<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: little-known]]></title>
    <link>http://securityratty.com/tag/little-known</link>
    <description></description>
    <pubDate>Tue, 18 Nov 2008 21:00:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[The "A"]]></title>
      <link>http://securityratty.com/article/1b9ddda67145b0350bba4d9bf6a096a3</link>
      <guid>http://securityratty.com/article/1b9ddda67145b0350bba4d9bf6a096a3</guid>
      <description><![CDATA[Information Security sits in a strange area somewhere between Business and IT in a little space that really hasn't been properly defined. It is exciting here

Generally, most people in Information...]]></description>
      <content:encoded><![CDATA[Information Security sits in a strange area somewhere between Business and IT in a little space that really hasn't been properly defined. It is exciting here.<br /><br />Generally, most people in Information Security today did not start out as pure Information Security people, they evolved. And where they evolved from gives one a clue as to their mindset and how they see themselves.<br /><br />Some come from an Audit background and you'll recognise these guys from their love of lists and frameworks - they dream of Cobit controls and little boxes that are waiting for ticks. Somehow they have tons of documentation and they know it all and can find it all. They generally drive Volvo's and like order.<br /><br />But most InfoSec guys come from an IT background and it shows. I guess that, having said that, most hackers come from an IT background too. And it shows.<br /><br />Now, lets consider the C-I-A triangle thingum. Quick lesson for those who don't know it - there are three aspects of information that Information Security wishes to preserve - the <span style="font-weight: bold;">C</span>onfidentiality, the <span style="font-weight: bold;">I</span>ntegrity and the <span style="font-weight: bold;">A</span>vailability. From my experience, most IT people are governed by Availability - the "A". In fact, when an IT contract is drawn up - there is no SLI or SLC but there will always be an SLA. With very specific terms, measurements and penalties.<br /><br />If the Firewall crashes and has to be rebuilt. What will the IT manager be most interested in? The A - how fast can you get the traffic moving again?<br /><br />So we have tools to measure uptime in 99.999999999999999s and such and anything that can cause network downtime (or if the network is up and the services such as mail are down - same difference) is taken care of. Spam, worms, viruses etc.<br /><br />I guess that hackers (those that define what we do) are also IT background people. They seem to be more concerned with big-bang, widely deployed DoS attacks and stealing IT resources. At least, they used to be, until they discovered that they could make money from stealing information. Actually, I may be naive but I don't believe that the hackers we have today are the same as those we had in the past... I believe that we have a new generation of hackers - criminals who merely use the Internet to steal money because that it where the money is easiest to steal.<br /><br />The problem is that we were lucky in a way that our old tools worked against the threats that we had - firewalls, antiviruses, etc etc. They don't work against people breaking into our networks and stealing information. For that we need a new generation of Information Security people (or the old generation to update their game)...<br /><br />Here is a quick poll to see which generation you are in:<br /><br />1. What is the one piece of information on your network that your competitors would love to see?<br />2. What is the percentage of mails coming into your network that are spam?<br />3. What mail is going to competitors?<br />4. What is the process for someone to order a pencil?<br />5. What is a blog?<br />6. Who in your organisation uses facebook for business?<br />7. How many of your PCs have up-to-date antivirus?<br />8. What is the worst virus out at the moment?<br />9. Do you believe that your Firewall is configured correctly?<br /><br />The answers are as follows:<br />1. This is ESSENTIAL to know if you want to be in the next generation. And you can't guess this. You may think that it is something financial but most financial information can be guessed by your competitors anyhow. You may think it is a recipe or special way of doing something but any established company has had their recipe ripped off anyhow and can beat any new competitor by competitive pricing. It may be new product information. It may be staff information. It may be the CEO's contact list. Don't guess - find out.<br /><br />2. Who cares? Certainly not the CEO. Maybe the CIO. "We are saving you x amount of bandwidth and your users x amount of time" is nice but won't save the business from closing down due to data loss. Operationalise this and get on with your job.<br /><br />3. Good to know. I'm sure that if you told your CEO/CIO "Last week we detected 5 large emails going to our competitors from inside our R&amp;D department" you'd have his full attention.<br /><br />4. Good to know. Who does the ordering? Who does the okaying? Who does the paying? If you know all of this then you know how business works. And when things go wrong - you'll be able to help.<br /><br />5. And do you want your staff to use them? And if they do, what can they put on them? What are they puting on them?<br /><br />6. This is an interesting question because Facebook is usually an issue of "The A" (productivity). But it can be an issue of C and I.<br /><br />7. Who cares? Again, this is an operational issue. Viruses that jump onto your radar are usually ones that attack "the A" but its the ones that are pushing information out of your organisation that are sneaky enough not to have sgnatures and not to be discovered. You will have PCs without up-to-date antivirus and you will have viruses. The trick is not to let your information be stolen by viruses. Also, keep backups so if a PC does get wiped out - you can get the information back again (but this is an operational issue again).<br /><br />8. Trick question - the answer is - the one you don't know about. Old generation InfoSec guys can rattle off names of viruses that are all in the top 10 at the moment.. New generation viruses are targetted and usually do their worst before a pattern is out.<br /><br />9. Old generation answer - yes. New generation answer - who cares? Information flows all over including in and out of the Firewall. Firewalls also usually rely on port security but most everything runs on port 80 anyhow so the Firewall should be configured but it doesn't kep us safe - more work needs to be done for that.<br /><br />I find that it is not very easy to move from old generation to new generation InfoSec. The main difference is that old generation was very technical and appealed to the technical nature of computer geeks. The new generation is business oriented and requires more interaction with people, more meetings, more time with people. Ouch.<br /><br />There will always be a place for technical people in Information Security but as the tools mature and "just work" there is less demand. And a background in technology is very useful when the technical guys try to "BS" you.<br /><br />And "the A" is very important too. Protecting your network from being brought down. Protecting information from disappearing. Stopping viruses. Etc. But the new generation will need to consider "the I" and "the C" as well because the attacks against these and the importance of protecting information against disclosure or manipulation will increase.<br /><br />This post was done to add my voice to what Rich says so quickly and concisely in the <a href="http://securosis.com/2008/11/10/the-two-kinds-of-security-threats-and-how-they-affect-your-life/">securosis blog</a>.<img src="http://feeds.feedburner.com/~r/SecurityThoughts/~4/471338550" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 01 Dec 2008 10:57:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/financial information">financial information</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/information security">information security</category>
      <category domain="http://securityratty.com/tag/generation infosec guys">generation infosec guys</category>
      <category domain="http://securityratty.com/tag/infosec guys">infosec guys</category>
      <category domain="http://securityratty.com/tag/information security people">information security people</category>
      <category domain="http://securityratty.com/tag/guys">guys</category>
      <category domain="http://securityratty.com/tag/staff information">staff information</category>
      <category domain="http://securityratty.com/tag/technical guys">technical guys</category>
      <source url="http://feeds.feedburner.com/~r/SecurityThoughts/~3/471338550/a.html">The "A"</source>
    </item>
    <item>
      <title><![CDATA[Safe Computing During The Holiday Season]]></title>
      <link>http://securityratty.com/article/832646954f5f9c892ef83ef66398bd73</link>
      <guid>http://securityratty.com/article/832646954f5f9c892ef83ef66398bd73</guid>
      <description><![CDATA[The holiday season is a time of increased online activity. During the hustle and bustle that surrounds this time of year, whats more convenient than saving a little time (and money) by shopping and...]]></description>
      <content:encoded><![CDATA[The holiday season is a time of increased online activity. During the hustle and bustle that surrounds this time of year, whats more convenient than saving a little time (and money) by shopping and b...]]></content:encoded>
      <pubDate>Tue, 25 Nov 2008 11:32:07 +0000</pubDate>
      <category domain="http://securityratty.com/tag/holiday season">holiday season</category>
      <category domain="http://securityratty.com/tag/time">time</category>
      <category domain="http://securityratty.com/tag/online activity">online activity</category>
      <category domain="http://securityratty.com/tag/money">money</category>
      <category domain="http://securityratty.com/tag/convenient">convenient</category>
      <category domain="http://securityratty.com/tag/surrounds">surrounds</category>
      <category domain="http://securityratty.com/tag/bustle">bustle</category>
      <category domain="http://securityratty.com/tag/hustle">hustle</category>
      <source url="http://www.net-security.org/article.php?id=1190">Safe Computing During The Holiday Season</source>
    </item>
    <item>
      <title><![CDATA[ Here Comes Everybody Review]]></title>
      <link>http://securityratty.com/article/639cf7107fd08bc70488e1f27a8ec2a3</link>
      <guid>http://securityratty.com/article/639cf7107fd08bc70488e1f27a8ec2a3</guid>
      <description><![CDATA[In 1937, Ronald Coase answered one of the most perplexing questions in economics: if markets are so great, why do organizations exist? Why don't people just buy and sell their own services in a market...]]></description>
      <content:encoded><![CDATA[<p>In 1937, Ronald Coase answered one of the most perplexing questions in economics: if markets are so great, why do organizations exist? Why don't people just buy and sell their own services in a market instead? Coase, who won the 1991 Nobel Prize in Economics, answered the question by noting a market's transaction costs: buyers and sellers need to find one another, then reach agreement, and so on. The Coase theorem implies that if these transaction costs are low enough, direct markets of individuals make a whole lot of sense. But if they are too high, it makes more sense to get the job done by an organization that hires people. </p>

<p>Economists have long understood the corollary concept of Coase's ceiling, a point above which organizations collapse under their own weight -- where hiring someone, however competent, means more work for everyone else than the new hire contributes. Software projects often bump their heads against Coase's ceiling: recall Frederick P. Brooks Jr.'s seminal study, <cite>The Mythical Man-Month</cite> (Addison-Wesley, 1975), which showed how adding another person onto a project can slow progress and increase errors. </p>

<p>What's new is something consultant and social technologist Clay Shirky calls &quot;Coase's Floor,&quot; below which we find projects and activities that aren't worth their organizational costs -- things so esoteric, so frivolous, so nonsensical, or just so thoroughly unimportant that no organization, large or small, would ever bother with them. Things that you shake your head at when you see them and think, &quot;That's ridiculous.&quot;</p>

<p>Sounds a lot like the Internet, doesn't it? And that's precisely Shirky's point. His new book, <a href="http://www.amazon.com/exec/obidos/ASIN/1594201536/counterpane/"><cite>Here Comes Everybody: The Power of Organizing Without Organizations</cite></a>, explores a world where organizational costs are close to zero and where ad hoc, loosely connected groups of unpaid amateurs can create an encyclopedia larger than the Britannica and a computer operating system to challenge Microsoft's. </p>

<p>Shirky teaches at New York University's Interactive Telecommunications Program, but this is no academic book. Sacrificing rigor for readability, <cite>Here Comes Everybody</cite> is an entertaining as well as informative romp through some of the Internet's signal moments -- the Howard Dean phenomenon, Belarusian protests organized on LiveJournal, the lost cellphone of a woman named Ivanna, Meetup.com, flash mobs, Twitter, and more -- which Shirky uses to illustrate his points. </p>

<p>The book is filled with bits of insight and common sense, explaining why young people take better advantage of social tools, how the Internet affects social change, and how most Internet discourse falls somewhere between dinnertime conversation and publishing. </p>

<p>Shirky notes that &quot;most user-generated content isn't 'content' at all, in the sense of being created for general consumption, any more than a phone call between you and a sibling is 'family-generated content.' Most of what gets created on any given day is just the ordinary stuff of life -- gossip, little updates, thinking out loud -- but now it's done in the same medium as professionally produced material. Unlike professionally produced material, however, Internet content can be organized after the fact.&quot; </p>

<p>No one coordinates Flickr's 6 million to 8 million users. Yet Flickr had the first photos from the 2005 London Transport bombings, beating the traditional news media. Why? People with cellphone cameras uploaded their photos to Flickr. They coordinated themselves using tools that Flickr provides. This is the sort of impromptu organization the Internet is ideally suited for. Shirky explains how these moments are harbingers of a future that can self-organize without formal hierarchies. </p>

<p>These nonorganizations allow for contributions from a wider group of people. A newspaper has to pay someone to take photos; it can't be bothered to hire someone to stand around London underground stations waiting for a major event. Similarly, Microsoft has to pay a programmer full time, and <cite>Encyclopedia Britannica</cite> has to pay someone to write articles. But Flickr can make use of a person with just one photo to contribute, Linux can harness the work of a programmer with little time, and Wikipedia benefits if someone corrects just a single typo. These aggregations of millions of actions that were previously below the Coasean floor have enormous potential. </p>

<p>But a flash mob is still a mob. In a world where the Coasean floor is at ground level, all sorts of organizations appear, including ones you might not like: violent political organizations, hate groups, Holocaust deniers, and so on. (Shirky's discussion of teen anorexia support groups makes for very disturbing reading.) This has considerable implications for security, both online and off. </p>

<p>We never realized how much our security could be attributed to distance and inconvenience -- how difficult it is to recruit, organize, coordinate, and communicate without formal organizations. That inadvertent measure of security is now gone. Bad guys, from hacker groups to terrorist groups, will use the same ad hoc organizational technologies that the rest of us do. And while there has been some success in closing down individual Web pages, discussion groups, and blogs, these are just stopgap measures. </p>

<p>In the end, a virtual community is still a community, and it needs to be treated as such. And just as the best way to keep a neighborhood safe is for a policeman to walk around it, the best way to keep a virtual community safe is to have a virtual police presence. </p>

<p>Crime isn't the only danger; there is also isolation. If people can segregate themselves in ever-increasingly specialized groups, then they're less likely to be exposed to alternative ideas. We see a mild form of this in the current political trend of rival political parties having their own news sources, their own narratives, and their own facts. Increased radicalization is another danger lurking below the Coasean floor. </p>

<p>There's no going back, though. We've all figured out that the Internet makes freedom of speech a much harder right to take away. As Shirky demonstrates, Web 2.0 is having the same effect on freedom of assembly. The consequences of this won't be fully seen for years. </p>

<p><cite>Here Comes Everybody</cite> covers some of the same ground as Yochai Benkler's <cite>Wealth of Networks</cite>. But when I had to explain to one of my corporate attorneys how the Internet has changed the nature of public discourse, Shirky's book is the one I recommended.</p>

<p>This essay <a href="http://www.spectrum.ieee.org/sep08/6631">previously appeared</a> in <i>IEEE Spectrum</i>.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=wZmPN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=wZmPN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=xDcAN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=xDcAN" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Tue, 25 Nov 2008 04:39:13 +0000</pubDate>
      <category domain="http://securityratty.com/tag/shirky">shirky</category>
      <category domain="http://securityratty.com/tag/shirky notes">shirky notes</category>
      <category domain="http://securityratty.com/tag/organizations">organizations</category>
      <category domain="http://securityratty.com/tag/community">community</category>
      <category domain="http://securityratty.com/tag/virtual community safe">virtual community safe</category>
      <category domain="http://securityratty.com/tag/organizations collapse">organizations collapse</category>
      <category domain="http://securityratty.com/tag/internet content">internet content</category>
      <category domain="http://securityratty.com/tag/internet discourse falls">internet discourse falls</category>
      <category domain="http://securityratty.com/tag/internet">internet</category>
      <source url="http://www.schneier.com/blog/archives/2008/11/here_comes_ever.html"> Here Comes Everybody Review</source>
    </item>
    <item>
      <title><![CDATA[Underground Crime Economy Healthy, Security Group Finds]]></title>
      <link>http://securityratty.com/article/9cbf36b031f2836e1adefc33db6532b7</link>
      <guid>http://securityratty.com/article/9cbf36b031f2836e1adefc33db6532b7</guid>
      <description><![CDATA[Hackers and scammers are still meeting up in online forums to buy and sell millions in stolen credit card numbers and online banking credentials, a security company reported Monday. While hackers...]]></description>
      <content:encoded><![CDATA[Hackers and scammers are still meeting up in online forums to buy and sell millions in stolen credit card numbers and online banking credentials, a security company reported Monday. While hackers offered enough cards to total more than $5 billion in collective balances, credit card numbers sell for as little as 10 cents now thanks to increasing security measures by online merchants, Symantec reports.<br style="clear: both;"/>
<a href="http://www.pheedo.com/click.phdo?s=6d5c296b0752a11742fc874b1aac6270&p=1"><img alt="" style="border: 0;" border="0" src="http://www.pheedo.com/img.phdo?s=6d5c296b0752a11742fc874b1aac6270&p=1"/></a>
<img src="http://www.pheedo.com/feeds/tracker.php?i=6d5c296b0752a11742fc874b1aac6270" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=50nMN"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=50nMN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=gLEun"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=gLEun" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=tTO8n"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=tTO8n" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=OR0aN"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=OR0aN" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=uwYAN"><img src="http://feeds.wired.com/~f/wired/politics/security?i=uwYAN" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=kg2Sn"><img src="http://feeds.wired.com/~f/wired/politics/security?i=kg2Sn" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=8xH7n"><img src="http://feeds.wired.com/~f/wired/politics/security?i=8xH7n" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=YCxdN"><img src="http://feeds.wired.com/~f/wired/politics/security?i=YCxdN" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/465135778" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/465135783" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 24 Nov 2008 19:03:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/online forums">online forums</category>
      <category domain="http://securityratty.com/tag/online">online</category>
      <category domain="http://securityratty.com/tag/credit card">credit card</category>
      <category domain="http://securityratty.com/tag/online merchants">online merchants</category>
      <category domain="http://securityratty.com/tag/symantec reports">symantec reports</category>
      <category domain="http://securityratty.com/tag/security measures">security measures</category>
      <category domain="http://securityratty.com/tag/security company">security company</category>
      <category domain="http://securityratty.com/tag/collective balances">collective balances</category>
      <category domain="http://securityratty.com/tag/hackers">hackers</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/465135783/the-nets-underg.html">Underground Crime Economy Healthy, Security Group Finds</source>
    </item>
    <item>
      <title><![CDATA[Another link spammer]]></title>
      <link>http://securityratty.com/article/4dd72baf5933c49893c38cadde935c82</link>
      <guid>http://securityratty.com/article/4dd72baf5933c49893c38cadde935c82</guid>
      <description><![CDATA[Yet another link spammer is cluttering up my in-box. Youd think that after exposing this one , and this one , and this one , theyd know better
The latest set of miscreants operates under the brand...]]></description>
      <content:encoded><![CDATA[<p>Yet another link spammer is cluttering up my in-box. You&#8217;d think that after exposing <a href="http://www.lightbluetouchpaper.org/2007/01/07/human-rights-and-biophysics-strange-similarities/">this one</a>, and <a href="http://www.lightbluetouchpaper.org/2007/08/30/the-interns-of-privila/">this one</a>, and <a href="http://www.lightbluetouchpaper.org/2007/12/20/fatal-wine-waiters/">this one</a>, they&#8217;d know better.</p>
<p>The latest set of miscreants operates under the brand &#8220;<a href="http://www.goodeyeforlinks.com" rel="nofollow">goodeyeforlinks.com</a>&#8221; and claim to &#8220;use white hat SEO techniques in order to get high quality, do-follow links to your website&#8221;. They also claim to be &#8220;professional&#8221; which in this case must mean you pay for their services, since sending out bulk unsolicited email is anything but professional.</p>
<p>Nevertheless, although their long term aim may indeed be to make money from legitimate, albeit foolish, businesses seeking a higher profile, the sites they have been promoting so far are anything but legitimate. In fact they&#8217;ve been fake sites covered with Google adverts (so-called &#8220;<a href="http://www.sabahan.com/2006/06/26/how-mfa-made-for-adsense-sites-make-money/">Made for AdSense</a>&#8221; (MFA) sites).</p>
<p>They started by asking me to link to &#8220;<a href="http://www.entovation.net" rel="nofollow">entovation.net</a>&#8221; which they claim is &#8220;page rank 3&#8243;. In fact it is page rank 3 (!) and a blatant copy of <a href="http://www.acentesolutions.com/">http://www.acentesolutions.com</a> which appears entirely genuine (albeit only page rank 1). They have also been promoting &#8220;<a href="http://www.poland-translation-services.com" rel="nofollow">poland-translation-services.com</a>&#8220;, which claims to be a site offering &#8220;A large team of 2,500 translators specializing in each sector, located in over 30 countries&#8221; &#8230;</p>
<p>However, this site is clearly fake as well. I haven&#8217;t tracked down where it all comes from, but much of <a href="http://poland-translation-services.com/Translate-a-Document.html" rel="nofollow">this page</a> comes from <a href="http://www.intowords.com.ar/espanol/traducciones/traducciones-de-espanol-ingles.html">this Argentinian page</a>, the text of which has been pushed through <a href="http://www.google.com/language_tools?hl=en">Google&#8217;s Spanish to English translation tools</a>&#8230;  which sadly (for example) renders </p>
<blockquote><p>
Comentarios: Se considera foja al equivalente a 500 palabras. Si el documento a traducir es menor a una foja, se lo considerará como una foja.
</p></blockquote>
<p>into </p>
<blockquote><p>
Comments: foja is considered the equivalent of 500 words. If the document is translated to a lesser foja, we will consider as a foja.
</p></blockquote>
<p>which makes the 2500 translators look more than a little bit <a href="http://www.cartoonbank.com/item/124224">foolish</a>!</p>
<p>The fake websites are hosted by <a href="http://www.euroaccess.nl/">EuroAccess Enterprises Ltd.</a> in The Netherlands (which is also where the email spam has been sent from). I&#8217;m not alone in receiving this type of email, further examples can be found <a href="http://archives.neohapsis.com/archives/openbsd/2008-09/1548.html">here</a>, and <a href="http://www.projecthoneypot.org/ip_89.248.172.66">here</a>, and <a href="http://dansdata.blogsome.com/2008/10/16/i-do-like-a-good-link-spam-in-the-morning/">here</a>, and <a href="http://avvoblog.com/2008/11/10/linkbrokers-gone-wild/">here</a>, and <a href="http://www.nabble.com/Link-exchange-with-page-rank-4--Hotel-site-td19973368.html">here</a>, and <a href="http://www.allvoices.com/contributed-news/1522559">here</a>, and even <a href="http://blogpintura.wordpress.com/#comment-5">here (in Spanish)</a>.</p>
<p>EuroAccess have a fine ticketing system for abuse complaints&#8230; so I&#8217;m able to keep track of what they&#8217;re doing about my emails drawing their attention to the fraudsters they are hosting. I am therefore fully aware that they&#8217;ve so far marked my missives as &#8220;Priority: Low&#8221;, and nothing else is recorded to have been done&#8230; However, the tickets are still &#8220;Status: Open&#8221;, so perhaps a little publicity will encourage them to reassess their prioritisation.</p>
]]></content:encoded>
      <pubDate>Sun, 23 Nov 2008 16:45:45 +0000</pubDate>
      <category domain="http://securityratty.com/tag/argentinian page">argentinian page</category>
      <category domain="http://securityratty.com/tag/page">page</category>
      <category domain="http://securityratty.com/tag/foja">foja</category>
      <category domain="http://securityratty.com/tag/lesser foja">lesser foja</category>
      <category domain="http://securityratty.com/tag/page rank">page rank</category>
      <category domain="http://securityratty.com/tag/considera foja">considera foja</category>
      <category domain="http://securityratty.com/tag/link spammer">link spammer</category>
      <category domain="http://securityratty.com/tag/link">link</category>
      <category domain="http://securityratty.com/tag/fake">fake</category>
      <source url="http://www.lightbluetouchpaper.org/2008/11/23/another-link-spammer/">Another link spammer</source>
    </item>
    <item>
      <title><![CDATA[Just Love This: Noisy vs Quiet from Rich]]></title>
      <link>http://securityratty.com/article/5b13607c4ea355a79b9b366f3adb21fd</link>
      <guid>http://securityratty.com/article/5b13607c4ea355a79b9b366f3adb21fd</guid>
      <description><![CDATA[OMG, some people (usually ex-Gartner... for whatever mystical reason) have this uncanny ability to present information in a way that just triggers an avalanche of insight. Here is an example: &quot; The...]]></description>
      <content:encoded><![CDATA[OMG, some people (usually ex-Gartner... for whatever mystical reason) have this uncanny ability to present information in a way that just triggers an avalanche of insight.  Here is an example: "<a href="http://securosis.com/2008/11/10/the-two-kinds-of-security-threats-and-how-they-affect-your-life/" rel="bookmark" title="Permanent Link to The Two Kinds Of Security Threats, And How They Affect Your Life">The Two Kinds Of Security Threats, And How They Affect Your Life </a>" from Rich Mogul.<br /><br />Some <a href="http://securosis.com/2008/11/10/the-two-kinds-of-security-threats-and-how-they-affect-your-life/">quotes</a>:  "We get money for noisy threats, and get called paranoid freaks for trying to prevent quiet threats (which can still lose our organizations a boatload of money, but don’t interfere with the married CEO’s ability to flirt with the new girl in marketing over email)."<br /><br />and<br /><br />"Slice up your budget and see how much you spend preventing noisy vs. quiet threats. It’s often our own little version of security theater."<br /><br />and<br /><br />"The problem is, noisy vs. quiet may bear little to no relationship to your actual risk and losses, but that’s just human nature."<br /><br />Overall, a MUST <a href="http://securosis.com/2008/11/10/the-two-kinds-of-security-threats-and-how-they-affect-your-life/">read</a>.<br /><br />God, please, send us some credible <a href="http://www.securitymetrics.org/content/Wiki.jsp">security metrics</a>... please.<div class="blogger-post-footer">About me: http://www.chuvakin.org</div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=Raf0N"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=Raf0N" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=fKCxN"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=fKCxN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=VLpzN"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=VLpzN" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~4/460247667" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 20 Nov 2008 14:50:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/quiet">quiet</category>
      <category domain="http://securityratty.com/tag/prevent quiet threats">prevent quiet threats</category>
      <category domain="http://securityratty.com/tag/noisy">noisy</category>
      <category domain="http://securityratty.com/tag/quiet threats">quiet threats</category>
      <category domain="http://securityratty.com/tag/noisy threats">noisy threats</category>
      <category domain="http://securityratty.com/tag/credible security metrics">credible security metrics</category>
      <category domain="http://securityratty.com/tag/uncanny ability">uncanny ability</category>
      <category domain="http://securityratty.com/tag/human nature">human nature</category>
      <category domain="http://securityratty.com/tag/mystical reason">mystical reason</category>
      <source url="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~3/460247667/just-love-this-noisy-vs-quiet-from-rich.html">Just Love This: Noisy vs Quiet from Rich</source>
    </item>
    <item>
      <title><![CDATA[MS AV Out and Free ... Uh-Oh]]></title>
      <link>http://securityratty.com/article/c11f864ccd2c2dd9f5e1fa6ef8d8a18d</link>
      <guid>http://securityratty.com/article/c11f864ccd2c2dd9f5e1fa6ef8d8a18d</guid>
      <description><![CDATA[With headlines like &quot; MS Destroys the Consumer AV Market ,&quot; the news hit ... well, hit the fan like the proverbial... well, you know what

Is it really &quot; Good-bye Big Yellow and Little Red? &quot; Probably...]]></description>
      <content:encoded><![CDATA[With headlines like "<a href="http://www.grumpysecurityguy.com/ms-destroys-the-consumer-av-market/">MS Destroys the Consumer AV Market</a>," <a href="http://www.microsoft.com/Presspass/press/2008/nov08/11-18NoCostSecurityPR.mspx">the news</a>  hit ... well, hit the fan like the proverbial... well, you know what :-) <br /><br />Is it really "<span style="font-style: italic;">Good-bye Big Yellow and Little Red?</span>"  Probably not, as this new offering is aimed at consumers and lower-end SMBs; large orgs will still pay ransom ... eh, subscription fees for their AV.  It was also interesting to read some of the comments, like "OMG, I so hate paying for AV... and now I won't have to."  If such sentiment is indeed widespread, maybe MS choose a really, really good moment to come out with this!<br /><br />The most fun comments are found on the <a href="http://windowsonecare.spaces.live.com">OneCare team blog</a> <a href="http://windowsonecare.spaces.live.com/blog/cns%21C29701F38A601141%2110418.entry">here</a>. Esp. see this one: "<span id="ctl00_MainContentPlaceholder_ctl01_ctl00_lblEntry"><span style="font-family:Calibri;font-size:100%;color:#000000;"><span style="font-style: italic;">a majority of consumers around the world do not have up-to-date antivirus, antispyware and antimalware protection</span>" (</span></span>now they will, thanks to MS! :-)<span id="ctl00_MainContentPlaceholder_ctl01_ctl00_lblEntry"><span style="font-family:Calibri;font-size:100%;color:#000000;">) and "</span></span><span id="ctl00_MainContentPlaceholder_ctl01_ctl00_lblEntry"><span style="font-family:Calibri;font-size:100%;color:#000000;">this new offering will focus on getting the majority of consumers the essential protection they need by providing comprehensive, real-time anti-malware protection, covering such threats as viruses, spyware, rootkits, trojans, and other emerging threats, in a single [FREE!], focused solution.</span></span><span id="ctl00_MainContentPlaceholder_ctl01_ctl00_lblEntry"><span style="font-family:Calibri;font-size:100%;color:#000000;">"</span></span><div class="blogger-post-footer">About me: http://www.chuvakin.org</div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=h001N"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=h001N" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=z96hN"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=z96hN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=k6jfN"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=k6jfN" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~4/458898788" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 19 Nov 2008 10:44:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/fun comments">fun comments</category>
      <category domain="http://securityratty.com/tag/comments">comments</category>
      <category domain="http://securityratty.com/tag/real-time anti-malware protection">real-time anti-malware protection</category>
      <category domain="http://securityratty.com/tag/hit">hit</category>
      <category domain="http://securityratty.com/tag/onecare team blog">onecare team blog</category>
      <category domain="http://securityratty.com/tag/news hit">news hit</category>
      <category domain="http://securityratty.com/tag/consumers">consumers</category>
      <category domain="http://securityratty.com/tag/essential protection">essential protection</category>
      <category domain="http://securityratty.com/tag/single free">single free</category>
      <source url="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~3/458898788/ms-av-out-and-free-uh-oh.html">MS AV Out and Free ... Uh-Oh</source>
    </item>
    <item>
      <title><![CDATA[RIAA Lawsuits May Be Unconstitutional]]></title>
      <link>http://securityratty.com/article/93a6a6f47d9d5b1467dbe190bc929894</link>
      <guid>http://securityratty.com/article/93a6a6f47d9d5b1467dbe190bc929894</guid>
      <description><![CDATA[Harvard law professor Charles Nesson is arguing , in court, that the Digital Theft Deterrence and Copyright Damages Improvement Act of 1999 is unconstitutional: He makes the argument that the Digital...]]></description>
      <content:encoded><![CDATA[<p>Harvard law professor Charles Nesson is <a href="http://techdirt.com/articles/20081030/0203582685.shtml">arguing</a>, in court, that the Digital Theft Deterrence and Copyright Damages Improvement Act of 1999 is unconstitutional:</p>

<blockquote>He makes the argument that the Digital Theft Deterrence and Copyright Damages Improvement Act of 1999 is very much unconstitutional, in that its hefty fines for copyright infringement (misleadingly called "theft" in the title of the bill) show that the bill is effectively a criminal statute, yet for a civil crime. That's because it really focuses on punitive damages, rather than making private parties whole again. Even worse, it puts the act of enforcing the criminal statute in the hands of a private body (the RIAA) who uses it for profit motive in being able to get hefty fines.

<blockquote>Imagine a statute which, in the name of deterrence, provides for a $750 fine for each mile-per-hour that a driver exceeds the speed limit, with the fine escalating to $150,000 per mile over the limit if the driver knew he or she was speeding. Imagine that the fines are not publicized, and most drivers do not know they exist. Imagine that enforcement of the fines is put in the hands of a private, self-interested police force, that has no political accountability, that can pursue any defendant it chooses at its own whim, that can accept or reject payoffs in exchange for not prosecuting the tickets, and that pockets for itself all payoffs and fines. Imagine that a significant percentage of these fines were never contested, regardless of whether they had merit, because the individuals being fined have limited financial resources and little idea of whether they can prevail in front of an objective judicial body.</blockquote></blockquote>

<p>Another <a href="http://www.usatoday.com/tech/news/2008-11-16-music-downloading_N.htm">news story</a>. </p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=5mEhN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=5mEhN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=u1zCN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=u1zCN" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Wed, 19 Nov 2008 10:33:11 +0000</pubDate>
      <category domain="http://securityratty.com/tag/digital theft deterrence">digital theft deterrence</category>
      <category domain="http://securityratty.com/tag/fines">fines</category>
      <category domain="http://securityratty.com/tag/deterrence">deterrence</category>
      <category domain="http://securityratty.com/tag/hefty fines">hefty fines</category>
      <category domain="http://securityratty.com/tag/theft">theft</category>
      <category domain="http://securityratty.com/tag/criminal statute">criminal statute</category>
      <category domain="http://securityratty.com/tag/statute">statute</category>
      <category domain="http://securityratty.com/tag/objective judicial body">objective judicial body</category>
      <category domain="http://securityratty.com/tag/body">body</category>
      <source url="http://www.schneier.com/blog/archives/2008/11/riaa_lawsuits_m.html">RIAA Lawsuits May Be Unconstitutional</source>
    </item>
    <item>
      <title><![CDATA[How much does spam cost you? Google will calculate]]></title>
      <link>http://securityratty.com/article/df0e09c0efb4a2faca9087a5e33810d9</link>
      <guid>http://securityratty.com/article/df0e09c0efb4a2faca9087a5e33810d9</guid>
      <description><![CDATA[How much is spam costing your company? Google unveiled a nifty little calculator Wednesday to help you add it...]]></description>
      <content:encoded><![CDATA[How much is spam costing your company? Google unveiled a nifty little calculator Wednesday to help you add it up.<br style="clear: both;"/>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:7f5a94aeae3bf6dacb09bcd3d7e06c84:AsOl%2BJeJWp9Msr4tBuxugComZqduw9FfqlmRgW4L9%2FFZQY5Fx9lPGDyrMpzjTzPNK5MKFsI3amWW'><img border='0' title='Add to digg' alt='Add to digg' src='http://www.pheedo.com/images/mm/digg.gif'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:dae35ee913a5b3009383655dea2a7795:R5LYDfRaXRzFw17WnFECow%2BW4LqQBFLygiOXv0NwIEQXE1anIsFRtFoTpH4WKOUY8IWlZcfOE%2FBV1Q%3D%3D'><img border='0' title='Add to StumbleUpon' alt='Add to StumbleUpon' src='http://www.pheedo.com/images/mm/stumbleit.gif'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:17f462313ca377ab852f2720e5cb8d91:1VU4%2BNomyDFUBns7ZoTvUPaX9L%2BlAADtLIH0dA9K2k72hYemA4yMh6IYDltPfWc7QXH7vvLnGUjYZQ%3D%3D'><img border='0' title='Add to Twitter' alt='Add to Twitter' src='http://www.pheedo.com/images/mm/twitter.png'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:f5f38d164a3d6ceab12e3c828092c409:oOR0%2BPZ0K7Z74WQot6sMrm9NrLbRXrZ%2B996DB%2BuhG2PhhX6AcYAIhQ2E06X4sujJIfRU1tHRy5N5Tw%3D%3D'><img border='0' title='Add to Slashdot' alt='Add to Slashdot' src='http://www.pheedo.com/images/mm/slashdot.png'/></a>
<br style="clear: both;"/>  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=ab888342c3d54a9772210cd39b94d55f" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=ab888342c3d54a9772210cd39b94d55f" style="display: none;" border="0" height="1" width="1" alt=""/>]]></content:encoded>
      <pubDate>Wed, 19 Nov 2008 02:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/google">google</category>
      <category domain="http://securityratty.com/tag/spam">spam</category>
      <category domain="http://securityratty.com/tag/calculator wednesday">calculator wednesday</category>
      <category domain="http://securityratty.com/tag/nifty">nifty</category>
      <category domain="http://securityratty.com/tag/company">company</category>
      <source url="http://feeds.computerworld.com/click.phdo?i=ab888342c3d54a9772210cd39b94d55f">How much does spam cost you? Google will calculate</source>
    </item>
    <item>
      <title><![CDATA[How much does spam cost you? Google will calculate]]></title>
      <link>http://securityratty.com/article/65403e1a8e3aaa6b4fbfc3a350e88841</link>
      <guid>http://securityratty.com/article/65403e1a8e3aaa6b4fbfc3a350e88841</guid>
      <description><![CDATA[How much is spam costing your company? Google unveiled a nifty little calculator Wednesday to help you add it...]]></description>
      <content:encoded><![CDATA[How much is spam costing your company? Google unveiled a nifty little calculator Wednesday to help you add it up.<p><A href="http://ad.doubleclick.net/jump/idg.us.nwf.rss/security;sz=468x60;ord=60066?">
<IMG src="http://ad.doubleclick.net/ad/idg.us.nwf.rss/security;sz=468x60;ord=60066?" border="0" width="468" height="60"></A>
</p>]]></content:encoded>
      <pubDate>Tue, 18 Nov 2008 21:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/google">google</category>
      <category domain="http://securityratty.com/tag/spam">spam</category>
      <category domain="http://securityratty.com/tag/calculator wednesday">calculator wednesday</category>
      <category domain="http://securityratty.com/tag/nifty">nifty</category>
      <category domain="http://securityratty.com/tag/company">company</category>
      <source url="http://www.networkworld.com/news/2008/111908-how-much-does-spam-cost.html?fsrc=rss-security">How much does spam cost you? Google will calculate</source>
    </item>
  </channel>
</rss>
