Well, well, well... It's that time of the year again: RSA Conference, the infosec class reunion!
As with my ongoing #TSASongs lampooning of the TSA, I like to drip, drip, drip or death-by-comedy my fellow tweeple with some infosec snark, for the weeks before the RSA Conference, when the vendor-PR spin machines start roaring past oughtta-be-illegal decibels. I use the main conference hashtag #RSAC to sneak in a few sarcastic, overwrought fake vendor pitches, replete with the latest and greatest buzzwords used (and abused) by infosec vendors, analysts and press.
Self-employed consultants like myself can do no wrong, of course, so I don't include that essential category in this ribbing ;-)
This is in many ways poking fun at what's going on in the infosec industry on any given day, not just at RSA Conference. When the tough economy meets daily train wreck headlines of massive breaches... the vendor who shouts the loudest and scariest often gets the most leads: http://t.co/SZDxchFO
Monty Python really gets it!
Note I didn't say the best quality leads, just the most leads...
Below please find a few of the better #RSAC tweets I dropped into the conference buzz machine.
Enjoy!
(In)Securely,
Gal Shpantzer
-My Evening Iguana can beat up ur Night Dragon and my CC-EAL7 CyberOwls use their Anti-Threat Talons (ATT) to eat ShadyRATs
-CyberWolves on the prowl? Swarm the threat w nocturnal CyberOwls, they target cyberwolves w Anti-Threat Talonswhere they hate it most!
-Holistically distributed, FIPS-approved, exascale, EO12333-compliant self-defending active-hackback web proxy honeypot in the cloudz
-Plz allow me2 introduce myself, I'm a con of wealth and taste, I've been round for a long long year, stole many a man's soul and faith
-So, you have problems with HIPAA SOX HITECH DITSCAP APT GLBA NIST FIPS-140 CC-EAL7 OASIS TCG NSA EO12333? My appliance does that! (For a good laugh, search EO 12333)
-0day detecting DEP/ASLR-enabled TCG KMIP SED for over-the-horizon threats 2 NFC micropayment due Wikileaks LadyGaga DVD threat vectors (referring to State Dep't cables leak)
-Hacktivist-aware, Privacy-enhancing, SinglePaneOfGlass SituationalAwareness of Console Management Distributed Denial of FIPS-140 DDoS
PersistentAdversarialThreatHostileEntityToilingIncessantlyCounterMeasuringAgainstReasonableKineticExigencyTrollingINventiveGroups
(Translation: PATHETICMARKETING)
-Virtualized BYOD active-defense of API orchestration through self-healing private cloud to holistically protect from CyberWolf attack
-Wirespeed (100G) CC-EAL4+ BigData Securing, Privacy-Aware, DataLeakagePreventing, TCL-enabled iOS/Android BYONOSQL
FYI the whole CyberWolves thing is, sadly, not my idea. It's from a real article. :-/ http://www.dcvelocity.com/articles/20111219supply_chain_info_networks_internet_security_threat/
#CantMakeThisUp
February 24, 2012
February 22, 2012
Verification of claims made in Security Domination via Hard Drive Isolation!
Since late 2009, I've been on a roadshow called Security Domination via Hard Drive Isolation, discussing the emerging Desktop-on-a-stick, PC-in-your-pocket and other USB-based mobility and security approaches. The niche emerged before the iThings craze really came to a full roar and is still today actively pursued as a valid approach for many use cases, including secure telework and remote access, disaster recovery and more.
There are several players in the USB hardware space that claim high-security encryption, some with a FIPS 140-2 level 3 validation from NIST. I would generally trust these USB sticks to carry files around, as a sort of secure briefcase, from one trusted machine to another, or as a backup media that's pre-encrypted.
Once the vendors in question start making claims that move past the secure briefcase use case, I start getting a bit concerned as to the nature of security they can provide.
There are two schools of thought in this niche: Bootable (boot to a clean OS) vs. Bubble. The bubble variety (by far the most common) is inherently less secure than the bootable for defeating software malware, since the bubble relies on various mechanisms that claim to defeat malware on the spinning disk of the host OS on the host machine (usually Windows). In my mind, this is a losing proposition, considering the sophistication of the malware we're seeing out there and the pace of evolution that the 'authors' have demonstrated.
While I've always been in awe of some of the mil-spec sticks' resistance to physical destruction, there are some claims that they make regarding the security of their extended product lines that I've challenged in the Security Domination talk. I specifically called out the issue of untrusted host OS keystroke-logging and screenshot-grabbing (yes, that's a term..) as a problem in the bubble space. Furthermore, I called out the inevitable destruction of the claim that the virtual (on-screen) keyboard was a solution to the problem.
Turns out that sick, er, great minds think alike! I just found this youtube video from April 2010 that challenges the virtual keyboard security claims via a demonstration of keystroke logging of USB key unlock passwords, including input from the virtual (on-screen) keyboard.
Here you go, virtual keyboard security is not as secure as we'd like it to be.
http://www.youtube.com/watch?v=B5mJEhg1HtU
This type of malware is (to be uncharacteristically mild) problematic for the high-security USB vendors who claim to solve several malware-related security problems without booting to a clean OS.
Not to put too fine a point on it, please understand this: If you're inserting a USB key into a USB port on an untrusted machine and you're not booting into a clean alternative OS, but rather piggybacking onto the untrusted, pre-pwned OS on the host machine... well then, you're putting the unlock password (and any other work you perform from the USB key's virtual OS) at risk from software keystroke loggers and screenshot grabbers, etc.
PS Hardware keystroke loggers are a related but different issue and are not in the scope of this discussion.
There are several players in the USB hardware space that claim high-security encryption, some with a FIPS 140-2 level 3 validation from NIST. I would generally trust these USB sticks to carry files around, as a sort of secure briefcase, from one trusted machine to another, or as a backup media that's pre-encrypted.
Once the vendors in question start making claims that move past the secure briefcase use case, I start getting a bit concerned as to the nature of security they can provide.
There are two schools of thought in this niche: Bootable (boot to a clean OS) vs. Bubble. The bubble variety (by far the most common) is inherently less secure than the bootable for defeating software malware, since the bubble relies on various mechanisms that claim to defeat malware on the spinning disk of the host OS on the host machine (usually Windows). In my mind, this is a losing proposition, considering the sophistication of the malware we're seeing out there and the pace of evolution that the 'authors' have demonstrated.
While I've always been in awe of some of the mil-spec sticks' resistance to physical destruction, there are some claims that they make regarding the security of their extended product lines that I've challenged in the Security Domination talk. I specifically called out the issue of untrusted host OS keystroke-logging and screenshot-grabbing (yes, that's a term..) as a problem in the bubble space. Furthermore, I called out the inevitable destruction of the claim that the virtual (on-screen) keyboard was a solution to the problem.
Turns out that sick, er, great minds think alike! I just found this youtube video from April 2010 that challenges the virtual keyboard security claims via a demonstration of keystroke logging of USB key unlock passwords, including input from the virtual (on-screen) keyboard.
Here you go, virtual keyboard security is not as secure as we'd like it to be.
http://www.youtube.com/watch?v=B5mJEhg1HtU
This type of malware is (to be uncharacteristically mild) problematic for the high-security USB vendors who claim to solve several malware-related security problems without booting to a clean OS.
Not to put too fine a point on it, please understand this: If you're inserting a USB key into a USB port on an untrusted machine and you're not booting into a clean alternative OS, but rather piggybacking onto the untrusted, pre-pwned OS on the host machine... well then, you're putting the unlock password (and any other work you perform from the USB key's virtual OS) at risk from software keystroke loggers and screenshot grabbers, etc.
PS Hardware keystroke loggers are a related but different issue and are not in the scope of this discussion.
January 06, 2012
Personnel Security: A Musical Journey, guided by Warren Zevon
(previously published elsewhere, now back home)
Warren Zevon: An Infosec Musical Journey
One analogy I learned early in my career is that Information security is a three-legged stool, consisting of Computer Security, Physical Security and Personnel Security. Compromise one of these legs and the stool falls over.
In some cases involving access to highly sensitive information, personnel security involves plumbing the depths of people's personal histories, up to and including very intrusive interviews and polygraphs. This part of information security is something that most practitioners and managers don't have to deal with, other than interfacing with HR or the personnel security office during the hiring process.
Where is the nexus between personal conduct and being trustworthy to protect sensitive information? That depends, amongst other factors, on the level of sensitivity of the information and the type of organization granting access to the information.
Let's take a musical journey through personnel security and rediscover an old classic, Lawyers, Guns and Money, by Warren Zevon.
According to Zevon, he wrote the lyrics to Lawyers, Guns and Money on wet cocktail napkins, while on vacation in Kauai, "after a long day of improbable and grotesque mischief."
http://www.youtube.com/watch?v=S5puAN1PGQw (mostly safe for work, has one four letter word that starts with S).
Let's analyze what we can learn from Zevon's lyrics as practitioners of information security, assuming that the subject of the song has sensitive information in his head and is being targeted for exploitation:
I went home with the waitress, the way I always do
How was I to know she was with the Russians too?
This is a classic honeypot situation, where an adversary uses an attractive person to get the target into a compromising position, in quite the literal sense, after which the target may be coerced to betray his country or captured for interrogation, or just killed.
Honeypots are fixtures of spy movie plots, from the James Bond franchise to Munich to The Good Shepherd.
One real life case of 'she was with the Russians' is that of Clayton Lonetree, who was in a sensitive US embassy security position in Moscow... http://www.hanford.gov/c.cfm/oci/ci_spy.cfm?dossier=72
A more recent example, more on point to information security, is the case of the missing Blackberry belonging to the aide to the British Prime Minister during a visit to China.
http://council.smallwarsjournal.com/archive/index.php/t-5775.html
More lyrics:
I was gambling in Havana
I took a little risk
Send lawyers, guns and money
Dad, get me outta this
This is another classic weakness that can result in becoming a more exploitable target, since gambling can become an addiction and result in grave financial hardship. Eventually someone with bad intentions may notice the weakness and may attempt to recruit the subject by using coercion or quid pro quo services demanded by people seeking cooperation from the target. "We give you money to take care of the gambling debts, the loan sharks won't break your bones and hey, no big deal, it's just some information, not like it's gonna hurt anybody..."
Next, we hear Zevon's character denying responsibility for his situation, declaring himself a victim of circumstance and bad luck:
I'm the innocent bystander
and somehow I got stuck
between a rock and a hard place
and I'm down on my luck
This denial of responsibility displays a lack of maturity and ability to recognize and correct personal flaws, which we all have to some degree. This is perhaps the worst offense committed by the subject of the song.
The US State Department website has a listing of the elements of the Whole Person concept that may be relevant to the adjudication of a background investigation for a security clearance. (Note that different parts of the US Government have different security-related priorities and bureacratic mechanisms, so there is not one place for a federal clearance).
http://www.state.gov/m/ds/clearances/60321.htm
If you read through the webpage, you'll find that Zevon's lyrics included behavior that would fall under several areas of concern in the Adjudicative Guidelines for Determining Eligibility to Classified Information:
Guideline D on Sexual Behavior, referring to "sexual behavior that causes an individual to be vulnerable to coercion, exploitation, or duress" as one of the specific concerns in the guideline.
Guideline F on Financial Considerations (explicitly mentioning compulsive gambling), and
Guideline E on Personal Conduct, which includes lack of full and open cooperation with investigators who are charged with determining if the subject of the investigation is trustworthy enough to obtain and keep a clearance. Specifically, "Refusal to provide full, frank and truthful answers to lawful questions of investigators, security officials, or other official representatives in connection with a personnel security or trustworthiness determination."
One good site for more specific examples of personnel security decisions is the Defense Office of Hearings and Appeals (DOHA), you can read about actual situations where people were denied clearances or lost them and appealed their cases to DOHA. These cases illustrate the balancing act involved in deciding whether to grant or deny a clearance and the legal underpinnings of the clearance adjudication process.
Many years of actual cases, including the latest ones from December 2011:
http://www.dod.gov/dodgc/doha/industrial/2011.html
The Adjudicative Desk Reference may be used as a guide by administrative judges and others in determining the outcome of personnel security matters. http://www.dhra.mil/perserec/products.html#ADR The reference was created by the Defense Department's Personnel Security Research Center (PERSEREC) as a tool to assist in making difficult decisions regarding suitability for cleared work.
Other products from PERSEREC may be of interest to those involved in HR, Insider Threat and Workplace Violence and other areas of research: Use with caution, this is not an exact science... The first link includes a pointer to a 2011 "Ethnographic Analysis of Second Life." http://www.dhra.mil/perserec/reports.html and http://www.dhra.mil/perserec/products.html
Warren Zevon: An Infosec Musical Journey
One analogy I learned early in my career is that Information security is a three-legged stool, consisting of Computer Security, Physical Security and Personnel Security. Compromise one of these legs and the stool falls over.
In some cases involving access to highly sensitive information, personnel security involves plumbing the depths of people's personal histories, up to and including very intrusive interviews and polygraphs. This part of information security is something that most practitioners and managers don't have to deal with, other than interfacing with HR or the personnel security office during the hiring process.
Where is the nexus between personal conduct and being trustworthy to protect sensitive information? That depends, amongst other factors, on the level of sensitivity of the information and the type of organization granting access to the information.
Let's take a musical journey through personnel security and rediscover an old classic, Lawyers, Guns and Money, by Warren Zevon.
According to Zevon, he wrote the lyrics to Lawyers, Guns and Money on wet cocktail napkins, while on vacation in Kauai, "after a long day of improbable and grotesque mischief."
http://www.youtube.com/watch?v=S5puAN1PGQw (mostly safe for work, has one four letter word that starts with S).
Let's analyze what we can learn from Zevon's lyrics as practitioners of information security, assuming that the subject of the song has sensitive information in his head and is being targeted for exploitation:
I went home with the waitress, the way I always do
How was I to know she was with the Russians too?
This is a classic honeypot situation, where an adversary uses an attractive person to get the target into a compromising position, in quite the literal sense, after which the target may be coerced to betray his country or captured for interrogation, or just killed.
Honeypots are fixtures of spy movie plots, from the James Bond franchise to Munich to The Good Shepherd.
One real life case of 'she was with the Russians' is that of Clayton Lonetree, who was in a sensitive US embassy security position in Moscow... http://www.hanford.gov/c.cfm/oci/ci_spy.cfm?dossier=72
A more recent example, more on point to information security, is the case of the missing Blackberry belonging to the aide to the British Prime Minister during a visit to China.
http://council.smallwarsjournal.com/archive/index.php/t-5775.html
More lyrics:
I was gambling in Havana
I took a little risk
Send lawyers, guns and money
Dad, get me outta this
This is another classic weakness that can result in becoming a more exploitable target, since gambling can become an addiction and result in grave financial hardship. Eventually someone with bad intentions may notice the weakness and may attempt to recruit the subject by using coercion or quid pro quo services demanded by people seeking cooperation from the target. "We give you money to take care of the gambling debts, the loan sharks won't break your bones and hey, no big deal, it's just some information, not like it's gonna hurt anybody..."
Next, we hear Zevon's character denying responsibility for his situation, declaring himself a victim of circumstance and bad luck:
I'm the innocent bystander
and somehow I got stuck
between a rock and a hard place
and I'm down on my luck
This denial of responsibility displays a lack of maturity and ability to recognize and correct personal flaws, which we all have to some degree. This is perhaps the worst offense committed by the subject of the song.
The US State Department website has a listing of the elements of the Whole Person concept that may be relevant to the adjudication of a background investigation for a security clearance. (Note that different parts of the US Government have different security-related priorities and bureacratic mechanisms, so there is not one place for a federal clearance).
http://www.state.gov/m/ds/clearances/60321.htm
If you read through the webpage, you'll find that Zevon's lyrics included behavior that would fall under several areas of concern in the Adjudicative Guidelines for Determining Eligibility to Classified Information:
Guideline D on Sexual Behavior, referring to "sexual behavior that causes an individual to be vulnerable to coercion, exploitation, or duress" as one of the specific concerns in the guideline.
Guideline F on Financial Considerations (explicitly mentioning compulsive gambling), and
Guideline E on Personal Conduct, which includes lack of full and open cooperation with investigators who are charged with determining if the subject of the investigation is trustworthy enough to obtain and keep a clearance. Specifically, "Refusal to provide full, frank and truthful answers to lawful questions of investigators, security officials, or other official representatives in connection with a personnel security or trustworthiness determination."
One good site for more specific examples of personnel security decisions is the Defense Office of Hearings and Appeals (DOHA), you can read about actual situations where people were denied clearances or lost them and appealed their cases to DOHA. These cases illustrate the balancing act involved in deciding whether to grant or deny a clearance and the legal underpinnings of the clearance adjudication process.
Many years of actual cases, including the latest ones from December 2011:
http://www.dod.gov/dodgc/doha/industrial/2011.html
The Adjudicative Desk Reference may be used as a guide by administrative judges and others in determining the outcome of personnel security matters. http://www.dhra.mil/perserec/products.html#ADR The reference was created by the Defense Department's Personnel Security Research Center (PERSEREC) as a tool to assist in making difficult decisions regarding suitability for cleared work.
Other products from PERSEREC may be of interest to those involved in HR, Insider Threat and Workplace Violence and other areas of research: Use with caution, this is not an exact science... The first link includes a pointer to a 2011 "Ethnographic Analysis of Second Life." http://www.dhra.mil/perserec/reports.html and http://www.dhra.mil/perserec/products.html
July 21, 2011
The Cons They Are a Changin'
I took some time off of #TSASongs to bring you this tribute to BSides security conferences.
http://www.securitybsides.com/
Please sing along with me, to the tune of Bob Dylan's The Times They Are a Changin'
A Parody with a message...
Come gather round Tweeple wherever you roam
and admit that the BSides around you have grown
and accept it that soon you'll need skillz that are honed
if your time to you is worth savin
then you better start learnin or you’ll sink like a stone
for the times they are a changin
come PR flacks and keynotes who dominate with your spend
and keep your eyes wide the chance won’t come again
and don’t hype too soon for the FUD’s still in spin
there’s no tellin who that its shamin'
for the loser now will be later to win
for the times they are a changin
come vendors and pitchmen, please heed the call
don’t sell in the doorway don’t flog up the hall
for he that gets hurt will be he who cold called
the battle outside ragin
will soon shake your Windows, bypass your firewalls
for the times they are a changin
come conference planners throughout the land
and don’t criticize what you can’t understand
our cons and our parties are beyond your command
your old road is rapidly aging
please get outta the new one if you can’t lend your hand
for the times they are a changin
the line it is drawn, the curse it is cast
the expensive cons now will lose people fast
as the closed cons now will later be past
the order is rapidly fadin
but the BSides con is a guaranteed blast
for the times they are a changin
---------------------------------------------------------------
Dedicated to the BSides crew and volunteers.
All my (g)love,
@Shpantzer
http://www.securitybsides.com/
Please sing along with me, to the tune of Bob Dylan's The Times They Are a Changin'
A Parody with a message...
Come gather round Tweeple wherever you roam
and admit that the BSides around you have grown
and accept it that soon you'll need skillz that are honed
if your time to you is worth savin
then you better start learnin or you’ll sink like a stone
for the times they are a changin
come PR flacks and keynotes who dominate with your spend
and keep your eyes wide the chance won’t come again
and don’t hype too soon for the FUD’s still in spin
there’s no tellin who that its shamin'
for the loser now will be later to win
for the times they are a changin
come vendors and pitchmen, please heed the call
don’t sell in the doorway don’t flog up the hall
for he that gets hurt will be he who cold called
the battle outside ragin
will soon shake your Windows, bypass your firewalls
for the times they are a changin
come conference planners throughout the land
and don’t criticize what you can’t understand
our cons and our parties are beyond your command
your old road is rapidly aging
please get outta the new one if you can’t lend your hand
for the times they are a changin
the line it is drawn, the curse it is cast
the expensive cons now will lose people fast
as the closed cons now will later be past
the order is rapidly fadin
but the BSides con is a guaranteed blast
for the times they are a changin
---------------------------------------------------------------
Dedicated to the BSides crew and volunteers.
All my (g)love,
@Shpantzer
September 29, 2009
Send In The Clowns (RIAA's Embarrassing Pursuits)
Have you ever sat yourself down and wondered: Hey, just how lame is RIAA's ability to do technical detection of 'copyright infringement' or whatever it is they're calling it these days?
Well, it turns out there is good evidence that the lameness goes even deeper than the already low expectations we have become accustomed to from this group.
It's not like RIAA's lameness is any news, really... Some of the most sober and respected leaders of the information security community have called RIAA out for their wayward ways. No less than Dr. Eugene Schultz, not known for being overly hyperbolic in his word choice, spoke of the RIAA:
"Clearly, clowns rule the circus when it comes to at least some of the RIAA’s witch hunts."
http://blog.emagined.com/2008/07/08/the-entertainment-industry-and-copyright-violation-crackdowns-how-much-is-too-much/
How can I top that kind of piledriver-by-blog? I'm nowhere near as smart nor eloquent as Dr. Schultz.
So why do I add to this criticism of RIAA, after all these years of silence?
Because, dear readers, the technical evidence is really starting to get to me (I know it's almost 2010... ok, ok...)
Previously, I posted about ridiculous RIAA letters coming to University of Washington researchers (http://dmca.cs.washington.edu)
The last straw came recently, when I sat through a lecture at a Dartmouth infosec conference and had to keep picking my jaw up off the floor, time after time, as a computer science professor and law professor described in detail how they toiled to save a poor soul from the cold, unrelenting wrath of RIAA's legal attack dogs.
The poor soul in question had no computer in her home at the time of the alleged infringement...
Here it is, the evidence (as if we needed more of it), just so you too can say "Now I know" the answer to the question above (the one about the depths of RIAA's lameness):
Summary of victory against RIAA by Professor Embree from Franklin Pierce Law School:
http://www.piercelaw.edu/news/posts/2009-06-18-victory-in-downloading-case.php
The letter from Ms. Mavis Roy, the would-be-victim of RIAA's ridiculous behavior, thanking the staff of the law clinic run by Professor Embree:
http://www.piercelaw.edu/assets/pdf/release-mavis-letter.pdf
The expert report by Professor Bratus (techies, get a snack and a comfy chair, this is good stuff):
http://www.piercelaw.edu/assets/pdf/release-mavis-case-expert-report.pdf
Bio of the heroic Professor Embree http://www.piercelaw.edu/ashlynlembree/index.php
And so, in the tradition of legislating from the blog bench (yes I can do that)...
Previously, I brought you Shpantzer's Law of Endpoint Security (http://shpantzer.blogspot.com/2009/04/shpantzers-law-of-endpoint-security.html)
Today, I bring you Shpantzer's Law of RIAA Law(suits):
I propose that from now on, anytime you post anything about RIAA going after obviously innocent people, then you must type/sing/hum a legally correct snippet of Send In The Clowns. Maybe just a bar or two, check with your favorite entertainment lawyer.
It'll be like our little inside joke. Only you and the eight people who read this blog will know! It's like being a part of an elite secret society, just without the hazing!
My personal favorite is Grace Jones' disco version, cuz hey, go cheesy or go home! Streisand, Judy Dench, Mel Torme, Frank Sinatra, or any such personality will do in a pinch. It's all there on the intertubes to enjoy.
For now.
Send In The Clowns...
Or SEND IN ZEE CLOWNS! (Frau Farbissina from Austin Powers style)
PS MediaSentry, whose technical failures are described in the technical report, is not doing RIAA's dirty work any longer, last time I checked.
PPS For a list of many people who performed and recorded this song:
http://en.wikipedia.org/wiki/Send_in_the_Clowns
(Krusty The Klown, shoulda known)
Well, it turns out there is good evidence that the lameness goes even deeper than the already low expectations we have become accustomed to from this group.
It's not like RIAA's lameness is any news, really... Some of the most sober and respected leaders of the information security community have called RIAA out for their wayward ways. No less than Dr. Eugene Schultz, not known for being overly hyperbolic in his word choice, spoke of the RIAA:
"Clearly, clowns rule the circus when it comes to at least some of the RIAA’s witch hunts."
http://blog.emagined.com/2008/07/08/the-entertainment-industry-and-copyright-violation-crackdowns-how-much-is-too-much/
How can I top that kind of piledriver-by-blog? I'm nowhere near as smart nor eloquent as Dr. Schultz.
So why do I add to this criticism of RIAA, after all these years of silence?
Because, dear readers, the technical evidence is really starting to get to me (I know it's almost 2010... ok, ok...)
Previously, I posted about ridiculous RIAA letters coming to University of Washington researchers (http://dmca.cs.washington.edu)
The last straw came recently, when I sat through a lecture at a Dartmouth infosec conference and had to keep picking my jaw up off the floor, time after time, as a computer science professor and law professor described in detail how they toiled to save a poor soul from the cold, unrelenting wrath of RIAA's legal attack dogs.
The poor soul in question had no computer in her home at the time of the alleged infringement...
Here it is, the evidence (as if we needed more of it), just so you too can say "Now I know" the answer to the question above (the one about the depths of RIAA's lameness):
Summary of victory against RIAA by Professor Embree from Franklin Pierce Law School:
http://www.piercelaw.edu/news/posts/2009-06-18-victory-in-downloading-case.php
The letter from Ms. Mavis Roy, the would-be-victim of RIAA's ridiculous behavior, thanking the staff of the law clinic run by Professor Embree:
http://www.piercelaw.edu/assets/pdf/release-mavis-letter.pdf
The expert report by Professor Bratus (techies, get a snack and a comfy chair, this is good stuff):
http://www.piercelaw.edu/assets/pdf/release-mavis-case-expert-report.pdf
Bio of the heroic Professor Embree http://www.piercelaw.edu/ashlynlembree/index.php
And so, in the tradition of legislating from the blog bench (yes I can do that)...
Previously, I brought you Shpantzer's Law of Endpoint Security (http://shpantzer.blogspot.com/2009/04/shpantzers-law-of-endpoint-security.html)
Today, I bring you Shpantzer's Law of RIAA Law(suits):
I propose that from now on, anytime you post anything about RIAA going after obviously innocent people, then you must type/sing/hum a legally correct snippet of Send In The Clowns. Maybe just a bar or two, check with your favorite entertainment lawyer.
It'll be like our little inside joke. Only you and the eight people who read this blog will know! It's like being a part of an elite secret society, just without the hazing!
My personal favorite is Grace Jones' disco version, cuz hey, go cheesy or go home! Streisand, Judy Dench, Mel Torme, Frank Sinatra, or any such personality will do in a pinch. It's all there on the intertubes to enjoy.
For now.
Send In The Clowns...
Or SEND IN ZEE CLOWNS! (Frau Farbissina from Austin Powers style)
PS MediaSentry, whose technical failures are described in the technical report, is not doing RIAA's dirty work any longer, last time I checked.
PPS For a list of many people who performed and recorded this song:
http://en.wikipedia.org/wiki/Send_in_the_Clowns
(Krusty The Klown, shoulda known)
September 16, 2009
DRM Watch now CopyrightandTechnology Blog
The DRMWatch website is now (for some time) http://copyrightandtechnology.com/
Bill Rosenblatt compiles stories and commentary about Copyright, Digital Rights Management, Watermarking and other copyright-related technology and the strategic moves made by tech companies, copyright holders and enforces, congresscritters, ISPs and other players in the crazy copyright scene.
Bill Rosenblatt compiles stories and commentary about Copyright, Digital Rights Management, Watermarking and other copyright-related technology and the strategic moves made by tech companies, copyright holders and enforces, congresscritters, ISPs and other players in the crazy copyright scene.
June 01, 2009
Word of the Day: Life Password
Help your friends and family avoid using a Life Password...
Life Password
May 19, 2009 Urban Word of the Day from UrbanDictionary.com
The password that you use for every website, email account, facebook, twitter, everything. Having a 'life password' is not a good idea, but everyone does it.
My friend found out my life password and wrecked my facebook account, stole all my paypal money and emailed offensive images to my mother.
Life Password
May 19, 2009 Urban Word of the Day from UrbanDictionary.com
The password that you use for every website, email account, facebook, twitter, everything. Having a 'life password' is not a good idea, but everyone does it.
My friend found out my life password and wrecked my facebook account, stole all my paypal money and emailed offensive images to my mother.
Subscribe to:
Posts (Atom)
