't quite fake as well with a computer. I know a few pros who make it a point to take along a cheap disposable camera and get some incidental shots on it before or after they get their moneymaker shots. It only costs about a buck to develop the roll neagative-only, and good luck refuting it... Photoshop can't edit on silver nitrate. :)
Also, the original image is likely to be shot in raw format, at full rez... 4096xsomething or bigger nowadays. The image you ripped off is already going to have loss artifacts in it if it came off the web, and it'll be in a much smaller resolution. You can try to up-rez it, but, err, the results will still (with today's technology) look yucky.
Because of all this, I doubt the iris thingy would be much more than (at level best) icing on a pro photog's cake.
BUT... this doesn't remove the original image, which a photog can take into court proving that it's his... now where's your 2-zillion x 1.5 zillion rez RAW image w/ the steganographic retina scan (and all the other related images showing similar scenery), to match the one he's using in court against you to prove original ownership? (which in turn pretty much tells you that it isn't even halfway useful until/unless somebody sues you for ripping off his work...)
OTOH, I don't think it has much practicality due to the simple fact that not all photographs (especially pro photos) are taken with someone's eyeball right up against the eyepiece. There's a reason that all the decent photo shops sell release cables and tripods, yanno? :)
Actually, it was their first thought after they got bitten personally by the botch-up, but IMHO not during design or at any stage before release.
If the end-using customer is their first thought, then please explain DRM.
It's like there's some guy in Brussels with a blindfold and a great big dartboard, each segment of it tagged with an industry ripe for legal harassment or something.
I mean, if they're that eager to insure competition and to stamp out anti-competitive behavior, then why not abandon the formal niceties (and periodic fines) and just go raid Microsoft's EU offices outright? Seeing some of that get a public airing would be hella interesting.
I use tcsh, you insensitive clod!
Okay, on a serious note, this is 1976(?) tech here. I can understand wanting it real bad in 1979, but, err, 32 year-old-stuff is kinda dated when you consider that we routinely give China techonology that's a whole Hell of a lot newer.
Besides, weren't they going to retire the Shuttle anyway? If China wants one so bad, why not sell 'em a used one for a decent markup?
As someone who has worked in and around certain aircraft projects a very long time ago, I can say for certain that this guy would've never even hoped to get near, say, an F-117 or B-2 project... there's too much compartmentalization (especially between NASA and the USAF/USN, for Hell's sakes...)
Given all of that - unless the guy started hacking mainframes and whatnot @ Boeing, I guess I just don't see where there would be a really huge dent in US national security at this point. He wouldn't have had the clearance, for starters.
So if someone came up to you unannounced, and said they know exactly how to break into your house, but won't tell you unless you pay them some money, you'd have no problems with it?
If I want my house to be secure, I can either secure it myself or I can pay someone to tell me where the vulnerabilities are.I don't argue against that. It's the unsolicited nature of it that irks.
Therein lies the problem. It's like some guy showing up at your house, saying that he knows exactly how he could break into that house, but he'll tell you how if you only pay him some money.
In short, nobody asked them to research the bug. They did the research unbidden.
If it's a question of fixing bugs for free, then quite simply they could just not do the research.
I don't have a locksmith soliciting me out of the blue, demanding payment for his knowledge?
Your locksmith is more akin to a security contractor or consultant - you specifically hire the guy to utilize his knowledge in order to fill a need which you yourself have (e.g. you locked yourself outside of the house or car). You don't have locksmiths coming to your door unbidden demanding payment.
I'm sure that you'd easily come up with a lot of reasons why it isn't cool.
On certain superficial moral levels, sure - proprietary closed-source shops would have it coming in a fashion. They make money from hidden information, so hiding information from them until a fee is paid sounds a bit like karma.
OTOH, that's not how we're supposed to work as a community, for one simple reason: end-users don't deserve the grief (which they would get in increased costs that would be passed onto them). Morally, a security researcher isn't supposed to hold information hostage and then credibly claim to be part of any ethical hacking community. At level best, they would be called grey hats; many would rightly call them black-hats.
Sorry, but there's a distinct lack of responsibility and ethics going on here, no matter how much you think the primary target may deserve it.
Agreed, for most instances - you can get a whole lot more performance in an hour's work out of dumping modules and packages you don't need, than out of tweaking the unholy crap out of a kernel for that last 0.001% performance boost. If you're smart you'll already have a minimum build kickstarted, from which you can add only what you need.
Unless I'm trying to squeeze every last CPU cycle out of a VMWare install for one more VM guest OS, or I get tasked to help assemble a custom build environment VM instance or server, I figure why bother?
As a bonus, I don't have to worry so much about patches breaking things.
Dunno about you, but it's my job to (among other things) keep abreast of emerging security issues, then decide on their severity and priority. A quickie scan of SANS ISC is just as much a morning habit to me as log reviews and sucking down the morning caffeinated liquid.
Shit, man... a sysadmin who doesn't check at least some source of leading-edge security news daily is IMHO either incompetent or lazy, and tend to be the ones who look really stupid once they get blindsided by a compromise.
I'd much rather be chided for pushing something off by a few minutes, than to have to explain to my boss and his peers why I didn't know about XYZ exploit, and more importantly, why I didn't do anything to prevent it from chowing down on the production servers...
(and no, I don't run Gentoo, and I avoid recompiling any kernel unless absolutely necessary).
I think your argument holds up until you consider that many of the installed Vista userbase probably came from users buying new computers and not having a choice as to which OS they wanted on it. I'd wager that is the easiest and biggest method for MS to push Vista onto customers whether they want it or not.
I agree that those who buy new machinery at the low/budget end don't have much choice. But, consider that OEM's are still selling Windows XP on their more popular computer product lines, and that, as you stated, the majority of Vista's userbase is from folks who have no other choice. This means that uptake is slow among all the other avenues (e.g. upgrading existing machinery, beige-boxers, gamers, and the like). Now how do those in the other avenues get their OS install more often than not? Most aren't going to shell out $499 for Vista Ultimate (or even $99 for the base version) just to discover that it's crap... many want to test it out before payment somehow, and WGA isn't going to let them do that very well. This is where WGA comes in. It's obvious (IMHO) that MSFT is going out of its way to stop alienating those who install copies, so the question arises... why would they?
You (wrongly) assume that I harbor some sort of hatred or envy of Vista... but in reality I'm only exploring some options as to why MSFT would do this w/ WGA.
When you realize that Windows upgrade adoptions has slowed with each new iteration, coupled with each new iteration having stronger and stronger anti-copy and 'anti-piracy' measures...? Yes, I realize that correlation != causation, but the coincidence is getting a bit too strong in this instance for me (and many others, I suspect) to not notice.
Not really... They didn't get paid the majority of what they would otherwise be rightly owed for Windows 3.1, but they still turn a profit later on.
How? Simple... a lot MSFT's money doesn't come from individual users - it comes from businesses. If users at home are used to Vista and cozy with it, businesses have less resistance to shifting their workstations to it (as a business, you pay the same license fee per seat no matter which OS version you have installed...) After all, how often do you see the BSA get all anal about individual users? ;)
Home users (and to a small extent, OEM's) are only part of the pipeline feeding towards the real money: business licensing.
It all makes sense - MSFT going nuts about larger organizations shifting away from Windows, but really giving nearly the same amount of damn about OEM's stubbornly still selling machinery pre-loaded with XP.
Besides, it only shows one of these factors, none of which are good:
In either case, none of this addresses the underlying bloat, bugs, and obviously creaking NT architecture, on an OS version that was allegedly rebuilt from the ground up. With most corporate folks likely holding off now for "Windows 7", and home users nursing XP. Vista likely won't make much difference now in either case...