On Mar 3, 2005, at 1:39 PM, Matt Marooney wrote:
Exactly, thank you Randall. I appreciate your feedback, I'll check
into
your suggestions further.
I like the way you put, "this is targeted at adults who are trying to
curb their own behavior". Seems like this list needs more people like
that! ;)
You asked a security list-serve a security related question.
Now, let me review, in a less snarky fashion, my issues with your
proposal.
1) It is easily circumvented.
a) the subject uses another computer.
b) the subject programs their upstream router to drop packets intended
for the monitoring organization.
2) It violates the privacy of other users.
a) your application could, unless written specifically to avoid this,
report on the actions of those other than the subject, on a shared
computer. Note that it renders the application moot, as then the
subject creates another user to go to the proscribed sites.
b) since you have specified that the application be difficult to
un-install, if the computer is transferred to another person, their
activity will be monitored, potentially generating false positives
attributed to the original subject under surveillance.
3) It can easily generate false positives.
There are a number of exploits for systems such as phpBB that inject
hidden IFRAMEs into HTML documents, which in turn load use JavaScript
to load other URLs.
As those URLs could be on the proscribed sites list, a visit to a
hacked phpBB site, say a support group for "addicts" could spawn visits
to your list of proscribed sites.
Or, someone could attempt to spoof the monitoring server to get to
record false hits.
5) It could be exploited.
See any number of reports of buffer overflow exploits sent to this
list. Without careful detainting of user inputs (URLs) you could allow
injection of malicious code.
Those are my technical objections. As for the others:
6) Who decides what is a 'suspect site'?
The decision to classify as site as pornographic has a significant
political component.
7) Trustworthiness of the Monitoring Organization
The monitoring organization now has at least one piece of information
(the act of installation is itself a datum) that can be used to attack
a person's reputation. Will the subject be able to terminate their
relationship with the monitoring organization? What are the monitoring
organization's data privacy policies? Will violations be reported to
data aggregators such as ChoicePoint? How secure is that data?
8) Trust vs. Pervasive Surveillance
Several people said they felt a legitimate need for this software
citing "pornography addiction."
I've emailed a few friends who are in grad programs and clinical
practice to confirm if there's an actual diagnosis of "pornography
addiction". Sorry, the term feels loaded, like something tossed about
during a congressional hearing.
And others mentioned the AA angle. However, when you join AA, to the
best of my knowledge, you do not have an alcohol sensor implanted in
your esophagus or stomach to report violations to AA.
What you do have is a sponsor, who you can call if you're on the verge
of taking a drink.
And when, if ever, do you build trust with the person who you have said
you have harmed? It strikes me as too easy to leave the secret
policeman on forever. But now there's a third pillow in that bed, and I
get the feeling that you do not condone polyamory.
That's why I made those remarks comparing your plan to the abuses of
Mao's Cultural Revolution. You privatize the intrusive, something
which, until recently, was the domain of totalitarian states.
-----
In conclusion, if someone believes they have an issue with respect to
adult materials, drugs, alcohol, or anything else, then instead of
installing software, maybe they should seek out a mental health
professional, cleric, or trusted friend. They are less likely to be
abused or exploited.
In short, don't create new problems trying to solve old ones.
I doubt this will change your course, but now I've said my piece on it.
Cheers,
-- whump
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
