Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

1/25/2006
12:12 PM
Bob Evans
Bob Evans
Commentary
50%
50%

Privacy: Three Cheers For Microsoft, AOL, Yahoo For Doing The Right Thing

First of all, three cheers for Microsoft! The latest news has the company defending its decision to cooperate with the Justice Department in an anti-pornography effort.

First of all, three cheers for Microsoft! The latest news has the company defending its decision to cooperate with the Justice Department in an anti-pornography effort.The company said it limited the material it gave to Justice to "a random sample of pages from its search index and some aggregated query logs that listed queries and how often they occurred," and that it was careful to avoid passing along any information that could possibly be tied to either an individual human or an individual machine or an individual IP address. All proper and above board, don't you think? Well, think again---the dyspeptic critics who first railed against this on the grounds that Microsoft and the others blatantly violated the privacy of their customers have now changed their tune a bit and are saying that it's no longer relevant whether any privacy was violated or not (and even they admit it was not).

Rather, these folks say, it's neither relevant nor good enough that Microsoft and Yahoo and AOL upheld without exception their responsibilities to protect the privacy of their customers---instead, these "critics" say, the issue isn't about privacy after all---it's about trust. And since they've been fully discredited for their initial criticism over privacy violations, they are now trumpeting fresh charges that Microsoft surrendered too easily or rolled over too quickly or knuckled under or chickened out or compromised or sold out or whatever other ridiculous and derogatory interpretation they want to use.

Here's an example from one of these experts/critics/scolds: "Nevertheless, by not pushing back against such a bad request for data, it leaves open the real fear that they might not push back if the U.S. government decided to go on a real fishing expedition in the future. Privacy may not have been lost but trust was." Hey---are you afraid? Have you lost trust? Do you lay awake at night, sweating about the US government going on a real fishing expedition by trampling over Microsoft and Yahoo to find out what normal Americans do and say online? I mean, look at the thousands---or is it millions?---of Americans who've been tossed into dungeons because the dastardly Patriot Act was used to find cross-matches between people who subscribe to "The Nation" and drink Tsing-Tao beer and have checked out "1984" from their public library? To call this absurd is to give it way too much credit.

Yet these scolds would have us believe that Microsoft has pushed us one step closer to the precipice of governmental tyranny by "giving in too easily." Let's see if Microsoft shareholders start dumping the company's stock in support of the "giving in too easily" criticism. Let's see if Microsoft customers start ripping out SQL Server and Word and Outlook because Microsoft "gave in too easily" instead of spending millions of dollars to have lawyers grandstand and give speeches to mollify the "privacy advocates." Lemme say it again: three cheers for Microsoft and AOL and Yahoo for doing the right thing and ignoring those "critics" whose credibility is diminishing as Microsoft's is rising.

And in a strange way, I'm almost looking forward to what the next volley will be from the "critics" when their "giving in too easily" campaign goes nowhere, because I'm curious: what will be left for them to criticize? I lack the imagination to conjure that up, but based on the track record of these public defenders, we can be sure they'll think of something. Based on that track record, my guess is their next effort won't make much sense to most people, it won't have much basis in reality, it'll be framed in highly emotional terms and doomsday contexts, and the media will give it massive coverage. Hmm...perhaps I've been missing the point all along.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Can Your Patching Strategy Keep Up with the Demands of Open Source?
Tim Mackey, Principal Security Strategist, CyRC, at Synopsys,  6/18/2019
Florida Town Pays $600K to Ransomware Operators
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12957
PUBLISHED: 2019-06-25
In Xpdf 4.01.01, a buffer over-read could be triggered in FoFiType1C::convertToType1 in fofi/FoFiType1C.cc when the index number is larger than the charset array bounds. It can, for example, be triggered by sending a crafted PDF document to the pdftops tool. It allows an attacker to use a crafted pd...
CVE-2019-12958
PUBLISHED: 2019-06-25
In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in FoFiType1C::convertToType0 in fofi/FoFiType1C.cc when it is trying to access the second privateDicts array element, because the privateDicts array has only one element allocated.
CVE-2019-12951
PUBLISHED: 2019-06-24
An issue was discovered in Mongoose before 6.15. The parse_mqtt() function in mg_mqtt.c has a critical heap-based buffer overflow.
CVE-2019-10689
PUBLISHED: 2019-06-24
VVX products using UCS software version 5.9.2 and earlier with Better Together over Ethernet Connector (BToE) application version 3.9.1 and earlier provides insufficient authentication between the BToE application and the BToE component, resulting in leakage of sensitive information.
CVE-2019-12346
PUBLISHED: 2019-06-24
In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to XSS via a specially crafted SAMLResponse XML post.