It was only a matter of time. Heh. Not a honeypot, eh? Rrrrriiight.
I just had to dig up an old post of mine that needed reposting...
Msg: 35175 of 43019 7/9/2007 4:27:06 AM Recs: 32 Sentiment: Not Disclosed By: Boyle M. Owl Send PM Profile Ignore Add To Favorites Legal Crows Come Home To Roost. Media Defender Says "We Didn't Mean It"
Media Defender backtracks on 'entrapment site'
It was all a terrible mistake
By Nick Farrell: Monday 09 July 2007, 07:14
THE MOVIE industry's private dick division has denied that it set up a P2P site designed to catch people pirating.
Media Defender admitted that it set up a site, called MiiVi, which looked exactly like a P2P site but claimed it was never meant to go live and was not designed to entrap pirates.
According to Ars Technica, Media Defender claimed the story has been blown far out of proportion and was started by sites like The Pirate Bay and TorrentFreak. MediaDefender's Randy Saaf told Ars Technica the story was "completely made up".
Well, not completely made up. He said Media Defender was working on an internal project that involved video and didn't realise that people would be trying to go to it and being a security company it didn't password-protect the site.
Saaf said that it was not an entrapment site, and Media Defender was not working with the MPAA on it. He claimed that the MPAA didn't even know about it.
However Ars asked theme why MediaDefender immediately removed all contact information from the whois registry for the domain if the site was so innocent. Saaf said that it was afraid of a hacker attack or people sending it spam.
It is not clear what Saaf was planning to do with all the details of would-be P2P users who might have logged into the site while it was accidently online or if anything was collected.
-------
Not an entrapment site? Walks like a duck...
Yeah, uh, Media Defender (nee Sentry) is in a heap of trouble because it gives the MPAA two things:
An unclean left hand and an unclean right hand. Media Defender's software installed a secret scanner that uploaded data on any "copyrighted files" to MPAA goons that may have resided on the computers of the dupes who went there.
You can't be breaking into people's computers and violating things like RIGL 11-52-3 by installing nefarious software. Many states have similar laws, and some states have laws specifically against spyware. "Evidence" gathered with unclean hands (this is an actual legal term and concept) angers judges to no end. Any "evidence" by the MPAA shown to be gathered by Media Defender now is under a very dark cloud.
That's why Media Defender is in deep shit. They committed felonies _and_ screwed their client. Thus all the "we didn't know people would actually _go_ to our honeypot"
And now it's proven that they really _did_ set it up as a honeypot. This weekend has turned out pretty good so far.
Hats off to the leaker. Now the _feds_ might have something to go after MediaDefender and the MPAA with. Oh, what delicious irony, with cream and sugar.
"Imagine if they put this botnet to a real use, like Seti@Home."
I thought about doing this for folding@home (cure cancer with a virus!), but once you get mondo points, someone's going to ask if you have _legitimate_ access to all those computers. Vijay likes to keep everything above board.
As for seti@home, I'd run it if it wasn't for the idea that I have that as communication gets more advanced, the less there is reliance on sending analogue electromagnetic waves hither and yon through the aether. SETI assumes that other civilizations will be using broadcasting instead of more targeted means of information transfer (cable, fiber optic, etc) and assumes analogue transmission instead of digital. After about 100 years on this planet, broadcast analogue is becoming "old fashioned." How likely is it that we are going to see that gnat's blink 100 or 200 year lifetime of analogue broadcast from other civilizations?
"Recording off the radio onto tape produces a lower fidelity analog copy and subsequent generations of copying of that copy introduces more noise at each generation."
"Also, since this was not a prop from the movies,"
There is only one prop, and there is probably only one direct casting of the prop. It's worth something, especially since provenance can be directly shown. I agree that it's not worth what the prop itself would be worth. Something that famous might be worth a million, but this is worth at least a few thousand, maybe 50, to the right rich SW fan.
"He was moving, (aka getting married and yelled at)"
Something like that is good enough to get auctioned off at a real auction house and not Ebay, for real money. It's not as if _real_ Star Wars stuff gets on the market.
And she was yelling at him for it? How about "This is going to pay for the wedding" or "Down payment on a house"? End of argument right there. Dumbass.
And the second dumbass removed all value?
Wow.
Please, if someone is giving away stuff like that, please give it to me. I'll be sure it will be taken care of properly.
"actually, Clinton used warrentless wiretaps in the Ames case."
Under the rules, you can do the tap or search and go back later and get the warrant within a certain time frame. It's a few days, IIRC. It sounds backwards, but it's better than the alternative of the "bad old days" when there wasn't _any_ way to conduct secret wiretaps with any guidance, so the FBI just did them willy nilly, collecting evidence that would never see the light of day in a real courtroom, because it wouldn't be admissible. The FISA court is a way to have *some* oversight, even though most people view it as a rubber stamp, and actually let some evidence be used in open court.
While people gnashed and wailed at Clinton for the expansion of these rules, it's the Bush administration that treats even these loosened rules as an obstacle. I mean, c'mon, they can't come up with "probable cause" even *after* the search?
"so a secret court takes steps towards transparency."
No, a secret court has had enough of being called irrelevant. EVERY president since Carter (Carter created it) has actually gone to get warrants from the court and the court has generally granted them. This administration, however, has wilfully ignored them _and_ said out in public that the FISA court system is an obstacle.
Anyone who has been paying attention to this _knows_ that the FISA judges are pissed off.
I am not one bit surprised that they sided with the ACLU.
And besides, Open Office precedes OOXML by a few years. If anything, OpenOffice.org *might* have a complaint about Microsoft misappropriating and reversing their name.
The results would be amusing. They're supposed to send you confirmation that it was submitted.
-- BMO
Re:They're effectively bankrupt
on
SCO Loses
·
· Score: 1
It's more than 16 million, because under the APA, SCO had to remit *all* of the fees to Novell to receive 5 percent as a sales commission.
Since the judge said that SCO is liable for conversion (refusing to remit those fees and claim as its own), SCO must remit all of it *plus whatever penalties and interest* are due.
-- BMO
Re:Summary is Flamebait
on
SCO Loses
·
· Score: 4, Insightful
"Uhm, the reason they lost is because they picked a fight with players who had billions of dollars"
No. They lost because they were _wrong_.
They had funding from Microsoft and Sun to go through with this (the "licenses" SCO sold them in 2003).
What we're all waiting for now is when Yarro, Anderer and McBride go to jail.
-- BMO
Re:And yet...
on
SCO Loses
·
· Score: 5, Informative
That's because the ruling came out *after* trading hours.
"Have you ever worked in a tech department that had to support frozen computers?"
A bit. It's a PITA, but for static setups that don't need touching and subject to "many hands" like in a library, it's not bad. Let's just say that students in a classroom are typically better behaved than many library patrons.
" Deep Freeze is really just a crappy way of avoiding the problem instead of dealing with it and fixing it."
Well, I think the problem with that lies elsewhere, probably in a place called Redmond. All this stuff is just patches upon patches to keep Windows from eating itself.
"But it is not that hard to lock down boxes properly, with group policy and using the default Windows groups."
Some would say that this should be the default, but "design and marketing decisions" prevent that.
"But they would whine if they couldn't add weatherbug and have five different toolbars in IE"
Nnnggghhh.... *puts on BOFH hat* "YOU GET THE POLICY OF DOOM! MUAHAHAHAHAHAH!!!!"
If you suspect something is evil with your setup, you should go with your gut instincts. You are probably more right than you know.
You should get away from antivirus. Seriously. I'm going to sound like a salesman, but bear with me a bit.
Antivirus and anti-malware in general, on Windows machines, closes the barn door after every single horse has bolted. There is _no_ way to be sure your Windows computer is badware/zombieware free. To top this off, it often sucks up incredible amounts of cycles that turn the latest gamer machine into an XT.
There is something that computer labs and libraries swear by and not at: Faronics' DeepFreeze. What you do is establish a "ground state" for the machine by doing a bare metal install and then installing DeepFreeze. You then have certain areas for data that are unfrozen, but the rest is basically locked up tight.
Surf by an evil site and get a drive-by install? Laugh maniacally, and reboot. The evil bits are then...gone. The machine has returned to its ground state. To install software permanently, you must "unfreeze" the machine, install your software, and then refreeze. The refreezing can be automatic for the next reboot or specified for a certain number of reboots, like if you were doing a Windows update and have to suffer through the interminable reboots. So it also gives Windows "parental supervision" - even for the 9x machines that don't have the concept of an "administrator" account.
Evilware in the presence of DeepFreeze is about as sticky as snot to teflon. If you insist on staying with Windows, this will let you sleep at night.
"If they provide the source code seperately, then the GPL requires them to offer the source code to any third party that asks for it for at least 3 years from their last binary distribution."
I don't think so. MySQL AB doesn't have to offer source to third parties if those third parties do not have a relationship with MySQL AB. The GPL was never intended to turn a software package into an albatross for the copyright holder. Besides, they own the copyright and can stop offering the GPLed branch of MySQL at any time.
But with regards to the previous messages, if I'm just distributing binaries, and I'm not passing on the written offer for source code, I'm the one on the hook. If I am a commercial distributor, there is always someone on that path that has the source code, and that person is _me_, as the last distributor in the chain for the sake of this discussion. This is why Tivo has to distribute source code to its end users and not RedHat or the original authors of the Free Software inside a Tivo box.
It is not fair, or morally right for me, while not acting as an agent of MySQL AB and distributing MySQL binaries, to put MySQL AB on the hook for people who haven't bought the binaries from them. *I* am the guy who should be offering up the source code. Not them.
With regards to clause C, if I am a non-commercial distributor, and I point at a public server for source code and that server disappears, the end user *cannot* get the source code from MySQL AB if mySQL AB says "tough titties, buy a licensed binary" and the end user doesn't feel like ponying up. MySQL AB is not obligated to give it to them, because that end user did not have a prior relationship with MySQL AB as a customer or even as a downloader of *their* binaries.
"This is because any party who receives the binary is entitled to the source even if they didn't get it directly from MySQL AB."
And you, Sir, are not entirely correct. I cannot bend over MySQL AB by giving people binaries of MySQL. If you get binaries from me, then *I* must offer the source code *not* MySQL. If MySQL AB no longer offers source to all comers, then it's *my* problem, not theirs.
From GPL V2 (which is what MySQL is using currently)
"b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,"
If I'm distributing version 2 GPLed MySQL, that clause is talking to _me_ and not MySQL AB. The "c" clause gives me an out if I'm noncommercial and I can point to SourceForge or a public server offering MySQL source.
Slashdot Mirror
It was only a matter of time. Heh. Not a honeypot, eh? Rrrrriiight.
I just had to dig up an old post of mine that needed reposting...
Msg: 35175 of 43019 7/9/2007 4:27:06 AM Recs: 32 Sentiment: Not Disclosed
By: Boyle M. Owl Send PM Profile Ignore Add To Favorites
Legal Crows Come Home To Roost. Media Defender Says "We Didn't Mean It"
Media Defender backtracks on 'entrapment site'
It was all a terrible mistake
By Nick Farrell: Monday 09 July 2007, 07:14
THE MOVIE industry's private dick division has denied that it set up a P2P site designed to catch people pirating.
Media Defender admitted that it set up a site, called MiiVi, which looked exactly like a P2P site but claimed it was never meant to go live and was not designed to entrap pirates.
According to Ars Technica, Media Defender claimed the story has been blown far out of proportion and was started by sites like The Pirate Bay and TorrentFreak. MediaDefender's Randy Saaf told Ars Technica the story was "completely made up".
Well, not completely made up. He said Media Defender was working on an internal project that involved video and didn't realise that people would be trying to go to it and being a security company it didn't password-protect the site.
Saaf said that it was not an entrapment site, and Media Defender was not working with the MPAA on it. He claimed that the MPAA didn't even know about it.
However Ars asked theme why MediaDefender immediately removed all contact information from the whois registry for the domain if the site was so innocent. Saaf said that it was afraid of a hacker attack or people sending it spam.
It is not clear what Saaf was planning to do with all the details of would-be P2P users who might have logged into the site while it was accidently online or if anything was collected.
-------
Not an entrapment site? Walks like a duck...
Yeah, uh, Media Defender (nee Sentry) is in a heap of trouble because it gives the MPAA two things:
An unclean left hand and an unclean right hand. Media Defender's software installed a secret scanner that uploaded data on any "copyrighted files" to MPAA goons that may have resided on the computers of the dupes who went there.
You can't be breaking into people's computers and violating things like RIGL 11-52-3 by installing nefarious software. Many states have similar laws, and some states have laws specifically against spyware. "Evidence" gathered with unclean hands (this is an actual legal term and concept) angers judges to no end. Any "evidence" by the MPAA shown to be gathered by Media Defender now is under a very dark cloud.
That's why Media Defender is in deep shit. They committed felonies _and_ screwed their client. Thus all the "we didn't know people would actually _go_ to our honeypot"
Whoops.
--
BMO
-------
Fast forward to today...
http://thepiratebay.org/tor/3806944/MediaDefender.Mail.200612.200709-MDD/
And now it's proven that they really _did_ set it up as a honeypot. This weekend has turned out pretty good so far.
Hats off to the leaker. Now the _feds_ might have something to go after MediaDefender and the MPAA with. Oh, what delicious irony, with cream and sugar.
--
BMO
I'll see your cheap joke and raise you one:
:-D
Why do the French plant trees beside the road?
So the Germans can march in the shade.
--
BMO
karma to burn baaaybe, karma to burn...
"The difference between "Evil" and "Not Evil" is only a matter of opinion."
No, the difference between "evil" and "not evil" is the bubble on the output of the gate.
--
BMO
"If anyone is willing to adopt to linux or just bash windows it's young people."
In Sweden, only old people use Windows
--
BMO
"Imagine if they put this botnet to a real use, like Seti@Home."
I thought about doing this for folding@home (cure cancer with a virus!), but once you get mondo points, someone's going to ask if you have _legitimate_ access to all those computers. Vijay likes to keep everything above board.
As for seti@home, I'd run it if it wasn't for the idea that I have that as communication gets more advanced, the less there is reliance on sending analogue electromagnetic waves hither and yon through the aether. SETI assumes that other civilizations will be using broadcasting instead of more targeted means of information transfer (cable, fiber optic, etc) and assumes analogue transmission instead of digital. After about 100 years on this planet, broadcast analogue is becoming "old fashioned." How likely is it that we are going to see that gnat's blink 100 or 200 year lifetime of analogue broadcast from other civilizations?
--
BMO
"How does one reasonably quantify admin productivity?"
Go see "Doctor Summeroff"
High blood pressure from dealing with stupid people should do it. A couple of months might be enough.
--
BMO
"Recording off the radio onto tape produces a lower fidelity analog copy and subsequent generations of copying of that copy introduces more noise at each generation."
l s/item-details.asp?EdpNo=2905632&CatId=1425
l e/
You just time traveled from what decade?
FM Radio cards:
http://www.cel-soft.com/RadioCard.htm
http://www.tigerdirect.com/applications/SearchToo
USB radio:
http://www.engadget.com/2004/07/13/usb-radio-dong
http://www.redferret.net/?p=7760
So how is saving a stream off the net any different than recording from one of these?
--
BMO
I read it as cowpi.
must...sleep.
--
BMO
I could really go for a Connection Machine of these.
It will take only 1024 of these to have the same number of processors as the Connection Machine.
http://en.wikipedia.org/wiki/Connection_Machine
--
BMO
"Also, since this was not a prop from the movies,"
There is only one prop, and there is probably only one direct casting of the prop. It's worth something, especially since provenance can be directly shown. I agree that it's not worth what the prop itself would be worth. Something that famous might be worth a million, but this is worth at least a few thousand, maybe 50, to the right rich SW fan.
--
BMO
There are so many things wrong with this story.
"He was moving, (aka getting married and yelled at)"
Something like that is good enough to get auctioned off at a real auction house and not Ebay, for real money. It's not as if _real_ Star Wars stuff gets on the market.
And she was yelling at him for it? How about "This is going to pay for the wedding" or "Down payment on a house"? End of argument right there. Dumbass.
And the second dumbass removed all value?
Wow.
Please, if someone is giving away stuff like that, please give it to me. I'll be sure it will be taken care of properly.
"actually, Clinton used warrentless wiretaps in the Ames case."
Under the rules, you can do the tap or search and go back later and get the warrant within a certain time frame. It's a few days, IIRC. It sounds backwards, but it's better than the alternative of the "bad old days" when there wasn't _any_ way to conduct secret wiretaps with any guidance, so the FBI just did them willy nilly, collecting evidence that would never see the light of day in a real courtroom, because it wouldn't be admissible. The FISA court is a way to have *some* oversight, even though most people view it as a rubber stamp, and actually let some evidence be used in open court.
While people gnashed and wailed at Clinton for the expansion of these rules, it's the Bush administration that treats even these loosened rules as an obstacle. I mean, c'mon, they can't come up with "probable cause" even *after* the search?
--
BMO
"so a secret court takes steps towards transparency."
No, a secret court has had enough of being called irrelevant. EVERY president since Carter (Carter created it) has actually gone to get warrants from the court and the court has generally granted them. This administration, however, has wilfully ignored them _and_ said out in public that the FISA court system is an obstacle.
Anyone who has been paying attention to this _knows_ that the FISA judges are pissed off.
I am not one bit surprised that they sided with the ACLU.
--
BMO
"The entire standard in verbatim is 'Open Office Extensible Markup Language'."
It's not.
It's Office Open Extensible Markup Language.
http://en.wikipedia.org/wiki/Office_Open_XML
No lawsuit.
And besides, Open Office precedes OOXML by a few years. If anything, OpenOffice.org *might* have a complaint about Microsoft misappropriating and reversing their name.
--
BMO
Done. Now if everyone would.
The results would be amusing. They're supposed to send you confirmation that it was submitted.
--
BMO
It's more than 16 million, because under the APA, SCO had to remit *all* of the fees to Novell to receive 5 percent as a sales commission.
Since the judge said that SCO is liable for conversion (refusing to remit those fees and claim as its own), SCO must remit all of it *plus whatever penalties and interest* are due.
--
BMO
"Uhm, the reason they lost is because they picked a fight with players who had billions of dollars"
No. They lost because they were _wrong_.
They had funding from Microsoft and Sun to go through with this (the "licenses" SCO sold them in 2003).
What we're all waiting for now is when Yarro, Anderer and McBride go to jail.
--
BMO
That's because the ruling came out *after* trading hours.
--
BMO
"Have you ever worked in a tech department that had to support frozen computers?"
A bit. It's a PITA, but for static setups that don't need touching and subject to "many hands" like in a library, it's not bad. Let's just say that students in a classroom are typically better behaved than many library patrons.
" Deep Freeze is really just a crappy way of avoiding the problem instead of dealing with it and fixing it."
Well, I think the problem with that lies elsewhere, probably in a place called Redmond. All this stuff is just patches upon patches to keep Windows from eating itself.
"But it is not that hard to lock down boxes properly, with group policy and using the default Windows groups."
Some would say that this should be the default, but "design and marketing decisions" prevent that.
"But they would whine if they couldn't add weatherbug and have five different toolbars in IE"
Nnnggghhh.... *puts on BOFH hat* "YOU GET THE POLICY OF DOOM! MUAHAHAHAHAHAH!!!!"
--
BMO
If you suspect something is evil with your setup, you should go with your gut instincts. You are probably more right than you know.
You should get away from antivirus. Seriously. I'm going to sound like a salesman, but bear with me a bit.
Antivirus and anti-malware in general, on Windows machines, closes the barn door after every single horse has bolted. There is _no_ way to be sure your Windows computer is badware/zombieware free. To top this off, it often sucks up incredible amounts of cycles that turn the latest gamer machine into an XT.
There is something that computer labs and libraries swear by and not at: Faronics' DeepFreeze. What you do is establish a "ground state" for the machine by doing a bare metal install and then installing DeepFreeze. You then have certain areas for data that are unfrozen, but the rest is basically locked up tight.
Surf by an evil site and get a drive-by install? Laugh maniacally, and reboot. The evil bits are then...gone. The machine has returned to its ground state. To install software permanently, you must "unfreeze" the machine, install your software, and then refreeze. The refreezing can be automatic for the next reboot or specified for a certain number of reboots, like if you were doing a Windows update and have to suffer through the interminable reboots. So it also gives Windows "parental supervision" - even for the 9x machines that don't have the concept of an "administrator" account.
Evilware in the presence of DeepFreeze is about as sticky as snot to teflon. If you insist on staying with Windows, this will let you sleep at night.
I swear, Faronics should hire me.
--
BMO
I should have included this as part of the quote:
"If they provide the source code seperately, then the GPL requires them to offer the source code to any third party that asks for it for at least 3 years from their last binary distribution."
I don't think so. MySQL AB doesn't have to offer source to third parties if those third parties do not have a relationship with MySQL AB. The GPL was never intended to turn a software package into an albatross for the copyright holder. Besides, they own the copyright and can stop offering the GPLed branch of MySQL at any time.
--
BMO
Sometimes all this stuff makes my head feel like it's gonna 'splode.
I was of the idea that he was saying that MySQL had to give people source for stuff *I* distributed.
--
BMO
But with regards to the previous messages, if I'm just distributing binaries, and I'm not passing on the written offer for source code, I'm the one on the hook. If I am a commercial distributor, there is always someone on that path that has the source code, and that person is _me_, as the last distributor in the chain for the sake of this discussion. This is why Tivo has to distribute source code to its end users and not RedHat or the original authors of the Free Software inside a Tivo box.
It is not fair, or morally right for me, while not acting as an agent of MySQL AB and distributing MySQL binaries, to put MySQL AB on the hook for people who haven't bought the binaries from them. *I* am the guy who should be offering up the source code. Not them.
With regards to clause C, if I am a non-commercial distributor, and I point at a public server for source code and that server disappears, the end user *cannot* get the source code from MySQL AB if mySQL AB says "tough titties, buy a licensed binary" and the end user doesn't feel like ponying up. MySQL AB is not obligated to give it to them, because that end user did not have a prior relationship with MySQL AB as a customer or even as a downloader of *their* binaries.
--
BMO
I actually think of "Death Race 2000"...
--
BMO
"This is because any party who receives the binary is entitled to the source even if they didn't get it directly from MySQL AB."
And you, Sir, are not entirely correct. I cannot bend over MySQL AB by giving people binaries of MySQL. If you get binaries from me, then *I* must offer the source code *not* MySQL. If MySQL AB no longer offers source to all comers, then it's *my* problem, not theirs.
From GPL V2 (which is what MySQL is using currently)
"b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,"
If I'm distributing version 2 GPLed MySQL, that clause is talking to _me_ and not MySQL AB. The "c" clause gives me an out if I'm noncommercial and I can point to SourceForge or a public server offering MySQL source.
--
BMO