Perilocity

DRM: The Secret that Can't be Kept

Cory Doctorow on why DRM can never work:

It's great for email, but it can never work for movies, TV shows or music, because in the case of "copy protection" the receiver is also the person that the system is meant to guard itself against.

Say I sell you an encrypted DVD: the encryption on the DVD is supposed to stop you (the DVD's owner) from copying it. In order to do that, it tries to stop you from decrypting the DVD.

Except it has to let you decrypt the DVD some of the time. If you can't decrypt the DVD, you can't watch it. If you can't watch it, you won't buy it. So your DVD player is entrusted with the keys necessary to decrypt the DVD, and the film's creator must trust that your DVD player is so well-designed that no one will ever be able to work out the key.

— Pushing the impossible, by Cory Doctorow, Guardian Unlimited, Tuesday September 4 2007

So as long as you can keep a secret from yourself, DRM will work....

-jsq

Aged Old Code

Old wine or whisky can become more complex and interesting. Old code becomes insecure:

Or at least become more vulnerable. I've recently been helping a client with their secure coding initiative and as a result I've been reading Mike Howard and Dave LeBlanc's Writing Secure Code which reminded me of an important aspect of maintaining a secure code base which often gets overlooked: That is that as code ages it becomes insecure.

— Evolve or Die, by arthur, Emergent Chaos, August 29, 2007 at 7:47 AM

The state of the art in discovering vulnerabilities advances. I remember when nobody worried much about buffer overflows. Related to that, programs get used in environments they weren't written for. Who really cared about buffer overflows on the early Internet when just getting it working for a few researchers was the goal? Related to that, the number of people motivated to break code keeps increasing, especially those with monetary motivation. With enough eyes are bugs are shallow also means with enough eyes all vulnerabilities become easy to find. Or, in this postmodern world, even computer programs are largely what people perceive them to be, and those perceptions change.

For example, Jeff Pulver perceives Facebook's video messages as videophone. How long before somebody perceives it as a phishing method? Where there's humans there's humint.

-jsq

Terrorism, Lightning, and Bloomberg

Sometimes a politician says something so sensible you wonder why everbody doesn't say it:

There are lots of threats to you in the world. There’s the threat of a heart attack for genetic reasons. You can’t sit there and worry about everything. Get a life.

You have a much greater danger of being hit by lightning than being struck by a terrorist.

In terms of what you as individual on the streets should worry about is not whether the person sitting next to you on the subway is a terrorist. The likelihood of that is so small it is not something you should worry about.

—Buzz Over Mayor’s ‘Get a Life’ Remark, By Sewell Chan, Empire Zone, June 6, 2007,  9:46 am

The outlet that originally quoted Bloomberg, wcbstv.com, quotes several people as saying terrorism is a big threat. However, it also points out that New York City is the safest city in America, with violent crime in general low and decreasing. Maybe if that TV station and others reported that more often, instead of constant, irrational fear, more people would understand what Bloomberg is saying.