Comments on: Jonathan Zittrain and a Cyber September 11

By: DavidMohring

DavidMohring — Sun, 21 Aug 2005 15:56:45 +0000

Locking owners of PCs out parts of their operating system in itself represents a security risk. Since no complex software has been found to be completely immune to exploitable vulnerabilities, any 9/11 security framework could itself be exploited.
See “Remote Attestation” and content access monopolies
http://itheresies.blogspot.com/2005_08_01_itheresies_archive.html

One solution to identity theft is the use of a separate back channel that is used to notify a registered person when a transaction is made. You only need a minority of people to join such a system to act in the same way as a canary in a mine, detecting potental cracking by third parties. Notifcations of important transactions could be sent to your cell phone as well as your PCs.
See Epic Ideas for Privacy Reform
http://itheresies.blogspot.com/2005_03_01_itheresies_archive.html

The only real solution is the adoption of a reliable framework and operating environment and DEMAND that, instead of the developers, trusted third parties audit and build the software used ( step 12 ).
See Twelve Step TrustABLE IT : VLSBs in VDNZs From TBAs
http://itheresies.blogspot.com/2004_10_01_itheresies_archive.html

By: ecksii

ecksii — Fri, 19 Aug 2005 04:44:33 +0000

Well, it appears that I’m out of sync with the show. I wish that I had seen this one when it was on deck… …sigh.

By: ecksii

ecksii — Fri, 19 Aug 2005 04:41:06 +0000

Marcus Ranum would be good to talk on this subject. Another good person would be Simson Garfinkle.

By: Judith Perrolle

Judith Perrolle — Fri, 19 Aug 2005 00:43:47 +0000

Jason, re: copynight – sounds interesting and meets 2 blocks from my house, the one in Cambridge anyway.

Also I have an interest in digital archiving, but I do mine as VirtualPCs on a mac. I don’t have room for more than a few real computers.

By: Jason Scott

Jason Scott — Fri, 19 Aug 2005 00:31:59 +0000

urbenz, that’s one of the core functionalities of anti-virus software. It’s one of the things they do, look for completely-whacky calls and functions that make no sense for the program. Obviously, they also use signature files and other stuff.

By: Jason Scott

Jason Scott — Fri, 19 Aug 2005 00:30:54 +0000

Judith, I was brought, I think, to give a little “on the ground” background to Jonathan’s talking, but as we both heard, the boy can handle himself quite well, and in many different ways. Like I said, I got whiplash as everbody bounced around. I’m glad I got to say something, anyway.

If you want to hear me tell a room full of people my thought on digital history, I gave a talk that’s available here:

http://www.archive.org/audio/audio-details-db.php?collectionid=2004-h2k2-digitalhistory-jasonscott&collection=textfiles_audio

Hey, go to the creative commons dinner this upcoming tuesday!

http://www.copynight.org/

By: urbenz

urbenz — Fri, 19 Aug 2005 00:26:38 +0000

Nice artsscene site, jason. I’ve always admired ascii art!

I wonder if there could be a program that does a test run of any “exe” or other virus file before it’s actually opened? It could check to see if it tries to duplicate itself or do any other of the bad things worms and virus’ do.

By: Judith Perrolle

Judith Perrolle — Fri, 19 Aug 2005 00:19:20 +0000

Jason, I *love* your basement! I wish you had gotten to say more on the show. Even when we back up and archive the electronic media don’t have anywhere near the shelf life of paper, papyrus, clay tablets, or stone. We are vulnerable to losing our recorded history is we put it on computers for storage.

By: Jason Scott

Jason Scott — Fri, 19 Aug 2005 00:19:04 +0000

On my website, textfiles.com, I have many dozens of “open source” viruses. That’s one level of it all, discussion of what they are, how they work. People do that all the time. Virus writers are a funny lot, although (and I am not kidding) some are actually deadly.

By: urbenz

urbenz — Fri, 19 Aug 2005 00:17:39 +0000

I’m waiting to see a virus program that’s open source. Or could this program be edited to be a virus itself?

By: Jason Scott

Jason Scott — Fri, 19 Aug 2005 00:12:15 +0000

I am very abnormal in how I approach data (hence I’m the “archivist guy”). My basement reflects this:

http://cache.cow.net/databarn.jpg

I’ve lost over 20 hard drives in the past 3 years (I have a few dozen running at any given time), so I know more than most the ethereal nature of data, and that sinking feeling when the metal crashes into metal.

By: Judith Perrolle

Judith Perrolle — Fri, 19 Aug 2005 00:10:22 +0000

Jon, There’s an interesting contradiction in antivirus company economic interests. If windows were actually designed to be more secure, who would buy their products?

Jason, Very smart to keep your backups elsewhere than beside your computer.
I learned this with paper since we had a fire in my apartment when I was working on my PhD dissertation.

By: urbenz

urbenz — Fri, 19 Aug 2005 00:09:52 +0000

Judith, I agree with you. I have a mac as well, and I’m very pleased with the work that was put into it to keep it secure.

By: urbenz

urbenz — Fri, 19 Aug 2005 00:07:22 +0000

response to Judith Perrolle

Well money is a decent motivator. But the developers of Firefox prove that some people innovate good products just for the sake of it.

By: Judith Perrolle

Judith Perrolle — Fri, 19 Aug 2005 00:06:33 +0000

urbenz, I just got a mac mini that sells for about $500 and uses a PC type monitor, mouse and keyboard. I have found the total cost of ownership to be lowest for macs and actually highest for linux (because I value my time:). But I prefer linux to windows anyway because it is more secure and opensource.

By: Jason Scott

Jason Scott — Fri, 19 Aug 2005 00:04:06 +0000

A lot of fun, as always, guys.

I think the net (heh) was cast a bit wide here. There’s so much to this subject, and an hour is tough to put it all in. Personally, I have great faith in capitalism solving a lot of problems regarding connectivity vs. clampdowns from central authority, but it is that very thing…. faith.

My life philosophy plays in here: I look at anything, be it data, loved ones, possessions… and I ask myself two questions:

1. “What effect would this have on my life it was was gone tommorrow?”
2. “What do I need to do to avoid losing it tonight?”

Hence a lot of my data is mirrored in six locations around the country, and backed up on DVDs, CDs, and digital tape.

I realize I’m in the minority.

By: JonGarfunkel

JonGarfunkel — Fri, 19 Aug 2005 00:03:51 +0000

Judith– thanks for appearing on the show… and in the “clog”! (the comment-log) I wish Z had answered your point about computer companies not being liable (would he have agreed? or would that stifle innovation? or is open source code a way out of such contracts?)

as to your point here… hmm… do you mean that Symantec and McAfee are doing quite well with the level of viruses that there are right now?

By: urbenz

urbenz — Fri, 19 Aug 2005 00:02:55 +0000

response to shpilk

I think that companies are trying to watch their wallets, and the bottom line is that Dell’s are cheaper than Mac’s when you initially buy them. I wonder how the price adds up when you take into account upgrade test time, upgrade time, and virus fighting time.

By: Judith Perrolle

Judith Perrolle — Fri, 19 Aug 2005 00:01:20 +0000

Something I didn’t get a chance to mention is that a lot of the effort to make the internet more “secure” is actually an effort to support the economic interests of near-monopoly technology and media companies against innovation.

By: urbenz

urbenz — Fri, 19 Aug 2005 00:00:33 +0000

I think that the only people who will be vulnerable are the users of any low quality operating system that needs patches for it’s patches that are for patches.

I believe that Mac OS X has a built in Firewall to prevent these type of attacks.

I wish that Mark Seinden could have stayed on air longer. It sounds like he spoke out of experience in the field.

By: ksandre

ksandre — Thu, 18 Aug 2005 23:56:05 +0000

KeithErskine Says:

Re: “libertarian dream”

“…. This eternal vigilance is what drives the open source community to make their operating systems (Linux, *BSD) secure.”

Applause! Right on!

Oh, yeah, software of questionable value? To whom? To M$ or the RIAA or the MPAA? Bye, bye BitTorrent….

By: shpilk

shpilk — Thu, 18 Aug 2005 23:55:58 +0000

oh, ya .. I’m running Win2K and had to run and get the patch.

Linux, Mac & other OS’es need to do a better job marketing, and convince the boss at work, too

By: JonGarfunkel

JonGarfunkel — Thu, 18 Aug 2005 23:55:17 +0000

ksandre– good point on the post *before*. JP Barlow’s “Declaration” was laughable.

By: shpilk

shpilk — Thu, 18 Aug 2005 23:54:02 +0000

Each operating system has it’s own vulnerabilities – the key to ensure the long term security of any worldwide system is diversity.

The reason we are discussing this is because Redmond WA puts out junk operating systems.

By: JonGarfunkel

JonGarfunkel — Thu, 18 Aug 2005 23:51:56 +0000

ksandre– Good point.

Jonathan Z– great point before about the security pitfalls about public wifi– when you connect through public wifi, you have absolutely zero knowledge about the network you’re connecting through. I take your larger point, that Internet is so ubiquitous we *expect* to connect all the time.

Good show.

By: ksandre

ksandre — Thu, 18 Aug 2005 23:51:15 +0000

Just for the sake of source, here the link to the John Perry Barlow famous statement:

A Declaration of the Independence of Cyberspace

http://homes.eff.org/~barlow/Declaration-Final.html

By: ksandre

ksandre — Thu, 18 Aug 2005 23:48:08 +0000

Oh, yeah: “no places to hide” on the internet – what about Privacy and Anonimity?

I thought this was about protecting precious and inportant data online?

By: JonGarfunkel

JonGarfunkel — Thu, 18 Aug 2005 23:46:13 +0000

while I’m waiting, I like Jason’s comment.

ksandre– the internet is monitored … which is what I asked Zittrain. oops I blew my question. Time to go home.

By: ksandre

ksandre — Thu, 18 Aug 2005 23:45:58 +0000

“Regulation” and “control” does not mean loggin or not logging.

By: KeithErskine

KeithErskine — Thu, 18 Aug 2005 23:45:29 +0000

At the beginning of the program, Chris said that the Internet was a libertarian ‘draem’ – that is, a decentralized network that works. One thing libertarians belive in is the right to defend yourself, that if you don’t, terrorists or despots will take away your liberties. This eternal vigilance is what drives the open source community to make their operating systems (Linux, *BSD) secure.