Missouri Governor Still Lying About Reporters Who Uncovered Ridiculous Bad State Computer Security; Still Insists They Were Hackers

from the lie-through-it,-mike dept

Missouri Governor Mike Parson is nothing if not committed to shamelessly lying. As you'll recall, after journalists from the St. Louis Post-Dispatch ethically informed the state that the Department of Elementary and Secondary Education (DESE) website included a flaw that revealed the social security numbers of over 600,000 state teachers and school administrators, Parson responded by calling the reporters hackers and vowing to prosecute them. Again, the DESE system displayed this information directly in the HTML, available for anyone to see if they knew where to look. That's not hacking. That's incompetent computer security.

So far, this has mostly played out as expected. A month after the revelations, DESE finally admitted it fucked up and apologized to the teachers and administrators and offered them identity fraud protection services. Then, last week, a public record request revealed something incredible, though perhaps not surprising: the FBI had already told Missouri officials that no hacking took place and DESE had prepared a statement (correctly) thanking the journalists for alerting them to their own fuck up... but that statement was ditched in favor of the nonsense one claiming that the journalists "hacked" the system. As we said in that last story, right at the end it notes that the Highway Patrol investigation, instigated by Parson, was "still active."

And now Parson is still standing by the ridiculous claim that the reporters are hackers. As for how he could possibly claim that after the revelation of internal documents on the situation? Well, Parson is trotting out the old "fake news" bullshit:

Asked at a ribbon-cutting ceremony Tuesday whether, in light of the records provided by the state, he still believed the newspaper committed a crime, Parson said, “Most certainly I believe that. And most certainly I don’t know where that information’s coming from that you guys printed on that, whether it’s very accurate or not either. It has a tendency not to be very accurate a lot of times.”

Dude. What? Do newspapers make errors sometimes? Sure. But (1) from the very beginning it was abundantly clear that the problem here was with the state, not with the reporters, because under no circumstances should people be able to see the Social Security Numbers of other people in HTML and (2) if you're crying "fake news" about documents revealed under a public records law then you have to actually say what's fake. Is Parson claiming that his own government supplied fake information in response to a public records request? Because that would be fucked up. No, the truth is that Parson can't handle the fact that everyone knows he's just wrong, so he's going to lie right through it.

Missourians, you deserve better than a governor who will actively lie to you and put state employees at risk. Elect someone who is not a liar.

Filed Under: dese, ethical disclosure, hackers, html, journalism, mike parson, missouri, security research
Companies: st. louis post-dispatch

Missouri Governor Doubles Down On 'View Source' Hacking Claim; PAC Now Fundraising Over This Bizarrely Stupid Claim

from the wtf-missouri dept

Hey Missouri: stop electing technically illiterate dipshits. First you had Claire McCaskill, one of the key sponsors of FOSTA (who is still defending it years later). You got rid of her, but replaced her with Josh Hawley, who seems to think his main job in the Senate (besides whipping up support for insurrectionists and planning his run for the Presidency) is to destroy the internet and reshape it according to his own personal vision.

And then there's your governor. We wrote about him a few years ago when he claimed (ridiculously) that the 1st Amendment meant he could withhold public records (which is not how any of this works). But, of course, last week, his tech ignorance broke into prime time after the St. Louis Post-Dispatch ethically disclosed that the state's Department of Elementary and Secondary Education (DESE) website was including teacher & administrator social security numbers in the HTML. DESE pulled down the pages, but not before calling the journalists "hackers." Parson then doubled down and called for the journalists to be prosecuted. And then kept insisting that viewing HTML source code was hacking.

For the past week people on Twitter have been repeatedly mocking Parson for this, but he just won't give up, and neither will the United Missouri PAC that is a huge Parson supporter and was even fined last year by the Missouri Ethics Commission over improper contributions and failure to report the contributions to Parson.

Earlier this week, United Missouri seemed to think that Parson's blatant technical illiteracy was worth doubling down on and turning into a culture war against "the fake news." It produced a video that is so embarrassing and cringeworthy it feels like a parody.

I mean, the transcript is so stupid that it makes me wonder about the quality of education in Missouri that someone could be this clueless.

The latest from the Missouri "fake news factory" is from the St. Louis Post-Dispatch, where a reporter has been digging around HTML code on a state website. The state technology division said the hacker took the records of at least 3 educators, decoded the HTML source code and viewed the social security numbers from the state website.

I mean, holy shit. HTML code is public. That's what "view source" is there for. There's no "digging around." And, incredibly, here United Missouri/Parson are admitting that the social security numbers were in HTML! THAT IS THE PROBLEM! No one should ever be putting SSNs in HTML. The fact that DESE put SSNs in HTML is the very problem that the reporters were highlighting. And if it wasn't actually a problem, why did DESE pull down the website in the first place? It's not hacking. It's showing that Parson's administration is incompetent.

And then, the video takes Parson's own failure to protect teachers and administrators in the state... and blames it on the reporters who (ethically) disclosed this negligent coding?

Governor Parson believes everyone is entitled to their privacy. Especially our teachers.

THEN WHY DID YOUR ADMINISTRATION REVEAL THEIR SOCIAL SECURITY NUMBERS IN HTML, YOU TECHNICALLY IGNORANT FOOLS? No one should ever be putting SSNs in HTML. The fact that they were there is the problem. Not the fact that these reporters alerted the state to their own coding (and data handling) error. The privacy breach is the state's fault, not the reporters. The reporters disclosed all of this in the most ethical manner possible: alerting the state and not publishing anything until after the leaked data was removed from the web.

Governor Parson is standing up to the fake news media and is committed to bringing to justice anyone who obtained private information. The St. Louis Post-Dispatch is purely playing politics. Exploiting private information is a squalid excuse for journalism. And hiding behind the noble principle of free speech to do it is shameful.

Note that they keep calling the St. Louis Post-Dispatch "fake news" but don't dispute a single thing they reported. So it's fake news, but also a crime? Furthermore, the only one who should be "brought to justice" is the state for putting social security numbers in HTML in the first place. And the only one "purely playing politics" appears to be Governor Mike Parson and his corrupt PAC.

And, of course, everyone with even the most basic understanding of HTML know that it's Parson who's full of shit here, as is clear from all the comments on the video:

I get that, these days, the Trumpian populists politicians think they can just make shit up and lie constantly and their ignorant base will lap it up, but this takes all that to new levels of stupid. You don't have to be a genius computer science grad to understand that you never ever put SSNs in HTML and that whoever did that is at fault here.

Filed Under: data breach, ethical disclosure, hacking, html, journalism, mike parson, missouri, view source
Companies: united missouri

EFF Officially Appeals Tim Berners-Lee Decision On DRM In HTML

from the last-ditch-effort dept

Last week, we wrote about the unfortunate and short-sighted decision by Tim Berners-Lee to move forward with DRM in HTML. To be more exact, the move forward is on Encrypted Media Extensions in HTML, which will allow third party DRM to integrate simply into the web. It's been a foregone conclusion that EME was going to get approved, but there was a smaller fight about whether or not W3C would back a covenant not to sue security and privacy researchers who would be investigating (and sometimes breaking) that encryption. Due to massive pushback from the likes of the MPAA and (unfortunately) Netflix, Tim Berners-Lee rejected this covenant proposal.

In response, W3C member EFF has now filed a notice of appeal on the decision. The crux of the appeal is the claimed benefits of EME that Berners-Lee put forth won't actually be benefits without the freedom of security researchers to audit the technology -- and that the wider W3C membership should have been able to vote on the issue. This appeals process has never been used before at the W3C, even though it's officially part of its charter -- so no one's entirely sure what happens next.

The appeal is worth reading so we're reposting a big chunk of it here:

1. The enhanced privacy protection of a sandbox is only as good as the sandbox, so we need to be able to audit the sandbox.

The privacy-protecting constraints the sandbox imposes on code only work if the constraints can't be bypassed by malicious or defective software. Because security is a process, not a product and because there is no security through obscurity, the claimed benefits of EME's sandbox require continuous, independent verification in the form of adversarial peer review by outside parties who do not face liability when they reveal defects in members' products.

This is the norm with every W3C recommendation: that security researchers are empowered to tell the truth about defects in implementations of our standards. EME is unique among all W3C standards past and present in that DRM laws confer upon W3C members the power to silence security researchers.

EME is said to be respecting of user privacy on the basis of the integrity of its sandboxes. A covenant is absolutely essential to ensuring that integrity.

2. The accessibility considerations of EME omits any consideration of the automated generation of accessibility metadata, and without this, EME's accessibility benefits are constrained to the detriment of people with disabilities.

It's true that EME goes further than other DRM systems in making space available for the addition of metadata that helps people with disabilities use video. However, as EME is intended to restrict the usage and playback of video at web-scale, we must also ask ourselves how metadata that fills that available space will be generated.

For example, EME's metadata channels could be used to embed warnings about upcoming strobe effects in video, which may trigger photosensitive epileptic seizures. Applying such a filter to (say) the entire corpus of videos available to Netflix subscribers who rely on EME to watch their movies would safeguard people with epilepsy from risks ranging from discomfort to severe physical harm.

There is no practical way in which a group of people concerned for those with photosensitive epilepsy could screen all those Netflix videos and annotate them with strobe warnings, or generate them on the fly as video is streamed. By contrast, such a feat could be accomplished with a trivial amount of code. For this code to act on EME-locked videos, EME's restrictions would have to be bypassed.

It is legal to perform this kind of automated accessibility analysis on all the other media and transports that the W3C has ever standardized. Thus the traditional scope of accessibility compliance in a W3C standard -- "is there somewhere to put the accessibility data when you have it?" -- is insufficient here. We must also ask, "Has W3C taken steps to ensure that the generation of accessibility data is not imperiled by its standard?"

There are many kinds of accessibility metadata that could be applied to EME-restricted videos: subtitles, descriptive tracks, translations. The demand for, and utility of, such data far outstrips our whole species' ability to generate it by hand. Even if we all labored for all our days to annotate the videos EME restricts, we would but scratch the surface.

However, in the presence of a covenant, software can do this repetitive work for us, without much expense or effort.

3. The benefits of interoperability can only be realized if implementers are shielded from liability for legitimate activities.

EME only works to render video with the addition of a nonstandard, proprietary component called a Content Decryption Module (CDM). CDM licenses are only available to those who promise not to engage in lawful conduct that incumbents in the market dislike.

For a new market entrant to be competitive, it generally has to offer a new kind of product or service, a novel offering that overcomes the natural disadvantages that come from being an unknown upstart. For example, Apple was able to enter the music industry by engaging in lawful activity that other members of the industry had foresworn. Likewise Netflix still routinely engages in conduct (mailing out DVDs) that DRM advocates deplore, but are powerless to stop, because it is lawful. The entire cable industry -- including Comcast -- owes its existence to the willingness of new market entrants to break with the existing boundaries of "polite behavior."

EME's existence turns on the assertion that premium video playback is essential to the success of any web player. It follows that new players will need premium video playback to succeed -- but new players have never successfully entered a market by advertising a product that is "just like the ones everyone else has, but from someone you've never heard of."

The W3C should not make standards that empower participants to break interoperability. By doing so, EME violates the norm set by every other W3C standard, past and present.

It's unclear to me why Tim Berners-Lee has been so difficult on this issue -- as he's been so good for so long on so many other issues. I understand that not everyone you agree with should ever agree with you on all things, but this seems like a very weird hill to die on.

Filed Under: appeal, drm, eme, html, tim berners-lee
Companies: eff, w3c

Tim Berners-Lee Sells Out His Creation: Officially Supports DRM In HTML

from the this-is-bad dept

For years now, we've discussed the various problems with the push (led by the MPAA, but with some help from Netflix) to officially add DRM to the HTML 5 standard. Now, some will quibble with even that description, as supporters of this proposal insist that it's not actually adding DRM, but rather this "Encrypted Media Extensions" (EME) is merely just a system by which DRM might be implemented, but that's a bunch of semantic hogwash. EME is bringing DRM directly into HTML and killing the dream of a truly open internet. Instead, we get a functionally broken internet. Despite widespread protests and concerns about this, W3C boss (and inventor of the Web), Tim Berners-Lee, has signed off on the proposal. Of course, given the years of criticism over this, that signoff has come with a long and detailed defense of the decision... along with a tiny opening to stop it.

There are many issues underlying this decision, but there are two key ones that we want to discuss here: whether EME is necessary at all and whether or not the W3C should have included a special protection for security researchers.

First, the question of whether or not EME even needs to be in HTML at all. Many -- even those who dislike DRM -- have argued that it was kind of necessary. The underlying argument here is that certain content producers would effectively abandon the web without EME being in HTML5. However, this argument rests on the assumption that the web needs those content producers more than those content producers need the web -- and I'm not convinced that's an accurate portrayal of reality. It is fair to note that, especially with the rise of smart devices from phones to tablets to TVs, you could envision a world in which the big content producers "abandoned" the web and only put their content in proprietary DRM'd apps. And maybe that does happen. But my response to that is... so what? Let them make that decision and perhaps the web itself is a better place. And plenty of other, smarter, more innovative content producers can jump in and fill the gaps, providing all sorts of cool content that doesn't require DRM, until those with outdated views realize they're missing out. Separately, I tend to agree with Cory Doctorow's long-held view that DRM is an attack on basic computing principles -- one that sets up the user as a threat, rather than the person who owns the computer in question. That twisted setup leads to bad outcomes that create harm. That view, however, is clearly not in the majority, and many people admitted it was a foregone conclusion that some form of EME would move forward.

The second issue is much more problematic. A bunch of W3C members had made a clear proposal that if EME is included, there should be a covenant that W3C members will not sue security researchers under Section 1201 of the DMCA should they crack any DRM. There is no reason not to support this. Security researchers should be encouraged to be searching for vulnerabilities in DRM and encryption in order to better protect us all. And, yet, for reasons that no one can quite understand, the W3C has rejected multiple versions of this proposal, often with little discussion or explanation. The final decision from Tim Berners-Lee on this is basically "sure a covenant not to sue would have been nice, and we think companies shouldn't sue, but... since this wasn't raised at the very beginning, we're not supporting it":

We recommend organizations involved in DRM and EME implementations ensure proper security and privacy protection of their users. We also recommend that such organizations not use the anti-circumvention provisions of the Digital Millennium Copyright Act (DMCA) and similar laws around the world to prevent security and privacy research on the specification or on implementations. We invite them to adopt the proposed best practices for security guidelines [7] (or some variation), intended to protect security and privacy researchers. Others might advocate for protection in public policy fora – an area that is outside the scope of W3C which is a technical standards organization. In addition, the prohibition on "circumvention" of technical measures to protect copyright is broader than copyright law's protections against infringement, and it is not our intent to provide a technical hook for those paracopyright provisions.

Given that there was strong support to initially charter this work (without any mention of a covenant) and continued support to successfully provide a specification that meets the technical requirements that were presented, the Director did not feel it appropriate that the request for a covenant from a minority of Members should block the work the Working Group did to develop the specification that they were chartered to develop. Accordingly the Director overruled these objections.

This is unfortunate. What's bizarre is that the supporters of DRM basically refuse to discuss any of this. Even just a few days ago, the Center for Democracy and Technology proposed a last-ditch "very narrow" compromise to protect a limited set of security and privacy researchers (just those examining implementations of w3C specifications for privacy and security flaws.) Netflix flat out rejected this compromise saying that it's "similar to the proposal" that was made a year ago. Even though it's not. It was more narrowly focused and designed to respond to whatever concerns Netflix and others had.

The problem here seemed to be that Netflix and the MPAA realized that they had enough power to push this through without needing to protect security researchers, and just decided "we can do it, so fuck it, let's do it." And Tim Berners-Lee -- who had the ability to block it -- caved in and let it happen. The whole thing is a travesty.

Corry Doctorow has a thorough and detailed response to the W3C's decision that pushes back on many of the claims that the W3C and Berners-Lee have made in support of this decision. Here's just part of it:

We're dismayed to see the W3C literally overrule the concerns of its public interest members, security experts, accessibility members and innovative startup members, putting the institution's thumb on the scales for the large incumbents that dominate the web, ensuring that dominance lasts forever.

This will break people, companies, and projects, and it will be technologists and their lawyers, including the EFF, who will be the ones who'll have to pick up the pieces. We've seen what happens when people and small startups face the wrath of giant corporations whose ire they've aroused. We've seen those people bankrupted, jailed, and personally destroyed.

This was a bad decision done badly, and Tim Berners-Lee, the MPAA and Netflix should be ashamed. The MPAA breaking the open internet I can understand. It's what that organization has wanted to do for over a decade. But Netflix should be a supporter of the open internet, rather than an out and out detractor.

As Cory notes in his post, there is an appeals process, but it's never been used before. The EFF and others are exploring it now, but it's a hail mary process at this point. What a shame.

Filed Under: circumvention, copyright, dmca, drm, eme, html, html 5, research, security, tim berners-lee
Companies: mpaa, netflix, w3c

Tim Berners-Lee Endorses DRM In HTML5, Offers Depressingly Weak Defense Of His Decision

from the welcome-to-the-locked-down-web dept

For the last four years, the Web has had to live with a festering wound: the threat of DRM being added to the HTML 5 standard in the form of Encrypted Media Extensions (EME). Here on Techdirt, we've written numerous posts explaining why this is a really stupid idea, as have many, many other people. Despite the clear evidence that EME will be harmful to just about everyone -- except the copyright companies, of course -- the inventor of the Web, and director of the W3C (World Wide Web Consortium), Sir Tim Berners-Lee, has just given his blessing to the idea:

The question which has been debated around the net is whether W3C should endorse the Encrypted Media Extensions (EME) standard which allows a web page to include encrypted content, by connecting an existing underlying Digital Rights Management (DRM) system in the underlying platform. Some people have protested "no", but in fact I decided the actual logical answer is "yes". As many people have been so fervent in their demonstrations, I feel I owe it to them to explain the logic.

He does so in a long, rather rambling post that signally fails to convince. Its main argument is defeatism: DRM exists, the DMCA exists, copyright exists, so we'll just have to go along with them:

could W3C make a stand and just because DRM is a bad thing for users, could just refuse to work on DRM and push back wherever they could on it? Well, that would again not have any effect, because the W3C is not a court or an enforcement agency. W3C is a place for people to talk, and forge consensus over great new technology for the web. Yes, there is an argument made that in any case, W3C should just stand up against DRM, but we, like Canute, understand our power is limited.

But there's a world of difference between recognizing that DRM exists, and giving it W3C's endorsement. Refusing to incorporate DRM in HTML5 would send a strong signal that it has no place in an open Internet, which would help other efforts to get rid of it completely. That's a realistic aim, for reasons that Berners-Lee himself mentions:

we have seen [the music] industry move consciously from a DRM-based model to an unencrypted model, where often the buyer's email address may be put in a watermark, but there is no DRM.

In other words, an industry that hitherto claimed that DRM was indispensable, has now moved to another approach that does not require it. The video industry could do exactly the same, and refusing to include EME in HTML5 would be a great way of encouraging them to do so. Instead, by making DRM an official part of the Web, Berners-Lee has almost guaranteed that companies will stick with it.

Aside from a fatalistic acceptance of DRM's inevitability, Berners-Lee's main argument seems to be that EME allows the user's privacy to be protected better than other approaches. That's a noble aim, but his reasoning doesn't stand up to scrutiny. He says:

If [video companies] put it on the web using EME, they will get to record that the user unlocked the movie. The browser though, in the EME system, can limit the amount of access the DRM code has, and can prevent it "phoning home" with more details. (The web page may also monitor and report on the user, but that can be detected and monitored as that code is not part of the "DRM blob")

In fact there are various ways that a Web page can identify and track a user. And if the content is being streamed, the company will inevitably know exactly what is being watched when, so Berners-Lee's argument that EME is better than a closed-source app, which could be used to profile a user, is not true. Moreover, harping on about the disadvantages of closed-source systems is disingenuous, since the DRM modules used with EME are all closed source.

Also deeply disappointing is Berners-Lee's failure to recognize the seriousness of the threat that EME represents to security researchers. The problem is that once DRM enters the equation, the DMCA comes into play, with heavy penalties for those who dare to reveal flaws, as the EFF explained two years ago. The EFF came up with a simple solution that would at least have limited the damage the DMCA inflicts here:

a binding promise that W3C members would have to sign as a condition of continuing the DRM work at the W3C, and once they do, they not be able to use the DMCA or laws like it to threaten security researchers.

Berners-Lee's support for this idea is feeble:

There is currently (2017-02) a related effort at W3C to encourage companies to set up "bug bounty" programs to the extent that at least they guarantee immunity from prosecution to security researchers who find and report bugs in their systems. While W3C can encourage this, it can only provide guidelines, and cannot change the law. I encourage those who think this is important to help find a common set of best practice guidelines which companies will agree to.

One of the biggest problems with the defense of his position is that Berners-Lee acknowledges only in passing one of the most serious threats that DRM in HTML5 represents to the open Web. Talking about concerns that DRM for videos could spread to text, he writes:

For books, yes this could be a problem, because there have been a large number of closed non-web devices which people are used to, and for which the publishers are used to using DRM. For many the physical devices have been replaced by apps, including DRM, on general purpose devices like closed phones or open computers. We can hope that the industry, in moving to a web model, will also give up DRM, but it isn't clear.

So he admits that EME may well be used for locking down e-book texts online. But there is no difference between an e-book text and a Web page, so Berners-Lee is tacitly admitting that DRM could be applied to basic Web pages. An EFF post spelt out what that would mean in practice:

A Web where you cannot cut and paste text; where your browser can't "Save As..." an image; where the "allowed" uses of saved files are monitored beyond the browser; where JavaScript is sealed away in opaque tombs; and maybe even where we can no longer effectively "View Source" on some sites, is a very different Web from the one we have today.

It's also totally different from the Web that Berners-Lee invented in 1989, and then generously gave away for the world to enjoy and develop. It's truly sad to see him acquiescing in a move that could destroy the very thing that made the Web such a wonderfully rich and universal medium -- its openness.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: drm, eme, html, html5, tim berners-lee
Companies: w3c

Survey: 27% Think A Gigabyte Is a Type Of South American Insect [Update: Or Not]

from the I-see-dumb-people dept

Update: Or not. It appears that this survey may be bogus. Still, the key point, that we've noted for years, is that the average person has no idea how much a gigabyte really is -- and we'd bet that's still true, even if this "survey" appears to be just a marketing stunt.

A new survey from a UK company unsurprisingly found that more than a few people are slightly clueless when it comes to technology terms. The multiple-choice survey, which polled 2,392 U.S. men and women 18 years of age or older, found that one in ten Americans believe that html is some form of sexually-transmitted disease. While most survey respondents knew the definition of more general terms (like "dialect"), the full survey (pdf) found that even basic tech terms confused many people. 42% thought a motherboard was a deck on a cruise ship, 15% thought that software was comfortable clothing, and 77% of respondents didn't know what SEO meant.

Interestingly, while 67% respondents knew that a gigabyte was a unit of measurement of digital information (though the survey didn't ask them how much information is contained in a gigabyte), 27% believed that a gigabyte was a type of South American insect. That's actually a better statistic than I've seen in the past. A 2008 poll suggested that 87% of those polled had no idea what a gigabyte was or how many they use. The New York Times did an entirely unscientific street poll a few years back and found that few, if any, passers by knew what a megabyte is:

"If a sampling of pedestrians on the streets of Brooklyn is any guide, most people have only a vague idea. One said a megabyte was “the amount of something we have to use the Internet,” adding, “We should have three or four." Miranda Popkey, 24, was closer: “It’s a measure of how much information you store. If there are too many of them, I can’t send my e-mail attachment."

The thing is, most people can get away with not knowing what a motherboard is without losing a limb. Thinking that USB is an acronym for a country in Europe may not make you the smartest person in the room, but it's not going to hurt your wallet. Even the 29% of survey respondents who thought a migraine was a type of rice should probably make it through the day without any major repercussions (assuming they don't choke on their own tongue or something). But with both fixed line and wireless carriers increasingly charging by the megabyte and gigabyte, people might want to brush up on the term before they have to take out a second mortgage to fund their Angry Birds habit.

Filed Under: gigabyte, html, survey, uk

Not Cool: MPAA Joins The W3C

from the that's-not-going-to-end-well dept

The W3C has been at the forefront of open standards and an open internet for many years, obviously. So it's somewhat distressing to see it announced this morning that the MPAA has now joined the group. After all, it was not that long ago that the MPAA flat out tried to break the open internet by imposing rules, via SOPA, that would have effectively harmed security protocols and basic DNS concepts. All because it refuses to update its business model at the pace of technology. The MPAA has never been about supporting open standards or an open and free internet. The W3C states that its "principles" are "web for all, web for everything" and that its vision is "web of consumers and authors, data and services, trust." The MPAA has basically been opposed to... well.... all of that. It has tried to take a consumer web of authors and turn it into a broadcast medium for major producers. It's tried to destroy trust, and put in place locks and keys.

In short, the MPAA has no place at all in the W3C. If there had been any indication that this was a shift in the MPAA's thinking, that actually would be interesting. If the MPAA had shown even the slightest indication that it was finally willing to embrace real internet principles and standards, and move Hollywood into the 21st century, that would be a good thing, and they should participate. But that's not what this is about, at all.

Instead, I fear that this is because of the stupid fight, which the W3C supports, to put DRM in HTML5. Tim Berners-Lee, who created the web and heads the W3C, has (for reasons that still don't make any sense) supported this dangerous proposal. Despite detailed explanations for why this is a bad idea, he has continued to defend the idea, which appears to go against nearly everything he's said in the past. Having the MPAA join the W3C is not encouraging at all.

Berners-Lee's support of DRM in HTML5 seems to be based on the short-sighted (and simply wrong) idea that the web needs the legacy entertainment industry more than the legacy entertainment industry needs the web. Building truly open standards that the world adopts will get the MPAA and others to come along eventually, because they'll realize they need to go where the people are, even if it isn't crippled with restrictions and locks. Bringing the MPAA into the process only continues to perpetuate this idea that we should be building a broadcast platform for the entertainment industry to push a message at consumers, rather than building a platform for creators of all kinds to communicate and share.

Filed Under: creators, drm, html, html 5, open standards, tim berners-lee, web standards
Companies: mpaa, w3c

Dear Rupert: Before Putting Up A Paywall, It Helps To Have Your Staff Check The HTML

from the just-a-suggestion dept

As you know by now, Rupert Murdoch's The Times (of London) has kicked off its paywall experiment, with an editor there claiming that news publications that don't put up a paywall will go out of business. Perhaps. We shall see... but in the meantime, Rupert might want to find people who understand HTML before he turned on the paywall. Reader Craig sent over a link to a Times Online story that tries to get people to go to the new paywalled site "for full coverage, pictures and video from the Middle East." The only problem? The link is broken. I took a screenshot with my mouse over the link, and you can see that rather than a proper link, the link doubles up on the http at the beginning: http://http://www.thetimes.co.uk/etc.... If you can't see it in the image above, click through for a larger version. Clicking the actual link, of course, gets you a page not found error. Oops. Now, you can say this is a small mistake that anyone can make (hell, we've made it here at times), but for a big professional news organization that are trying to drive people to this new pay site, you would think they would have at least had someone double check the links... On top of this, it really highlights the pure annoyance factor that The Times has created for everyone. Not only is it locking up its content behind a paywall, it makes you go hunting for it, and redirects its audience to a totally different place (and, in this case, not even very well).

Filed Under: html, links, paywall, rupert murdoch, the times
Companies: news corp.

People Start Noticing That The Web Competes With iPad Apps

from the well,-there-you-go... dept

Back in February, when many in the media were insisting that iPad apps were going to save the media business, we wondered why all the stuff they were talking about sticking in their apps couldn't work on the web as well. It appears that others are noticing that as well. Jason Fry at the Nieman Journalism Lab is noting that publications' own websites may be the biggest competition to their iPad apps -- and he was apparently a big believer in the concept of iPad apps originally. But after using the iPad for a while, he's realizing that the web is pretty good again:

After about a week of using the iPad, I started deleting apps, because the websites themselves were perfectly adequate. This is the reverse experience of the iPhone. On the iPhone, the browser was used only in emergencies, and apps ruled. On the iPad, at least for now, the opposite is true -- the browser is superb, and renders many apps superfluous.

That complicates things for news organizations. Many have already put too much faith in the idea that being able to charge for apps will reinvigorate their financial prospects. Now, they have to confront the reality that their apps may compete with their own websites -- and right now the apps don't win that competition.

Of course, I can see some in the media getting the wrong idea out of this, and using it as an excuse to put "exclusive" content only in the app... but, that will just leave them open to competition from publications who add more value to their website.

Filed Under: apps, html, ipad, iphone, journalism, news, web

Law Firm Uses Copyright Claim To Say You Can't View Its Website's HTML Source

from the that's-a-new-one dept

Greg Beck writes in to let us know that the law firm that was recently challenged for claiming that it was a copyright violation to post its cease-and-desist letter also has some other interesting ideas about copyright, including banning people from looking at the firm's source code. You can view the entire user agreement, but the amusing part is:

"We also own all of the code, including the HTML code, and all content. As you may know, you can view the HTML code with a standard browser. We do not permit you to view such code since we consider it to be our intellectual property protected by the copyright laws. You are therefore not authorized to do so."

As Beck says, "That's kind of like a puppet show invoking copyright to prohibit the audience from looking at the strings. The user agreements of the law firm and one of its clients also contain a bunch of terrible terms that have become all too common: a prohibition on linking to the site, copying anything from the site (even if its fair use), and even referring to the website owner by name. The law firm doesn't even allow its own clients to say they're represented by the firm without permission." He also notes that the law firm in question is demanding that another website remove criticism of one of their clients because it did not receive permission to use the client's name or link to the website -- two things that the laws and the courts have been pretty clear in saying is perfectly legal over the years.

Filed Under: copyright, html, view source