Risk
1/25/2006
12:12 PM
Bob Evans
Bob Evans
Commentary
50%
50%

Privacy: Three Cheers For Microsoft, AOL, Yahoo For Doing The Right Thing

First of all, three cheers for Microsoft! The latest news has the company defending its decision to cooperate with the Justice Department in an anti-pornography effort.

First of all, three cheers for Microsoft! The latest news has the company defending its decision to cooperate with the Justice Department in an anti-pornography effort.The company said it limited the material it gave to Justice to "a random sample of pages from its search index and some aggregated query logs that listed queries and how often they occurred," and that it was careful to avoid passing along any information that could possibly be tied to either an individual human or an individual machine or an individual IP address. All proper and above board, don't you think? Well, think again---the dyspeptic critics who first railed against this on the grounds that Microsoft and the others blatantly violated the privacy of their customers have now changed their tune a bit and are saying that it's no longer relevant whether any privacy was violated or not (and even they admit it was not).

Rather, these folks say, it's neither relevant nor good enough that Microsoft and Yahoo and AOL upheld without exception their responsibilities to protect the privacy of their customers---instead, these "critics" say, the issue isn't about privacy after all---it's about trust. And since they've been fully discredited for their initial criticism over privacy violations, they are now trumpeting fresh charges that Microsoft surrendered too easily or rolled over too quickly or knuckled under or chickened out or compromised or sold out or whatever other ridiculous and derogatory interpretation they want to use.

Here's an example from one of these experts/critics/scolds: "Nevertheless, by not pushing back against such a bad request for data, it leaves open the real fear that they might not push back if the U.S. government decided to go on a real fishing expedition in the future. Privacy may not have been lost but trust was." Hey---are you afraid? Have you lost trust? Do you lay awake at night, sweating about the US government going on a real fishing expedition by trampling over Microsoft and Yahoo to find out what normal Americans do and say online? I mean, look at the thousands---or is it millions?---of Americans who've been tossed into dungeons because the dastardly Patriot Act was used to find cross-matches between people who subscribe to "The Nation" and drink Tsing-Tao beer and have checked out "1984" from their public library? To call this absurd is to give it way too much credit.

Yet these scolds would have us believe that Microsoft has pushed us one step closer to the precipice of governmental tyranny by "giving in too easily." Let's see if Microsoft shareholders start dumping the company's stock in support of the "giving in too easily" criticism. Let's see if Microsoft customers start ripping out SQL Server and Word and Outlook because Microsoft "gave in too easily" instead of spending millions of dollars to have lawyers grandstand and give speeches to mollify the "privacy advocates." Lemme say it again: three cheers for Microsoft and AOL and Yahoo for doing the right thing and ignoring those "critics" whose credibility is diminishing as Microsoft's is rising.

And in a strange way, I'm almost looking forward to what the next volley will be from the "critics" when their "giving in too easily" campaign goes nowhere, because I'm curious: what will be left for them to criticize? I lack the imagination to conjure that up, but based on the track record of these public defenders, we can be sure they'll think of something. Based on that track record, my guess is their next effort won't make much sense to most people, it won't have much basis in reality, it'll be framed in highly emotional terms and doomsday contexts, and the media will give it massive coverage. Hmm...perhaps I've been missing the point all along.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2208
Published: 2014-12-28
CRLF injection vulnerability in the LightProcess protocol implementation in hphp/util/light-process.cpp in Facebook HipHop Virtual Machine (HHVM) before 2.4.2 allows remote attackers to execute arbitrary commands by entering a \n (newline) character before the end of a string.

CVE-2014-2209
Published: 2014-12-28
Facebook HipHop Virtual Machine (HHVM) before 3.1.0 does not drop supplemental group memberships within hphp/util/capability.cpp and hphp/util/light-process.cpp, which allows remote attackers to bypass intended access restrictions by leveraging group permissions for a file or directory.

CVE-2014-5386
Published: 2014-12-28
The mcrypt_create_iv function in hphp/runtime/ext/mcrypt/ext_mcrypt.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 does not seed the random number generator, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging the use of a single initial...

CVE-2014-6228
Published: 2014-12-28
Integer overflow in the string_chunk_split function in hphp/runtime/base/zend-string.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted arguments to the chunk_split ...

CVE-2014-6229
Published: 2014-12-28
The HashContext class in hphp/runtime/ext/ext_hash.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 incorrectly expects that a certain key string uses '\0' for termination, which allows remote attackers to obtain sensitive information by leveraging read access beyond the end of the string,...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.