Risk
1/25/2006
12:12 PM
Bob Evans
Bob Evans
Commentary
50%
50%

Privacy: Three Cheers For Microsoft, AOL, Yahoo For Doing The Right Thing

First of all, three cheers for Microsoft! The latest news has the company defending its decision to cooperate with the Justice Department in an anti-pornography effort.

First of all, three cheers for Microsoft! The latest news has the company defending its decision to cooperate with the Justice Department in an anti-pornography effort.The company said it limited the material it gave to Justice to "a random sample of pages from its search index and some aggregated query logs that listed queries and how often they occurred," and that it was careful to avoid passing along any information that could possibly be tied to either an individual human or an individual machine or an individual IP address. All proper and above board, don't you think? Well, think again---the dyspeptic critics who first railed against this on the grounds that Microsoft and the others blatantly violated the privacy of their customers have now changed their tune a bit and are saying that it's no longer relevant whether any privacy was violated or not (and even they admit it was not).

Rather, these folks say, it's neither relevant nor good enough that Microsoft and Yahoo and AOL upheld without exception their responsibilities to protect the privacy of their customers---instead, these "critics" say, the issue isn't about privacy after all---it's about trust. And since they've been fully discredited for their initial criticism over privacy violations, they are now trumpeting fresh charges that Microsoft surrendered too easily or rolled over too quickly or knuckled under or chickened out or compromised or sold out or whatever other ridiculous and derogatory interpretation they want to use.

Here's an example from one of these experts/critics/scolds: "Nevertheless, by not pushing back against such a bad request for data, it leaves open the real fear that they might not push back if the U.S. government decided to go on a real fishing expedition in the future. Privacy may not have been lost but trust was." Hey---are you afraid? Have you lost trust? Do you lay awake at night, sweating about the US government going on a real fishing expedition by trampling over Microsoft and Yahoo to find out what normal Americans do and say online? I mean, look at the thousands---or is it millions?---of Americans who've been tossed into dungeons because the dastardly Patriot Act was used to find cross-matches between people who subscribe to "The Nation" and drink Tsing-Tao beer and have checked out "1984" from their public library? To call this absurd is to give it way too much credit.

Yet these scolds would have us believe that Microsoft has pushed us one step closer to the precipice of governmental tyranny by "giving in too easily." Let's see if Microsoft shareholders start dumping the company's stock in support of the "giving in too easily" criticism. Let's see if Microsoft customers start ripping out SQL Server and Word and Outlook because Microsoft "gave in too easily" instead of spending millions of dollars to have lawyers grandstand and give speeches to mollify the "privacy advocates." Lemme say it again: three cheers for Microsoft and AOL and Yahoo for doing the right thing and ignoring those "critics" whose credibility is diminishing as Microsoft's is rising.

And in a strange way, I'm almost looking forward to what the next volley will be from the "critics" when their "giving in too easily" campaign goes nowhere, because I'm curious: what will be left for them to criticize? I lack the imagination to conjure that up, but based on the track record of these public defenders, we can be sure they'll think of something. Based on that track record, my guess is their next effort won't make much sense to most people, it won't have much basis in reality, it'll be framed in highly emotional terms and doomsday contexts, and the media will give it massive coverage. Hmm...perhaps I've been missing the point all along.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-4692
Published: 2015-07-27
The kvm_apic_has_events function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging /dev/kvm access for an ioctl call.

CVE-2015-1840
Published: 2015-07-26
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space cha...

CVE-2015-1872
Published: 2015-07-26
The ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c in FFmpeg before 2.5.4 does not validate the number of components in a JPEG-LS Start Of Frame segment, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via craft...

CVE-2015-2847
Published: 2015-07-26
Honeywell Tuxedo Touch before 5.2.19.0_VA relies on client-side authentication involving JavaScript, which allows remote attackers to bypass intended access restrictions by removing USERACCT requests from the client-server data stream.

CVE-2015-2848
Published: 2015-07-26
Cross-site request forgery (CSRF) vulnerability in Honeywell Tuxedo Touch before 5.2.19.0_VA allows remote attackers to hijack the authentication of arbitrary users for requests associated with home-automation commands, as demonstrated by a door-unlock command.

Dark Reading Radio
Archived Dark Reading Radio
What’s the future of the venerable firewall? We’ve invited two security industry leaders to make their case: Join us and bring your questions and opinions!