Comments and track-backs disabled after spam flood

Yesterday was the Random Oracle blog’s turn to become targetted in a track-back spam attack. Each post ended up with a handful of track-backs to articles on the same bogus blog, which appears to be nothing more than an undigested collection of random paragraphs from different WordPress blogs.

Requiring a CAPTCHA solution with each comment/track-back would have solved this problem. Windows Live Spaces (formerly MSN Spaces) has this option. It is far more effective than the alternatives of allowing public commenting or requiring authentication. The latter is not a barrier since the underlying identity system is disconnected from the real world and has no reputation attached. Spammers can register one account, use this to spam hundreds of blogs and move on to start from clean slate when the ID is black-listed. WordPress controls on commenting are primitive by comparison. Ping-backs and track-backs can be disabled, comments can be disabled or held in the queue for moderation. Finally comments can bet limited to users who had a previously approved comment, which creates a boot-strapping problem. Proof-of-work by solving CAPTCHAs is much better suited to this problem: users serious enough to comment on an article will not mind taking a few extra seconds to solve the puzzle. Spammers will give up and move on to the next blog.

cemp

HD-DVD processing key and Internet censorship

More observations:

  • Attempting to suppress information after it has been leaked on the Internet is highly counter-productive. The heavy-handed tactics required to force the hand of web-site owners and publishes across the world only serve to draw more attention to the problem. This is a lesson that DVD Copy Control Association learned the had way with DeCSS.  But it should have been an obvious point to extrapolate from individual experiences. For example Outlook/Exchange have a feature to recall messages– but the “recall” works by sending another message which the recipient must first open, before Outlook will process it to remove the original one. Emails are often sent by mistake; to err is human. But sending a recall only draws attention to the original blunder and virtually guarantees more people will read it. This is because most errors involve sending a message to the wrong audience: not recognizing the subject line or sender, most  busy people may be tempted to ignore the message or file it away for later review. Send a recall message though, and suddenly everyone dropals their work and dig up the original. (Bonus points for sending an additional message on top of the recall: in 2004 an HR person sent email containing salary information to an entire building at MSFT campus. She followed up with a high-priority message admonishing people not to open the original, even kindly explaining the contents of the confidential attachment. )
  • User generated content cuts both ways. It can fuel a website, but it can also bring untold dangers in the way of legal risk. Digg is far from alone here– witness the Viacom litigation over copyrighted content posted to YouTube. This is the trade off associated with riding an economic externality in the form of getting your audience to build your business: the result is a t the whim of users. Trying to shape the externality by weeding out the negatives can back fire. It is difficult to build a sense of ownership unless users feel they can post their choice of content, as opposed to content approved by the omniscient moderators.
  • Commercial ventures have a lot more to lose than individual bloggers. Deeper pockets equals greater incentives to be litigated for perceived wrongs. Digg has decided to take a stand and ignore the C&D letters. Depending on your perspective, this is either a principled stand to be applauded, or unabashed grab for cheap publicity via corporate martyrdom. Developments over the next few days will be interesting. Already there is speculation on whether Digg has any legal ground to stand on. But either way, the decision to stop censoring the content would have been difficult to justify for any reason to an established company.

cemp

Dangerous digits, forbidden Diggs: how not to deal with leaks

The main encryption key protecting all HD-DVD content  against unauthorized copying (“processing key”) was discovered almost 3 months ago in February, and published in the Doom9 forums. In some ways that hack was just a question of time. Software DRM is always vulnerable to reverse engineering. Unlike a true cryptographic  attack, in this case the crown jewels are there, hidden in plain sight shipped with every copy of software capable of playing HD-DVD and BluRay discs. It is quite possible other people had already accomplished the same feat but chose to keep quite and perhaps profit by privately exploiting this information, selling to pirating rings etc.

All of that would be expected. But the truly strange part is that the disclosure issue flared up again yesterday in a storm of protest messages to Digg. Short version of the story:

  • Somebody posted the key in a Digg submission
  • Digg removed it in response to a cease-and-deskist letter, fueling all sorts of conspiracy theories including one allegation that the site had been receiving funding from the HD-DVD association.
  • Users revolted– for 24 hours, every other story on the site featured creative ways to publish the key.
  • Digg admitted the error of its ways and tried to make amends, agreeing to not remove any more user submissions. Damn the torpedoes, full speed ahead.

As quoted in the New York Times article published today:

“You’d rather see Digg go down fighting than bow down to a bigger company,” wrote Kevin Rose, Digg’s founder, in a blog post. “We hear you, and effective immediately we won’t delete stories or comments containing the code and will deal with whatever the consequences might be. If we lose, then what the hell, at least we died trying.”

Jay Adelson, Digg’s chief executive, said in an interview that the site was disregarding the advice of lawyers. “We just decided that it is more important to stand by our users.”

Stepping back for a second, let’s put on the risk management hat and ask what has been accomplished in this campaign asking websites to take down offending posts. Breach of valuable cryptographic key material is a serious problem, even when it was destined to happen with the current DRM design. But arguably there is marginal utility in limiting scope of the disclosure. Now the key itself is not really the dangerous asset, since most users can not write the software required to duplicate content. It is only useful to the select few who have the software but not the key. We can bet that no reputable software vendor will be writing that code, although the success of DeCSS in the past shows commercial involvement is far from necessary to get critical mass. But even granting that there is some good reason for limiting distribution of the key, what purpose did the C&D  letters serve?

  1. Ensuring that the key is even more widespread online than ever before, as indignant users made ahere  point of duplicating the 16 hexadecimal digits everywhere they went online. (And some times offline: it is now on tshirts and mugs. CafePress lists over 1000 products.) In this way the cease & desist letter served to initiate the greatest “distributed content replication” rush seen this far. Some of the entires were quite ironic: in one case the C&D letter itself contained the key, which ended up on Chilling Effects.
  2. Drawing extensive press coverage from mainstream media, including New York Times, Forbes and BBC. At a time when the legitimacy of DRM is in question and Apple has successfully spear-headed a movement to offer DRM-free music, the attempt to compensate for technical failures of AACS with legal tactics is unlikely to win any converts to the content industry viewpoint.
  3. Drawing the ire of customers– it would not be the first time.

This is hardly a success story in limiting the distribution of leaked secrets.

cemp

Ubuntu on Dell OEM machines– the inflection point for Linux?

According to this CNet article picked up everywhere today, Dell will be shipping desktops PCs and laptops pre-installed with Ubuntu.

Dell had already broken ranks with PC manufacturers by shipping PCs without an operating system. These systems are not easy to discover on the main website– one has to select the cryptically named “Open source desktops” option under Products menu, which takes the customer to a page describing the n Series. Strangely enough there is nothing open source about the three models offered, because it ships with the largely irrelevant FreeDOS operating system instead of a proper GNU/Linux system installation. Quote:

“With the n Series desktop, customers have the flexibility to install an alternative operating system (such as a version of Linux® ), and help reduce the price of this system. In addition, the n Series desktop comes with a non-formatted hard drive ready for your custom installation. Dell’s n Series desktop ships with a copy of FreeDosTM , an open-source operating system that is ready to install.”

Shipping Ubuntu can finally put some real momentum behind this half-hearted move. Ubuntu is perhaps the most approachable and usable of all Linux distributions, intended to take the complexity out of setting up a new system out of the box. Web page on the desktop edition promises that it “just works”— exactly the type of language software vendors in the past used to appeal to novice users.

cemp

Choosing a way out of misery

Observations on two books read back-to-back:

On the surface they could not be more different. Hardin was a distinguished academic, a professor of ecology at UC Santa Barbara best known for his 1968 article Tragedy of the commons. Limits is densely written, carefully argued and creates a compelling story out of an overload of evidence. It does not make for easy reading, dwelling at length on the words of Malthus, Keynes and Smith. Mohammad is the recipient of the 2006 Nobel Peace Prize for his work with the Grameen foundation on micro-finance. His work is auto-biographical and very personal, freely mixing anecdotes from his own upbringing in Bangladesh, frustration with the disconnect of his economics department in Bangladesh from the reality of the country around it and harsh criticism of World Bank policies on foreign aid.

But both are concerned with the same problem at the end of the day: reducing misery in the world. Given their different starting points, it may have been inevitable that both also arrived at very different conclusions. Hardin insists on the importance of recognizing natural limits. These are “hard” physical limits imposed by the parameters of planet Earth, distinct from artificial scarcity created by economics. (This is our home, he argues, dismissing as an adolescent fantasy the common science fiction vision of leaving the Earth behind and colonizing other planets.) The overall message is very pessimistic: unless we learn to respect these limits and stop runaway, unsustainable exploitation of natural resources, at some point the entire race will experience drastic decline in standards of living. By contrast Mohammad is optimistic, arguing that given the necessary resources, individuals will improve their own condition.

(continued)

cemp

Equities vs. real-estate

End of the housing bubble and resulting correction is encouraging sanity checks all around. CNN/Money published an interesting article comparing stocks against real-estate as investment vehicles. This is a good long-term view of the situation, undistorted by short term anomalies and irrational exuberance prevailing in the middle of the next contemporary tulip frenzy.

Bottom line in the eight-point comparison is stocks outperform in three categories (performance, cost, effort and diversification) while real-estate has the edge on three (taxes, leverage and volatility or more precisely lack thereof) and drawing on transparency. But the weighting of the categories will differ for each person and the story is more complex in each case.

Historically S&P 500 has returned around 12%, while real estate appreciated at a rate of 3.5%– barely keeping up with inflation. But the situation can easily reverse in the short term. For example, the same article cites 2001-2006 as one period where housing outperformed the broader indices:

Real estate has packed quite a punch of late, appreciating 12.4% annually between 2001 and 2006, according to the S&P/Case-Shiller U.S. Home Price index. That clobbered stock prices, which gained only 4.3% a year as measured by the S&P 500.

These 5 years saw the end of the dot-com bubble, followed by a recession, beginning of the second Gulf war and slow recovery. Real-estate continued to appreciate and prop up consumer spending with the equity built. But a different study looking at about 25 year stretch between 1978-2004 found stocks delivering better returns at 13.4% verses 8.6%. (That is arguably a more fair comparison because it includes a mix of strong growth periods including the 1980s, covering the later boom-bust cycle in technology and ending at the height of the real-estate bubble.) Another interesting data point was that REITs overall proved to be one of the better investment categories, combining the low transactional costs of stocks with a market valuation pegged to diversified property appreciation.

cemp

Paying tribute to Jackie Robinson

Today is the 60th anniversary of Jackie Robinson breaking the color barrier in major league baseball.

Even though the number 42 he wore while playing for the Brooklyn Dodgers has been retired from all baseball, commissioner Bud Selig granted a temporary exception for contemporary players to wear that famed number today. Current players paying tribute to the man include David Ortiz of the Red Sox, Ken Griffey Jr. of the Cincinatti Reds and all of the LA Dodgers, descendants of the Brooklyln Bums, the very first team to undertake integration.

cemp

Hybrid car as generator-on-wheels

CNet News is running a photo-story titled Hybrids that give back to the grid. The article centers on heavily modded hybrids exhibited at the Alternative Energy Solutions Summit at AMD headquarters in Sunnyvale, CA. One of them is the well known PRIUS+, a plug-in hybrid project from CalCars. More intriguing is the concept car from Pacific Gas & Energy, where the car can feed power back to the grid. Intended application is to reduce the power drawn from the grid, or even profit by a type of electricity arbitrage over time. During the day when air-conditioners are running full blast and stores are open, power demand is higher– and so are prices– compared to evenings. Charging at night with mains power (or simply charging from normal driving) and selling the surplus back to the grid at peak pricing time has the potential to turn every driver into a micro power-plant operator.

But a more mundane application could turn out to be the prime driver: supplying emergency power in the case of an outage. Typically power can be drawn from a vehicle in a  variety of ways:

  • From the cigarette-lighter adapter, for low consumption needs (<150 W) from charging a cell-phone to running a laptop. Unless the gadget has its own car adapter, this requires an inverter to convert DC from the battery into 110V AC that electronics in North America expect.
  • Directly from the battery, using a beefier inverter. One popular manufacturer’s models go up to 3000W. This is good enough to run most appliances, including microwave, large TVs, PCs, vacuum and even power hungry dishwashers although running them all at once may be a challenge.  (This page from the Dept of Energy lists typical consumption of gadgets.)

Neither can cope with the demands of a water-heater or clothes dryer which can go up to 5000 watts. Enter hybrid vehicles. Batteries in a bone-stock Prius are rated at around 20 kilowatts, indicating that the bank of batteries is capable of supplying all the power required to run a house. Plug-in hybrids have even more powerful batteries since they are designed to be able to run ~40 miles without having to start the internal consumption engine. But the  those batteries may not have been designed to supply large amounts of power continuously. In ordinary driving the “electric assist” kicks in occasionally for heavy acceleration or low-power cruising. (The car can always fall back on the ICE to drive the alternator and generator more power for charging the batteries as needed.)

Either way serious mods are necessary before the Prius in the garage can replace the trusty generator during an outage, which is the vision that PG&E has advocated. It is a promising concept and may well become cost-effective for buyers, considering that a moderate size 5000W generator lists over $3K. This would be one more reason for increased hybrid sales in hurricane-prone areas such as coastal Florida.

cemp

Schadenfreude and sub-prime lending crisis

The housing bubble inspired its own tradition of nay-sayers, doomsday predictors and real-estate Cassandras. One of the first on the scene was the Housing Bubble blog, chronicling the story of excesses gone awry and  sellers in denial well into the correction. It is now joined by a growing chorus of sarcastic, bitter voices. For example there is Housing Doom, not to be confused with Housing Panic or  There are even blogs dedicated to local bubbles in some of the major metropolitan areas such as the San Diego Real Estate Chrono-Collapsometer , Seattle bubble and Boston bubble. Clearly it is fashionable to predict doom-and-gloom in real estate.

Mainstream media is taking a different approach. An article CNN/Money ran yesterday posed the question of exactly what caused the crisis in sub-prime lending. (BTW Wikipedia entry defines that as lending to borrowers with FICO rating below 620.) The blame went to mortgage brokers for steering people to incorrect loans, appraisers for wildly over-stating property values, regulators for taking a laissez-fair approach to the industry, lenders for being over-zealous to extend credit, Wall Street for trading securities backed by substandard mortgage loans and of course, real-estate agents for propping up demand with exaggerated pricing.

Curiously left out of the equation are the borrowers who rushed to snap up these loans or investors who decided to gobble up the securities offered by Wall Street. (In a strange case of deja vu, Michael Lewis’s classic Liar’s Poker about 1980s excesses on Wall Street chronicles the story of Solomon Brothers traders successfully creating mortgage-backed securities.) And this blame game is not distributing the credit equally here or taking into account incentives. Real-estate agents are motivated to close deals and sell the property at highest price possible, which leads to all types of subtle tactics to pressure buyers into over-bidding and sellers into accepting a lower bid as chronicled by  Steven Levitt and Steven Dunbar in Freakonomics. It’s hard to fault NARA for that one. But appraisers are supposed to be objective in producing a fair, unbiased estimate of the market value of a property. A real-estate agent standing smug as the client bids a fortune on low-quality, wood-frame construction mass-produced suburban schlock could fall back on the excuse that he/she is only doing the job. So are the traders pushing mortgage-backed securities on eager investors– supply and demand continues to operate in this climate. But the appraiser who sanctions an unconscionable price with speculative valuations is clearly in breach of professional obligations.

cemp

Renewable energy hits a home-run

At the Colorado Rockies’ ball park in Denver, CO. The Rockies may not have been doing very well in the MLB past couple of seasons, but they are ahead of the curve on greening professional sports. Treehugger reports that the the team has added a 46-panel solar array at the stadium, intended to power an LED based multimedia display system.

This follows on the heels of the Cincinnatti Reds playing a carbon-neutral game  by purchasing offset credit and the San Francisco Giants announcing a solar-panel installation at AT&T Park. (Call it guilt over steroid-inflated home run totals.)

cemp