<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: abusive]]></title>
    <link>http://securityratty.com/tag/abusive</link>
    <description></description>
    <pubDate>Wed, 23 Jan 2008 12:14:58 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[ICANN Approves New .INFO Policy]]></title>
      <link>http://securityratty.com/article/cd6398fad5b32c821bfe8b24969e83a1</link>
      <guid>http://securityratty.com/article/cd6398fad5b32c821bfe8b24969e83a1</guid>
      <description><![CDATA[Last month Afilias , the domain registry for .INFO , proposed a new &quot;Abusive Domain Use Policy&quot; that would appear to give them arbitrary power to decide what is and is not acceptable. Consider the...]]></description>
      <content:encoded><![CDATA[Last month <a href="http://www.afilias.com/">Afilias</a>, the domain registry for <a href="http://www.info.info/">.INFO</a>, proposed <a href="http://www.icann.org/registries/rsep/afilias-request-20jun08.pdf">a new "Abusive Domain Use Policy"</a> that would appear to give them arbitrary power to decide what is and is not acceptable. Consider the following language:<blockquote><i>Pursuant to Section 3.6.5 of the RRA, Afilias reserves the right to deny, cancel or transfer any registration or transaction, or place any domain name(s) on registry lock, hold or similar status, that it deems necessary, in its discretion;</i></blockquote>
Now it appears (<a href="http://www.domainnamenews.com/icann-policy/icann-approves-new-info-policy/1740">thanks to Domain Name News for the tip</a>) that <a href="http://www.icann.org/registries/rsep/jones-to-afilias-18jul08.pdf">ICANN has approved the proposed policy and given the green light to implementation</a>. The ICANN letter states that they found no "...significant competition or security and stability issues" and asks Afilias to report on results of the changes. But ICANN did not explicitly solicit public comment on the change before approving it.

As DomainNameNews points out though, comments to any registry proposal can be submitted at any time by sending an email to registryservice (at) icann.org and are published <a href="http://forum.icann.org/lists/registryservice/">on the ICANN website</a>."<br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=aafe57485cc6ab66b73f3d71762b6ff4" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=aafe57485cc6ab66b73f3d71762b6ff4" style="display: none;" border="0" height="1" width="1" alt=""/><img src="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~4/341492192" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 21 Jul 2008 04:16:30 +0000</pubDate>
      <category domain="http://securityratty.com/tag/icann">icann</category>
      <category domain="http://securityratty.com/tag/icann website">icann website</category>
      <category domain="http://securityratty.com/tag/abusive domain">abusive domain</category>
      <category domain="http://securityratty.com/tag/domain">domain</category>
      <category domain="http://securityratty.com/tag/afilias reserves">afilias reserves</category>
      <category domain="http://securityratty.com/tag/afilias">afilias</category>
      <category domain="http://securityratty.com/tag/icann letter">icann letter</category>
      <category domain="http://securityratty.com/tag/domain registry">domain registry</category>
      <category domain="http://securityratty.com/tag/policy">policy</category>
      <source url="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~3/341492192/icann_approves_new_info_policy.html">ICANN Approves New .INFO Policy</source>
    </item>
    <item>
      <title><![CDATA[ICANN Approves New .INFO Policy]]></title>
      <link>http://securityratty.com/article/d5161f1ef550ab412bb9cc0a92fc9996</link>
      <guid>http://securityratty.com/article/d5161f1ef550ab412bb9cc0a92fc9996</guid>
      <description><![CDATA[Last month Afilias , the domain registry for .INFO , proposed a new &quot;Abusive Domain Use Policy&quot; that would appear to give them arbitrary power to decide what is and is not acceptable. Consider the...]]></description>
      <content:encoded><![CDATA[Last month <a href="http://www.afilias.com/">Afilias</a>, the domain registry for <a href="http://www.info.info/">.INFO</a>, proposed <a href="http://www.icann.org/registries/rsep/afilias-request-20jun08.pdf">a new "Abusive Domain Use Policy"</a> that would appear to give them arbitrary power to decide what is and is not acceptable. Consider the following language:<blockquote><i>Pursuant to Section 3.6.5 of the RRA, Afilias reserves the right to deny, cancel or transfer any registration or transaction, or place any domain name(s) on registry lock, hold or similar status, that it deems necessary, in its discretion;</i></blockquote>
Now it appears (<a href="http://www.domainnamenews.com/icann-policy/icann-approves-new-info-policy/1740">thanks to Domain Name News for the tip</a>) that <a href="http://www.icann.org/registries/rsep/jones-to-afilias-18jul08.pdf">ICANN has approved the proposed policy and given the green light to implementation</a>. The ICANN letter states that they found no "...significant competition or security and stability issues" and asks Afilias to report on results of the changes. But ICANN did not explicitly solicit public comment on the change before approving it.

As DomainNameNews points out, though, comments to any registry proposal can be submitted at any time by sending an e-mail to registryservice (at) icann.org and are published <a href="http://forum.icann.org/lists/registryservice/">on the ICANN Web site</a>."<img src="http://feedproxy.google.com/~r/RSS/cheap_hack/~4/-r6XYAggbEo" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 21 Jul 2008 04:16:30 +0000</pubDate>
      <category domain="http://securityratty.com/tag/icann">icann</category>
      <category domain="http://securityratty.com/tag/icann letter">icann letter</category>
      <category domain="http://securityratty.com/tag/abusive domain">abusive domain</category>
      <category domain="http://securityratty.com/tag/icann web site">icann web site</category>
      <category domain="http://securityratty.com/tag/domain">domain</category>
      <category domain="http://securityratty.com/tag/afilias reserves">afilias reserves</category>
      <category domain="http://securityratty.com/tag/afilias">afilias</category>
      <category domain="http://securityratty.com/tag/domain registry">domain registry</category>
      <category domain="http://securityratty.com/tag/policy">policy</category>
      <source url="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~3/-r6XYAggbEo/icann_approves_new_info_policy.html">ICANN Approves New .INFO Policy</source>
    </item>
    <item>
      <title><![CDATA[Further reflections on Trend, Barracuda and open source]]></title>
      <link>http://securityratty.com/article/686206b4d95f1f86d03f780332c72bab</link>
      <guid>http://securityratty.com/article/686206b4d95f1f86d03f780332c72bab</guid>
      <description><![CDATA[Over the last day I have had more of a chance to think on the Trend Micro-Barracuda patent war. I have also done some more research and reading on this one. In my earlier article I said that this is...]]></description>
      <content:encoded><![CDATA[
<div xmlns="http://www.w3.org/1999/xhtml"><p>Over the last day I have had more of a chance to think on the Trend Micro-Barracuda patent war.&nbsp; I have also done some more research and reading on this one.&nbsp; In my <a href="http://www.stillsecureafteralltheseyears.com/ashimmy/2008/01/it-seems-the-ca.html">earlier article</a> I said that this is not about open source so much as it is about gateway anti-virus.&nbsp; Upon further reflection though I am not as sure.&nbsp; Here are some other facts to consider:<br /><br />1. ClamAV may have as many as 1 million users downloaded updates daily. This makes them at least a potential formidable competitor to Trend.&nbsp; One that I am sure Trend would like to see go away because they can't compete with them on price.<br />2. Going after individual users of Clam would be like herding cats.&nbsp; There is no way you can hit them all.&nbsp; At best you may get a few high profile cases.<br />3. Barracuda has deep pockets. Instead of herding cats go after one fat cat who has deep pockets to pay you the kind of money you want and send a message to the rest of the cats that they could be next, so either use another AV (like Trend for instance) or pony up some fee for patent use.&nbsp; <br /><br />In fact the above scenario is not terribly different than the recording industry going after napster. It was easy to go after one relatively fat cat, rather than herding and chasing a bunch of smaller cats.&nbsp; In fact the recording industry has given themselves something of a black eye by going after poor grandmothers and children for illegal downloads. I think Trend tries to avoid the same type of black eye by saying this is not about open source but just AV. It is about open source.&nbsp; They just don't want to be perceived as going after open source and don't want to chase the small fry. But do they want ClamAV as a competitor? Probably not.<br /><br />4. Trend's decision to pursue this in the ITC seems abusive.&nbsp; Barracuda does not import the ClamAV software. It is downloaded from servers here in the US. The servers are assembled here in the US as well.&nbsp; This case does not belong in the ITC and should be thrown out of there. It may have served Trend well with Fortinet who was importing their products into the US, but it is the wrong venue for this suit.<br /><br />All that being said, I think that this more than ever still demands that Sourcefire as the owners of ClamAV step up to the plate here. If I was a paying customer of Sourcefire for Clam and was subject to a patent infringement case, I would expect them to defend.&nbsp; I think the fact that Barracuda does not pay them today evidently for the use of Clam is not reason enough to let Barracuda take the brunt of this battle on.<br /><br />Also looking at the proof gathered, I think there is a better than even chance that this patent will be thrown out. If so Barracuda will have done the open source community and the gateway AV industry a huge service.</p></div>

<p><a href="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?a=j6UAGA"><img src="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?i=j6UAGA" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=FM0vNaD"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=FM0vNaD" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=5hATWrD"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=5hATWrD" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=xlO05gD"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=xlO05gD" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=9LZWOjD"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=9LZWOjD" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=CQGvkjd"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=CQGvkjd" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=kVOCMk"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=kVOCMk" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~4/226330153" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 30 Jan 2008 20:48:58 +0000</pubDate>
      <category domain="http://securityratty.com/tag/trend">trend</category>
      <category domain="http://securityratty.com/tag/source">source</category>
      <category domain="http://securityratty.com/tag/barracuda">barracuda</category>
      <category domain="http://securityratty.com/tag/clamav">clamav</category>
      <category domain="http://securityratty.com/tag/clamav software">clamav software</category>
      <category domain="http://securityratty.com/tag/source community">source community</category>
      <category domain="http://securityratty.com/tag/competitor">competitor</category>
      <category domain="http://securityratty.com/tag/clamav step">clamav step</category>
      <category domain="http://securityratty.com/tag/black eye">black eye</category>
      <source url="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~3/226330153/further-reflect.html">Further reflections on Trend, Barracuda and open source</source>
    </item>
    <item>
      <title><![CDATA[Financial Ombudsman losing it?]]></title>
      <link>http://securityratty.com/article/74e08152850c21aa924133108ad1f3fd</link>
      <guid>http://securityratty.com/article/74e08152850c21aa924133108ad1f3fd</guid>
      <description><![CDATA[I appeared on You and Yours (Radio 4) today at 12.35 with an official from the Financial Ombudsman Service, after I coauthored a FIPR submission to a review of the service which is currently being...]]></description>
      <content:encoded><![CDATA[<p>I appeared on &#8220;You and Yours&#8221; (Radio 4) today at 12.35 with an official from the Financial Ombudsman Service, after I coauthored a <a href="http://www.fipr.org/080116huntreview.pdf">FIPR submission</a> to a review of the service which is currently being conducted by <a href="http://www.thehuntreview.org.uk/">Lord Hunt</a>.</p>
<p>Our <a href="http://www.fipr.org/080116huntreview.pdf">submission</a> looks at three cases in particular in which the ombudsman decided in favour of the banks and against bank customers over disputed ATM transactions. We found that the adjidicators employed by the ombudsman made numerous errors both of law and of technology, and concluded that their decisions were an affront to reason and to justice.</p>
<p>One of the cases has already <a href="http://www.lightbluetouchpaper.org/2007/02/08/financial-ombudsman-on-chip-pin-infallibility/">appeared here</a> on lightbluetouchpaper; the other two cardholders appeared on an investigation into card fraud on &#8220;Tonight with Trevor MacDonald&#8221;, and their case papers are included, with their permission, as <a href="http://www.fipr.org/080116huntreview.pdf">appendices to our submission</a>. These papers are damning, but the Hunt review&#8217;s staff declined to publish them on the somewhat surprising grounds that the information in them might be used to commit identity theft against the customers in question. Eventually they <a href="http://www.thehuntreview.org.uk/submissions/submissions.html">published</a> our submission minuss the two appendices of case papers. (If knowing someone&#8217;s residential address and the account number to a now-defunct bank account is enough for a criminal to steal money from you, then the regulatory failures afflicting the British banking system are even deeper than I thought.)</p>
<p>The Financial Ombudsman Service, and its predecessor the Banking Ombudsman, have for many years found against bank customers and in favour of the banks. In the early-to-mid 1990s, they upheld the banks&#8217; outrageous claim that mag-stripe ATM cards were invulnerable to cloning; this led to the court cases described <a href="http://www.cl.cam.ac.uk/~rja14/Papers/wcf.html">here</a> and <a href="http://www.cl.cam.ac.uk/~rja14/Papers/liability.pdf">here</a>. That position collapsed when ATM criminals started being sent to prison. Now we have another wave of ATM card cloning, which we&#8217;ve discussed several times: we&#8217;ve shown you a <a href="http://www.lightbluetouchpaper.org/2006/12/24/chip-pin-terminal-playing-tetris/">chip and PIN terminal playing Tetris</a> and described <a href="http://www.lightbluetouchpaper.org/2007/08/08/chip-and-pin-relay-attack-paper-wins-best-student-paper-at-usenix-security-2007/">relay attacks</a>. There&#8217;s much more to come.</p>
<p>The radio program is not yet available online; I&#8217;ll put in a link here when it appears. We clearly have them rattled; the ombudsman was patronising and abusive, and made a number of misleading statements. He also said that the &#8220;independent&#8221; Hunt review was commissioned by his board of directors. I hope it turns out to be a bit more independent than that. If it doesn&#8217;t, then consumer advocates should campaign for the FOS to be abolished and for customers to be empowered to take disputes to the courts, as we argue in section 31-32 of our <a href="http://www.fipr.org/080116huntreview.pdf">submission</a>.</p>
]]></content:encoded>
      <pubDate>Wed, 23 Jan 2008 12:14:58 +0000</pubDate>
      <category domain="http://securityratty.com/tag/ombudsman">ombudsman</category>
      <category domain="http://securityratty.com/tag/financial ombudsman service">financial ombudsman service</category>
      <category domain="http://securityratty.com/tag/service">service</category>
      <category domain="http://securityratty.com/tag/submission">submission</category>
      <category domain="http://securityratty.com/tag/submission minuss">submission minuss</category>
      <category domain="http://securityratty.com/tag/customers">customers</category>
      <category domain="http://securityratty.com/tag/bank customers">bank customers</category>
      <category domain="http://securityratty.com/tag/independent hunt review">independent hunt review</category>
      <category domain="http://securityratty.com/tag/fipr submission">fipr submission</category>
      <source url="http://www.lightbluetouchpaper.org/2008/01/23/financial-ombudsman-losing-it/">Financial Ombudsman losing it?</source>
    </item>
  </channel>
</rss>
