Another Report Shows That FOSTA Increased (Not Decreased) Sex Trafficking; Where Is The Outrage?

from the next-time-listen-to-experts dept

Before FOSTA passed, a ton of experts warned it would lead to bad things, and now we're seeing more and more stories about how FOSTA is actually increasing the sex trafficking problem, rather than decreasing it. Police have admitted that it's now harder to catch traffickers without the information they used to get from Backpage, and pimps have apparently seized on the opportunity to make use of the disappearance of Backpage and other sites to more aggressively position themselves as the only option for sex workers.

The latest such report to make this clear is in the San Francisco Chronicle, where police note that FOSTA has emboldened pimps to take control of sex workers' lives:

“Without being able to advertise online,” Long said, “a huge number of sex workers were forced to go outside, and many have reported that former pimps came out of the woodwork offering to ‘manage’ their business again since they were now rendered unable to find and screen clients online.”

[...]

“The very bill that was supposed to stop trafficking has quite literally given formerly irrelevant traffickers new life,” Long said.

I'm truly curious how the various folks who stumped for FOSTA now feel about this. A bunch of Hollywood stars, including Amy Schumer, Seth Meyers, Josh Charles and Tony Shaloub, all stumped on behalf of FOSTA, making claims that were blatantly untrue. It would be nice if these celebrities could respond to all of the new evidence showing that -- just as sex workers and experts predicted -- FOSTA has made the situation much worse for sex workers, and put many of them in serious danger.

Filed Under: danger, fosta, san francisco, sex trafficking

Lenovo CTO Claims Concerns Over Superfish Are Simply 'Theoretical'

from the find-a-new-cto dept

Lenovo keeps making things worse. First it installed crappy Superfish malware/adware on a bunch of its computers. That was bad enough. But the real problem was that in a clever little "hack" to get around the fact that the adware wouldn't work on HTTPS enabled pages, Superfish installed its own self-signed root certificate to basically create a massively dangerous man-in-the-middle attack to snoop on what you were doing on those HTTPS pages. Oh, and to make it even worse, the company made sure that everyone who had this Superfish self-signed root certificate had the exact same certificate with an easily cracked password, so that a massive and easily exploited vulnerability is in place in tons of machines out there. And Lenovo's first response was to insist there was no evidence of any security concerns. It later, quietly, deleted that statement, but still seems to be unwilling to admit what an incredibly dangerous situation it has created.

In fact, the company is still in denial mode. Lenovo's CTO, Peter Hortensius, was interviewed by the WSJ, and he insisted that any threats were "theoretical."

WSJ: There seems to be a disparity between what security researchers are saying about the potential dangers of this Superfish software, and what the company has said about this app not presenting a security risk.

Hortensius: We’re not trying to get into an argument with the security guys. They’re dealing with theoretical concerns. We have no insight that anything nefarious has occurred. But we agree that this was not something we want to have on the system, and we realized we needed to do more.

Fire your CTO, Lenovo. Fire your marketing people. Fire your security team. This is a disaster. In our first post, we compared it to the Sony rootkit fiasco from a decade ago, while noting the security risk here is much, much greater. And, so far, Lenovo appears to be playing straight from the Sony rootkit response playbook. If you don't recall, after security folks pointed out what a security disaster the rootkit was, Sony's response was to dismiss the concerns as... theoretical:

"Most people, I think, don't even know what a rootkit is, so why should they care about it?"

In both cases, these technologies opened up giant, massive vulnerabilities on people's computers. In both cases, they were easily exploitable (in the Lenovo case, much, much, much more easily exploitable in a much, much, much more nefarious way). And, in both cases, senior execs from the company tried to handwave it away because they don't know if anyone abused these problems. This ignores that (1) it's quite possible people have been abusing these vulnerabilities for months and it's just not public yet, and (2) more importantly, it doesn't fucking matter because the vulnerability is still there and easily exploitable by lots and lots of people now because it's widely known.

Handwaving this off as a "theoretical" concern is not just missing the point -- it suggests a fundamental lack of understanding about rather basic security practices. As I mentioned earlier, I've been a very loyal Thinkpad buyer for years (though, thankfully, the machine I bought a couple months ago wasn't one infected this way). Every time I've dabbled with other laptops I've regretted it. But Lenovo's response to this is very quickly convincing me that the company should never get any more money from me. It's not just the initial screwup in preinstalling such a security mess, but the completely ridiculous response to it that suggests a company that still doesn't recognize what it has done.

Filed Under: certificate, danger, peter hortensius, security, self-signing, superfish
Companies: komodia, lenovo, superfish

General Keith Alexander Is An Opportunistic Coward

from the shielded-in-shame dept

In all that we've written about General Keith Alexander, former chief guy at the NSA who has overseen the most egregious overreach in domestic spying American history, we've learned a great deal about him. For instance, we know logic eludes him, after he insisted that we need more spying because current spying is encouraging terrorism. We also know he doesn't give a damn about the whole freedom of the press thing, what with his support for press gag orders. And we know he's a man of limited imagination, having told Congress he just can't think of any other way to keep you and I safe without the NSA's massive surveillance programs.

You know what else Keith Alexander is? A coward. I say that absolutely knowing that I'll probably get killed in the comments for suggesting a man who signed up to serve the public, serve in the military, and serve in intelligence is a coward. Well to hell with anyone who suggests you can't call a man who serves a coward. Where were all of you when Edward Snowden was getting lambasted in the exact same way? Still, accusing a man like Alexander of cowardice requires an explanation. Get yourself started by watching this clip of his appearance on CNN.

"It's going to get more dangerous. I would rather be sitting here in the hot seat defending what we're doing than sitting here in the hot seat after a terrorist attack and you asking me 'how did we fail the country?' It's a bad place out there. They're trying to kill us. These are some of the tools. If you take away some of the tools, it is my assessment after forty years in the business, and today is my fortieth anniversary in joining the army, it is my assessment that it is going to get tougher. And these leaks have hurt us. They will get tougher."

Okay, let's get the obvious out of the way. All this harm that has supposedly been done by Snowden's leaks turns out to be smoke and mirrors, as far as what the government is willing to prove is concerned. Now that that's out of the way, perhaps unlike some of my colleagues here, I too believe there is a very real danger from international terrorism. That said, a blanket statement about how bad things are and how "they" are trying to kill us is about as useful as a rectum on a houseplant. Nobody is arguing that there isn't at least some degree of danger, the argument is over how far we're willing to let our government go to protect the liberty at which they're chipping away, nevermind the way we comport ourselves as a member of the international community.

But it's the first part of that statement that really pisses me off and it's that same part that reveals the cowardice inside Alexander. This constant hint-dropping of how much more difficult it is to prevent the next domestic terrorist attack now that the public is aware of the massive surveillance program is a pretty clear attempt at innoculation of responsibility. It's as if these spy chiefs looked at the damning of public officials that occurred after 9/11 (far too little of it, in my opinion) and decided to shield themselves from possible future criticism by proactively blaming Snowden's leaks for forthcoming attacks. Read another way, his hot seat comment reads to say: if sometime in the future, thousands of Americans end up dead in an attack, don't come blame us, you took our tools away from us.

For me, it's hard to imagine a more cowardly statement. Is Alexander so afraid to face potential failure that he would scapegoat someone who, at the very least, thought he was doing his patriotic duty? Would he have the intelligence community sidestep their responsibility simply because the public now recognizes the NSA's overreach? Would he cast off his duty simply because sunlight has finally marked his underground lair?

That kind of chess-piece positioning isn't the act of a patriot. It isn't the act of a hero. It's the act of a coward, which is exactly what General Keith Alexander is, and I'm happy to treat him like one. After all, the brave thing to do is to understand that freedom comes with danger and to bear that danger gratefully and willingly.

Filed Under: danger, fear, fud, keith alexander, threats

Mainstream Press Realizing That E-PARASITE/SOPA Is Ridiculously Broad

from the good-for-them dept

It's been unfortunate that the mainstream press hasn't really spent much time digging into the actual details of the text of the E-PARASITE/SOPA bill, and just how awful it is. At best, some of them have done a "well, the tech industry is worried about it" kind of piece, without actually looking at the details. Thankfully, some in the press really are digging in. James Temple, at the SF Chronicle, has an excellent and detailed piece about how SOPA would do more to "stop online innovation" than it would ever do to stop online "piracy." Just a snippet:

There are lots of concerns here, including the amount of discretion it hands to the attorney general. But another big worry is that blocking the domain name for one infringing site (say, latviablogging.com/counterfeitrolexes) could prevent access to thousands of innocent ones also hosted under that domain (like latviablogging.com/motherscookierecipes).

"It is inevitable that there will be bad behavior on any site that has thousands and thousands of dedicated subsections," said Dane Jasper, CEO of Santa Rosa Internet service provider Sonic.net. Cutting off the entire site's traffic and funds amounts to an "Internet death penalty" without a trial, he said.

It also highlights the ridiculous broad drafting and confusing language in the bill -- something SOPA/E-PARASITE defenders still refuse to admit. The worst of the worst is in the definition of what constitutes "dedicated to the theft of U.S. property." The dreadful drafting is going to lead to massive lawsuits:

This section of the bill appears to apply to both U.S.-based sites and foreign ones, or even a portion of a site, if it's "dedicated to theft of U.S. property." One of the key definitions of that is if a site "is taking, or has taken, deliberate actions to avoid confirming a high probability" of infringement. Public Knowledge, a Washington, D.C., public interest group, helpfully boiled down that clumsy legalese to: "lacking sufficient zeal to prevent copyright infringement."

In other words, it would place the responsibility for detecting and policing infringement onto the site itself, rather than content owners, as required under the DMCA.

"There's really not much question that this bill is designed to do an end run around the DMCA," said Corynne McSherry, intellectual property director at the Electronic Frontier Foundation, a digital rights group in San Francisco. "What has been affirmed by court after court is that service providers do not have to affirmatively police infringement. That's a good thing because it's a terrible burden to put on a service provider."

The thing that gets me is that if defenders of this bill were intellectually honest, they'd just admit that they were, in fact, trying to change the DMCA, and have a conversation on that point. So far, only Rep. Bob Goodlatte has been intellectually honest enough to admit that's the case. However, others in our comments and on other sites keep insisting that the bill is "narrowly drafted" just to impact the worst of the worst. Anyone who reads the plain (if convoluted) text of the bill knows that's simply not true. A "narrowly drafted" bill does not impact pretty much every internet property, like SOPA does.

Filed Under: danger, e-parasite, innovation, press, sopa

How Did Danger Not Backup Its Servers? How Did Microsoft Allow Such A Failure?

from the one-of-those-times-where-epic-fail-applies dept

I bought the very first Danger smartphone the day it came out (rare for me -- I'm not so much of an early adopter on mobile phones). One of the features I liked the best was the fact that all of the data on the phone was immediately and automatically backed up to Danger's servers. Since then, I've always been amazed that other providers didn't make similar features standard. Danger never fully lived up to its hype, and eventually sold out to Microsoft. It was never entirely clear why Microsoft would want Danger, but at the very least you would think that it would make sure that the servers were pretty safe and redundant. Or so you would think. Apparently Danger had a massive server failure and is warning people that their data may be completely lost. The company is telling people not to turn off their devices, as the only way to keep the data alive is to keep the phone going.

It's difficult to think of a system failure that makes a company look quite this bad. Tons of people have Sidekick phones and rely on server backup to keep their data. Not having a working redundant backup is a stunning sort of failure for Microsoft, and should remind people of the inherent dangers in relying on a cloud based service. While there are lots of cloud-based solutions that are quite useful, people are definitely going to need to be able to have alternative local and remote backups to make sure that, in this kind of situation, they're not totally relying on a company who should do things right, but perhaps did not.

Filed Under: backup, cloud computing, danger, server side, sidekicks
Companies: danger, microsoft

Don't Say You Weren't Warned About How Dangerous The Wii Can Be

from the domestic-tranquility dept

When the Nintendo Wii first came out, there were lots of stories talking about how it was causing users physical pain, and it was blamed for an increasing number of ER visits. Further proof that the Wii can be harmful to your health comes out of Austin, Texas, where a guy has been accused of trying to choke his girlfriend with a Wiimote strap -- after she woke him up and accused him of eating all of her Girl Scout cookies. Nintendo's already been sued once for making the Wiimote's wrist strap too weak; we won't hang around to see if another lawyer alleges they've now made it too strong.

Filed Under: choking, danger, wii
Companies: nintendo