Re: [Full-Disclosure] Bios programming...

[Bill Humphries <whump@xxxxxxx>]

On Mar 3, 2005, at 1:39 PM, Matt Marooney wrote:

> Exactly, thank you Randall.  I appreciate your feedback, I'll check 
> into
> your suggestions further.
>
> I like the way you put, "this is targeted at adults who are trying to
> curb their own behavior".  Seems like this list needs more people like
> that!  ;)

You asked a security list-serve a security related question.

Now, let me review, in a less snarky fashion, my issues with your 
proposal.

1) It is easily circumvented.

	a) the subject uses another computer.
	b) the subject programs their upstream router to drop packets intended 
for the monitoring organization.

2) It violates the privacy of other users.

	a) your application could, unless written specifically to avoid this, 
report on the actions of those other than the subject, on a shared 
computer. Note that it renders the application moot, as then the 
subject creates another user to go to the proscribed sites.
	b) since you have specified that the application be difficult to 
un-install, if the computer is transferred to another person, their 
activity will be monitored, potentially generating false positives 
attributed to the original subject under surveillance.

3) It can easily generate false positives.

	There are a number of exploits for systems such as phpBB that inject 
hidden IFRAMEs into HTML documents, which in turn load use JavaScript 
to load other URLs.

	As those URLs could be on the proscribed sites list, a visit to a 
hacked phpBB site, say a support group for "addicts" could spawn visits 
to your list of proscribed sites.

	Or, someone could attempt to spoof the monitoring server to get to 
record false hits.

5) It could be exploited.

See any number of reports of buffer overflow exploits sent to this 
list. Without careful detainting of user inputs (URLs) you could allow 
injection of malicious code.

Those are my technical objections. As for the others:

6) Who decides what is a 'suspect site'?

	The decision to classify as site as pornographic has a significant 
political component.

7) Trustworthiness of the Monitoring Organization

	The monitoring organization now has at least one piece of information 
(the act of installation is itself a datum) that can be used to attack 
a person's reputation. Will the subject be able to terminate their 
relationship with the monitoring organization? What are the monitoring 
organization's data privacy policies? Will violations be reported to 
data aggregators such as ChoicePoint? How secure is that data?

8) Trust vs. Pervasive Surveillance

Several people said they felt a legitimate need for this software 
citing "pornography addiction."

I've emailed a few friends who are in grad programs and clinical 
practice to confirm if there's an actual diagnosis of "pornography 
addiction". Sorry, the term feels loaded, like something tossed about 
during a congressional hearing.

And others mentioned the AA angle. However, when you join AA, to the 
best of my knowledge, you do not have an alcohol sensor implanted in 
your esophagus or stomach to report violations to AA.

What you do have is a sponsor, who you can call if you're on the verge 
of taking a drink.

And when, if ever, do you build trust with the person who you have said 
you have harmed? It strikes me as too easy to leave the secret 
policeman on forever. But now there's a third pillow in that bed, and I 
get the feeling that you do not condone polyamory.

That's why I made those remarks comparing your plan to the abuses of 
Mao's Cultural Revolution. You privatize the intrusive, something 
which, until recently, was the domain of totalitarian states.

-----

In conclusion, if someone believes they have an issue with respect to 
adult materials, drugs, alcohol, or anything else, then instead of 
installing software, maybe they should seek out a mental health 
professional, cleric, or trusted friend. They are less likely to be 
abused or exploited.

In short, don't create new problems trying to solve old ones.

I doubt this will change your course, but now I've said my piece on it.

Cheers,

-- whump

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html