Category: Comment

Why blocking Newzbin2 won't make the blindest bit of difference

[Update, 5th of April 2011: Oh look, the Business Secretary Vince Cable went on record saying that the Government would stop blocking web sites using the SI of the Digital Economy Act. Heh. (Newzbin2 was blocked via legal methods offered through the Copyrights, Designs and Patents Act - making that entire equivalent section of the DEA redundant, and also upon further scrutiny, extremely poorly worded. You can also read Justice Arnold's ruling.)]

A friend emailed me a link to a BBC article [1]"BT ordered to block links to Newzbin 2 web site", BBC News, July 28 2011 discussing the 'landmark' judgment handed down by an (out of his depth?) judge regarding the enforced blocking by BT of Newzbin2 to stop its customers from accessing copyrighted materials in a piratey manner.

Everyone's dancing around the topic. (I do not advocate piracy as a means to solve the current problems the creative industries face, but I haven't paid for every single song I've ever listened to.) However the older I get, the more I understand about the importance of paying your dues - and understanding the value of a piece of music or film, and understanding why it's right to pay a fair price for it. I have, quite literally, spent thousands of pounds on my music collection, with a heavy investment into vinyl along with many CDs and even a few C90s 😉 Regrettably I believe this judgment could have serious ramifications for not only the future of entertainment industries but personal rights and freedoms. My email back to my friend turned into somewhat of a long one... And here it is reproduced for your enjoyment.

Read my reply!

References

References
↑1 "BT ordered to block links to Newzbin 2 web site", BBC News, July 28 2011

The decreasing usefulnesss of blocklists?

[Update, February 2014: I no longer use client-side blocklists. Join the discussion in the comments.]

My current job involves music and copyright to a fair extent. Ironically whilst I used to be a chronic downloader in my teens, these days not only do I enforce copyrights online, I also buy more music than ever.

However, I'm still healthily paranoid :> and I run Peerblock on every machine I touch, including work machines.

Now, dearth of available IPv4 addresses aside - and what seems to me like the increasingly futile idea of blocking ranges of IPv6 addresses! - it's incredibly difficult to accurately maintain a blocklist of IPs, let alone administer or implement dozens of them. There's too much "collateral damage" from innocent IPs. And as more lists are used and combined, the usefulness and accuracy of the blocks exponentially decreases.

Case in point (and this has made me reevaluate the usefulness of apps like Peerblock with lists from services such as iBlocklist): in the past couple of days, on machines running Peerblock with default lists and Kaspersky Internet Security have been unable to finish their daily definitions updates. How come? It turns out that all of the Kaspersky update servers are classified on half a dozen lists as "bad" IPs. To finish an update, you must disable Peerblock - hardly its intended purpose!

Currently, all Kaspersky IPs between 38.113.165.68 and .86 are in a fair few blocklists hosted on iBlocklist, for various reasons - you can view them by going to the iBlocklist query page and tapping in (for example) 38.113.165.86. Here's what I got on a query just now:

This is clearly incorrect, and as an added inconvenience Kaspersky cannot finish a definitions update until PeerBlock is temporarily disabled.

There still seems to be no easy way of flagging up specific IPs or ranges for review if they have been reassigned or are no longer under the control of the original company (as I suspect is the case with these Kaspersky IPs) - how best should we go about notifying iBlocklist as to the inaccuracy of the blocklist entries?

Anti-Infringement
BayTSP:38.0.0.0-38.255.255.255
level1
Performance Systems International-ed2k/ap2p:38.113.114.164-38.113.175.255
level2
Performance Systems International / Cogent Communications:38.108.107.69-38.114.63.255
level3
PSINet, Inc:38.0.0.0-38.114.63.255
rangetest
Performance Systems International Inc:38.0.0.0-38.114.63.255
Primary Threats
Performance Systems International-ed2k/ap2p:38.113.112.43-38.113.175.255
Business ISPs
Performance Systems International:38.0.0.0-38.255.255.255
ipfilterX
TMEOH PSI:38.0.0.0-38.255.255.255
United States
United States:38.0.0.0-38.255.255.255

Now, this is obviously far too much of a kneejerk reaction; some lists have the entire Class A range blocked and the rest have a good old dollop listed! Hammer to crack a nut anyone? Obviously one need not use every list, but the problem remains that popular programs such as Peerblock download and use several of these lists by default (including the "level1" list), and these are not being kept up to date by Bluetack, the supplier. (This has been an ongoing problem for some time).

The more you use these lists, the more you'll find legitimate IPs being blocked - I explicitly have to allow all the BBC IP addresses to use their web sites, which is intensely frustrating. My "permallow.p2b" exceptions list grows in size each day... So take everything with a pinch of salt! Disabling HTTP is a bodge workaround, but programs like Kaspersky will often use UDP on port 2001 (for example) to update, and those will always fall foul of the egress traffic block as long as people keep on using the massively popular, but stale, blacklists.

Keep watching the log windows...

This made me firmly in favour of the postal strikes

I'd recently been doing my usual fencesitting with regards to the postal strike, particularly as my workplace is directly affected by the deliverability of Royal Mail items but not wholly convinced, as it's been fairly obvious for a good long while now that the management of Royal Mail are almost completely inept at running a business in a profitable manner. (Aside - curiously, although we're affected by them, my boss supports the strikes.)

I then came across an article from September this year written by postie of seven years 'Roy Mayall' (geddit?), where he quite matter-of-factly describes the scenarios faced by RM staff on a daily basis: edicts are implemented from upon high with no real workforce consultation; posties essentially forced to lie about their work volumes in the logbooks and regularly do unpaid overtime just to keep up with the sheer volume of work; union representatives railroaded out of any serious decision-making... Plus something which surprised me the most: Royal Mail's official average of mail per bag, which they use to calculate yearly volume through their network, was not even close to the actual amount when a manual count was undertaken a little while back.

So, setting aside some of the very worrying (and arguably endemic) problems 'Roy' describes one of the Royal Mail's core claims - that volume has been down year on year necessitating all the cost-cutting measures - is most likely little more than a spurious, disingenuous statement, completely contradicted when the hard facts are examined.

If you're undecided about the postal strikes, I strongly suggest you read the article. It's a real eye-opener, and might just convince you to change your view to supporting the RM staff in their strikes if you're not 100% sure just yet. The full article can be found on the London Review of Books web site - click here to read it.

Received a letter from the Domain Registry of America? Warm the shredder up

The Domain Registry of America is a scam organisation which fraudulently invoices individuals and companies alike for renewal of .com/.net/.org domain names. They work on the assumption that clueless people will simply fill out the form and send it back - but by doing so, you end up paying far above the going rate for the domain name renewals, plus they actually take ownership of your domain names and move them away from your current registrar.

How do they send you convincingly-written letters? Well, they just poll the public whois information for your domain names (which includes expiry date, full address and full name). So, be mindful also that whatever information you provided during registration will be available for the whole world to see! You may consider anonymising some of the data, or going through a third party anonymous registrar service (which will cost extra on top of the domain registration fees - GoDaddy currently charge $20 for two years).

The Domain Registry of America is one of the older scam organisations making money off the backs of unsuspecting Internet users, but sadly their 'business' persists. UK-Cheapest has published an article detailing the DROA and their various other companies (with similar names) - read and avoid if you get a letter through the post from them!

I ♥