Wednesday, January 3, 2007


News Item 7959 2006 Predictions Scorecard. [Freedom to Tinker]

2006 Predictions Scorecard.

As usual, we[base ']ll start the new year by reviewing the predictions we made for the previous year. After our surprisingly accurate 2005 predictions, we decided to take more risks having more 2006 predictions, and making them more specific. The results, as we[base ']ll see, were [sigma] predictable.

Here now, our 2006 predictions, in italics, with hindsight in ordinary type.


(1) DRM technology will still fail to prevent widespread infringement. In a related development, pigs will still fail to fly.

We predict this every year, and it[base ']Äôs always right. This prediction is so obvious that it[base ']Äôs almost unfair to count it.

Verdict: Right.


(2) The RIAA will quietly reduce the number of lawsuits it files against end users.

Verdict: Right.


(3) Copyright owners, realizing that their legal victory over Grokster didn[base ']Äôt solve the P2P problem, will switch back to technical attacks on P2P systems.

They did realize the Grokster case didn[base ']t solve their problem; but they didn[base ']t really emphasize technical countermeasures. They didn[base ']t seem to have a coherent anti-P2P strategy.

Verdict: mostly wrong.


(4) Watermarking-based DRM will make an abortive comeback, but will still be fundamentally infeasible.

The comeback was limited to the now-dead analog hole bill, which backed the dead-on-arrival CGMS-A + VEIL technology. Watermarking still looks infeasible for copy protection.

Verdict: mostly wrong.


(5) Frustrated with Apple[base ']Äôs market power, the music industry will try to cozy up to Microsoft. Afraid of Microsoft[base ']Äôs market power, the movie industry will try to cozy up to Washington.

The music industry was indeed frustrated by Apple[base ']s market power. But they drove a hard bargain with Microsoft, shackling Zune[base ']s most interesting features. The movie industry did cozy up to Washington, but no more than usual, and probably not due to Microsoft-fear.

Verdict: mostly wrong.


(6) The Google Book Search case will settle. Months later, everybody will wonder what all the fuss was about.

No settlement, but excitement about the Book Search case has definitely waned.

Verdict: mostly wrong.


(7) A major security and/or privacy vulnerability will be found in at least one more major DRM system.

Verdict: wrong.


(8) Copyright issues will still be stalemated in Congress.

Another easy one.

Verdict: right.


(9) Arguments based on national competitiveness in technology will have increasing power in Washington policy debates.

This didn[base ']t happen. We thought the election would make economic health more salient; but the election focus was elsewhere.

Verdict: mostly wrong.


(10) Planned incompatibility will join planned obsolescence in the lexicon of industry critics.

Verdict: mostly wrong.


(11) There will be broad consensus on the the need for patent reform, but very little consensus on what reform means.

The main policy division, predictably, was between the infotech and biotech sectors.

Verdict: right.


(12) Attention will shift back to the desktop security problem, and to the role of botnets as a tool of cybercrime.

This should have happened, but commentators mostly missed the growing importance of this issue. Botnets were implicated in the spam renaissance.

Verdict: mostly wrong.


(13) It will become trendy to say that the Internet is broken and needs to be redesigned. This meme will be especially popular with those recommending bad public policies.

This trend mostly didn[base ']t materialize, though there were wisps of this argument in the net neutrality debate.

Verdict: mostly wrong.


(14) The walls of wireless providers[base ']Äô [base ']Äúwalled gardens[base ']Äù will get increasingly leaky. Providers will eye each other, wondering who will be the first to open their network.

Verdict: mostly right.


(15) Push technology (remember PointCast and the Windows Active Desktop?) will return, this time with multimedia, and probably on portable devices. People won[base ']Äôt like it any better than they did before.

Push tried to bring the TV model to the Net, so it seemed logical that as TV moved onto the Net it would become more push-like. But this didn[base ']t happen, at least not yet.

Verdict: wrong.


(16) Broadcasters will move toward Internet simulcasting of free TV channels. Other efforts to distribute authorized video over the net will disappoint.

Verdict: mostly right.


(17) HD-DVD and Blu-ray, touted as the second coming of the DVD, will look increasingly like the second coming of the Laserdisc.

The jury is still out, but this prediction is looking good so far.

Verdict: mostly right.


(18) [base ']ÄúDigital home[base ']Äù products will founder because companies aren[base ']Äôt willing to give customers what they really want, or don[base ']Äôt know what customers really want.

Outside of promotional efforts in the trade press, we didn[base ']t hear much about the digital home.

Verdict: mostly right.


(19) A name-brand database vendor will go bust, unable to compete against open source.

Verdict: wrong.


(20) Two more significant desktop apps will move to an Ajax/server-based design (as email did in moving toward Gmail). Office will not be one of them.

There seemed to be a trend in this direction, but I can[base ']t point to two major apps that moved. But Google did introduce Office-like products in this category.

Verdict: mostly wrong.


(21) Technologies that frustrate discrimination between different types of network traffic will grow in popularity, backed partly by application service providers like Google and Yahoo.

These technologies didn[base ']t develop, perhaps because of the policy stalemate over net neutrality.

Verdict: wrong.


(22) Social networking services will morph into something actually useful.

This one is hard to categorize. The meaning of [base "]social networking[per thou] changed during 2006; it now refers to sites like MySpace and Facebook that are primarily webpage hosting services. That[base ']s a useful and popular function; but it[base ']s the term rather than the technology that morphed.

Verdict: mostly right (I guess).


(23) There will be a felony conviction in the U.S. for a crime committed entirely in a virtual world.

Commenters noted at the time that this prediction was poorly specified. Which didn[base ']t matter, because it was wrong no matter how you interpret it.

Verdict: wrong.

Overall scorecard for 2006 predictions: four right, five mostly right, nine mostly wrong, five wrong. That[base ']s more wrong than right, by a narrow margin, showing that our risk-taking strategy worked.

Stay tuned for our 2007 predictions.

[Freedom to Tinker]
11:58:10 PM  PermaLink   / trackback []  

News Item 7958 Not Your Average Phishing Scam.

Not Your Average Phishing Scam.

One of the first phishing scams to catch Security Fix's eye in the new year -- a counterfeit Amazon.com login page -- may set the tone for the sophistication of online schemes involving fake bank and e-commerce sites in 2007. The bogus site, which was active as of early Tuesday morning, makes use of the real Amazon.com site in an effort to fool visitors into entering their real usernames and passwords.

This type of trick, known as a type of "man-in-the-middle" attack, logs the user into his or her account at Amazon.com, then it displays the data that Amazon serves up once the user is logged in. Visitors who supply bogus or otherwise incorrect usernames and passwords are shown a copy of the page Amazon users normally see if they mistype either of their credentials.

Click this image to see a screen shot of the phishing site.

The lure in this phishing attack is an e-mail that warns the recipient about supposed unauthorized activity on his or her Amazon account and directs the user to reset the account's credentials. Anyone who enters a real Amazon username and password is asked to provide their date of birth, address and Social Security number.

Security Fix first learned of this scam site from Paul Laudanski of Castlecops.com, a group of volunteers who work with Internet service providers, Web hosting companies and law enforcement to help find and disable phishing sites and other online scams.

Laundanski said the fake Amazon site appears to have been created from a phishing "kit," or a pre-packaged set of counterfeit Web pages sold on the Internet black market. Already, he said, the same Amazon phishing kit has been spotted in use on a number of separate Web servers, suggesting that the technique is indeed being shared among scammers.

For all its sophistication, though, this particular Amazon scam site has some serious weaknesses. For one, it didn't attempt to obfuscate the IP address or otherwise monkey with the appearance of the browser address bar to hide the fake server's true address. Also, the anti-phishing technology in the Netcraft Toolbar and the blacklists built into both Internet Explorer and Firefox flagged this site as malicious pretty early on.

Laudanski said that if this type of man-in-the-middle attack becomes the norm, it could prompt more online merchants implementing things like "captchas," online Turing tests that prompt the visitor to read and type in a series of jumbled letters and or numbers in an effort to separate real users from automatic logins of the sort used in this attack.

[Security Fix]
11:53:04 PM  PermaLink   / trackback []  

News Item 7957 FTC Delays End-Date of Temporary "Safe Harbor" for Prerecorded Telemarketing.

FTC Delays End-Date of Temporary "Safe Harbor" for Prerecorded Telemarketing.

Move May Signify Little, But May Be Ray of Hope for Marketers

The Federal Trade Commission issued a pre-holiday announcement that it would extend its forbearance from enforcing provisions of its Telemarketing Sales Rule ("TSR") that strictly regulate use of automated prerecorded messages to market goods and services to solicit charitable donations. As reported by the recent posting here, the FTC proposed in October to modify the TSR to make clearer that even prerecorded messages permitted under Federal Communications Commission rules that parallel the TSR, are prohibited by the FTC unless the caller has obtained the express agreement, in writing, of the call recipient for placement of the prerecorded call. This represented a 180-degree shift by the FTC, which previously had proposed to reconcile its rule with the FCC's under a multi-part "safe harbor" that would have allowed prerecorded sales and solicitations.

[Privacy and Security Law Blog]
11:48:51 PM  PermaLink   / trackback []  

News Item 7955 E-Vote Challenge Denied.

E-Vote Challenge Denied. Florida judge rejects candidate's review of ballots as infringing 'trade secrets.' [PC World: Latest Technology News]
11:41:53 PM  PermaLink   / trackback []  

News Item 7954 Acrobat Reader Plugin Vulnerable to Attacks.

Acrobat Reader Plugin Vulnerable to Attacks. Security blogger calls it 'When PDFs Attack!' [PC World: Latest Technology News]
11:40:17 PM  PermaLink   / trackback []  

News Item 7953 Reality Bites Music Industry, Expect Further Denial and Legislative Begging.

Reality Bites Music Industry, Expect Further Denial and Legislative Begging.

According to CNET, an increasing number of folks in the music biz want to give up on DRM. The music business continues to sell fewer and fewer CDs. Meanwhile, the download business has apparently plateued. If music companies do not change their business model, they will continue to see dwindling profits.

The article also observes that the music industry is, to some degree (I would say to a great degree), in a mess of its own making. The pathological insistence on maintaining seperate DRM for everything and trying to squeeze maximum revenue out of each song directly has given iTunes a lock on it huge market share (and thus the power to resist new RIAA licensing demands), because DRM gets in the way of potential competitors and limits consumer demand.

Of coruse, the music industry is merely one more example of a business built on a [base "]users are mushrooms[per thou] (i.e., [base "]they will eat whatever excrement we dump on them[per thou]) model that is collapsing in the face of users with real alternatives. The movie industry, the music industry, the radio and television conglomerates, all seemed to have suffered this delusion that you could produce a crappier and crappier product and charge more for it without losing any business. So music producers focused on mass-produced garbage while charging sky-high prices, buying out independent stores that promote independent artists and pushing mass sales of a chosen few mass market CDs through a handful of giant retail chains. Movie producers focused more and more on potential and formuliaic [base "]blockbusters[per thou] while jacking up prices and adding commercials to the beginning of movies. Radio consolidated, homogenized and reduced playlists, eliminated local bands, jacked up commercial time. Television and cable conglomerates did likewise. Similar trends afflicted the book publishing industry, where mass production eliminated the [base "]middle list[per thou] of authors in favor of the next potential Nora Roberts or Tom Clancy, following a predefined formula dictated by company research on what [base "]readers want.[per thou]

read more

[Public Knowledge - Policy Blog]
11:38:20 PM  PermaLink   / trackback []