2 year anniversary of Bug 122445: Spoof prevention: Warn if username/password in link (url) looks like a hostname – nothing to protect anyone from phishing yet. Things I’m for:

• Dialog Box w/ suspicious usernames – understand that it’s YAWD, but in this case, I think warranted – if a user doesn’t ignore it, it’ll let them not load the site at all (a good thing) – however, users *do* just click through, so part two of the solution; a per-domain pop-up blocking type interface might make sense…
• Hostname (domain name)/username display – The urlbar should start w/ the hostname and then display the l/p after or separately (one option, another displaying full url, but w/ org info, text at the end), or not at all (I don’t like url chopping/mangling, but either (any! color and escape it all for all I care) solution is better than allowing phishing to go on)
• Links should start w/ [hostname] in status/mouseover – just as an additional FYI; however, if there’s no real way to prevent this being spoofed in JS, maybe not a good idea… (an inline warning might be interesting)

OK, I just got finished reading 150+ comments over the past two years on this bug. I’m feeling what slice1900 (original bug submitter) is saying:

——-
Additional Comment #159 From slice1900@*** 2004-01-28 13:31 PST
——-

Given that Microsoft plans to update to IE to complete do away with ALL
HTTP/HTTPS AUTH, rather than attempting to sanity check them in any way, all I
have to say is TFB to all your whiners who complained about how my original
idea in the bug report to only care about .’s in usernames because it might
inconvenience a dozen users at some obscure site or another using HTTP AUTH
that’s dumb enough to have usernames with dots in them.

Mozilla should now just follow suit and disable ALL uses of HTTP AUTH in the
browser because standard or not, now that MS is obsoleting it, the few
remaining sites legitimately using will cease soon enough when they have the
first reports from IE users with the patch that it no longer works and they
realize MS will no longer support it.

Of course I expect in reality that Mozilla will continue to do nothing, as
those same whiners that obstructed anything constructive being done, like
Adam’s patch that apparently was never considered by anyone with any power in
the Mozilla organization to do anything about it, to continue to whine about
how Mozilla should continue to support HTTP AUTH anyway, because it is the
“standard”, even though only sites used where no users use IE would continue to
use the brain-damaged HTTP AUTH option from this point on.

Thus insuring that not only did Mozilla not take the leadership on this
issue, despite my bug report being filed TWO YEARS AGO TOMORROW, it will
probably remain for quite a while as the only browser still vulnerable in all
its versions to the phishing scams. I’m sure those will go on for quite a
while since there will be enough vulnerable versions of IE out there for
several more years.

No wonder Mozilla never went anywhere, people were too worried about stupid
crap like themes and support for stuff no one uses like SVG and MNG, instead of
worrying about things that will benefit the average end user. Mozilla should
just give up any illusions it is for the average user, and just content itself
to be a geek browser for people who are already too smart to fall for such
scams, and those of us who got their friends and parents to use it when they
had one too many bad experiences with IE can send them Opera’s way instead
since even though it is closed source and costs money, they actually seem to
care about their users.

I will probably get flamed for this, maybe even kicked off bugzilla, but I
really don’t care. I’m just so disappointed and disillusioned by the whole
thing I probably won’t bother to ever waste my time contributing bug reports to
Mozilla again anyway.

Here’s the MS KB announcement: 834489 – Microsoft plans to release a software update that modifies the
default behavior of Internet Explorer for handling user information in
HTTP and HTTPS URLs

It’s now been 9 months since I switched to editing my blog in vim. Much, much, much longer than I expected. Perhaps it’s time to actually start working on this thing in seriousness? (Of course, I’ve planned to do this before)

Praise be to the power of the interweb. Dan Phiffer sent along some PHP code that does Sigalert.com speed parsing.

• Netflix: the fly in the ointment of VoD
• Rare Ant May Help Solve Some Mysteries Of Social Evolution – neat

Microsoft Support: Steps that you can take to help identify and to help protect yourself from deceptive (spoofed) Web sites and malicious hyperlinks

The most effective step that you can take to help protect yourself from malicious hyperlinks is not to click them. Rather, type the URL of your intended destination in the address bar yourself. By manually typing the URL in the address bar, you can verify the information that Internet Explorer uses to access the destination Web site. To do so, type the URL in the Address bar, and then press ENTER.

Hmm, last reviewed 12/26/2003, so before the second and even more serious IE linking bug (doubly dangerous when combined with the still unfixed spoofing bug). I guess Microsoft Support isn’t really in a position to outline the easy one-step solution of say… installing Mozilla?

• Dominey on Flash MovieClip Tweening Prototypes
• The Panopticon Singularity – marching towards ubiquitous surveillance
• Who told Dean to scream for lock-down, TCPA computing? – The Register does some digging on Declan McCullagh’s claims
  

  So there we have it: Dean wasn’t advocating a national ID card, nor was he blithely inviting smart card vendors to breach citizens’ privacy even further. However, it was remarkably ill-advised of him to advocate locking down the PC “at the edge of the network” without examining the implications for the consumer, or even the software industry.

• Papal blessing for break-dancers – downrocking in His name
• Power Rangers = Joshua Micah Marshall asks whether the Bush administration has created a new American empire or weakened the old one; some very good points
  

  Conservative ideologues, in calling for an international order in which America would have a statelike monopoly on coercive force, somehow forgot what makes for a successful state. Stable governments rule not by direct coercion but by establishing a shared sense of allegiance. In an old formula, domination gives way to hegemonybrute force gives way to the deeper power of consent. This is why the classic definition of the state speaks of legitimate force. In a constitutional order, government accepts certain checks on its authority, but the result is to deepen that authority, rather than to diminish it. Legitimacy is the ultimate force multiplier, in military argot. And if your aim is to maintain a global order, as opposed to rousting this or that pariah regime, you need all the force multipliers you can get.

Has someone written a SigAlert parser before? If you know of one, please drop a line

Pre homework linkdump:

• America as a One-Party State – hopefully alarmist
• Security As Theater – Maciej writes about his recent experiences/observations returning home on an international flight
• TPM George Soros Interview
  

  And there is another aspect that is coming into sharper focus
  to me, even since I wrote the book. That is that this administration
  has no compunction in misleading the people. It has no respect for the
  truth. This, I think, is a real danger. It is the danger of an
  Orwellian world. It’s not new, because obviously, Orwell wrote about
  this fifty years ago. But what he wrote in 1984,
  you know, the Ministry of Truth being the Propaganda Ministry, the use
  of words meaning the opposite of what they are meant to mean. The Fox
  News, “Fair and Balanced,” the “Clear Skies” Act for permitting
  pollution, the “Leave No Child Behind” [that] provides no money for the
  legislation. All these things I think pose a real danger to our
  democracy if they succeed in misleading the electorate. And there is
  only one remedy: an intelligent and enlightened electorate that sees
  through it.

• Cheetohs of Mass Destruction – weapons of mass destruction-related program activities == processed cheese food snack product (contains no actual cheese)
• Unintelligent Design Network, Inc.
  

  Miller himself, a biologist, states on of our best illustrations. There have been 23 elephant-like animals in history, and yet only two survive today (and we add, they’re not doing very well). Clearly, this is the mark of an all-powerful creator who is stuck on the same stupid idea and can’t figure out why the hell they keep dying off. Hmm, perhaps it’s because giant, big-eared mammals with huge, prehensile noses are ridiculous? I mean, WTF? A giant, powerful, grasping nose? It looks like something a preschooler would make up.

• Anti-spam software – some CRM114 add-ons; note, CRM114 dies on large attachments. the current solution seems to be limiting filesize to something reasonable in procmail (I decided to go with * < 120000); Bill Yerazunis says it’s not a flaw, but why did it leave a dozen hanging crm processes on my system? (I’m running getmail on a 3/min cron)
• Calendar Access Protocol (CAP) – draft 11, expires this week. final eta: never?
• The SAKAI Project is a collaboration among several higher education institutions to develop and share open source software. Additional details will be posted here soon. (OKI + custom uPortal; large Mellon grant)
• Redbrick Helpdesk: Procmail Tutorial – has info on setting up mutt
• Political Compass – Economic Left/Right: -4.62, Social Libertarian/Authoritarian: -6.15 (smack dab in the lower left)
• “the Copy Left” – interesting /. tangent discussion on the term, views of IP/property rights
• Virtualmin – web gui for managing Apache virtual servers

• The Dynabook Revisited – Alan Kay interview, seems familiar
• 2004 Spam Conference Talks – all online in Real. Need to watch url filtering, authentication protocols…
• iChatStatus – pref pane to do fun stuff w/ iChat status
• Beyond File Sharing: An Interview with Sharman Networks CTO Phil Morle – quite interesting, actually
• Orkut Launch: The Good, The Bad, and the Ugly
• Warren Ellis on orkut – agree w/ most of this, have thought about solutions, will post on features of dss in future
• Foe Romeo: My social network ideal
• EXTERNAL INOCULATION THEORY
• A MIME Encoding for Spam Inoculation Messages

• 100 Things to Do with Your Boyfriend or Girlfriend… Instead of It – this is frickin’ awesome; too many good ones to list. Almost as good as cool-2b-real (oops, looks like it just got hacked, should be back w/ beefy goodness soon)
• Get Your War On Pt 31 – steroid-related program activities
• GetUpMove.com – Tanya lost 95lb’s playing DDR, and so can you! (Hey, I’m impressed that they make a metal pad, that kicks ass)
• Web Design and Implementation (4002-409) – Liz Lawley’s class blog
• Conservative Group Quietly Drops Plans for Same-Sex Marriage Poll – oops, looks like most of the country do like the idea of equal rights, who’d have thought that in America?
• Replacing the Sky – Apple/Pro writeup on Abbra Grupp, compositor
• Random thought: just thinking about how a few years ago, it was common practice for movies to make completely fake GUIs for their computers; nowadays, not so much so