The stupid cookie law is dead at last – “exactly what websites were doing in 2009, except in a bigger font”

The organisation responsible for policing the UK cookie law has just announced that they will stop asking users for permission to set cookies on their own website. In other words:

The Information Commissioner’s Office – who for brevity I’ll call Fickle the Clown –  says they’re doing this “so that we can get reliable information to make our website better”. They’ve changed their mind because “many more people are [now] aware of cookies”.

In future Fickle will use a banner to tell their visitors that by visiting their website they consent to the use of cookies, and they’ll link to a page explaining what cookies are and how to disable them in your browser. So exactly what websites were doing in 2009, except in a bigger font.

You MUST click through to the posting, if only to see the infographics.

Where can I see the list of proposed / new TLDs? Has anyone bid on “.onion”? #tor @torproject

this —^

Why I believe that we will have to break up Nominet, the UK domain’s registry

A few months ago I wrote about this (PDF) at ComputerWorld:

Nominet: a website, by any other name, would be more secure?

So Nominet – the people who own, manage and monetise the top-level .uk DNS domain – propose to allow creation of domain names directly under the UK suffix (PDF).

Thus instead of inflatable-widgets.co.uk you could instead own inflatable-widgets.uk, and it is argued that this is somehow better.

I would argue that in terms of the value it offers, the proposition is actually an irrelevance and potentially harmful overall.

Having top-level domains like “.uk” is certainly an elegant way to distinguish local services like www.gov.uk from www.gov.au – but you can see even in the titlebar of this posting that internet users at large have adopted many diverse ways of naming themselves.

Continues…

The best example of this phenomenon that I have found so far is www.startupbritain.co – a national campaign by entrepreneurs for entrepreneurs, harnessing the expertise and passion of Britain’s leading businesspeople to celebrate, inspire and accelerate enterprise in the UK – which just happens to have a Colombian domain name.

A8ouYGlCEAAKov4

People no longer care about the nationality of domain names – you know that bit.ly is a Libyan domain, right? – instead what they care about more is that domain names are consistent and that hosts are reachable, so that the link you received from a friend works just like it did for them, albeit he/she is in another country.

So I just wrote the following, in response to a query on the Open Rights Group Advisory maillist:


I’ve not yet bothered to write the followup posting to my original article, but to make a point: there’s a “tragedy of the commons” aspect to the whole thing, too.

Nominet are unilaterally declaring themselves to be not only the trustees of, but also the police and estate agents for, a negative form of space.

To put this into English it would be something like:

We own all conceivable subdomain names under “.uk” – excluding those which already exist such as {co,ac,gov,police,nhs,plc,ltd}.uk – and shall imbue any future domain name with security as an “added value“; and we shall police their usage and shall charge extra for them accordingly; conversely all existing domains (including gov.uk) are henceforth to be denigrated as insecure and should be treated accordingly.

They have declared a negative space* – everything that does not already exist – to be theirs, and to have pre-existing “security” qualities associated with it, qualities which will be theirs alone to exploit (ie: enforce) and for which homesteaders will have to pay.

It could be argued that Nominet have the privilege to do this / those rights already in their role as registrar, and I respect that argument; but if they were going to add value to something then I would prefer that they make a positive-space approach to it – eg: create a “*.nomisecure.uk” domain – which they police and sell real-estate beneath, and then open-up the possibility for competitors (Sophos, McAfee) to create similar.

Instead Nominet have grabbed negative-space – everything that does not already exist, including alecmuffett.uk, benlaurie.uk, net.wars.uk – and declared that it is premium realestate that will demand a premium price, and that they alone shall police it; or you can do your own security in addition but if you don’t come up to scratch / meet Nominet’s zoning requirements then you will be kicked out.

If they get their way then I shall be pushing for a campaign for Nominet to be broken up; as opposed to being some bureaucratic and not entirely unbeloved equivalent of the National Grid or English Heritage for the Internet namespace, they seem now to be bent upon profit maximisation, diversification into value-add services and exploitation of monopoly.

My belief is that the “.uk” TLD is a commons only slightly more commercial than the IPv4 address space – but fortunately restricted only by human imagination, not 32-bit wordlengths – and I believe that that commons should be overseen equitably and without telling people what they will have to do (ie: conform to Nominet’s policing) merely to be permitted to exist in it.

As such I foresee breaking up Nominet into a small and strictly not-for-profit trust to disburse chunks of “.uk” and then a series of companies that monetise those chunks with value add services.

Prettymuch like we are currently supposed to be, in fact.


* obligatory joke to explain the concept of negative space:

One day a farmer called up an engineer, a physicist, and a mathematician and asked them to fence of the largest possible area with the least amount of fence. The engineer made the fence in a circle and proclaimed that he had the most efficient design. The physicist made a long, straight line and proclaimed “We can assume the length is infinite…” and pointed out that fencing off half of the Earth was certainly a more efficient way to do it. The Mathematician just laughed at them. He built a tiny fence around himself and said “I declare myself to be on the outside.”

Nominet have done the latter.


Hence the title of this posting.

YAY: “Android X server « my20percent” # X-Windows On Android. Phones are becoming Workstations are becoming Servers.

Voici Android X server « my20percent:

For the past few months I’ve been implementing an X11 server to run natively under Android. In the near future I may have need for a serializable user interface, so to get a better understanding of how they work I decided to implement the de facto standard, X11.

Well, it turns out the X protocol is bigger than I thought, but through sheer bloody-mindedness I got it finished. And it might actually be useful.

I had assumed that all internet-enabled smartphones would be sitting behind NAT-ing routers, both for security reasons and to conserve IPv4 addresses. But no, on the ‘3’ network in Australia at least, phones all have externally-accessible IP addresses, meaning they can run servers. So you could potentially launch a Linux X application out in the cloud and have it display on your phone.

The user interface is fairly simple: touch the screen to move the pointer, and use the directional pad to activate the left/middle/right buttons. Update: the volume up/down buttons now work as mouse left/right buttons. Both virtual and physical keyboards are supported.

The source code is available at http://code.google.com/p/android-xserver/ under an MIT licence, and the application (called X Server) is available for free through the Android Market.

For me, though, the money quote is:

on the ‘3’ network in Australia at least, phones all have externally-accessible IP addresses, …

…now where have I heard of the desirability of that before?

New DSL modem / Vigor 120 – 18.23Mbps down, 1.00Mbps up

Really, the upload annoys me. I must have a good line, so something is capping that at precisely 1.00Mbps. It’s repeatable. Bloody nuisance.

Also I have now got to work out how to rebuild my home DMZ.

Formerly I bridged two ethernet ports together on my firewall to make a flat internet-facing network, and one port connected to the internet-facing servers (Tor) while the other port went into my DSL router. The combined bridge interface held the public IP address for the firewall and was nominated as the “WAN” interface.

However: now the firewall is the primary internet-facing device, and the primary interface is a PPPoE link into the DSL modem.

I have no idea how I am (whether I could) bridge a point-to-point PPPoE interface with an ethernet one, and if so what do I do about the IP address?

Experimentation needed, advice welcome.

BBC News – Readers’ best passive-aggressive wi-fi names

Of course my favourite is Free Public WiFi.

A recent feature on the rise of passive-aggressive wi-fi names prompted a huge response from readers. Here are a few of them.

My friend Lola from Waddinxveen in The Netherlands is an ex US marine and finds it funny to scare her friends down her street with Surveillance Van #2. She says there is a lot of curtain twitching since she renamed her wi-fi – understandably. Nicholas Webster, Dorchester

I’ve seen this network name at two different apartments I’ve lived at, definitely my personal favourite: F.B.I. Surveillance Van.Jacob Bernal

Until recently, our wi-fi connection showed up as PoliceSurveillanceVan, as we thought it would put the wind up the students next door. Now we go by Eric and Ernie – my husband being the one with the short, fat, hairy legs. Rachael Christie, Liverpool

The Beeb seem to have a tenuous grasp of “passive aggressive”, though. Sometimes correct, but not the majority.

via BBC News – Readers’ best passive-aggressive wi-fi names.

Government won’t fund ploughshare research, so instead we adapt the swords # #hackerspace #darpa

Piffle:

“Having these programs in schools is fantastic, but the military calling the shots in American education?” Mitch Altman, a co-founder of Noisebridge, a San Francisco hackerspace, said in an interview. “I don’t see that as a positive move,” added Mr. Altman, who, in an online post, was among the first to take a stand against the program.

The controversy over the government programs led to a tense session in a packed ballroom at the Hackers on Planet Earth conference this summer in New York, where recipients and critics of the Darpa financing gathered to discuss its implications.

“If you grow a piece of celery in red water, it’s going to be red,” said Sean Auriti, who is known as Psytek at the hackerspace Alpha One Labs in Brooklyn, which he runs. “I’m just wondering how this Darpa defense contract money is going to influence these projects.”

Probably much the same way that it influenced the Internet and TorProject; as a former gun-runner I would be far more worried about Department of Treasury funding coming with strings, than Military.

I’m not saying this is all good. I am saying that the NYT debate is a storm in a teacup. We already know that all software is dual-use, but apparently some folk on my team have forgotten.

via Worries Over Defense Dept. Money for ‘Hackerspaces’ – NYTimes.com.

“Nominet: a website, by any other name, would be more secure?”

Nominet: a website, by any other name, would be more secure?

Nominet propose to allow domain names directly under “.uk”; this is better? So Nominet – the people who own, manage and monetise the top-level .uk DNS domain – propose to allow creation of domain names directly under the UK suffix (PDF). Thus instead of inflatable-widgets.co.uk you could instead own inflatable-widgets.uk, and it is argued that this is somehow better. I would argue that in terms of the value it offers, the proposition is actually an irrelevance and potentially harmful overall. Having top-level domains like “.uk” is certainly an elegant way to distinguish local services like www.gov.uk from www.gov.au – but you can see even in the titlebar of this posting that internet users at large have adopted many diverse ways of naming themselves. For instance ComputerworldUK is www.computerworlduk.com rather than computerworld.co.uk which is something else entirely; our parent publication is at www.computerworld.com and yet from a business perspective we get along just fine.

…read more, or comment at Unscrewing Security

“Why does iTunes 10.7 try to contact the domain bogusapple.com?” /ht @glynwintle

Why does iTunes 10.7 try to contact the domain bogusapple.com?.

My guess would be an Apple intranet-internal hostname that escaped into production.

Glyn wrote:

Some Apple systems have started odd connection attempts to bogusapple?com: bit.ly/QEX3Bd
The domain was free so @VxJasonxV bought it

…which is amusing.

#403Forbidden – Iranian Censorship Exhibition at @small_media

To London, yesterday, to see a small but fine exhibition by @small_media on what it is like to live with Internet censorship in Iran:

Untitled

IMG_2890 - Version 2

It was eye-opening to experience stories of a country where blogging can lead to death, where to have internet access faster than 128-Kbit (note: kilobits) requires a special government warrant, where in order to use a cybercafe requires the cafe owner to take a copy of your government ID-card, and where so many sites are blocked.

This latter we tested first-hand via a couple of Macs connected remote-desktop style to Windows systems in Iran, and just trying URL suggestions from a semi-random selection of Post-It Notes demonstrated the arbitrariness of the blocks – the Guardian and NPR are not blocked but neither is the United States Nazi Party; however various Iran-specific news sites and teeny little websites dealing in Gay/Lesbian issues are.

So we had a little competition: the post-it notes for every blocked websites were hung on a network of strings suspended from the ceiling, and the team which discovered the greatest number of blocked websites won some nougat.

The strings filled up quite fast.

Untitled

Also web-usage was a bit like 1999 all-over-again; forget about HD video when… you… are… still… waiting… for… a… 1024… by… 768… image… to… load.

So, illuminating.

And very fucked up.

In fact the only positive thing that can be said for the Iranian Internet Censorship Regime is that their mandatory data retention period is only 6 months, between a half and a quarter of that which is proposed in the UK/Europe.

Untitled Untitled IMG_2890 - Version 2 Untitled Untitled Untitled Untitled Untitled Untitled Untitled Untitled Untitled Untitled Untitled