Making Peer-to-Peer Legal

I was just lamenting that the record labels, such as EMI and BMG, should have built online music stores long ago. As it turns out, they have done just that. Interstingly enough, they’ve built the first legal Peer-to-Peer (P2P) music store. Peer Impact uses P2P technology so that songs are downloaded from your PC, not central servers. At a million songs strong, there is plenty of music to pick from. However, this is not a P2P free-for-all, like the Gnutella network. You still need to pay for the songs and they are protected by Windows Media (WMA) format. The best part of this new network is that you can earn credits for recommending songs, video, and other content to others. When the other person downloads the music from you, Peer Impact will credit you up to 10% of the purchase price. Sweet.

Subscribe to this blog's RSS feed

That’s right. Mr. "You’re Fired!" now has his own blog. The tagline to the blog is "Ideas and Opinions from Donald Trump and His Circle of Experts." For the most part, Trump’s entries are short platitudes masquerading as advice. Other more personal posts are just kind of puzzling - I’m not sure he quite gets the concept of blogging. For example, a post on 6/8/2005 goes: "I have a real passion for learning. It grew out of my days as a student at the Wharton School and my professional experience." That’s it. That’s the entire post. Hmmm. Yeah. Good to know, Mr. Trump. I guess no one is up to the task of telling the Donald he’s doing it wrong!

The war on casual
piracy rages on! ("Casual Piracy" being the new, meaner term for what used to be know as "casual copying.") Two of the big record labels, EMI and BMG, are now
manufacturing all of their CDs with copyright protection built in. The copy
protection limits the number of copies you can make of any CD to three. Also, it
prevents you from porting the songs from these protected CDs to your iPod unless
you request a workaround from Sony. The protection itself isn’t designed to be
ironclad, there is a very easy way around it: rip the tracks to your Windows
Media Player library and burn a CD using the ripped tracks. From this CD, you
can upload the tracks back into WMP or into other media players, like iTunes.
From the media player, you can burn CDs of these tracks as often as you
like. Still, it’s a lot of work just to burn CDs…and that’s the idea. "Our
goal is to create a series of speed bumps that make it clear to users that there
are limits [to copying]," says Thomas Hesse, president of Sony BMG’s Global
Digital Business Group. "If you attempt to burn 20 copies and distribute them to
all of your friends, that’s not appropriate."

Patrick Jordan, a researcher at Sunbelt Software, discovered a major identify theft ring when testing a machine infected with the CoolWebSearch (CWS) spyware application. Jordan found that the machine he was testing had become spam zombie and he noticed a call back to a remote server. He traced back the remote server and found an incredibly sophisticated criminal identity theft ring. The remote server itself is located in the U.S., but the domain is registered overseas (in China). Sunbelt Software contacted the FBI and they are now working on the case.

There is a keylogger file involved with this exploit that grows and grows until it is sent off to the remote server and then the cycle begins again. As the company began to research other infected machines, they found that he data contained in this keylogger file was very disturbing: IM chat sessions, search terms, social security numbers, credit cards, logins and passwords, etc. It was so bad that Subelt Software contacted some people personally to warn them. In the case of one particular family where the father had just been through open heart surgery, the file contained social security numbers, their credit card, DOBs, login and password info for their bank and credit card companies, etc. The family had very little money and could have been devasted had they not been warned.

Sunbelt can not confirm that this exploit is directly related to the CWS spyware program, but I wouldn’t be surprised if it was. CWS is a notoriously difficult-to-remove software program. Sunbelt’s recommendation to anyone concerned about what to do was this: get a software firewall. NOW. I would recommend ZoneAlarm. They offer a software firewall that’s free for personal use. If you have yet to install a software firewall, there is no time like the present!

In May of this year, the Federal Trade Commission urged ISPs to "pay more attention" to what their customers were doing online. One of the important areas addressed was watching for suspicious patterns of emails that could mean that the customer’s PC was compromised by zombie code. Zombie PCs are used by spammers to do the dirty work of sending out the mass of spam emails. In fact, zombie PCs are responsible for 40 percent of the spam sent today.

Though I agree that zombie PCs are a real problem that should be addressed, what are the ISPs doing to follow this "recommendation?" Are they just reading email headers or are they parsing the content of your emails themselves? It appears to me that they are parsing the emails themselves. According to an article on ZDnet, a company called ICG has been hired by many ISPs to fight the zombie spambot problem. This list of ISPs has not yet been released. Visiting ICG’s website, I clicked on "iThreat Industry Solutions" for "Internet Service Providers." This took me to a page that details their software and what it does - "iThreat® Service Provider Solutions draw on the unique capabilities of ICG’s Mailer.base™.  Mailer.base™’s parsing engine processes the headers and bodies of millions of messages received. The parsed contents are interrelated, and linked to other intelligence sources relevant to e-mail-based threats, allowing service providers to track the nature and sources of harmful communication sent to, from, or spoofing their domains and IP address ranges."

If it was just a matter of parsing the emails, well, that’s one thing…but they are comparing them to other sources of intelligence. This to me implied the use of a database on their end. I did further investigating on the ICG website and found that the company is into all kinds of web-monitoring activity. In fact, the website states: "ICG investigators utilize our proprietary technologies as well as public and private data sources to obtain intelligence that clarifies the identity, motives, and impacts of individuals or groups responsible for the alias or site. By cross-referencing our findings against closed-source public record databases and our own intelligence, we can effectively refine and target suspects. ICG analysts are experienced in undercover correspondence, undercover purchases, and management of confidential informants."

So let me get this straight, this company has possibly been hired by my ISP to parse my emails, compare the content in them to various data sources, some of them being PRIVATE public records, and determine if I’m a threat, all based on a recommendation from the FTC? Whoa. Can we say Big Brother?

Inernet Explorer 7 (beta) was released on Thursday, and stories about it are making their way to the web. From the first real screenshots, it seems that the browser has buttons that make it look somewhat "Firefox-y." (Maybe if we make it look like Firefox…)

The most interesting story surrounding the beta’s release is a report on The Register about numerous reports from beta testers saying that their Yahoo! and Google toolbars had vanished. As in disappeared completely. Hmmm…

However, the self-proclaimed Microsoft geek blogger said he spoke with Dean Hachamovitch, the guy who runs the IE team, and reports that Dean says that they
tested with the Google and Yahoo toolbar and it was running on their
machines and they
in no way are trying to block the Google toolbar from working. He says
that he commits to everyone to getting the toolbar to work and if
there’s something that isn’t working the IE team wants to know about it
so they can fix it.

So, the blogging community is keeping Microsoft honest, and Microsoft is keeping the community posted on what they’re doing and what their intentions are. I’d say that’s exactly how it should be.