Archive for the tag 'security'

Lots of proxy probing going on: CONNECT verb attacks

prince.org has been getting a ton of proxy-probing attacks lately… I see in the logs TONS of “CONNECT :25″ requests, ie trying to ping a remote SMTP server through prince.org as a web proxy. Now, mind you, prince.org doesn’t have a proxy enabled… so… you figure it out. Script kiddies, go away. Too bad it’s coming from a rather large number of IPs, or I’d just blacklist them. At least some are resolving back to Taiwan. Annoying…

Ah, there IS a way (after much futzing) to block CONNECTs explicitly. Done!

jyte openid experiment/social credibility site

jyte.com looks a little like a web2.0 weekend project from university students, and it probably is, but is somewhat amusing nonetheless. I’m pretty sure they’re hoping to get bought by Yahoo for 100x their investment :)

Jyte allows you to make “statements” or “claims” as they call them, and let people quickly rate them up/down, for realtime social interaction. Are you cool? Make a claim!

Anyhow, probably the most significant point about it is that it uses OpenID for login. This is really a great thing, I’m a huge fan of stuff like OpenID (I say “like”, because personally I prefer the Yahoo BBAuth stuff, as 400 million people already have the login credentials to use it.) It’ll be interesting to see if this takes off and gets really popular; it could, seeing how hotornot it crazy lucrative and Bix got bought by Yahoo… maybe I’m just jealous I didn’t come up with this super-simple idea :)

The MPAA’s plan for anti-piracy technology: it’s a secret!

In this article at Wired about digital projection of films and anti-piracy measures, Brad Hunt of the MPAA is quoted as saying:

“We’re not trying to describe specifically what is being done, because the effectiveness of these technologies is based on a lack of knowledge.”

Ah, the old “security through obscurity” tactic. That always works so well… not. But hey, don’t tell the MPAA; their continued ignorance is probably an overall good thing: the more shitty movies get pirated, the less likely people will pay to go see them, the more likely quality movies are to be made, for which people DO pay for. I have seen a bootleg or two in my time, largely because with a 17-month-old, I don’t get many opportunities to go to the movies, and I want to see some things before the DVD is released. Movies I like, I buy the DVDs for. Many other people are the same way, I’m sure. (Actually, a lot of folks are probably renting the dvds and not buying them, via Netflix or Blockbuster, but I tend to like to own movies that are worth watching, especially if there’s extras on the disc.)

Aside from that silliness above, the article basically just says there will be a time & location stamp in the film. Big whoop. I suspect (a) this won’t survive through the projection->camcorder->encoding (and possibly ->reencoding) process, and (b) most pirates just don’t care. Until you have to show ID and have your picture taken going into the theater, I don’t see this being much of a deterrent. Better plan: have ushers (remember them?) or security folks observe people in the theater, and spot people with camcorders. But wait, this would cost the theaters money, and is likely difficult to acheive 100% success, which is almost needed, due to the multiplication factor innate to piracy.

But hey, maybe it’ll stop the low-tech pirates hawking cheap dvds at swap meets and on the corner. Maybe…. but internet-based/p2p piracy, I seriously doubt it’ll have any effect. You know what would work? Making quality movies, giving something extra to the theater experience (interactivity? better value? purchase the DVD at a discount on the way out?), and treating your customers with respect instead of apathy, disdain, and mistrust.