| Main |

December 28, 2007

Corporate conspiracies… not

UNEASYsilence published a story two days ago about connections to 2O7.net from Adobe CS3 applications.

It’s scaremongering of the worst sort. The connections to 2O7.net are happening because the splash panel fetches a Flash graphic from Adobe’s website when you start the app. It is used to fill the bottom right corner, like this:

Picture 1.png

Anyway, when you load that graphic, it connects to Omniture (who own the 2O7.net domain) who provide site access statistics and the like. Big hairy deal.

It simply isn’t, as UNEASYsilence were all too keen to suggest, some sort of devious invasion of privacy on Adobe’s part.

There should be a variant of Hanlon’s Razor to cover this kind of thing. Perhaps something like

Never attribute to privacy infringement that which can be adequately explained by on-line content delivery, statistics gathering or software update.

It’s not quite as succinct now though. We need something snappier (suggestions, anyone?)

Or maybe people should just stop crying wolf every time Little Snitch tells them that an application is accessing the network.

December 19, 2007

Why is this news?

The BBC thinks that it’s newsworthy that Liberal Democrat leader Nick Clegg does not believe in God.

I think it’s much more interesting that the BBC decided to write an article about it. Most of the British population doesn’t believe in God these days, so it’s hardly worthy of a headline on the BBC News website when we find that one of our politicians doesn’t either. That just makes Mr. Clegg representative of the people, unlike Tony Blair and Gordon Brown who both hold religious beliefs.

As a result, while this kind of thing might be big news in the United States, it’s really the fact that Blair and Brown are religious that should have made headlines over here.

December 18, 2007

More U.K. government data loss.

After a couple of previous stories about data loss, you’d have thought it would be the end of it, but sadly, it isn’t. This time it’s three million driving test candidates’ data, and while it c|net’s article says that the lost disk was “formatted specifically for Pearson systems”, the fact is that that is no protection whatsoever.

OK, so in this particular instance it wasn’t the Government that lost the data. But they did give it to someone who then didn’t take enough care with it, and after introducing legislation designed to protect the public from companies doing that exact same thing.

I’ve said it before and I’ll say it again. The fault here is that financial institutions and the Government are prepared to use facts about you as your canonical identity. This is wholly the wrong approach, because there is no authentication involved.

It should be possible for me to write all my personal details on a billboard sign in the middle of London and have no fear that someone will take credit in my name. And that means that we need a different means of establishing a canonical identity, one that includes authentication.

Mike Gibson, you should be ashamed!

OK, so I found this little gem:

MikeGibson.jpg

Yes, that’s right, someone is looking for a pirated copy of one of our products, in this case iPartition 3.

Only in this case, this someone is Mike Gibson. How do I know? Well, easy really; look at this Dave Matthews Band “fansite”, or on the gibsonweb.net wiki where it helpfully links to Mike’s blog. Yes, Mike is EmptyG and EmptyG is Mike; check out the ICQ and AIM addresses if you don’t believe me.1

Software isn't the only thing Mike is happy to pirate, either; there’s a copy of David Pogue’s book iPhone: The Missing Manual on Gibson’s iPhone page (there’s no link to it because you should buy it if you want a copy; what you shouldn’t do is download it from Mike Gibson’s website).

And just in case anyone doubts Mike Gibson’s pirate credentials, he’s probably also got himself an illegal copy of VMWare Fusion2 (if the site I found the original post on is to be believed, where he was thanking someone for posting a link to a copy on a file-sharing site). And he recommends two other Mac-specific piracy forums, again on the same site. I’m not going to be specific about those because I don’t care to advertise them. Finally, you’ll note from the above that Mike has made 3,608 posts on the piracy board I took that screenshot from.

So if you’re wondering what a software pirate looks like, here he is, with girlfriend Dana (who I’m sure had nothing to do with any of this). If you live near Encinitas, CA, near San Diego, you might even see Mike on the street.

And Mike, if you’re reading this and wishing you had been more discreet3, you’ve missed the point entirely. You shouldn’t be trying to get hold of illegal copies of other peoples’ hard work in the first place. If you want a copy of iPartition 3, you can buy one like everyone else.

As it is, I’d say you’re hoist by your own petard. You should be ashamed.

1 You may feel I’m being a little unfair singling out one individual here. Perhaps that’s true, but my purpose here is really to make software pirates realise that they don’t have total anonymity on the Internet. Nor do I think that this in any way violates anyone’s privacy. All of the information here is publicly available, and it’s that way because Mike Gibson made it that way.

2 It’s impossible to be certain, without access to his machine, or to the logs of the file-hosting site’s servers. And he’ll probably delete it when he sees this. I have copies of all of the pages from the piracy sites, of course, so modifying those pages would be rather pointless.

3 The fact that Mike wasn’t more discreet is a simple reflection of the fact that people feel untouchable on the Internet. They know that there is no effective copyright enforcement, for the simple reason that there is no practical legal method by which it could be achieved.

Told you so

Well it looks like I was right about the whole MacHeist/MacZot thing, according to a post from Steve Harris of Reinvented Software (via Daring Fireball).

Yes, Steve made a bit of money by selling through MacZot. Not much though, and his figures pretty much blow the you’ll-make-money-from-upgrades argument out of the water.

And following on from John Gruber’s original guesses as to the amount of money made by the organisers of MacHeist, Wikipedia notes that MacHeist I raised $200,000 for charities and took $800,000 in total. Using similar working to Gruber’s original calculations, we find that1:

12 Dec 2006NewsfireTextMateFinal
Total Revenue $132,000$200,000$400,000$800,000
Total Raised for Charity $33,000$50,000$100,000$200,000
Post-Charity Revenue $99,000$150,000$300,000$600,000
Est. Other Expenses $30,000$30,000$30,000$30,000
Total Profit $69,000$120,000$270,000$570,000
 
Est. Total Payments to Dev's $54,500$67,000$79,500$79,500
Est. MacHeist Profit $14,500$53,000$190,500$490,500
 
MacHeist Profit Share 21%44%71%86%
Developers' Combined Profit Share 79%56%29%14%
Developers' Ind. Average Share 10%6%3%1%

So MacHeist’s organisers could have pocketed as much as half a million U.S. dollars, some 86% of the profit after the charitable donation and expenses, as compared with a total of 14% for the developers, or an average of just 1% per developer, and more than twice as much as was paid to charity. That, frankly, is nothing short of scandalous, and I’m sure that the people who bought from MacHeist would expect most of their money either to go to the developers or to charity, whereas in fact the overwhelming majority has presumably ended up lining the pockets of MacHeist’s organisers.

So while I feel somewhat smug to learn that I was right about MacHeist and MacZot all along (as, I'm sure do John Gruber [and again], Paul Kafasis, and Gus Mueller to name but a few), I feel sorry for the developers, charities, and customers who I think were ripped off.

1 Just to make clear:- the numbers in this table are based on educated guesses and what little information has been made public. See the original Daring Fireball post for specific details.

December 17, 2007

Illegal activation attempts

On occasion, when people illegally distribute our software, we end up having to revoke their licenses. I’m sure they feel that this is some sort of “revenge” measure, but it really isn’t about that; we do it for two main reasons:

  • To stop others from activating copies of the files they distributed.
  • To stop them from distributing future versions and updates.

As a result of one recent incident, we’ve been seeing a lot of attempts to activate illegal copies of iPartition 3. So many, in fact, that I’m quite tempted to publish the IP addresses of the people involved. Doubtless if we do that, people will whine about infringement of their privacy, but I’m not suggesting publishing their names, just their IP addresses and maybe their machine serial numbers.

I’d be interested to hear others’ thoughts on this idea.

December 11, 2007

Poppycock from the FSF

Peter Brown of the Free Software Foundation (from BBC News):

“Media companies are trying to force people to think about copyright infringement almost in line with murder on the high seas.”

That’s complete poppycock, and the FSF should know better; they’ve been around more than long enough to have seen the software and music piracy phenomenon arise, and that being the case, I can’t believe they don’t know that “pirates” play up to the skull-and-crossbones image.

It’s only recently, when massive copyright infringement has become mainstream (and yes, sadly, it is mainstream), that people have started to object to the use of the word “piracy” in this context, and only then because they want to think they’re doing nothing wrong.

He goes on to say

“Copyright law is about copying and reproduction of work; that is on the statue books for everyone and is sufficient to tackle the problem.”

which, again, is complete arse-gravy (to quote Stephen Fry). We can tell that it isn’t sufficient to tackle the problem because there are many thousands of copyrighted files being shared every day on peer-to-peer networks, and the few prosecutions to date have done little to discourage that.1

Also, anyone involved with copyright will tell you that it’s presently impossible to enforce to any reasonable extent because of jurisdictional issues. For instance, the infringer may be in (say) Italy, and may be using a service run by a German company but hosted on servers in London and whose details are being obscured by a “privacy” service run by an American company.

So, you want to start a lawsuit? You’ll first have to obtain a subpoena from a U.S. court, which requires that you file a suit in the United States. But the U.S. court doesn’t have any jurisdiction in London, so in order to get the name of the German company you’ll need to sue the U.K.-based hosting company in a U.K. court. You still haven’t got the name of the infringer yet, and you still don’t even know which country they’re in. So now you sue the German company in a German court to get them to give up the name of the infringer. If you’re lucky, you have name and address and you know the infringer is Italian. So you start another lawsuit in an Italian court.

The tally so far? Lawsuits in four different countries, which means at least four sets of lawyers; you can’t get anyone to pay for those because the people you were suing weren’t individually doing anything wrong… you just needed them to give up the name of their customers. You probably could recover the costs—which, by now are astronomical—from the copyright infringer, however that assumes that they actually have enough money to pay for all those lawsuits and lawyers, which is unlikely. And how long has all of this taken? Years, probably. Some court systems are fast; others simply are not.

This is uneconomic and impractical even for huge corporations, and Peter Brown would have us believe that it’s a viable solution for e.g. solo software developers?! I’m beginning to see why Fake Steve Jobs calls them “freetards”.

Personally, I think that the fact that the problem here is widespread misbehaviour on the part of the general public means that the only option is for copyright infringement to become a petty crime, like shoplifting. Of course, the civil rights movement will probably fight such a move, but at the end of the day we either have to accept that copyright isn’t working (in which case the only option will be strong DRM, which nobody really likes), or do something about it.

1 Of course, the problem has changed from one where the only infringers who really made a dent in copyright holders’ bottom line where organised criminals to a situation where large numbers of consumers in the market are now able to cause mass-scale infringement.

That’s why copyright law doesn’t work any more… it was only ever intended to deal with the organised criminals churning out counterfeit goods to make a profit, not with mass infringement from an uncaring public that just wants things for free.

December 7, 2007

The man who sued God, but this time for real

An Indian judge has issued a court summons for two gods.

I’d laugh my head off if they actually turned up, but given my scepticism about the existence of deities generally (gods, as far as I’m concerned, are a lot of superstitious nonsense that we could usefully do without1), I find the prospect disappointingly unlikely.

It does put the priest in a quandary though. If they don’t turn up, who is the court going to hold in contempt? Surely the priest, as the representative of those gods, is the only option, which means he might very well win his case and go to jail :-)

1 If you’re going to claim that I can’t know that they don’t exist, you’re right, it is impossible to know that for certain. However, in the absence of evidence that there is a huge invisible elephant sat behind me, I choose not to believe in such a beast. Believing in deities is no more or less ridiculous.

(No, this is not politically correct. Too bad. I don’t subscribe to the view that we should all tiptoe about for fear of offending over-sensitive religious types. If you’re offended, go out and buy yourself a copy of The God Delusion and read it properly. I dare you.)

“Privacy”, again

Somewhat predictably, the “privacy” lobby1 has been taking advantage of the increased publicity after the recent H.M. Revenue & Customs debacle.

However, the entire debate is marred by the fact that all of the people shouting the loudest are completely missing the point.

The problem is not really that HMRC has just lost 25 million sets of personal details. That’s very careless of them, of course, and it’s quite right that they should be chastised for it. But that isn’t really the problem.

The problem is that the Government, the banks, building societies, lenders and credit reference agencies use your personal details as an identifier for you, without authentication of any sort. If it weren’t possible to take out a loan in someone else’s name just by knowing a few personal details, the loss of data from HMRC would be incompetent, but largely inconsequential.

The right fix is not to enact new and even sillier laws to “protect” our personal data—to do that would be to treat the symptom, not the cause. The right fix is to close the loophole that is being exploited by so-called identity thieves2. And the loophole is the fact that the Government doesn’t issue us with a decent identity mechanism that can be positively authenticated3.

The sad thing about this entire affair is that identity cards, done right, would solve this problem in a fairly satisfactory manner, and without posing any real risk of loss of privacy.

1 If you want to know why privacy is in quotes, see this post.

2 I think “identity theft” is something of a misnomer—the people doing the thievery are not stealing your identity… they are stealing other peoples’ money (or maybe even your money) using your identity, in exactly the same way that a thief might steal a security pass (which is someone’s identity) and then use that to steal goods or cash.

3 Interestingly, the Government does issue us with all sorts of identifying documents and numbers. Passports, driving licenses, National Insurance numbers, PAYE reference numbers. The only one I’m aware of that has any sort of authentication whatsoever is the Government Gateway identity that gets given to people who want to use the Government’s on-line services.

One in ten drivers “bump and run”

Apparently, one in ten U.K motorists has collided with a parked vehicle and driven off, according to the BBC. One in ten!!

If true, I reckon ten percent of U.K. motorists should probably have their driving licenses confiscated.

I have to say, I’ve thought for ages that the focus on technical proficiency in the driving test was misguided. It isn’t incompetence that causes the largest number of problems on the road, it’s peoples’ attitudes, so what we really need is a psychological test, rather than trying to beef-up what was already a perfectly good proficiency test.

December 6, 2007

Measuring the atmosphere of an extra-solar planet

From Universe Today:

And this was the technique that Redfield and his team used to measure the atmosphere. "Take a spectrum of the star when the planet is in front of the star," explains Redfield. "Then take a spectrum of the star when it’s not. Then you divide the two and get the planet’s atmospheric transmission spectrum. Each time the planet passes in front of the star the planet blocks some of the star’s light. If the planet has no atmosphere, it will block the same amount of light at all wavelengths. However, if the planet has an atmosphere, gasses in its atmosphere will absorb some additional light."

It occurs to me that this approach has an interesting flaw. If we were to find a planet whose body was transmissive for some reason (the example that springs to mind is a planet made entirely of glass or of some translucent or transparent mineral like quartz or diamond), the assumption that the solid body of the planet blocks light equally at all wavelengths is no longer true.

What’s the likelihood of such a body existing? Quite low, I should think; after all, many things that we think of as transparent would probably be opaque at planetary sizes. But then the universe is a big place, and there are plenty of strange and unlikely sounding objects out there already.

I suppose most such configurations are likely to show up in the line spectra, but even then my guess is that they could easily be mis-interpreted. That, of course, is one of the hazards of all of this type of research… because we can’t actually resolve the planets themselves, we don’t really know what we’re looking at. It’s all best-guess and assumptions. In a few hundred years’ time, I’m sure people will look back on the present-day planet hunters with considerable amusement, just as many of us do today at the unusual beliefs of some of our ancestors.

December 2, 2007

Why not stephen.uk?

Stephen Fry’s latest post includes the following explosion of despair:

“How come we British are just about the only nation on earth who have to make the tedious and entirely unnecessary three extra keystrokes every time we type a URL? I could be stephen.fr in France, stephen.za in South Africa, stephen.ru in Russia, stephen.nl in Holland, etc, etc, but here? Oh no, it’s stephen dot co dot bloody uk. How annoying is that?”

It should really be “stephen dot me dot bloody uk”, of course. “.co.uk” is really intended for commercial organisations, but because of its liberal registration policies, like the similar “.com” TLD it has been widely abused for other uses. As a result, the general public seems, not unsurprisingly, to be a little mystified as to what the TLDs and the U.K. SLDs actually mean.

It may still seem a little irritating having to type a few extra keystrokes, though of course you’re entirely free to register “stephen.com” instead, and having these fixed SLDs does make it a little harder for people to fraudulently set up sites that appear to belong to the British Government (for instance). Particularly now that internationalized domain names are becoming available… can you tell the difference between “.gov.uk” and “.gоv.uk”? I find it quite difficult myself, but the two are different.

Anyway, if you want the reasons for the “.co” or “.me” and a list of second-level domains, Wikipedia has one.