Blog and Personal Web Site
Policy Template

This totally fab event features rad cover artist Richard Cheese with Lounge Against the Machine, Jonathan Coulton, Chance, the Radio Adventures of Dr. Floyd, Natalie Gelman and is hosted by The Bitterest Pill’s Dan Klass.

Not only that, to make sure we get you in the right mood, we’re chipping in for your drinks, too! So smile, say “cheese” and keep checking back here as an, official sponsor of the Coverville 500, to find out how you, our favorite peeps, can catch up with us 7 p.m. Aug. 15 at the Bally’s Hotel and Casino on the strip.

OK. Technical jargon paragraph: DNS stands for Domain Name System. Basically, it takes the name of the website (like geeknewscentral.com) and points it to the host server on the internet. Think of it like a phone book - you open it up and reference a name with their phone number.

The US Computer Emergency Readiness Team (or CERT for short) was informed of an issue where web sites could get misdirected through what is called "cache poisoning". Cache poisoning is like having a phone book where someone crossed out the phone number you want and put in their own.

Cache poisoning was not why Comcast was hacked 2 months prior. They suffered a "Pharming" scam, which is where the information is either changed on the computer trying to go to the site, or the host server (which is the case of Comcast). Poisoning happens on the DNS server itself.

The bug was luckily found by Dan Kaminsky, who is the director of penetration testing at IOActive Inc, a comprehensive Computer Security Services company. He basically found the bug by "Accident" and reported it in early 2008. Security researchers then convened at Microsofts' campus to plan a patch of this potentially dangerous issue.

Some companies were left in the dark until last month. They knew a problem existed but could only make some counter measures. This was so the research team could create a fail-safe fix and not make the issue known to those that could and would exploit the hole.

Even now, they will not give out all the details. We will finally get a full detail when all is said and done next month. What we do know is that the hole is related to the transaction ID in which each DNS entry has. The ID is a random number with 65 thousand possibilities and associated with the DNS entry in the database. If the two items do not match up, then DNS will not resolve the name.

Apparently, 65 thousand numbers is not random enough. It's like trying to break into a safe with a combination lock using a stethoscope. The new process will add "More randomness" with an added 16 bits of security.

Since this can affect the way you access sites (including secure sites), the application of these patches has to be done slowly and methodically. Can't just shut down the whole system at 2 AM. Any mix up and a large group of people won't be able to get to their part of the internet.

Where this gets even more hairy is the fact that Servers have to be aware of some of the changes so they can reroute and adjust their firewalls and DMZ. Most servers will have to update to BIND9 (Berkley Internet Name Domain). A large number are still on version 8. Yahoo, for example, will be updating it's infrastructure.

I think we avoided a possibly major issue here. Think what would have happened if someone found out about this hole. They could easily have re-routed you to a site that could have phished out and stole important data. You wouldn't have known until it's too late. Let's hope the fix is done as quick as possible and that it holds well.

I know this sounds time-consuming, but I've done a few things to speed up the process. One is that I use Firefox and have the adblock plus add-on running, which turns off all advertising and leaves me with just the facts, ma'am. This leads to fewer distractions once I'm on a site. I also have pared down to where I really want to go, and go only there. Once in a site with multiple levels of information (like the New York Times or USAToday, I go only to those sections that I am going to get the information I'm looking for. The last thing I've done is turn into a really good headline reader. If the headline doesn't catch my eye, I pass it up. If the headline does catch my eye, but the first two sentences of the article don't follow through, then I pass it on for the next article. I also have figured out what tech sites are going to give me the best information without a bunch of duplication. I don't read Arstechnica anymore, or techmeme, because it is a rehash of what I get at Techdirt. I rarely read Techcrunch, because it is constantly talking about mergers and acquisitions of software and social sites and I'm not interested in either. I get good info from USAToday's tech section, believe it or not, and I am addicted to Engadget and Gizmodo. I avoid Digg like the plague, because too much of their content is focused on gaming and juvenile fanboy stuff that isn't my thing.

By being selective and using the tools at my disposal, I get through 5 newspapers and about ten tech news blogs/sites in about 45 minutes this way. It is not a huge amount of time and I consider it to be fairly productive. I spend a whole lot more time writing in my blogs and for here than I do reading the actual news.

I don't necessarily think that aggregators are the way to go for everyone. I have friends who use them, and I know Todd lives with his, but I have always felt that that "pared down" information was leaving something out for me. I have to wonder if aggregators will eventually go by the wayside through lack of usage. Of the 17 techs in my department at my J.O.B., only one of them uses an aggregator, and we all are heavy readers of tech news. That says something, I think.

Both these trends are understandable to an extent. The sheer volume of content and the large number of blogs that are out there make it very difficult for people to easily find interesting or relevant content without the aggregators. This is a catch 22 situation. There is too much content out there for a user to filter it without taking up way too much time. The aggregator sites help with this by doing a pre-filter for us. This leads to a bit of group think though, where we only see the articles that algorithm's have determined are the most important. RSS readers are also a way for us to deal with large amounts of information more easily

It is natural that a space that is as relatively new as blogging will evolve rapidly over time. The environment will continue to evolve as technologies grow and develop and as people throw ew ideas into the mix. I don't think anyone can argue that we have the whole community information thing down perfectly yet. We have never individually had access to more information as a species and we need to work out exactly how to best process it.

I do not believe that the final solution is going to be the aggregators. This is not really a model that gives us the best information. It is the method that is easiest for advertising though, and since that is the prime method for revenue in the space this gives those sites the power at the moment. I would imagine that the future will be in more human edited content rather than algorithm generated content. For this method to succeed though a way to generate revenue directly from the content consumption needs to exist as advertising revenue is not large enough or stable enough to fund this.

Advertising also has a corrupting influence on editorial content. This is not necessarily in a pernicious way, but a subtle influence that this has when advertising is the only method with which a company gets its revenue. The people that give you your revenue are your real customers. If all you have is advertising then your business is to deliver people to advertisers, not to deliver a service to your "consumer". Over time a couple of revenue generating models will emerge and then the game will change yet again.