LWN.net Weekly Edition for June 30, 2005 [LWN.net]

The Grokster ruling

June 29, 2005

This article was contributed by Joe 'Zonker' Brockmeier.

The long-awaited Metro-Goldwyn-Mayer v. Grokster decision was handed down by the Supreme Court on Monday, with disappointing if not surprising results. The court unanimously decided against Grokster, overturning the summary judgment in favor of Grokster issued by the United States District Court and upheld by the 9th Circuit Court of Appeals. The case has been remanded to the District Court for reconsideration, which seems likely to go against Grokster and Streamcast. Groklaw has the full decision as text, and it is also available as a PDF.

What was at question was whether Grokster, et al, can be held liable for use of P2P software when the software had substantial non-infringing uses, and when the parties were not aware of infringement. The Supreme Court has held that a party can be held liable for distributing software if the party is seen to be "inducing or encouraging direct infringement, and infringes vicariously by profiting from direct infringement while declining to exercise the right to stop or limit it."

The decision was eagerly awaited by both sides, and has been viewed as having widespread implications for the future of P2P technologies. If the court had upheld the decision of the District Court, it would have been largely viewed as an affirmation of the assumption that producers of technology are not liable for its uses, if it has substantial non-infringing uses. In the Sony Corp. of America v. Universal City Studios case, widely known as the Betamax case, the court decided that Sony was not liable because the VCR was "capable of commercially significant noninfringing uses."

Instead, the court's decision focuses on whether or not the company intends to promote infringement, or benefit from infringement. The decision points out that Grokster and StreamCast "each took active steps to encourage infringement." So, merely having substantial non-infringing uses is not enough. According to the Supreme Court's decision, companies can be found liable if they actively promote the technology or take "other affirmative steps to foster infringement." What comprises an "affirmative step" is open to debate, and will no doubt be seen quite differently by the entertainment industry and the technology industry.

The court also complained that neither company "made an effort to filter copyrighted material from users' downloads or otherwise impede the sharing of copyrighted files." This may set a difficult standard for P2P technologies, having to try to "impede the sharing of copyrighted files." While BitTorrent, for example, may not be encouraging users to commit copyright infringement, it's doing little to dissuade copyright infringement. How much will companies, or open source projects, be expected to police their users?

As Ed Felten writes, how the courts rule on the next generation of technologies is more important than whether Grokster and StreamCast continue doing business:

Here the Court did not offer the clarity we might have hoped for, opting instead for what Tim Wu has described as the Miss Manners rule, under which vendors must avoid showing an unseemly interest in infringing uses of their products. This would appear to protect vendors who are honestly uninterested in forstering infringement, as well as those who are very interested but manage to hide it.

Lower courts will be left to apply the Grokster Court's inducement rule to the facts of other file distribution technologies. How far will lower courts go? Will they go too far?

The litmus test is BitTorrent. Here is a technology that is widely used for both infringing and non-infringing purposes, with infringement probably predominating today. And yet: It was originally created to support noninfringing sharing (of concert recordings, with permission). Its creator, Bram Cohen, seems interested only in noninfringing uses, and has said all the right things about infringement - so consistently that one can only conclude he is sincere. BitTorrent is nicely engineered, offering novel benefits to infringing and noninfringing users alike. It is available for free, so there is no infringement-based business model. In short, BitTorrent looks like a clear example of the kind of dual-use technology that ought to pass the Court's active inducement test.

The decision isn't quite as bad as it could have been -- except for Grokster and StreamCast, of course. The court could have revisited the Sony decision, though it declined to do so at this time. However, it seems likely that this decision will encourage the entertainment industry to continue suing companies to force them to prove the "fair use question," as Fred von Lohmann puts it:

A variety of new digital technologies are advertised and promoted for uses that the technology vendors believe to be fair uses. For example, Time Trax promotes its technology for recording satellite radio, Mercora for recording music from webcasts, and Sling Media for transmitting your TiVo'd TV shows to yourself over the Internet. All maintain that these personal, noncommercial, nontranformative uses of copyrighted works fall within the scope of fair use. No court, however, has ever weighed in on these (or virtually any other) personal digital fair uses.

If these innovators are wrong on the fair use score, however, are they all liable for inducement? To put it another way, the Supreme Court's ruling may put "fair use technology companies" in the position of having to litigate, and win, the fair use question on behalf of their customers in order to resist an inducement charge. That's an expensive burden to foist on these companies.

Expensive indeed. In the final analysis, the Grokster ruling means many more years of litigation and continued attempts by the entertainment industry to litigate technology they find threatening out of existence. It may very well have a chilling effect on companies and projects who wish to provide P2P technologies or other "time-shifting" and "space-shifting" technologies.

Comments (13 posted)

The Grumpy Editor mangles some web pages

As long as there have been web pages, there have been web page annoyances. Back in the early days, it was <blink> tags. Blinking text seems awfully archaic and old-fashioned in these days of flash and javascript atrocities, but we had to manage to get annoyed at the technology that was available at the time; you youngsters won't understand. Back in those days, the technology for annoyance mitigation were also limited; we had to rely upon special-purpose web proxy processes and other unwieldy hacks.

LWN looked at greasemonkey back in March. Greasemonkey is a powerful tool, but it requires that the user write scripts to perform the edits; it's also a heavyweight tool for one-time page tweaks. So your editor decided to look at some of the other tools which are available. Thanks to the Firefox plugin architecture, there is a wealth of tools out there for would-be page manglers.

Your editor's first stop was aardvark, an extension which, unlike most others, is not found on the mozdev.org site. Aardvark is a tool optimized for examination of web pages, and the deletion of items from those pages.

Aardvark lurks during normal browsing, only making itself visible when the "start aardvark" item is chosen from the right-button context menu. Thereafter, the HTML element containing the pointer will be highlighted; picking the interesting portion of the page is simply a matter of moving the pointer there and, possibly, using "w" to "widen" the scope to larger, containing elements. Once the element of interest is chosen, it is a matter of a keystroke to remove it from the page, blank it out, perform some simple formatting changes, or view the HTML source. The source viewer is a nice touch; it enables easy examination of a specific part of a page which might otherwise be hard to find among the kilobytes of junk that modern editors and content management systems dump into pages.

What aardvark lacks, first of all, is any sort of help facility. The user must simply memorize a dozen or so keystrokes, or keep a pointer to the help information available. There is also no way to make changes permanent. So aardvark can be useful for one-time tweaks (useful, for example, to print a page without wasting sheets of paper on unrelated junk), and as a nicer sort of "view source" function. It is not helpful for making permanent changes, however.

Platypus is an on-the-fly editor which is very similar to aardvark, but which appears to be somewhat more advanced in some areas. For starters, platypus has a help screen for people who cannot remember the keyboard shortcuts. The selection of HTML elements is very similar to aardvark, except that the arrow keys are used: Platypus explicitly recognizes the tree structure of web pages, and uses arrows to move up and down the tree, or to "sibling" elements (stepping across columns in a table, for example).

Platypus can do a number of things which aardvark can't. It can relocate elements on the page, should you like things organized in a different way. So it can be used to rearrange navigation links, or put seldom-useful stuff at the bottom of the page. There is a simple CSS editor which can be used to reformat things or change their colors. And, for advanced users, there is a regular expression-based HTML editor which can make no end of changes.

Perhaps the key feature behind platypus, however, is used at the end: once you have mangled a web page to your satisfaction, a keystroke turns all of the edits into a greasemonkey script. Install that script, and the changes become permanent.

The biggest down side to platypus, perhaps, is that its source viewer is nearly unusable. Instead of aardvark's nice, hierarchical display, platypus gave your editor a window with everything in one long line of text.

The final stop on this tour is rip, which stands for "remove it permanently." As its name would suggest, rip has a very specific mission: allow the user to select web page elements, rip them out of the page, and never see them again. It cannot perform all of the functions of either aardvark or platypus, but it is effective at what it does do.

Rip's core interface is simple: put the pointer over an undesired web element, put down the right button, and select "remove it permanently" from the resulting context menu. The affected area will be briefly highlighted when the menu item is hit, but before it is selected. Rip could benefit from the more developed mechanisms for selecting elements seen in aardvark and platypus; it can be hard to communicate to rip exactly what you want to get rid of.

First-time users may be surprised to learn that rip, when installed, includes "rips" for several popular sites, including Slashdot, BoingBoing, and Wired. There is a wiki page available to host rips created by other users; it probably would be best to put all of them there, and not mess with specific pages without the user's acknowledgment. That said, rip seems like a useful tool for quick simplification of web pages.

Which tool would a grumpy editor, made even grumpier by the user-hostile features of certain web sites, use? Rip is a lightweight tool for quick removal of unwanted web cruft, but it lacks flexibility and ease of use. The future in this space almost certainly belongs to the combination of a powerful script-based facility (like greasemonkey) combined with a nicer front end - platypus, for now. With tools like these, control of the web is moving closer to where it belongs: with the people actually trying to read all that content.

Comments (9 posted)

Catching the Podcasting Buzz

June 29, 2005

This article was contributed by Dan York

On Tuesday, Apple released iTunes 4.9 with a host of new features. Now, given that iTunes is only available for Windows and Mac, what does this have to do with LWN? Plenty... here's why. One of the strongest new features of iTunes 4.9 is its native support for podcasting. While you have always been able to use a "podcatcher" to download podcasts (and you can continue to do so), having the support natively within iTunes only makes it that much easier and will have the effect of exposing iTunes' millions of users to the new world of podcasting. (Note: You do not have to have an iPod to listen to podcasts. Your regular PC - or any MP3 player - will work perfectly fine.)

Therein lies the opportunity for those of us in the Linux / open source space to actively promote our software, products, tools and services to a whole new audience. There are definitely already a number of Linux-related podcasts out there, notably:

and several others available through directories such as iPodder.org and sites such as Techpodcasts.com. However, the space is definitely available for more entries.

What do you need to get started? As outlined in this NewsForge article, not much. The process of creating a podcast on Linux, or any operating system, is extremely simple:

Record an audio file and convert it to MP3.
Upload the file to a website.
Add the file to a RSS 2.0 feed that supports "enclosures".

Congratulations... you are now a podcaster! Now, the reality is that there is a bit more than that. You need to have content that will attract people - and you have to be committed to doing it on a regular basis. But beyond that, that is really all you need. As you may already know, podcasts vary widely from ad-hoc recordings that people record into their MP3 player while they are walking their dog or driving all the way up to professionally recorded and produced broadcast-quality shows.

Getting Help

Now, if you would like a further introduction or want to start off taking a podcast to the next level in production quality, Wiley Press has just published Podcasting: The Do-It-Yourself Guide written by Todd Cochrane at Geek News Central. The book covers the territory you would expect, starting with the basics of how to listen to podcasts, getting started with creating a podcast, doing the recording and post-production and finally publishing your podcast for others to share. He wraps up with a bit on the business side of podcasts that may be of value to those looking to get very serious about it.

The best part of the book, to me, were the chapters the author spent on the actual hardware involved with creating a podcast. Sure, you can just use a basic microphone and the sound card inside of your system - and many podcasts are done that way today - but many techies starting will immediately want to look at how to improve their sound quality. Unless you have a background in audio engineering, the next step isn't terribly clear. The author helps greatly here explaining in easy terms (and keeping the reality of budgets in mind) the different kind of microphones, mixers and other tools you might want to use. These chapters, followed by a visit to the site and forums at podcastrigs.com were of tremendous value to me in looking at what equipment I might want to use.

Another excellent part was a later section on the recording process and post-production where the author walked you through how to use Audacity. He had some very helpful advice around recording but what was more useful to me was helping explain how to use some of Audacity's many effects to improve the sound quality of the recording. (Audacity could use an entire book itself!)

Note that the author candidly admits that he is no Linux guru and does focus the book on Windows and Macintosh systems, both of which he had easy access to. However, to his credit he does make the effort to identify Linux versions of various types of software and spends a great amount of time on Audacity, which is available for Windows, Mac and Linux/UNIX.

All in all, an excellent book for someone interested in getting started. There were a couple of areas where I personally would have liked more information, but overall it was a great investment and one I would highly recommend.

For readers looking for more in-depth technical information, I would suggest heading over to O'Reilly to check out Digital Audio Essentials by Bruce and Marty Fries. Now, the major irony is that this book came out in April 2005 but does not cover podcasting at all! Given O'Reilly's typically longer time frames for production (and the fact that podcasting only really emerged in late 2004) this is perhaps understandable, but it is a disappointing omission.

With that caveat, though, the book is definitely one to consider adding to your bookshelf if you are considering getting into podcasting. Like the Cochrane book, it spends some time at the beginning covering hardware and such issues as interfacing your computer with your home stereo system. The real strength of this book to me, though, were the middle chapters that went into technical detail on digital audio issues in general and then specifically into various digital audio formats. For someone entering that world, it is a great guide to the jungle of audio acronyms.

As with the other book, the authors do get into the basics of recording and producing digital audio files. They also spend some time talking about how to convert older media, including records, over into digital media. Post-production gets detailed coverage here, although not quite in the tutorial fashion of the Cochrane book. The book wraps up with a discussion around burning CDs and DVDs, an interesting section on setting up an Internet radio station and finally a section on legal and copyright issues. Like the other book, this one is Windows and Mac-centric with a few pointers to cross-platform programs, although not as many as the other book.

Again, outside of the complete omission of podcasting, Digital Audio Essentials is an excellent text to help someone get started. Partner it with the Podcasting Do-It-Yourself Guide and you have a powerful combo to help launch someone into the world of podcasting.

Now let's see what podcasts readers can come up with in the realm of Linux and open source! (Leave links in the comments to any shows you particularly enjoy and we'll look at reviewing them in future issues.)

Final note: If you are interested in more info about actually using an Apple iPod with Linux, check out the July 2005 Linux Journal article, "Using an iPod in Linux".

Comments (10 posted)

Page editor: Rebecca Sobol

Security

Brief items

A look at the Auditor Security Collection

June 29, 2005

This article was contributed by Joe 'Zonker' Brockmeier.

The Auditor Security Collection team has just put out a new release. The Auditor Security Collection is a Knoppix-based live CD with a huge selection of security tools that can be used for security audits and penetration testing.

The latest release includes two different ISO images -- one for systems with Intel B/G wireless cards, and one without.

We tried Auditor on a workstation and notebook computer. Auditor detected all of the hardware, even the wireless card in the notebook, flawlessly. Unlike Knoppix, Auditor does not automatically attempt to get an IP address by DHCP on boot -- the user must do this manually.

There are far too many applications included with Auditor to go into each one individually. The CD includes several classes of applications, found on the KDE menu in the "Auditor" menu. The menu classes include "Footprinting," "Scanning," "Analyzer," "Spoofing," "Bruteforce," "Forensics" and "Password cracker." Suffice it to say that Auditor includes a comprehensive list of tools for any user who needs to perform a security audit.

Of course, Auditor could be applied to less-than-honest endeavors as well. Using Auditor, we were able to quickly start up EtherApe to start monitoring network traffic on our LAN, use Dsniff to scan for passwords sent over the network, and run Nessus to scan for vulnerabilities. Given a laptop, wireless card and close proximity to a unprotected (or under-protected) wireless network, and a user could walk away with quite a few passwords and usernames just by casual browsing.

In addition to scanning and penetration testing, Auditor would come in handy for forensics on compromised computers with tools like Wipe, Sleuthkit, recover and testdisk. Auditor also includes a decent selection of normal productivity tools, which will come in handy for admins and security consultants to produce full reports on the same machine they use for scanning and penetration testing. Auditor includes several text editors, image capture tools, and even vnc2swf for users who need to make Flash movies of their tests.

The Remote-Exploit website also has links to Flash movies demonstrating various uses of the Auditor Security Collection, including cracking 128-bit WEP and decrypting SSL traffic using a Man in the Middle attack.

In short, Auditor is a one-stop shop for Linux users who want a full selection of security testing tools. We'd recommend that any system administrator take a look at Auditor, and consider adding it to their security tool chest. If nothing else, it should provide an eye-opener as to what kinds of easy-to-use tools are available to potential attackers.

LWN.net Weekly Edition for June 30, 2005

ClamAV: denial of service

Heimdal: buffer overflow vulnerabilities

kernel: Linux amd64 kernel vulnerabilities

razor-agents: denial of service

RealPlayer HelixPlayer arbitrary code execution

a2ps: input validation error

bzip2: race condition and infinite loop

cacti: SQL injection and PHP file inclusion

cpio - file permissions error

cpio: directory traversal

cURL: buffer overflow

cvs: multiple vulnerabilities

cyrus-imapd: buffer overflows

dbus: information disclosure

dhcp: format string vulnerability

Dnsmasq: poisoning and DoS

emacs21: format string vulnerability in "movemail"

enscript: arbitrary code execution

ettercap: format string vulnerability

evolution: message crash vulnerability

Foomatic: Arbitrary command execution in foomatic-rip

FreeRADIUS: buffer overflow and SQL injection

gaim: denial of service

gdb: multiple vulnerabilities

gtk-pixbuf, gtk2: denial of service

gedit: format string vulnerability

gettext: Insecure temporary file handling

gftp: missing input sanitizing

ghostscript: symlink vulnerabilities

glibc: tempfile vulnerability in catchsegv script

gnupg: information leak

grip: buffer overflow

groff: insecure temporary directory

gxine: format string vulnerability

gzip: race condition and directory traversal

htdig: cross site scripting

ImageMagick: xwd coder denial of service

imap: buffer overflow in c-client

imlib2: buffer overflows

infozip: privilege escalation, directory-traversal

junkbuster: heap corruption and settings modification

kdelibs: unsanitzied input

kernel: multiple vulnerabilities

kernel: ELF loader core dump vulnerability

kernel: multiple vulnerabilities

kimgio input validation errors

libconvert-uulib-perl: arbitrary code execution

libdbi-perl: insecure temporary file

libgd2: buffer overflows in PNG handling

libnet-ssleay-perl: weakened cryptographic operations

libTIFF: buffer overflow

libxml2 - arbitrary code execution

libxml2: multiple buffer overflows

libXpm: new buffer overflows

lvm10: creates insecure temporary directory

mailman: path traversal

mc: buffer overflow

mod_python: remote access vulnerability

Mozilla Firefox, Mozilla Suite: multiple vulnerabilities

mozilla firefox: javascript vulnerabilities

MPlayer: heap overflows

MySQL: input validation and temporary file vulnerabilities

ncpfs: multiple vulnerabilities

Net-SNMP: fixproc insecure temporary file creation

nfs-utils: arbitrary code execution

openssh: directory traversal

openssl: der_chop script temp file vulnerability

OpenSSL: information leak

OpenSSL: denial of service vulnerabilities

Opera: multiple vulnerabilities

perl: setuid vulnerabilities

perl: symlink vulnerability

php4: integer overflow and denial of service

phpsysinfo: cross-site-scripting

postgresql: EXECUTE privilege vulnerability

postgresql: database initialization errors

Pound: buffer overflow

ppxp: missing privilege release

realplayer: arbitrary code execution