SoftwareShift

Botnets

I came across an interesting visual representation of a botnet this week and I started thinking about the solution to the problem. After throwing out poor solutions that focus on the destination of an attack such as disabling the target (which most ISP's do) and blocking ip addresses (impossible because you have to block thousands of random IP's), I realized that the correct solution is the answer to this question: "how can you disable a decentralized network?"

The answer to that particular question is difficult because there isn't a single point of failure. There isn't a central point of control on which to focus your efforts. This explains the music industry's failure make any significant dent in the peer-to-peer networks and Microsoft's inability to extinguish Linux. And, interestingly, the Internet itself is the largest decentralized network. How can one disable the Internet?

In regards to botnets, I suspect that a strict technical solution will never work because there isn't a single point of failure. Any serious attempt to do so will require other non-technical channels and, unfortunately, there isn't an incentive for any organization to take on the task.

Most spam comes from just six botnets - register.co.uk

What a botnet looks like - csoonline.com

Patents

NTP, famous from the NTP/RIM case, is back in the news again. This time it is suing the telcos (Verizon, AT&T, Sprint, T-Mobile) for email delivery to mobile devices. My guess is that they are hoping for quick settlements from these companies with deep pockets rather than a protracted legal battle considering that some of their patents were invalidated by the USPTO shortly after the settlement in the RIM case.

On a related note, Tim O'reilly posted his thoughts about a peer review system for software patents. I think that this a good idea assuming that the "peers" can remain consistently impartial.

NTP sues Verizon, AT&T, Sprint Nextel and T-Mobile via slashdot

NTP's entry on Wikipedia - wikipedia.org

Patents and Scientific Peer Review - radar.oreilly.com

Stallman Transcript

Here is a link to the transcript of Richard Stallman's explanation of the GPLv3. He gives a brief introduction to free software and then explains the new clauses found in version 3 of the GPL.

RMS Explains GPLv3 Draft 3 via slashdot

BotNets

This is a problem thats not going to go away anytime soon. Vint Cerf (inventor of TCP/IP) at the World Economic Forum in Switzerland made the claim that there are 150 million computers, out of a total 600 million, that are members of various botnets. If the 1 out of 4 statistic doesn't scare you, the data transfer rates will: 10-20Gbps. That's 5 dvd's or 4000 mp3's (5mb each) per second.

Now, who's going to fix this? A slashdotter made the interesting point that ISP's can do something but won't because it's too costly. And if the target is on their network, they will take the target down (which is the purpose of the botnet attack) rather than identify and block the zombie pc's. And we can't make ISP's responsible for content. Think network neutrality.

25 Percent of All Computers in a Botnet? - arstechnica.com via slashdot

FLOSS Study

The European Commission(the executive body of the EU) released a study last week about effects of FLOSS(free/libre/open source software). The conclusions of the study were less than surprising:

"Our findings show that, in almost all the cases, a transition toward open source reports of savings on the long term costs of ownership of the software products."

I wonder how MS is going to respond to this, if at all.

Large FLOSS Study Gets the Real Facts - europa.eu via slashdot

Microsoft and the SFLC

In December, the Software Freedom Law Center filed a brief in support of Microsoft arguing that software isn't patentable. Originally and interestingly, Microsoft made the same claim while appealing the supreme court's decision in favor of AT&T over Microsoft's patent infringement of AT&T's speech codecs. Microsoft states:

Software code is an intangible string of information not a “component” as required by the statute.

The statute refers to 35 USC 271 section f of the U.S. Patent Act.

I hope Microsoft wins this one because of the possible by-product: The supreme court's decision that software cannot not be patented. We'll see.

Software ain't patentable, damn it! - freesoftwaremagazine.com

Software Freedom Law Center Files Brief with Supreme Court Arguing Against Software Patents - - softwarefreedom.org

Microsoft v. AT&T: Transnational Patent Law At The Supreme Court - - patentlyo.com

Fake Boarding Passes - Update

Some good news: the FBI dropped its charges against the student who developed a research website that could generate fake airline boarding passes. This outcome is definitely reasonable, though I feel the initial actions of the FBI were heavy handed. Now, I wonder if anyone is going to do anything about this security problem. My guess is no.

IU Student, Focus Of FBI Probe, Speaks Out - theindychannel.com via slashdot

Software, Security and Boarding Passes

A few weeks ago, someone developed a website that could generate fake airline boarding passes. And, of course, there was a large (over)reaction by the media and the government. Now, without giving the concept much thought, it sounds bad and hacker-like. But, the developer claims that he did this to demonstrate a obvious and serious vulnerability. I tend to believe him since this is was a completely public website (anyone could access it) and this security issue has been discussed several times before.

Aside from the flawed airline security, the problem here is that there isn't a safe way to disclose a vulnerability or security risk. How is one supposed to disclose a major security issue? And when the organization, in this case, the TSA, ignores the vulnerability for three years (Bruce Schneier published the vulnerability in 2003), what can you do without getting investigated, arrested or sued?

Personally, I think there needs to be a process supported by a government or private institution, that acts as a buffer between discoverer and the organization that the vulnerability affects. This would solve the three central problems: legitimacy of the claim, timely disclosure and discoverer protection. In detail, legitimacy would occur by the independent investigation of the claim. Timely disclosure would be achieved by first disclosing the vulnerability to the victim and then to the public. And, regarding discoverer protection, this can be upheld by guaranteeing discover anonymity (at least until the vulnerability is neutralized).

It's unfortunate that someone who points out (again) a serious problem that really affects everyone can potentially get into trouble.

The Boarding Pass Brouhaha - wired.com

Bruce Schneier's Website

Copyright and Software

Freesoftwaremagazine.com has an excellent article on copyright and its relation to software. It's a little short but its well written and makes excellent points about how copyright is being used (misused) by proprietary software vendors.

Some interesting points:

"First and foremost when we talk about software, we have the question of source code. If the purpose of encouraging publication through the limited privilege of copyright is to "promote the progress of science and useful

arts", as stated in the U.S. constitution, this is only possible with software by including publication of the source..."

"Along with the ethical question of source availability would come the freedom to make at least some private copies, and to use parts of a program, perhaps for example libraries and functions that contain file conversion routines, as well as the right to create interoperable works, and to make private modifications. While not including all the freedom as we recognize them in the free software movement, proprietary software that is distributed under the privilege of copyright should clearly do so by offering at least some of the freedoms that we do recognize..."

"Finally, when we speak of software, we are speaking of something that is also in part math and science, as well as a medium for expression of ideas. The question of math is important since natural laws, constants, properties of nature, etc, generally cannot be copyrighted or patented. For this reason, there is reason to suggest that ethically copyright should be less restrictive for software than for other kinds of works..."

To summarize in a couple of questions: (1) Is it ethical, or socially acceptable under the original intended use of copyright and fair use, to deliver software without the source code? (2) Since software, at its core, consists of logic and math, both of which are universally constant, is it ethical to even apply copyrights or patents?

In my opinion, the answer to both questions is no. However, the reason companies/vendors/developers continue to behave unethically because it is legal to do so and their businesses models rely upon it. I believe that this will eventually change, but, unfortunately, it won't be due to the ethical considerations. The primary catalyst will be the forced competition from the free and open source arena.

Copyright, bad faith, and software licensing - freesoftwaremagazine.com

OSDL and Software Patents

The Open Source Development Lab has started a new project to attempt to improve the quality of software patents. They are going to tag and categorize software found in open source software repositories in an attempt to document prior art. Although this is a step in the right direction, it is a stop-gap solution, at best.

Richard Stallman of the Free Software Foundation (FSF) has posted a response on newsforge and he makes a valid point by stating that prior art isn't the only problem in regards to software patents. The problem is also apparent in new developments that have no prior art. For example: Amazon's 1-click patent. He states that the solution is to abolish software patents. And I agree.

Prior art won't solve the software patent problem - newsforge.com

Open Source as Prior Art (OSDL) - osapa.com