Centennial Man: 2014-06-15

Saturday, June 21, 2014

What took ya so long?

http://www.designntrend.com/articles/15705/20140620/yo-app-everyone-talking-hacked.htm

The 'Yo' App Everyone Is Talking About Has Been Hacked

Yo has reportedly been hacked and the phone numbers of those using the app could be at risk, according to The Wall Street Journal.

"Security researchers at the Georgia Institute of Technology found a glaring hole...

...The students apparently found a way to access the cell phone numbers of every Yo user, including the founder of the app, Or Arbel. The students, still unidentified, emailed their findings to TechCrunch last night.

"The best laid schemes o' mice an' men / Gang aft agley"

http://zeenews.india.com/news/net-news/google-play-stares-at-serious-security-breach-study_940920.html

Google Play stares at serious security breach: Study

Using a new tool called PlayDrone, researchers at Columbia Engineering have discovered a crucial security problem in Google Play - the official Android app store where millions of Android users get their apps.

They found that developers often store their secret keys in their app's code, similar to usernames/passwords info.

These can be then used by anyone to maliciously steal user data or resources from service providers such as Amazon and Facebook.

These vulnerabilities can affect users even if they are not actively running the Android apps.

… PlayDrone scales by simply adding more servers and is fast enough to crawl Google Play on a daily basis, downloading more than 1.1 million Android apps and decompiling over 880,000 free applications.

… Google is now using our techniques to proactively scan apps for these problems to prevent this from happening again in the future, he added in a paper presented at the ACM SIGMETRICS conference.

Follow-up for my student Vets and something for my Computer Forensic students. Note that I have skipped a lot of this report. The important thing seems to be that the VA doesn't bother to encrypt patient data. (The “due to being attached” excuse is an outright lie since the laptops were not attached.)

Inside a VA breach investigation

A breach involving the Denver VA center was reported in the VA’s most recent monthly report to Congress. I’m including it here because it shows how thorough the VA can be in investigating breaches – and how time-consuming and labor-intensive it can be when someone neglects security measures like a cable:

Incident Summary

Two biomedical device laptops were discovered missing on 05/20/14. VA Police were notified of the event. The two missing laptops were password protected but not encrypted due to being attached to biomedical devices. The laptops were located on mobile test stations in the Pulmonary Department.

“I'm shocked, shocked I tell you!” (Full text omitted)

Court renews NSA phone program

Julian Hattem reports:

The federal court overseeing the country’s spy agencies renewed an order Friday allowing the National Security Agency to collect phone records of people in the United States.

The Foreign Intelligence Surveillance Court’s renewal of the contested program, authorized under Section 215 of the Patriot Act, comes as lawmakers continue to debate reform legislation.

“Given that legislation has not yet been enacted, and given the importance of maintaining the capabilities of the Section 215 telephony metadata program, the government has sought a 90-day reauthorization of the existing program,” the Justice Department and Office of the Director of National Intelligence (ODNI) said in a joint statement.

Friday, June 20, 2014

A global tragedy?

http://economictimes.indiatimes.com/tech/internet/facebook-website-crashes/articleshow/36815571.cms

Facebook global 30-minute outage leaves users frustrated

Facebook today experienced a global outage that left its over 1.2 billion users, including those in India, unable to access the world's largest social networking portal.

For about 30 minutes, users logging into the website saw the message: "Sorry something went wrong. We're working on getting this fixed as soon as we can."

… With Facebook down, netizens took to microblogging site Twitter to vent their frustration.

While many compared the outage to an "apocalypse", others mocked the situation saying "people may now have to talk to each other face to face".

Attention Ethical Hackers. Imagine the fun you could have if your favorite law professor was on sabbatical in (for example) New Zealand. By the time he returned, you could have emptied his office, his house, and his garage! What (hypothetical) fun!

http://www.makeuseof.com/tag/ebay-launches-ios-app-called-ebay-valet-will-sell-stuff/

eBay Launches iOS App Called “eBay Valet” Which Will Sell Your Stuff For You

Have you ever wanted to sell stuff on eBay but found you were too lazy to actually do it? Well eBay has filled that niche by introducing an app for iPhone which will do the actual selling for you, in exchange for a 30% cut. It’s called eBay Valet, and seems to be confined to eBay USA for now.

Think of Valet as one of those consignment stores which were really popular some years back. But being eBay, the scale is obviously much bigger, and the organization is much more efficient. The mobile app is an expansion on the web-based version of the service called Sell For Me, and it seems to be designed to make everything as simple as possible.

Don't think of it as a phone, think of it as a sales tool.

http://venturebeat.com/2014/06/19/amazon-fire-phone-might-be-the-biggest-privacy-invasion-ever-and-no-ones-noticed/

Amazon’s Fire Phone might be the biggest privacy invasion ever (and no one’s noticed)

… There’s a lot of gee-whiz gadgetry in the new Fire Phone: a 3-D screen, head sensors, dynamic perspective shifts as you move, and real-time identification of over 100 million objects. That last part, the real-time identification, is the new Firefly function.

Firefly is a seriously impressive combination of hardware, software, and massive cloud chops that delivers an Apple-like simplicity to identify objects like books, movies, games, and more, just by pointing your Fire Phone’s camera at them and tapping the Firefly button.

Lest you noticed a common denominator to those items and get the crazy idea that Firefly is only for stuff you can buy at Amazon, it also recognizes songs (oh, you can buy those on Amazon too) and TV shows (ditto) as well as phone numbers, printed information, and QR codes.

Wait.

How do you think it recognizes those things, including text on images, for which Amazon says it will offer language translation features later this year?

Well, the Firefly button and the camera button are one and the same. Meaning that whenever you’re using Firefly, you’re using the camera. Plus, of course, you’re turning on audio sensors that capture ambient sound.

… By storing all the photos you’ll ever take with Firefly, along with GPS location data, ambient audio, and more metadata than you can shake a stick at in Amazon Web Services, Amazon will get unprecedented insight into who you are, what you own, where you go, what you do, who’s important in your life, what you like, and, probably, what you might be most likely to buy.

Babies in your pictures? Sell that dame diapers. Lots of old-school hot rods? See if you can sell Billy Bob some NASCAR shwag, or maybe beef jerky. Outdoorsy, are you, with your pictures of remote mountaintops and idyllic forest meadows? Clearly you need hiking boots and granola. Looking at a business card? Perhaps things she likes will be things you’ll like, too.

There are “information systems” and there are “collections of data” – this sounds like the latter. If you can't access your own data what are you paying IT for?

$10,000 Price Tag Put on Nevada Parent’s Data Request

I meant to post this last week, but hey, I’m old, I forget.

Benjamin Herold reports:

Nevada state education officials recently told a parent it would cost him more than $10,000 to access the data the department has collected on his four children, raising a tangled web of questions about everything from the structure of state educational databases to the interpretation of federal student-privacy laws to the implementation of new Common Core State Standards.

Parents have a right to inspect their children’s educational records at no cost to them under FERPA. But those requests are typically made to the Local Educational Agency (LEA), i.e., the child’s school district. In this case, the parent was querying information the state educational agency held in their databases.

The $10k tag would be for the state to develop a system to produce records responsive to his request as they currently have no means to do so. But should they have the means? What if data in a state database became corrupted after it was correctly transmitted by the LEA? Could that eventually cause difficulty for the student? And even if there was no potential for harm to the student, shouldn’t parents have the right to see what information the state has compiled about their children, which often includes parental and family information?

Read more on Education Week.

This is a settlement, but it looks like the bank was not adequately secured.

http://krebsonsecurity.com/2014/06/oil-co-wins-350000-cyberheist-settlement/

Oil Co. Wins $350,000 Cyberheist Settlement

A California oil company that sued its bank after being robbed of $350,000 in a 2011 cyberheist has won a settlement that effectively reimbursed the firm for the stolen funds.

TRC Operating Co. Inc., an oil production firm based in Taft, Calif., had its online accounts hijacked after an account takeover that started late in the day on Friday, November 10, 2011. In the ensuing five days, the thieves would send a dozen fraudulent wires out of the company’s operating accounts, siphoning nearly $3.5 million to accounts in Ukraine.

The oil firm’s financial institution, Fresno-based United Security Bank, successfully blocked or recalled all but one of the wires – for $299,000. Nevertheless, TRC later sued its bank to recover the remaining wire amount, arguing that USB failed to offer a commercially reasonable security procedure because the bank offered little more than a user name and password to help secure the account.

… As we seen time and again, a single virus infection can ruin your company. And I wouldn’t count on the lawyers to save your firm from the very real cost of a cyberheist: These court challenges can just as easily end up costing the victim business well more than their original loss (see Ruling Raises Stakes for Cyberheist Victims).

Businesses do not enjoy the same protections against cyberfraud that are afforded to consumer banking customers. If this is news to you, or if you’d just like some tips how to reduce your exposure to online banking fraud, please take a moment to read my recommendations here: Online Banking Best Practices for Businesses.

(Related) Interesting question.

http://www.securityweek.com/are-organizations-ready-pci-dss-30-0

Are Organizations Ready for PCI DSS 3.0?

Businesses that handle payment card data have to become compliant with the Payment Card Industry Data Security Standard 3.0 (PCI DSS 3.0) by December 31, 2014, yet many appear to be unprepared for the challenge.

According to a recent study conducted by NTT Com Security, only 30% of organizations have created a plan for compliance after reviewing requirements, with 70% of those surveyed being unaware of the December 31 deadline. Additionally, 41% of the respondents said they have heard of PCI DSS 3.0, but haven’t laid out a plan for compliance.

I see a market among the right wing anti-government types. No one else would put up with 65 “detection alarms” per minute.

http://www.pcmag.com/article2/0,2817,2459756,00.asp

Test a Personal Drone Detection System for $500

If they can't blame “The Internet” who will they blame?

http://www.bespacific.com/new-study-finds-internet-responsible-dying-newspapers/

New study finds Internet not responsible for dying newspapers

by Sabrina I. Pacifici on June 19, 2014

“[A] recently published study finds that we may be all wrong about the role of the Internet in the decline of newspapers. According to research by University of Chicago Booth School of Business Professor Matthew Gentzkow, assumptions about journalism are based on three false premises. In his new paper, Trading Dollars for Dollars: The Price of Attention Online and Offline, which was published in the May issue of the American Economic Review, Gentzkow notes that the

first fallacy is that online advertising revenues are naturally lower than print revenues, so traditional media must adopt a less profitable business model that cannot support paying real reporters.

The second is that the web has made the advertising market more competitive, which has driven down rates and, in turn, revenues.

The third misconception is that the Internet is responsible for the demise of the newspaper industry…

Several different studies already have shown that people spend an order of magnitude more time reading than the average monthly visitor online, which makes looking at these rates as analogous incorrect… By comparing the amount of time people actually see an ad, Gentzkow finds that the price of attention for similar consumers is actually higher online. In 2008, he calculates, newspapers earned $2.78 per hour of attention in print, and $3.79 per hour of attention online. By 2012, the price of attention in print had fallen to $1.57, while the price for attention online had increased to $4.24. Gentzkow also points out that the popularity of newspapers had already significantly diminished between 1980 and 1995, well before the Internet age, and has dropped at roughly the same rate ever since. “People have not stopped reading newspapers because of the Internet,” Gentzkow notes.”

Perspective If they wanted to look better they should have included more family and friends than a mere 7%.

http://onpolitics.usatoday.com/2014/06/19/congress-confidence-gallup-poll/

Congress hits new low: Only 7% have confidence in the institution

Perspective. Not what I expected. (mostly graphics, I'd like to see the raw data)

http://www.theatlantic.com/technology/archive/2014/06/facebook-texting-teens-instagram-snapchat-most-popular-social-network/373043/

The Most Popular Social Network for Young People? Texting

Apparently, I've been going about this all wrong! I need to dumb down my Apps!

http://www.forbes.com/sites/jaymcgregor/2014/06/19/app-raises-1m-in-funding-for-simply-sending-the-message-yo-back-and-forth/

App Raises $1M In Funding For Simply Sending The Message 'Yo' Back And Forth

… Allow me to introduce you to new chat app, Yo.

You may have heard of it recently, it has been dominating headlines over the last 24 hours for two reasons. Firstly, its simplicity. The app allows you to message friends with the word “Yo” and that’s it. Nothing else can be said other than sending this innocuous greeting.

Secondly, it has just raised $1m in seed funding from CEO of Mobli, Moshe Hogeg’s angel fund.

… The founder Or Abel told the Financial Times that he coded the app in eight hours, after being asked by his then boss Moshe Hogeg, to make a notification app that could summon his secretary.

For my students. Think outside the box.

http://www.makeuseof.com/tag/distracted-google-search-4-search-engines-ignore/

Distracted By Google Search? 4 “Search Engines” You Should Not Ignore

… Alternative search engines look at search in different ways. Some tout privacy… while some go for specialization.

The four below have a common factor – they are all user-curated platforms. They may not be search engines by the strictest definition, but they are huge reserves of data.

YouTube

Slideshare

Amazon

For my students. Start telling your elected officials what you want/need/demand/wish for... And most importantly, where they screwed up!

http://www.bespacific.com/sunlight-foundation-announcement-finally-gave-congress-email-addresses/

Sunlight Foundation Announcement – We finally gave Congress email addresses

by Sabrina I. Pacifici on June 19, 2014

Via Tom Lee: “On OpenCongress, you can now email your representatives and senators just as easily as you would a friend or colleague. We’ve added a new feature to OpenCongress. It’s not flashy. It doesn’t use D3 or integrate with social media. But we still think it’s pretty cool. You might’ve already heard of it. Email. This may not sound like a big deal, but it’s been a long time coming. A lot of people are surprised to learn that Congress doesn’t have publicly available email addresses. It’s the number one feature request that we hear from users of our APIs. Until recently, we didn’t have a good response. That’s because members of Congress typically put their feedback mechanisms behind captchas and zip code requirements. Sometimes these forms break; sometimes their requirements improperly lock out actual constituents. And they always make it harder to email your congressional delegation than it should be. This is a real problem. According to the Congressional Management Foundation, 88% of Capitol Hill staffers agree that electronic messages from constituents influence their bosses’ decisions. We think that it’s inappropriate to erect technical barriers around such an essential democratic mechanism. Congress itself is addressing the problem. That effort has just entered its second decade, and people are feeling optimistic that a launch to a closed set of partners might be coming soon. But we weren’t content to wait. So when the Electronic Frontier Foundation (EFF) approached us about this problem, we were excited to really make some progress. Building on groundwork first done by the Participatory Politics Foundation and more recent work within Sunlight, a network of 150 volunteers collected the data we needed from congressional websites in just two days. That information is now on Github, available to all who want to build the next generation of constituent communication tools. The EFF is already working on some exciting things to that end. But we just wanted to be able to email our representatives like normal people. So now, if you visit a legislator’s page on OpenCongress, you’ll see an email address in the right-hand sidebar that looks like Sen.Reid@opencongress.org or Rep.Boehner@opencongress.org.

You can also email myreps@opencongress.org to email both of your senators and your House representatives at once. The first time we get an email from you, we’ll send one back asking for some additional details. This is necessary because our code submits your message by navigating those aforementioned congressional webforms, and we don’t want to enter incorrect information. But for emails after the first one, all you’ll have to do is click a link that says, “Yes, I meant to send that email.” One more thing: For now, our system will only let you email your own representatives. A lot of people dislike this. We do, too. In an age of increasing polarization, party discipline means that congressional leaders must be accountable to citizens outside their districts. But the unfortunate truth is that Congress typically won’t bother reading messages from non-constituents — that’s why those zip code requirements exist in the first place. Until that changes, we don’t want our users to waste their time. So that’s it. If it seems simple, it’s because it is. But we think that unbreaking how Congress connects to the Internet is important. You should be able to send a call to action in a tweet, easily forward a listserv message to your representative and interact with your government using the tools you use to interact with everyone else.”

(Related) Here's something Congress could address.

http://www.theatlantic.com/technology/archive/2014/06/study-there-are-few-legal-protections-for-people-harassed-online/372995/

Study: People Harassed Online Have Few Legal Protections

… No doubt there are police out there who have used social media. Still, according to a recent paper from the Center on Law and Information Policy at Fordham Law School, Hess’s experience is not unusual. "Although online harassment and hateful speech is a significant problem, there are few legal remedies for victims," authors Alice Marwick and Ross Miller wrote. Victims who go to the police often find what Hess found; most law enforcement agencies have neither the resources nor the expertise to deal with harassment, and are ill-equipped to even understand the problem, much less take it seriously.

Thursday, June 19, 2014

Perhaps there's an App for that, and I could get in on the fun? Perhaps a bounty for finding cars on the “Repo” list? Or for finding stolen cars?

License Plate Reader Company Sues Another State For ‘Violating’ Its First Amendment Right To Build A 1.8-Billion-Image Database

Tim Cushing writes:

Private companies engaging in large-scale surveillance are pushing back against the push back against large-scale surveillance… by filing lawsuits alleging their First Amendment right to photograph license plates is being infringed on by state laws forbidding the use of automatic license plate readers by private companies.

Now, these laws aren’t saying law enforcement agencies can’t use these readers. They can. What they do say (or did… Utah’s law was amended after a lawsuit by license plate reader company Vigilant) is that private companies, like repossession firms and tow truck services, can’t use these readers. But apparently they do, and those who manufacture and support the equipment would like to continue capturing this market.

Cyrus Farivar at Ars Technica reports that Vigilant has filed another lawsuit, this time against the state of Arkansas, arguing that a state law curbing the use of LPRs by private companies tampers with its free speech rights.

Wednesday, June 18, 2014

All kinds of questions here. Did Nokia tell the other phone manufacturers who were leasing their software? Did the bad guys ever modify the code? Should they have told their customers? Interesting that in the “Age of Surveillance” the cops can't track whoever picked up the cash. (Perhaps they should have put a phone in the bag?)

http://uk.reuters.com/article/2014/06/17/us-nokia-idUKKBN0ES1UC20140617

Nokia 'paid millions to software blackmailers six years ago'

Finnish telecoms equipment company Nokia paid several million euros to criminals who threatened to reveal the source code for part of an operating system used in its smartphones some six years ago, Finnish TV station MTV said on Tuesday.

The police confirmed to Reuters that they were investigating a case of alleged blackmail and that the case was still open. Nokia was not immediately available for comment.

… MTV said that the blackmailers had acquired [Interesting choice of words... Bob] the encryption key for a core part of Nokia's Symbian software and threatened to make it public.

Had it done so anyone could then have written additional code for Symbian including possible malware which would have been indistinguishable from the legitimate part of the software, MTV said.

After the blackmail attempt Nokia contacted the police and agreed to deliver the cash to a parking lot in Tampere, central Finland. The money was picked up but the police lost track of the culprits, MTV said.

For my Computer Security students. It's far cheaper to put up a “This site is secure” logo than to actually make the site secure. However this only fools users, since hackers would never read it – we find unsecured sites by running programs (called spiders) that automate the search.

http://www.troyhunt.com/2014/06/lessons-in-insecure-ssl-courtesy-of.html

Lessons in insecure SSL courtesy of Hoyts cinemas

The law is clear and has been available for years. Funny how no one cares until it hits the news.

http://www.bbc.com/news/technology-27887639

Google and Facebook can be legally intercepted, says UK spy boss

UK intelligence service GCHQ can legally snoop on British use of Google, Facebook and web-based email without specific warrants because the firms are based abroad, the government has said.

Classed as "external communications", such activity can be covered by a broad warrant and intercepted without extra clearance, spy boss Charles Farr said.

The policy was revealed as part of a legal battle with campaign group Privacy International (PI).

… However, he said data collected in this way "cannot be read, looked at or listened to" except in strictly limited circumstances.

… Mr Farr says that actually reading or examining a Briton's communications swept up in this way would still require a domestic, more targeted warrant.

(Related) Or until it's an election year.

Op-Ed Ron Wyden, Mark Udall and Rand Paul: How to end the NSA dragnet

Senators Ron Wyden, Mark Udall, and Rand Paul have jointly authored an op-ed in the Los Angeles Times. They write, in part:

Although the bill approved by the House is intended to end bulk collection, we are not at all confident that it would actually do so. The bill would require the government to use a “selection term” to secretly collect records, but the definition of “selection term” is left vague enough that it could be used to collect all of the phone records in a particular area code or all of the credit card records from a particular state. Meanwhile, the bill abandons nearly all of the other reforms contained in the Senate version of the USA Freedom Act, while renewing controversial provisions of the Patriot Act for nearly three more years.

This is clearly not the meaningful reform that Americans have demanded, so we will vigorously oppose this bill in its current form and continue to push for real changes to the law. This firm commitment to both liberty and security is what Americans — including the dedicated men and women who work at our nation’s intelligence agencies — deserve. We will not settle for less.

Read the op-ed on the L.A. Times.

Tools & Techniques. Remember the old (in Internet years) saying: practice “Safe Hex!” Perhaps you should buy one for your CEO and other travelers?

http://krebsonsecurity.com/2014/06/gear-to-block-juice-jacking-on-your-mobile/

Gear to Block ‘Juice Jacking’ on Your Mobile

… Juice-jacking as a threat probably first crept into the collective paranoia of gadget geeks in the summer of 2011, after I wrote a story about two researchers at the DefCon hacker convention in Vegas who’d set up a mobile charging station designed to educate the unwary to the fact that many mobile devices (particularly Apple devices) are set up to connect to a computer and immediately sync data.

Their proof-of-concept was a reminder that in the (admittedly unlikely) event that a clever attacker managed to hide a small computer inside of a USB charging kiosk, he might be able to slurp up your device’s data.

Since that story, several products have sprung up to help minimize such threats. These small USB pass-through devices are designed to allow charging yet block any data transfer capability. The two products I’ve been using over the past few months include the “USB Condom” and a device called the “Juice-Jack Defender.”

USB Condom http://www.usbcondoms.com/

Juice-Jack Defender http://www.chargedefense.com/

...and our government is making it mandatory! How wonderful.

http://www.bespacific.com/u-s-health-care-system-compares-internationally/

How the U.S. Health Care System Compares Internationally

by Sabrina I. Pacifici on June 17, 2014

The Commonwealth Fund: “The United States health care system is the most expensive in the world, but this report and prior editions consistently show the U.S. underperforms relative to other countries on most dimensions of performance. Among the 11 nations studied in this report—Australia, Canada, France, Germany, the Netherlands, New Zealand, Norway, Sweden, Switzerland, the United Kingdom, and the United States—the U.S. ranks last, as it did in the 2010, 2007, 2006, and 2004 editions of Mirror, Mirror. Most troubling, the U.S. fails to achieve better health outcomes than the other countries, and as shown in the earlier editions, the U.S. is last or near last on dimensions of access, efficiency, and equity. In this edition of Mirror, Mirror, the United Kingdom ranks first, followed closely by Switzerland.”

“Hey, he looked suspicious!”

Meshal: The Last, Best Hope for National Security Bivens Claims?

Last Friday, Judge Sullivan (D.D.C.) dismissed Meshal v. Higgenbotham, a long-outstanding Bivens suit brought by a U.S. citizen who alleged that, while travelling in the Horn of Africa, he was detained for four months, interrogated, and tortured at the direction of–and by–U.S. government officials (tellingly, the government did not claim that the alleged conduct was constitutional). In a thoughtful 37-page opinion setting forth his reasons for dismissing the case, Judge Sullivan offered a fairly candid (and, in my view, accurate) explanation for why Meshal couldn’t recover for conduct that, if proven, would unquestionably constitute “appalling (and, candidly, embarrassing)” violations of his constitutional rights: In a nutshell, it’s the Fourth, Seventh, and D.C. Circuits’ fault.

Tools & Techniques: for lawyers and my Criminal Justice students.

http://www.bespacific.com/new-way-look-law-data-viz-machine-learning/

New Way to Look at Law, With Data Viz and Machine Learning

by Sabrina I. Pacifici on June 17, 2014

Wired – [snipped] “As its creators [Daniel Lewis and Nik Reed] see it, Ravel’s visual search offers myriad improvements over the old columns of text results. It better lets you see how cases evolved over time, and potentially lets you see outliers that could be useful in crafting an argument–cases that would languish at the bottom of a more traditional search. The visualization, Reed insists, “tells a lot more of the story of law than the rank ordered list.” (That might be true. When they first showed their visual search to a veteran judge, he looked at the complex map of circles and responded: “This is how my brain works!”).

Note – there is a free and a premium version for subscribers. See Robert Ambrogi’s profile of the company to understand more about this new generation of visualization and relational context for online legal research. Ravel’s footprint is still small in comparison to those of LexisNexis and Westlaw, but relevancy is based on deliverables. The very scope of “searching” has transcended the linear into an often overwhelming realm of big data, analysis and visualizations that provides altogether different kinds of “results” to “queries.” These are indeed interesting times, and the legal community is the beneficiary of innovative, results driven technology solutions such as this one.

Is this strategy defensible? Can the lawsuits possibly cost less that the profits? I guess they couldn't work deals with the “New Music” bloggers who have huge followings, so they must have said, “Let's see if we can replicate Apple's mistakes in selling music and Amazon's in selling books.” What they did say was, “Take it or leave it.”

http://www.ft.com/cms/s/0/ea6728e2-f568-11e3-afd3-00144feabdc0.html

YouTube to block indie labels as it launches paid music service

YouTube is about to begin a mass cull of music videos by artists including Adele and the Arctic Monkeys, after a number of independent record labels refused to sign up to the licensing terms for its new subscription service.

The Google-owned company will start blocking videos “in a matter of days” to ensure that all content on the new platform is governed by its new contractual terms, said Robert Kyncl, YouTube’s head of content and business operations.

Google’s decision to press ahead without some of the best-known artists shows its determination to enter the fast-growing market for music subscription services. Amazon last week launched its own service as part of its Prime subscription bundle, while Apple last month acquired Beats Music through its $3bn purchase of headphone maker Beats Electronics.

Perspective.

http://www.theatlantic.com/technology/archive/2014/06/chilis-is-installing-tablet-ordering-at-all-its-restaurants/372836/

Chili's Has Installed More Than 45,000 Tablets in Its Restaurants

A suggestion for my students. It might be amusing to write an App to pull all of this data into one file. Be sure to keep a defibrillator handy if you show the results to your CEO.

http://www.makeuseof.com/tag/how-much-google-know-about-you/

How Much Does Google Really Know About You?

For my students who research. Kinda-sorta like electronic Xeroxing.

http://www.makeuseof.com/tag/never-lose-webpage-6-ways-read-later-platform/

Never Lose That Webpage Again: 6 Ways To Read It Later On Any Platform

There’s one HUGE problem with Internet bookmarks: if the website goes down or you have no web access, you’re out of luck. Few things are more frustrating than needing a bookmark only to find there’s nothing you can do to visit it. Rest assured, however, because there’s a handy solution.

Instead of bookmarking a web page, consider archiving it. If you download and store a local copy of the web page, you can access it whenever you want – even if the site itself goes down. The downside is that archives use more hard drive space than bookmarks do, but the trade-off is well worth it.

Something to tease my Math students with...

http://news.sciencemag.org/brain-behavior/2014/04/monkeys-can-do-math

Monkeys Can Do Math

… Rhesus macaques that have been trained to associate numerical values with symbols can get the answer right, even if they haven’t passed a math class. The finding doesn’t just reveal a hidden talent of the animals—it also helps show how the mammalian brain encodes the values of numbers.

Previous research has shown that chimpanzees can add single-digit numbers. But scientists haven’t explained exactly how, in the human or the monkey brain, numbers are being represented or this addition is being carried out. Now, a new study helps begin to answer those questions.

Food for thought. This is what makes changing the “Culture” of an organization so difficult.

http://blogs.hbr.org/2014/06/strategy-isnt-what-you-say-its-what-you-do/

Strategy Isn’t What You Say, It’s What You Do

You sometimes hear managers complain that their organization has no strategy. This isn’t true. Every organization has a strategy: its strategy is what it does. Think about it. Every organization competes in a particular place, in a particular way, and with a set of capabilities and management systems — all of which are the result of choices that people in the organization have made and are making every day.

When managers complain that their company’s strategy is ineffectual or non-existent, it’s often because they haven’t quite realized that their strategy is what they’re doing rather than what their bosses are saying.

Tuesday, June 17, 2014

For my Computer Security students. Look at the tools and practices that were ignored or improperly implemented!

Stratfor hack: what the forensics showed

Cryptome has uploaded Verizon’s forensic investigation of the Stratfor hack in 2011. Their investigation began in December 2011 and was concluded in February 2012.

You can read the report here (66 pp., pdf).

Over the past few years, I’ve seen more and more references to the idea that if breached entities have their legal counsel arrange for a forensics or breach investigation, the breach investigation would be considered privileged communications or attorney-client work. Needless to say, I am not happy at any end-run around transparency involving breach investigations. While there may well be information in those reports that should be protected lest attackers learn of significant security features or vulnerabilities that could put the entity at future risk, in many cases, companies just want to shield these reports for fear that customers or the public will be appalled at any security lapses or poor practices – or that they will use these reports in litigation against the entity.

Scott Koller of InformationLawGroup addresses the privilege issue and a ruling in U.S. ex rel Barko v Halliburton Co., and then offers some advice for counsel as to how to increase their chances of being able to claim privilege. Read his comments and suggestions on InfoLawGroup.

(Related) What is your data worth? (What if their conclusion is $0.25 per occurance?)

UK: Payouts suggested for “irresponsibly used” patient data in care.data scheme – report

Press Association reports:

Patients whose personal information is misused in the new medical records data-sharing scheme should be able to sue the NHS, a new report suggests.

People whose data is lost or “irresponsibly used” under the care.data initiative should be able to claim compensation through the NHS Litigation Authority, the authors said.

The group of experts established by the Institute of Global Health Innovation at Imperial College London, with a grant from the Peter Sowerby Foundation, said the programme is “essential to improve care”.

Centennial Man

Saturday, June 21, 2014

Friday, June 20, 2014

Thursday, June 19, 2014

Wednesday, June 18, 2014

Tuesday, June 17, 2014

Search This Blog

Followers

Blog Archive

Links

About Me