Normal view

There are new articles available, click to refresh the page.
Before yesterdayMain stream

Fair Use Still Protects Histories and Documentaries—Even Tiger King

15 May 2024 at 16:28

Copyright’s fair use doctrine protects lots of important free expression against the threat of ruinous lawsuits. Fair use isn’t limited to political commentary or erudite works – it also protects popular entertainment like Tiger King, Netflix’s hit 2020 documentary series about the bizarre and sometimes criminal exploits of a group of big cat breeders. That’s why a federal appeals court’s narrow interpretation of fair use in a recent copyright suit threatens not just the producers of Tiger King but thousands of creators who make documentaries, histories, biographies, and even computer software. EFF and other groups asked the court to revisit its decision. Thankfully, the court just agreed to do so.

The case, Whyte Monkee Productions v. Netflix, was brought by a videographer who worked at the Greater Wynnewood Exotic Animal Park, the Oklahoma attraction run by Joe Exotic that was chronicled in Tiger King. The videographer sued Netflix for copyright infringement over the use of his video clips of Joe Exotic in the series. A federal district court in Oklahoma found Netflix’s use of one of the video clips—documenting Joe Exotic’s eulogy for his husband Travis Maldonado—to be a fair use. A three-judge panel of the Court of Appeals for the Tenth Circuit reversed that decision and remanded the case, ruling that the use of the video was not “transformative,” a concept that’s often at the heart of fair use decisions.

The appeals court based its ruling on a mistaken interpretation of the Supreme Court’s opinion in Andy Warhol Foundation for the Visual Arts v. Goldsmith. Warhol was a deliberately narrow decision that upheld the Supreme Court’s prior precedents about what makes a use transformative while emphasizing that commercial uses are less likely to be fair. The Supreme Court held that commercial re-uses of a copyrighted work—in that case, licensing an Andy Warhol print of the artist Prince for a magazine cover when the print was based on a photo that was also licensed for magazine covers—required a strong justification. The Warhol Foundation’s use of the photo was not transformative, the Supreme Court said, because Warhol’s print didn’t comment on or criticize the original photograph, and there was no other reason why the foundation needed to use a print based on that photograph in order to depict Prince. In Whyte Monkee, the Tenth Circuit honed in on the Supreme Court’s discussion about commentary and criticism but mistakenly read it to mean that only uses that comment on an original work are transformative. The court remanded the case to the district court to re-do the fair use analysis on that basis.

As EFF, along with Authors Alliance, American Library Association, Association of Research Libraries, and Public Knowledge explained in an amicus brief supporting Netflix’s request for a rehearing, there are many kinds of transformative fair uses. People creating works of history or biography frequently reproduce excerpts from others’ copyrighted photos, videos, or artwork as indispensable historical evidence. For example, using sketches from the famous Zapruder film in a book about the assassination of President Kennedy was deemed fair, as was reproducing the artwork from Grateful Dead posters in a book about the band. Software developers use excerpts from others’ code—particularly declarations that describe programming interfaces—to build new software that works with what came before. And open government organizations, like EFF client Public.Resource.Org, use technical standards incorporated into law to share knowledge about the law. None of these uses involves commentary or criticism, but courts have found them all to be transformative fair uses that don’t require permission.

The Supreme Court was aware of these uses and didn’t intend to cast doubt on their legality. In fact, the Supreme Court cited to many of them favorably in its Warhol decision. And the Court even engaged in some non-commentary fair use itself when it included photos of Prince in its opinion to illustrate how they were used on magazine covers. If the Court had meant to overrule decades of court decisions, including its own very recent Google v. Oracle decision about software re-use, it would have said so.

Fortunately, the Tenth Circuit heeded our warning, and the warnings of Netflix, documentary filmmakers, legal scholars, and the Motion Picture Association, all of whom filed briefs. The court vacated its decision and asked for further briefing about Warhol and what it means for documentary filmmakers.

The bizarre story of Joe Exotic and his friends and rivals may not be as important to history as the Kennedy assassination, but fair use is vital to bringing us all kinds of learning and entertainment. If other courts start treating the Warhol decision as a radical rewriting of fair use law when that’s not what the Supreme Court said at all, many kinds of free expression will face an uncertain future. That’s why we’re happy that the Tenth Circuit withdrew its opinion. We hope the court will, as the Supreme Court did, reaffirm the importance of fair use.

DNS Tunneling Abuse Expands to Tracking & Scanning Victims – Source: www.darkreading.com

dns-tunneling-abuse-expands-to-tracking-&-scanning-victims-–-source:-wwwdarkreading.com

Source: www.darkreading.com – Author: Elizabeth Montalbano, Contributing Writer Source: Aleksey Funtap via Alamy Stock Photo Attackers are taking malicious manipulation of DNS traffic to the next level, abusing DNS tunneling to scan a victim’s network infrastructure as well as track victims’ online behavior. The goal? To gain useful insights into new ways to compromise organizations. […]

La entrada DNS Tunneling Abuse Expands to Tracking & Scanning Victims – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Christie’s Auction Website Hacked Just Before Major Sales

By: Alan J
13 May 2024 at 06:27

Christie’s Auction House

Just days before its highly anticipated spring art auctions, Christie's, the renowned auction house, had fallen victim to a cyberattack, taking its website offline and raising concerns about the security of client data. The Christie's auction house cyberattack has sent shockwaves through the art world, with collectors, advisers, and dealers scrambling to adapt to the sudden disruption. Christie's is a British auction house founded in 1766 by James Christie, offering around 350 different auctions annually in over 80 categories, such as decorative and fine arts, jewelry, photographs, collectibles, and wine. The auction house has a global presence in 46 countries, with 10 salerooms worldwide, including London, New York, Paris, Geneva, Amsterdam, Hong Kong, and Shanghai. The company provided a temporary webpage after its official website was taken down and later notified that the auctions would proceed despite the setbacks caused by the cyberattack.

Christie’s Auction House Cyberattack Occurs Ahead of Major Auctions

[caption id="attachment_68140" align="alignnone" width="1000"]Christie’s Auction House Cyberattack Source: Shutterstock[/caption] The cyberattack came at an inopportune time for Christie's, with several high-stakes auctions estimated at around $850 million in worth scheduled to take place in New York and Geneva. Art adviser Todd Levin highlighted the significance of the timing, expressing concern that the cyberattack was happening during a pivotal moment before the spring sales when buyers confirm their interest in artworks. He raised a pressing question: "How can potential bidders access the catalog?" The auctions will include works by Warhol, Basquiat, and Claude Monet, and pieces from the Rosa de la Cruz Collection, that are expected to generate hundreds of millions of dollars in revenue. Christie's website was taken offline following the hack which affected some of its systems. Despite the setback, Christie's has assured clients that the auctions will proceed as planned, with bidders able to participate in person, by phone, or through Christie's Live platform. Despite the hack, Christie's CEO Guillaume Cerutti assured clients that all eight live auctions in New York and Geneva would proceed as scheduled, with the exception of the Rare Watches sale, which was postponed to May 14th. In a statement, Cerutti elaborated: "I want to assure you that we are managing this incident according to our well-established protocols and practices, with the support of additional experts. This included, among other things, the proactive protection of our main website by taking it offline."

Growing Cybersecurity Concerns in the Art World

The incident is a sobering reminder of the increasing threat of cyberattacks in the art world. In recent years, several museums and art market platforms have fallen victim to hacking, highlighting the need for vigilance in protecting sensitive client information amidst slumbering sales. Earlier in January, a service provider managing the online collections of several prominent museums had been targeted, affecting institutions like The Museum of Fine Arts in Boston, the Rubin Museum of Art in New York, and the Crystal Bridges Museum of American Art. Last year in 2023, Christie's had another security incident come to light when it was discovered inadvertently exposing the GPS location and co-ordinates of several art pieces purchased by some of the world’s biggest and wealthiest collectors, revealing their exact whereabouts.  In 2017, hackers employed an email scam to intercept payments between dealers and clients, siphoning sums ranging from £10,000 to £1 million. These incidents underscore the art world's vulnerability to similar threats as the market becomes increasingly digital, auction houses and museums must take proactive steps to to invest in stronger defenses against a rapidly evolving cyber threat landscape and the risks it may pose to the art industry. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Purple Reign

By: Rhaomi
8 May 2024 at 12:58
A rare archaeological object – thought to be the only one of its type in the former Roman Empire – has been discovered in Carlisle, England. The remnants of the Roman bathhouse at the Carlisle Cricket Club have revealed an extremely rare chunk of Tyrian purple dye, the first of its kind ever discovered in northern Europe and possibly the entire Roman Empire. [...] Known as "imperial purple," tyrian purple was an extremely valuable dye in ancient Rome because of its rich, vivid color, which denoted imperial authority, wealth, and status. It took a lot of resources and labor-intensive procedures to produce even small amounts, as it was made from thousands of crushed sea snails (Bolinus brandaris) from the Mediterranean. This rarity and exclusivity meant that it was more valuable than gold, sometimes up to three times as much by weight.
Fun fact: If a buyer wanted to know if there was something fishy about their exquisite dye, they could always see if it passed the smell test -- read the straight poop inside.

MeFite peeedro offers some amusing historical context from a 2019 post:
Tyrian purple dye works were famously odoriferous, as it was made from the liquid collected after thousands of crushed shellfish were left to putrefy in the sun. The rich purple producing cities of Tyre and Sidon were "unpleasant to live in" because of the smell according to Strabo even though the dye works were well outside of the cities. But, unlike a tannery, the finished Tyrian purple cloth smelled just as bad as the process that made it. "Neither the stink nor the color is reduced by washing; perfume would have been necessary to disguise the smell, even after washing and long periods of airing." Pliny the Elder called Tyrian purple "among the most abominable of odors" and wondered how something so smelly could be highly valued. The Roman poet insult comic Martial wrote a diss track full of misogyny and antisemitism about a particular woman saying, in part, that he would prefer to smell a "fleece twice dipped in Tyrian purple" than smell her. Smelling worse than double-dipped fleece of Tyrian purple was quite the sick burn of the day.
No word on if the archaeological find at Carlisle was still a smelly one.

North Yorkshire Council to phase out apostrophe use on street signs

North Yorkshire Council to phase out apostrophe use on street signs. A local authority has announced it will ban apostrophes on street signs to avoid problems with computer systems. North Yorkshire Council is to ditch the problematic punctuation point as it says it can affect geographical databases. The council said all new street signs would be produced without one, regardless of previous use.

Why Your VPN May Not Be As Secure As It Claims

6 May 2024 at 10:24

Virtual private networking (VPN) companies market their services as a way to prevent anyone from snooping on your Internet usage. But new research suggests this is a dangerous assumption when connecting to a VPN via an untrusted network, because attackers on the same network could force a target’s traffic off of the protection provided by their VPN without triggering any alerts to the user.

Image: Shutterstock.

When a device initially tries to connect to a network, it broadcasts a message to the entire local network stating that it is requesting an Internet address. Normally, the only system on the network that notices this request and replies is the router responsible for managing the network to which the user is trying to connect.

The machine on a network responsible for fielding these requests is called a Dynamic Host Configuration Protocol (DHCP) server, which will issue time-based leases for IP addresses. The DHCP server also takes care of setting a specific local address — known as an Internet gateway — that all connecting systems will use as a primary route to the Web.

VPNs work by creating a virtual network interface that serves as an encrypted tunnel for communications. But researchers at Leviathan Security say they’ve discovered it’s possible to abuse an obscure feature built into the DHCP standard so that other users on the local network are forced to connect to a rogue DHCP server.

“Our technique is to run a DHCP server on the same network as a targeted VPN user and to also set our DHCP configuration to use itself as a gateway,” Leviathan researchers Lizzie Moratti and Dani Cronce wrote. “When the traffic hits our gateway, we use traffic forwarding rules on the DHCP server to pass traffic through to a legitimate gateway while we snoop on it.”

The feature being abused here is known as DHCP option 121, and it allows a DHCP server to set a route on the VPN user’s system that is more specific than those used by most VPNs. Abusing this option, Leviathan found, effectively gives an attacker on the local network the ability to set up routing rules that have a higher priority than the routes for the virtual network interface that the target’s VPN creates.

“Pushing a route also means that the network traffic will be sent over the same interface as the DHCP server instead of the virtual network interface,” the Leviathan researchers said. “This is intended functionality that isn’t clearly stated in the RFC [standard]. Therefore, for the routes we push, it is never encrypted by the VPN’s virtual interface but instead transmitted by the network interface that is talking to the DHCP server. As an attacker, we can select which IP addresses go over the tunnel and which addresses go over the network interface talking to our DHCP server.”

Leviathan found they could force VPNs on the local network that already had a connection to arbitrarily request a new one. In this well-documented tactic, known as a DHCP starvation attack, an attacker floods the DHCP server with requests that consume all available IP addresses that can be allocated. Once the network’s legitimate DHCP server is completely tied up, the attacker can then have their rogue DHCP server respond to all pending requests.

“This technique can also be used against an already established VPN connection once the VPN user’s host needs to renew a lease from our DHCP server,” the researchers wrote. “We can artificially create that scenario by setting a short lease time in the DHCP lease, so the user updates their routing table more frequently. In addition, the VPN control channel is still intact because it already uses the physical interface for its communication. In our testing, the VPN always continued to report as connected, and the kill switch was never engaged to drop our VPN connection.”

The researchers say their methods could be used by an attacker who compromises a DHCP server or wireless access point, or by a rogue network administrator who owns the infrastructure themselves and maliciously configures it. Alternatively, an attacker could set up an “evil twin” wireless hotspot that mimics the signal broadcast by a legitimate provider.

ANALYSIS

Bill Woodcock is executive director at Packet Clearing House, a nonprofit based in San Francisco. Woodcock said Option 121 has been included in the DHCP standard since 2002, which means the attack described by Leviathan has technically been possible for the last 22 years.

“They’re realizing now that this can be used to circumvent a VPN in a way that’s really problematic, and they’re right,” Woodcock said.

Woodcock said anyone who might be a target of spear phishing attacks should be very concerned about using VPNs on an untrusted network.

“Anyone who is in a position of authority or maybe even someone who is just a high net worth individual, those are all very reasonable targets of this attack,” he said. “If I were trying to do an attack against someone at a relatively high security company and I knew where they typically get their coffee or sandwich at twice a week, this is a very effective tool in that toolbox. I’d be a little surprised if it wasn’t already being exploited in that way, because again this isn’t rocket science. It’s just thinking a little outside the box.”

Successfully executing this attack on a network likely would not allow an attacker to see all of a target’s traffic or browsing activity. That’s because for the vast majority of the websites visited by the target, the content is encrypted (the site’s address begins with https://). However, an attacker would still be able to see the metadata — such as the source and destination addresses — of any traffic flowing by.

KrebsOnSecurity shared Leviathan’s research with John Kristoff, founder of dataplane.org and a PhD candidate in computer science at the University of Illinois Chicago. Kristoff said practically all user-edge network gear, including WiFi deployments, support some form of rogue DHCP server detection and mitigation, but that it’s unclear how widely deployed those protections are in real-world environments.

“However, and I think this is a key point to emphasize, an untrusted network is an untrusted network, which is why you’re usually employing the VPN in the first place,” Kristoff said. “If [the] local network is inherently hostile and has no qualms about operating a rogue DHCP server, then this is a sneaky technique that could be used to de-cloak some traffic – and if done carefully, I’m sure a user might never notice.”

MITIGATIONS

According to Leviathan, there are several ways to minimize the threat from rogue DHCP servers on an unsecured network. One is using a device powered by the Android operating system, which apparently ignores DHCP option 121.

Relying on a temporary wireless hotspot controlled by a cellular device you own also effectively blocks this attack.

“They create a password-locked LAN with automatic network address translation,” the researchers wrote of cellular hot-spots. “Because this network is completely controlled by the cellular device and requires a password, an attacker should not have local network access.”

Leviathan’s Moratti said another mitigation is to run your VPN from inside of a virtual machine (VM) — like Parallels, VMware or VirtualBox. VPNs run inside of a VM are not vulnerable to this attack, Moratti said, provided they are not run in “bridged mode,” which causes the VM to replicate another node on the network.

In addition, a technology called “deep packet inspection” can be used to deny all in- and outbound traffic from the physical interface except for the DHCP and the VPN server. However, Leviathan says this approach opens up a potential “side channel” attack that could be used to determine the destination of traffic.

“This could be theoretically done by performing traffic analysis on the volume a target user sends when the attacker’s routes are installed compared to the baseline,” they wrote. “In addition, this selective denial-of-service is unique as it could be used to censor specific resources that an attacker doesn’t want a target user to connect to even while they are using the VPN.”

Moratti said Leviathan’s research shows that many VPN providers are currently making promises to their customers that their technology can’t keep.

“VPNs weren’t designed to keep you more secure on your local network, but to keep your traffic more secure on the Internet,” Moratti said. “When you start making assurances that your product protects people from seeing your traffic, there’s an assurance or promise that can’t be met.”

A copy of Leviathan’s research, along with code intended to allow others to duplicate their findings in a lab environment, is available here.

A careful analyst of the textured nature of historical repetition

By: chavenet
5 May 2024 at 04:40
Thucydides intimates that the careful art of drawing fitting analogies, honed as it may be through the diligent study of political history, will assist some to think more clearly about the present. But mastering this art should not be confused with political mastery. The power of 'great' events will remain too easily harnessed, and too hard to control, to serve only those who are clear-headed and well-intentioned. Specious analogies will remain a danger for as long as people stand to benefit from them, and their emotional pull will continue to knock even the most astute off balance. And yet, if there's little chance that political life will ever be freed from distortive thinking, it may still prove less hazardous for those who look toward history as something more than a sourcebook of convenient parallels. from What would Thucydides say? [Aeon]

Thucydides previously

Who lives in a pineapple under the sea?

By: Rhaomi
1 May 2024 at 18:55
You could call them "sky flowers," but that doesn't really make sense either—after all, the faded blue behind each squiggle is water, not sky, and the squiggles themselves don't represent solid objects in any tangible, meaningful way. But they look right. The reds and greens and yellows add life and color in a way that a flat blue might not. Those odd shapes, suspended motionless with no clear reason or value, establish a tone. There are a lot of things that don't make sense on SpongeBob SquarePants. But there's a clear and coherent vision that runs through the entire show, from the design of SpongeBob's kitchen-sponge body down to the squeaky-balloon sound of his footsteps. It's a perspective, and a warm, specific, crazy little world. Of course it has sky flowers in it. What else would be up there?
Today marks 25 years since the original broadcast of "Help Wanted" -- the pilot episode of marine biologist Stephen Hillenburg's educational comic that became a delightful romp of "relentless optimism and fundamental sweetness", a hothouse flower of inventive and absurdist imagination, a cultural touchstone for multiple generations, and one of the most iconic and beloved animated franchises of the 21st century. Are you ready, kids?

Background Stephen Hillenburg, In His Own Words - "Compiled from various interviews, documentaries and other appearances, here is Stephen Hillenburg, talking about SpongeBob, his career, and more." Hillenburg's original educational comic, The Intertidal Zone, on the Internet Archive Hillenburg's death at age 57 from ALS led to an outpouring of grief and remembrance The original 1997 "story bible" SpongeBob Season 1 DVD Behind the Scenes The Oral History of SpongeBob SquarePants MeFi on the show's 10th anniversary ✏️ Animation ✏️ Spongebob Squarepants: The Art of the Gross-Up, a technique originally pioneered by Ren and Stimpy - see also: spongebobfreezeframes.tumblr.com Lovingly-curated Imgur galleries of all the matte-painting freeze-frame moments (notes):
Season 1: part one - part two - part three Season 2: part one - part two - part three - part four Season 3: part one - part two - part three - part four
(PS: Why so much focus on the first three seasons? Because Hillenburg left the show after the release of the first movie at the end of season 3, causing a noticeable decline in tone and quality.) ️ Voice Acting ️ The incredible voice cast has done plenty of table reads of key episodes (Help Wanted, Band Geeks, Shanghaied), not to mention dubbed classic cinema (previously), but most impressive are their fully-produced live-action skits: The Trusty Slab - More scenes Tom Kenny & Bill Fagerbakke Answer the Web's Most Searched Questions News you can use: How to do the SpongeBob laugh (Note that Kenny also doubled as series "host" Patchy the Pirate) ✍️ Essays + Articles ✍️ On The Postmodern Ethos Of "Spongebob Squarepants"
Like all postmodern "texts", Spongebob Squarepants doesn't deny the absurdity of existence. The show is filled with absurd and surreal moments, far too many to describe here. And as a postmodern show, Spongebob has its nihilistic moments as well. One in particular that stands out is from season three's episode "Doing Time", when Spongebob and Patrick attempt to break Mrs. Puff out of jail. After she refuses to leave, Spongebob wonders to Patrick if maybe she'd forgotten what it's like to "live in the outside world". The scene then cuts to a montage of typical postmodern malaise — a man (fish, rather) going to work, sitting in rush hour traffic, then gazing dejectedly out of his window as a woman asks if he's coming to bed. Depressing, hopeless, and completely nihilistic, this moment reminds viewers of their own mortality and the dangers of routine... or, if you're just a kid, you'll realize that being an adult can suck.
SpongeBob Made the World a Better, More Optimistic Place
On Monday, SpongeBob SquarePants creator Stephen Hillenburg died after a recent diagnosis with ALS. Nickelodeon confirmed the news on Twitter Tuesday afternoon. What followed was an outpouring of grief for the man behind one of the most recognizable and beloved cartoon characters of all time. [...] Through his show, Hilleburg was an evangelist of sorts for the unstoppable power of positive thinking, which he usually dramatized with absurd scenarios. Think of the time SpongeBob sculpts a perfect marble sculpture with a crack of the chisel, or when he wins a fast foodery face-off against the Flying Dutchman—the undead daddy of burger grilling—with the special ingredient of love. SpongeBob tackles everything in life—work, driving school, friendship, pain, lifeguarding, climate change—with a level of zealous breeziness usually reserved zen monks and six-year-old kids.
Memes Vox: How SpongeBob memes came to rule internet culture
It's hard to overstate just how popular SpongeBob SquarePants memes are. On Reddit, r/BikiniBottomTwitter — which exists mainly so that people can screencap the memes from Twitter and share them on Reddit — has more than 1.7 million subscribers, making it one of the site's most popular meme subreddits. (By comparison, the more general r/Spongebob subreddit only has 74,000 subscribers.) And SpongeBob memes don't just appear and then die; as Digg's editors noted in the site's 2018 SpongeBob retrospective, the biggest SpongeBob memes "are all pretty much meme superhits. There are no deep cuts here." What exactly is it about SpongeBob memes that make them so enduring and enjoyable?
SpongeBob SquarePants creator Stephen Hillenburg gave the internet language Revisit: A Chronology of SpongeBob Memes Tom Kenny and Bill Fagerbakke on Spongebob Meme Culture What's your favorite SpongeBob quote? Each Radiohead album described with SpongeBob -- just the first of a whole genre of video memes Music Songs:
Season 1: Opening Theme - Livin' In The Sunlight, Lovin' In The Moon Light - Ripped Pants - Jelly Fish Jam [CW: flashing lights] - The F.U.N. Song - Doing the Sponge - I Wanna Go Home Season 2: Loop de Loop - This Grill is Not a Home - Sweet Victory - Hey All You People - Hey Mean Mr. Bossman [Happy May Day, btw] Season 3: Striped Sweater - Electric Zoo - Underwater Sun - When Worlds Collide - You're Old - The Campfire Song Song
Plus a complete playlist of season 1's eclectic production music, including twangy ukelele, ragtime, traditional Hawaiian , whimsical Rakenhornpipe, and of course sea shanties like "What Shall We Do With the Drunken Sailor" Recaps + Retrospectives TVTropes' sprawling article on the series and recap of nearly the entire run Episode retrospectives:
Help Wanted (S1E1): Reimagined as a collaborative ReAnimation and as a black-and-white classic cartoon Pizza Delivery (S1E5): This Is What A Perfect Episode Of Spongebob Looks Like - A whole playlist of live-action remakes SB-129 (S1E14): How Spongebob Explored Existential Nihilism ("SB-129") Rock Bottom (S1E17): "Rock Bottom" reimagined as a Gothic claymation - Podcast discussion Hooky (S1E20): The Powerful Message In This Episode of Spongebob: Don't Get "Hooked" On Drugs Squirrel Jokes (S2E11): The Smartest Episode of Spongebob Squarepants (an Analysis) Shanghaied (S2E13): Live-action remake Band Geeks (S2E15): Band Geeks Is The Best Spongebob Episode - Band Geeks ReAnimated - the disappointing Super Bowl LIII cameo (and the improved LVIII version) Procrastination (S2E17): This SpongeBob Episode Will Make You Stop Procrastinating Sailor Mouth (S2E18): SpongeBob SwearPants: A Look At Moralization Of Swearing - Why "Sailor Mouth" Was So Controversial Squidville (S2E26): Spongebob's Darkest Episode Wet Painters (S3E10): Bubbles of Thought - Full storyboard recap Krusty Krab Training Video (S3E10): The Brilliance of Krusty Krab Training Video - Live-action remake Chocolate With Nuts (S3E12): Live-action (puppet!) remake Graveyard Shift (S3E24): How 'Nosferatu' turned up in SpongeBob SquarePants - Why a Painting of SpongeBob SquarePants Just Sold for $6 Million
The official YouTube playlist of 50 episode capsule summaries in 5 minutesClips ️ A grab-bag of memorable moments (via):
I DON'T NEED IT - How to blow a bubble - FIRMLY GRASP IT - 1% Evil, 99% Hot Gas - The gang's all here - We serve food here, sir - Krusty Krab Pizza - The pioneers used to ride these babies for miles - He's just standing there... MENACINGLY - Are there any other Squidwards I should know about? -Too hot... Too wet... Toulouse Lautrec - Everything is chrome in the future! - Photosynthesis -"MY LEG" - Advanced darkness - Steppin' on the beach - You used me... for LAND DEVELOPMENT - Stop starin' at me with them big ol' eyes - Have you finished those errands? - The story of the Ugly Barnacle - "No, this is Patrick" - Leif Ericsson Day - The boy cries him a sweater of tears, and you kill him - Ravioli Ravioli, give me the formuoli - Freeform jazz - That's OK, take your time - WHO ARE YOU PEOPLE - What I learned in boating school is... - Going on dry land - How does he dooo that? - DoodleBob - The inner machinations of my mind are an enigma - Is mayonnaise an instrument? - Flag twirlers - BIG... MEATY... CLAWS - That's his... eager face - Sweet Victory - Nosferatu! - - Sentence enhancers - Bold and Brash - MY NAME'S... NOT... RIIICK! - One Eternity Later... - Push it somewhere else - I'll remember you all in therapy - The Magic Conch - You like Krabby Patties, don't you, Squidward? - We've been smeckledorfed! - IMAGINATION - Wumbo - Smitty Werbenjagermanjensen - Striped Sweater - The French Narrator's time cards - Welcome to the Salty Spittoon, how tough are ya? - Weenie Hut, Jr.'s - The world's smallest violin - A clever visual metaphor used to personify the abstract concept of thought - Robots have taken over the world! - Spongebob and Patrick as parents - We're not cavemen -- we have technology! - HOOPLA! - Maximum Overdrive - It's time for the moment you've been waiting for - CHOCOLATE - Is your mother home? - Flatter the customer! - Mermaid Man and Barnacle Boy - What do you normally do when I'm gone? - That's a 4/4 string ostinato in D minor! Every sailor knows that means death! - Are you feeling it now, Mr. Krabs? -
Episodes
And lastly, the first three classic seasons online (click to expand)S1E1: Help Wanted / Reef Blower / Tea at the Treedome S1E2: Bubblestand / Ripped Pants S1E3: Jellyfishing / Plankton! S1E4: Naughty Nautical Neighbors / Boating School S1E5: Pizza Delivery / Home Sweet Pineapple S1E6: Mermaid Man and Barnacle Boy / Pickles S1E7: Hall Monitor / Jellyfish Jam S1E8: Sandys Rocket / Squeaky Boots S1E9: Nature Pants / Opposite Day S1E10: Culture Shock / F.U.N. S1E11: MuscleBob BuffPants / Squidward the Unfriendly Ghost S1E12: The Chaperone / Employee of the Month S1E13: Scaredy Pants / I Was a Teenage Gary S1E14: SB-129 / Karate Choppers S1E15: Sleepy Time / Suds S1E16: Valentines Day / The Paper S1E17: Arrgh! / Rock Bottom S1E18: Texas / Walking Small S1E19: Fools in April / Neptunes Spatula S1E20: Hooky / Mermaid Man and Barnacle Boy II S2E1: Your Shoes Untied / Squids Day Off S2E2: Something Smells / Bossy Boots S2E3: Big Pink Loser / Bubble Buddy S2E4: Dying for Pie / Imitation Krabs S2E5: Wormy / Patty Hype S2E6: Grandmas Kisses / Squidville S2E7: Prehibernation Week / Life of Crime S2E8: Christmas Who? S2E9: Survival of the Idiots / Dumped S2E10: No Free Rides / Im Your Biggest Fanatic S2E11: Mermaid Man and Barnacle Boy III / Squirrel Jokes S2E12: Pressure / The Smoking Peanut S2E13: Shanghaied / Gary Takes a Bath S2E14: Welcome to the Chum Bucket / Frankendoodle S2E15: The Secret Box / Band Geeks S2E16: Graveyard Shift / Krusty Love S2E17: Procrastination / Im with Stupid S2E18: Sailor Mouth / Artist Unknown S2E19: Jellyfish Hunter / The Fry Cook Games S2E20: Sandy, SpongeBob, and the Worm / Squid on Strike S3E1: The Algaes Always Greener / SpongeGuard on Duty S3E2: Club SpongeBob / My Pretty Seahorse S3E3: The Bully / Just One Bite S3E4: Nasty Patty / Idiot Box S3E5: Mermaid Man and Barnacle Boy IV / Doing Time S3E6: Snowball Effect / One Krabs Trash S3E7: As Seen on TV / Can You Spare a Dime? S3E8: No Weenies Allowed / Squilliam Returns S3E9: Krab Borg / Rock-a-Bye Bivalve S3E10: Wet Painters / Krusty Krab Training Video S3E11: Party Pooper Pants S3E12: Chocolate with Nuts / Mermaid Man and Barnacle Boy V S3E13: New Student Starfish / Clams S3E14: Ugh S3E15: The Great Snail Race / Mid-Life Crustacean S3E16: Born Again Krabs / I Had an Accident S3E17: Krabby Land / The Camping Episode S3E18: Missing Identity / Planktons Army S3E19: The Sponge Who Could Fly (The Lost Episode) S3E20: SpongeBob Meets the Strangler / Pranks a Lot
♫♪

Congress Should Just Say No to NO FAKES

29 April 2024 at 16:21

There is a lot of anxiety around the use of generative artificial intelligence, some of it justified. But it seems like Congress thinks the highest priority is to protect celebrities – living or dead. Never fear, ghosts of the famous and infamous, the U.S Senate is on it.

We’ve already explained the problems with the House’s approach, No AI FRAUD. The Senate’s version, the Nurture Originals, Foster Art and Keep Entertainment Safe, or NO FAKES Act, isn’t much better.

Under NO FAKES, any person has the right to sue anyone who has either made, or made available, their “digital replica.” A replica is broadly defined as “a newly-created, computer generated, electronic representation of the image, voice or visual likeness” of a person. The right applies to the person themselves; anyone who has a license to use their image, voice, or likeness; and their heirs for 70 years after the person dies. It’s retroactive, meaning the post-mortem right would apply immediately to the heirs of, say, Prince, Tom Petty, or Michael Jackson, not to mention your grandmother.

Boosters talk a good game about protecting performers and fans from AI scams, but NO FAKES seems more concerned about protecting their bottom line. It expressly describes the new right as a “property right,” which matters because federal intellectual property rights are excluded from Section 230 protections. If courts decide the replica right is a form of intellectual property, NO FAKES will give people the ability to threaten platforms and companies that host allegedly unlawful content, which tend to have deeper pockets than the actual users who create that content. This will incentivize platforms that host our expression to be proactive in removing anything that might be a “digital replica,” whether its use is legal expression or not. While the bill proposes a variety of exclusions for news, satire, biopics, criticism, etc. to limit the impact on free expression, interpreting and applying those exceptions is even more likely to make a lot of lawyers rich.

This “digital replica” right effectively federalizes—but does not preempt—state laws recognizing the right of publicity. Publicity rights are an offshoot of state privacy law that give a person the right to limit the public use of her name, likeness, or identity for commercial purposes, and a limited version of it makes sense. For example, if Frito-Lay uses AI to deliberately generate a voiceover for an advertisement that sounds like Taylor Swift, she should be able to challenge that use. The same should be true for you or me.

Trouble is, in several states the right of publicity has already expanded well beyond its original boundaries. It was once understood to be limited to a person’s name and likeness, but now it can mean just about anything that “evokes” a person’s identity, such as a phrase associated with a celebrity (like “Here’s Johnny,”) or even a cartoonish robot dressed like a celebrity. In some states, your heirs can invoke the right long after you are dead and, presumably, in no position to be embarrassed by any sordid commercial associations. Or for anyone to believe you have actually endorsed a product from beyond the grave.

In other words, it’s become a money-making machine that can be used to shut down all kinds of activities and expressive speech. Public figures have brought cases targeting songs, magazine features, and even computer games. As a result, the right of publicity reaches far beyond the realm of misleading advertisements and courts have struggled to develop appropriate limits.

NO FAKES leaves all of that in place and adds a new national layer on top, one that lasts for decades after the person replicated has died. It is entirely divorced from the incentive structure behind intellectual property rights like copyright and patents—presumably no one needs a replica right, much less a post-mortem one, to invest in their own image, voice, or likeness. Instead, it effectively creates a windfall for people with a commercially valuable recent ancestor, even if that value emerges long after they died.

What is worse, NO FAKES doesn’t offer much protection for those who need it most. People who don’t have much bargaining power may agree to broad licenses, not realizing the long-term risks. For example, as Jennifer Rothman has noted, NO FAKES could actually allow a music publisher who had licensed a performers “replica right” to sue that performer for using her own image. Savvy commercial players will build licenses into standard contracts, taking advantage of workers who lack bargaining power and leaving the right to linger as a trap only for unwary or small-time creators.

Although NO FAKES leaves the question of Section 230 protection open, it’s been expressly eliminated in the House version, and platforms for user-generated content are likely to over-censor any content that is, or might be, flagged as containing an unauthorized digital replica. At the very least, we expect to see the expansion of fundamentally flawed systems like Content ID that regularly flag lawful content as potentially illegal and chill new creativity that depends on major platforms to reach audiences. The various exceptions in the bill won’t mean much if you have to pay a lawyer to figure out if they apply to you, and then try to persuade a rightsholder to agree.

Performers and others are raising serious concerns. As policymakers look to address them, they must take care to be precise, careful, and practical. NO FAKES doesn’t reflect that care, and its sponsors should go back to the drawing board. 

RansomHouse Strikes Again: Banten Regional Development Bank Tbk Targeted

RansomHouse Cyberattack

RansomHouse, a notorious ransomware group, has struck again. This time, their alleged target is the Bank Pembangunan Daerah Banten Tbk, a regional development bank owned by the government of Banten province, Indonesia.

While the full extent of the cyberattack on Banten Regional Development Bank remains undisclosed, the implications could be significant given the nature of the institution and its focus on micro-enterprises and small and medium enterprises (SMEs).

The claim made by RansomHouse regarding the cyberattack on Banten Regional Development Bank raises serious concerns about data security and the vulnerability of financial institutions to cyber threats.

Implications of Cyberattack on Banten Regional Development Bank

With a reported revenue of $27 million, the potential impact of such an attack could be far-reaching, not only in terms of financial losses but also in terms of customer trust and market stability. [caption id="attachment_64561" align="aligncenter" width="586"]RansomHouse Strikes Again Source: X[/caption] However, the authenticity of the ransomware group claim remains uncertain. Despite the announcement of the Banten Regional Development Bank cyberattack by the ransomware group, the bank's official website appears to be fully functional, raising doubts about the validity of the ransomware group's assertion. The lack of an official response from the bank further complicates the matter, leaving the claim unverified.

RansomHouse: Modus Operandi

RansomHouse, which emerged in March 2022, is known for its multi-pronged extortion tactics. Unlike traditional ransomware groups, RansomHouse claims to focus solely on extortion, threatening to publicly disclose stolen data rather than encrypting it. This modus operandi is designed to maximize pressure on victims to pay the ransom. The group portrays itself as a 'force for good', aiming to expose companies' vulnerabilities and shortcomings. The group primarily targets large enterprises and high-value entities through phishing and spear-phishing emails. They often utilize sophisticated third-party frameworks like Vatet Loader, Metasploit, and Cobalt Strike to infiltrate their targets' networks. This ransomware group typically demands payment in Bitcoin, enhancing the anonymity of transactions and making it difficult for law enforcement agencies to track.

Recent Claims by RansomHouse

This recent cyberattack on Banten Regional Development Bank follows a pattern of similar incidents targeting prominent organizations. In April, RansomHouse allegedly targeted Lopesan Hotels, claiming to have obtained sensitive data amounting to 650GB, including details of hotel revenue and employee information. Before that, in February, the group targeted Webber International University and GCA Nederland, adding them to their list of victims on the dark web portal. The rise of ransomware attacks highlights the urgent need for organizations to strengthen their cybersecurity measures. With cybercriminals becoming increasingly sophisticated, traditional security protocols may no longer be sufficient to defend against such threats. For financial institutions like Banten Regional Development Bank, protecting sensitive customer data is paramount. Beyond financial losses, a cyberattack can severely damage a bank's reputation and erode customer trust. Therefore, investing in cybersecurity should be a top priority for such organizations. In conclusion, the alleged cyberattack on Banten Regional Development Bank by Ransomware group underlines the growing threat posed by ransomware groups to organizations worldwide. While the authenticity of the claim remains unverified, the incident serves as a wake-up call for businesses to enhance their cybersecurity defenses. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Cyberattack Disables Ukrainian Broadcaster 1+1 Media, Affecting 39 Channels

Cyberattack on 1+1 Media

One of Ukraine's major media conglomerates, 1+1 Media, reported a debilitating cyberattack targeting its satellite TV channels. In a statement released on Wednesday regarding the cyberattack on 1+1 Media, the media giant revealed that 39 channels, including some of its flagship networks, were rendered inaccessible, marking a significant blow to the country's media infrastructure.

According to the officials, the cyberattack on 1+1 Media, which occurred in parallel with heightened tensions in the region, particularly the "cynical attack" on peaceful Chernihiv, saw deliberate attempts to disrupt satellite communications on the Astra 4A 11766 H transponder. Cyberattack on 1+1 Media This transponder hosts the broadcasts of 39 TV channels, including those operated by Vlasna and partner channels under the 1+1 Media umbrella such as 1+1 Ukraine, 1+1 Marathon, 2+2, TET, PLUSPLUS, Bigudi, KVARTAL TV, among others. Consequently, the affected channels experienced temporary slowdowns as efforts to rectify the issue were underway.

Suspected Russian Involvement in Cyberattack on 1+1 Media

1+1 Media's official notice suggested strong indications of the involvement of the Russian Federation in the cyberattack. The Ukraine media house pointed to Russia's alleged active jamming of satellite signals belonging to Ukrainian TV channels on the Astra 4A and Hotbird 13E satellites, both operated by European telecommunications companies SES and Eutelsat. This cyberattack on 1+1 Media marks a concerning escalation in Russia's ongoing efforts to disrupt Ukrainian media and sow disinformation. The backdrop to this latest 1+1 Media cyberattack is the broader context of cyber warfare and propaganda tactics employed amidst the conflict between Ukraine and Russia. Notably, in February 2024, Ukraine experienced a larger-scale implementation of its TV program on the Astra 4A satellite, which faced immediate challenges due to Russian interference. This pattern highlights Russia's strategic aim to undermine Ukrainian sovereignty and manipulate public perception, particularly in regions adjacent to the conflict zones. In response to the cyberattack, Ukrainian media outlets issued calls for heightened vigilance and information hygiene among citizens. The dissemination of accurate information amidst a barrage of disinformation campaigns becomes increasingly crucial in safeguarding national stability and countering hostile narratives. Recommendations were made for alternative means of accessing TV signals, including T2, cable, OTT, and internet-based platforms, to mitigate the impact of future attacks on satellite broadcasts.

Persistent Threat Amidst Allegations

This incident adds to a series of cyber assaults that Ukraine has endured since Russia's full-scale invasion in February 2022. Kyiv has consistently pointed fingers at Moscow for orchestrating these attacks, accusing Russia of employing cyber warfare as a tool to destabilize the country. Despite repeated allegations, Russian authorities have remained silent on the matter, declining to address accusations of involvement in cyber offensives against Ukraine. Among the affected media outlets, Ukraine's 24 Channel also reported disruptions to its satellite broadcast, attributing the incident to hackers launching propaganda campaigns. Despite efforts to restore the signal, the channel encountered persistent attacks, highlighting the relentless nature of cyber threats faced by Ukrainian media organizations. As Ukraine grapples with the multifaceted challenges posed by cyber warfare, the latest assault on its media infrastructure underlines the urgent need for international collaboration in combating cyber threats and safeguarding the integrity of democratic institutions. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

RansomHouse Allegedly Strikes Lopesan Hotels: 650GB Data Breach Unfolds

18 April 2024 at 00:32

RansomHouse group, lopesan data breach

The RansomHouse group allegedly added Lopesan Hotels to the list of victims on its extortion site, claiming that they had obtained 650GB of data regarding the hotel revenue ($382.4M) and details about 408 employees. The group claims to have encrypted the data on March 22 2024 while stating that the company is not interested in the confidential data being leaked on the internet. The Lopesan Hotel Group is a family-owned group that began its activities in 1972 as group that takes on public construction projects. The hotel chain later scaled to become a multinational company, operating from its headquarters in the Gran Canaria islands.

RansomHouse Group Shares Details on the Lopesan Hotels Cyberattack

The Cyber Express has reached out to the hotel group to learn more about this Lopesan Hotels cyberattack. However, at the time of writing this, no official statement or response has been received, leaving the claims for this intrusion stand unverified right now. However, the hacker group alleges that along with the claims of the cyberattack, the group added that the hotel chain is failing to resolve the cyberattack situation, stating, "Dear Lopesan Hotel Group, We are sure that you are not interested in your confidential data to be leaked or sold to a third party. We highly advise you to start resolving that situation." Moreover, RansomHouse shared a link to the downloadable data that doesn't require any password, making the data available to all the users on the data leak site.

RansomHouse Group is Known to Target High-Value Targets

The ransomware gang that claimed this attack began as a ransomware-as-a-service operation that emerged in late 2021 with active attacks against the networks of large enterprises and high-value targets. RansomHouse initially began targeting Italy, but later began targeting countries such as the United States and Spain. The group primarily tends to target the industrial and technology sectors and  set up a victim extortion page  on May 2022. In the words of RansomHouse representatives, the group claims to not encrypt data and that they are 'extortion only,' claiming itself as a ‘force for good’ that intends ‘shine a light’ on companies with poor security practices. The group has been observed accepting only Bitcoin payments. The group's operations tend to be smaller and more sophisticated than some of the bigger contemporary ransomware groups. They are known to recruit members on prominent underground marketplaces and utilize a Tor-based chat room for ransom negotiations. Since the group tends to conduct extortion only attacks, their techniques tend to be stealthier and quicker as no encryption process occurs and typical ransomware detection triggers are avoided.

RansomHouse Group Was Responsible for Massive Data Breaches

The RansomHouse group recently developed a new tool dubbed as 'MrAgent' that targets VMware ESXi hypervisors typically known to house valuable data.  The group targeted several large-sized organizations through the last year. Their campaigns include attacks such as the theft of 450 GB of data from the semi-conductor giant AMD, an attack disrupting the healthcare services of the Hospital Clínic de Barcelona in Spain, and an an attack on Shoprite, Africa's largest supermarket chain The sophistication of the RansomHouse group's campaigns and scale of their attacks demand heightened vigilance and proactive defense strategies to safeguard against similar breaches, despite their claims to be a positive force. As for the Lopesan Hotels cyberattack, this is an ongoing story. The Cyber Express will be monitoring the situation and we'll update this post once we have more information on this alleged attack or any official confirmation from Lopesan Hotels. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

How to protect yourself from online harassment

10 April 2024 at 15:19

It takes a little to receive a lot of online hate today, from simply working as a school administrator to playing a role in a popular movie or video game.

But these moments of personal crisis have few, immediate solutions, as the current proposals to curb and stem online harassment zero in on the systemic—such as changes in data privacy laws to limit the personal information that can be weaponized online or calls for major social media platforms to better moderate hateful content and its spread.

Such structural shifts can take years (if they take place at all), which can leave today’s victims feeling helpless.

There are, however, a few steps that everyday people can take, starting now, to better protect themselves against online hate and harassment campaigns. And thankfully, none of them involve “just getting off the internet,” a suggestion that, according to Leigh Honeywell, is both ineffective and unwanted.

“The [idea that the] answer to being bullied is that you shouldn’t be able to participate in public life—I don’t think that’s okay,” said Honeywell, CEO and co-founder of the digital safety consultancy Tall Poppy.

Speaking to me on the Lock and Code podcast last month, Honeywell explained that Tall Poppy’s defense strategies to online harassment incorporate best practices from Honeywell’s prior industry—cybersecurity.

Here are a few steps that people can proactively take to limit online harassment before it happens.

Get good at Googling yourself

One of the first steps in protecting yourself from online harassment is finding out what information about you is already available online. This is because, as Honeywell said, much of that information can be weaponized for abuse.

Picture an angry diner posting a chef’s address on Yelp alongside a poor review, or a complete stranger sending in a fake bomb threat to a school address, or a real-life bully scraping the internet for embarrassing photos of someone they want to harass.  

All this information could be available online, and the best way to know if it exists is to do the searching yourself.

As for where to start?

“First name, last name, city name, or other characteristics about yourself,” Honeywell said, listing what, specifically, to search online.

It’s important to understand that the online search itself may not bring immediate results, but it will likely reveal active online profiles on platforms like LinkedIn, X (formerly Twitter), Facebook, and Instagram. If those profiles are public, an angry individual could scrape relevant information and use it to their advantage. Even a LinkedIn profile could be weaponized by someone who calls in fake complaints to a person’s employer, trying to have them fired from their position.

In combing through the data that you can find about yourself online, Honeywell said people should focus on what someone else could do with that data.

“If an adversary was trying to find out information about me, what would they find?” Honeywell said. “If they had that information, what would they do with it?”

Take down what you can

You’ve found what an adversary might use against you online. Now it’s time to take it down.

Admittedly, this can be difficult in the United States, as Americans are not protected by a national data privacy law that gives them the right to request their data be deleted from certain websites, platforms, and data brokers.

Where Americans could find some help, however, is from online resources and services that streamline the data removal process that is enshrined in some state laws. These tools, like the iOS app Permission Slip, released by Consumer Reports in 2022, show users what types of information companies are collecting about them, and give user the opportunity to request that such data be deleted.

Separately, Google released on online tool in 2023 where users can request that certain search results that contain their personal information be removed. You can learn more about the tool, called “Results about you,” here.

When all else fails, Honeywell said that people shouldn’t be afraid to escalate the situation to their state’s regulators. That could include filing an official complaint with a State Attorney General, or with the Consumer Financial Protection Bureau, or the Federal Trade Commission.

“It sounds like the big guns,” Honeywell said, “but I think it’s important that, as individuals, we do what we can to hold the companies that are creating this mess accountable.”

Lock down your accounts

If an adversary can’t find your information through an online search, they may try to steal that information by hacking into your accounts, Honeywell said.

“If I’m mad at David, I’m going to hack into David’s email and share personal information,” Honeywell said. “That’s a fairly standard way that we see some of the worst online harassment attacks escalate.”

While hackers may have plenty of novel tools at their disposal, the best defenses you can implement today are the use of unique passwords and multifactor authentication.

Let’s first talk about unique passwords.

Each and every single one of your online accounts—from your email, to your social media profiles, to your online banking—should have a strong, unique password. And because you likely have dozens upon dozens of online accounts to manage, you should keep track of all those passwords with a devoted password manager.

Using unique passwords is one of the best defenses to company data breaches that expose user login credentials. Once those credentials are available on the dark web, hackers will buy those credentials so they can attempt to use them to gain access to other online accounts. You can prevent those efforts going forward by refusing to repeat passwords across any of your online accounts.

Now, start using multifactor authentication, if you’re not already.

Multifactor authentication is offered by most major companies and services today, from your bank, to your email, to your medical provider. By using multifactor authentication, also called MFA or 2FA, you will be required to “authenticate” yourself with more than just your password. This means that when you enter your username and password onto a site or app, you will also be prompted with entering a separate code that is, in many cases, sent to your phone via text or an app.

MFA is one of the strongest protections to password abuse, ensuring that, even if a hacker has your username and password, they still can’t access your account because they will not have the additional authentication that is required to complete a login.

In the world of cybersecurity, these two defense practices are among the gold standard in stopping cyberattacks. In the world of online harassment, they’re much the same—they work to prevent the abuse of your online accounts.

Here to help

Online harassment is an isolating experience, but protecting yourself against it can be quite the opposite. Honeywell suggested that, for those who feel overwhelmed or who do not know where to start, they can find a friend to help.

“Buddy up,” Honeywell said. “If you’ve got a friend who’s good at Googling, work on each other’s profile, identify what information is out there about you.”

Honeywell also recommended going through data takedown requests together, as the processes can be “extremely tedious” and some of the services that promise to remove your information from the internet are really only trying to sell you a service.

If you’re still wondering what information about you is online and you aren’t comfortable with your way around Google, Malwarebytes has a new, free tool that reveals what information of yours is available on the dark web and across the internet at large. The Digital Footprint Portal, released in April, provides free, unlimited scans for everyone, and it can serve as a strong first step in understanding what information of yours needs to be locked down.

To learn what information about you has been exposed online, use our free scanner below.

KDE 6 release: D-Bus and Polkit galore

3 April 2024 at 15:57

The SUSE security team restricts the installation of system wide D-Bus services and Polkit policies in openSUSE distributions and derived SUSE products. Any package that ships these features needs to be reviewed by us first, before it can be added to production repositories.

In November, openSUSE KDE packagers approached us with a long list of KDE components for an upcoming KDE6 major release. The packages needed adjusted D-Bus and Polkit whitelistings due to renamed interfaces or other breaking changes. Looking into this many components at once was a unique experience that also led to new insights, which will be discussed in this article.

For readers that are new to D-Bus and/or Polkit, the following sections offer a summary to get a better idea about these systems.

↫ Matthias Gerstner

You don’t get these kinds of in-depth looks at how a major new release like KDE 6 gets implemented in a popular distribution like openSUSE. What’s especially crazy is that this only really covers D-Bus and Polkit, and those are just two of the countless aspects of openSUSE affected by KDE 6.

Making the Law Accessible in Europe and the USA

14 March 2024 at 17:46

Special thanks to EFF legal intern Alissa Johnson, who was the lead author of this post.

Earlier this month, the European Union Court of Justice ruled that harmonized standards are a part of EU law, and thus must be accessible to EU citizens and residents free of charge.

While it might seem like common sense that the laws that govern us should be freely accessible, this question has been in dispute in the EU for the past five years, and in the U.S. for over a decade. At the center of this debate are technical standards, developed by private organizations and later incorporated into law. Before they were challenged in court, standards-development organizations were able to limit access to these incorporated standards through assertions of copyright. Regulated parties or concerned citizens checking compliance with technical or safety standards had to do so by purchasing these standards, often at significant expense, from private organizations. While free alternatives, like proprietary online “reading rooms,” were sometimes available, these options had their own significant downsides, including limited functionality and privacy concerns.

In 2018, two nonprofits, Public.Resource.Org and Right to Know, made a request to the European Commission for access to four harmonized standards—that is, standards that apply across the European Union—pertaining to the safety of toys. The Commission refused to grant them access on the grounds that the standards were copyrighted.   

The nonprofits then brought an action before the General Court of the European Union seeking annulment of the Commission’s decision. They made two main arguments. First, that copyright couldn’t be applicable to the harmonized standards, and that open access to the standards would not harm the commercial interests of the European Committee for Standardization or other standard setting bodies. Second, they argued that the public interest in open access to the law should override whatever copyright interests might exist. The General Court rejected both arguments, finding that the threshold for originality that makes a work eligible for copyright protection had been met, the sale of standards was a vital part of standards bodies’ business model, and the public’s interest in ensuring the proper functioning of the European standardization system outweighed their interest in free access to harmonized standards.

Last week, the EU Court of Justice overturned the General Court decision, holding that EU citizens and residents have an overriding interest in free access to the laws that govern them. Article 15(3) of the Treaty on the Functioning of the EU and Article 42 of the Charter of Fundamental Rights of the EU guarantee a right of access to documents of Union institutions, bodies, offices, and agencies. These bodies can refuse access to a document where its disclosure would undermine the protection of commercial interests, including intellectual property, unless there is an overriding public interest in disclosure.

Under the ECJ’s ruling, standards written by private companies, but incorporated into legislation, now form part of EU law. People need access to these standards to determine their own compliance. While compliance with harmonized standards is not generally mandatory, it is in the case of the toy safety standards in question here. Even when compliance is not mandatory, products that meet technical standards benefit from a “presumption of conformity,” and failure to conform can impose significant administrative difficulties and additional costs.

Given that harmonized standards are a part of EU law, citizens and residents of member states have an interest in free access that overrides potential copyright concerns. Free access is necessary for economic actors “to ascertain unequivocally what their rights and obligations are,” and to allow concerned citizens to examine compliance. As the U.S. Supreme Court noted in in 2020, “[e]very citizen is presumed to know the law, and it needs no argument to show that all should have free access” to it.

The Court of Justice’s decision has far-reaching effects beyond the four toy safety standards under dispute. Its reasoning classifying these standards as EU law applies more broadly to standards incorporated into law. We’re pleased that under this precedent, EU standards-development organizations will be required to disclose standards on request without locking these important parts of the law behind a paywall.

SXSW Tried to Silence Critics with Bogus Trademark and Copyright Claims. EFF Fought Back.

13 March 2024 at 19:01

Special thanks to EFF legal intern Jack Beck, who was the lead author of this post.

Amid heavy criticism for its ties to weapons manufacturers supplying Israel, South by Southwest—the organizer of an annual conference and music festival in Austin—has been on the defensive. One tool in their arsenal: bogus trademark and copyright claims against local advocacy group Austin for Palestine Coalition.

The Austin for Palestine Coalition has been a major source of momentum behind recent anti-SXSW protests. Their efforts have included organizing rallies outside festival stages and hosting an alternative music festival in solidarity with Palestine. They have also created social media posts explaining the controversy, criticizing SXSW, and calling on readers to email SXSW with demands for action. The group’s posts include graphics that modify SXSW’s arrow logo to add blood-stained fighter jets. Other images incorporate patterns evoking SXSW marketing materials overlaid with imagery like a bomb or a bleeding dove.

Graphic featuring parody of SXSW arrow logo and a bleeding dove in front of a geometric background, with the text "If SXSW wishes to retain its credibility, it must change course by disavowing the normalization of militarization within the tech and entertainment industries."

One of Austin for Palestine's graphics

Days after the posts went up, SXSW sent a cease-and-desist letter to Austin for Palestine, accusing them of trademark and copyright infringement and demanding they take down the posts. Austin for Palestine later received an email from Instagram indicating that SXSW had reported the post for violating their trademark rights.

We responded to SXSW on Austin for Palestine’s behalf, explaining that their claims are completely unsupported by the law and demanding they retract them.

The law is clear on this point. The First Amendment protects your right to make a political statement using trademark parodies, whether or not the trademark owner likes it. That’s why trademark law applies a different standard (the “Rogers test”) to infringement claims involving expressive works. The Rogers test is a crucial defense against takedowns like these, and it clearly applies here. Even without Rogers’ extra protections, SXSW’s trademark claim would be bogus: Trademark law is about preventing consumer confusion, and no reasonable consumer would see Austin for Palestine’s posts and infer they were created or endorsed by SXSW.

SXSW’s copyright claims are just as groundless. Basic symbols like their arrow logo are not copyrightable. Moreover, even if SXSW meant to challenge Austin for Palestine’s mimicking of their promotional material—and it’s questionable whether that is copyrightable as well—the posts are a clear example of non-infringing fair use. In a fair use analysis, courts conduct a four-part analysis, and each of those four factors here either favors Austin for Palestine or is at worst neutral. Most importantly, it’s clear that the critical message conveyed by Austin for Palestine’s use is entirely different from the original purpose of these marketing materials, and the only injury to SXSW is reputational—which is not a cognizable copyright injury.

SXSW has yet to respond to our letter. EFF has defended against bogus copyright and trademark claims in the past, and SXSW’s attempted takedown feels especially egregious considering the nature of Austin for Palestine’s advocacy. Austin for Palestine used SXSW’s iconography to make a political point about the festival itself, and neither trademark nor copyright is a free pass to shut down criticism. As an organization that “dedicates itself to helping creative people achieve their goals,” SXSW should know better.

EFF to Ninth Circuit: There’s No Software Exception to Traditional Copyright Limits

11 March 2024 at 18:31

Copyright’s reach is already far too broad, and courts have no business expanding it any further, particularly where that reframing will undermine adversarial interoperability. Unfortunately, a federal district court did just that in the latest iteration of Oracle v. Rimini, concluding that software Rimini developed was a “derivative work” because it was intended to interoperate with Oracle's software, even though the update didn’t use any of Oracle’s copyrightable code.

That’s a dangerous precedent. If a work is derivative, it may infringe the copyright in the preexisting work from which it, well, derives. For decades, software developers have relied, correctly, on the settled view that a work is not derivative under copyright law unless it is “substantially similar” to a preexisting work in both ideas and expression. Thanks to that rule, software developers can build innovative new tools that interact with preexisting works, including tools that improve privacy and security, without fear that the companies that hold rights in those preexisting works would have an automatic copyright claim to those innovations.

That’s why EFF, along with a diverse group of stakeholders representing consumers, small businesses, software developers, security researchers, and the independent repair community, filed an amicus brief in the Ninth Circuit Court of Appeals explaining that the district court ruling is not just bad policy, it’s also bad law.  Court after court has confronted the challenging problem of applying copyright to functional software, and until now none have found that the copyright monopoly extends to interoperable software absent substantial similarity. In other words, there is no “software exception” to the definition of derivative works, and the Ninth Circuit should reject any effort to create one.

The district court’s holding relied heavily on an erroneous interpretation of a 1998 case, Micro Star v. FormGen. In that case, the plaintiff, FormGen, published a video game following the adventures of action hero Duke Nukem. The game included a software tool that allowed players themselves to build new levels to the game and share them with others. Micro Star downloaded hundreds of those user-created files and sold them as a collection. When FormGen sued for copyright infringement, Micro Star argued that because the user files didn’t contain art or code from the FormGen game, they were not derivative works.

The Ninth Circuit Court of Appeals ruled against Micro Star, explaining that:

[t]he work that Micro Star infringes is the [Duke Nukem] story itself—a beefy commando type named Duke who wanders around post-Apocalypse Los Angeles, shooting Pig Cops with a gun, lobbing hand grenades, searching for medkits and steroids, using a jetpack to leap over obstacles, blowing up gas tanks, avoiding radioactive slime. A copyright owner holds the right to create sequels and the stories told in the [user files] are surely sequels, telling new (though somewhat repetitive) tales of Duke’s fabulous adventures.

Thus, the user files were “substantially similar” because they functioned as sequels to the video game itself—specifically the story and principal character of the game. If the user files had told a different story, with different characters, they would not be derivative works. For example, a company offering a Lord of the Rings game might include tools allowing a user to create their own character from scratch. If the user used the tool to create a hobbit, that character might be considered a derivative work. A unique character that was simply a 21st century human in jeans and a t-shirt, not so much.

Still, even confined to its facts, Micro Star stretched the definition of derivative work. By misapplying Micro Star to purely functional works that do not incorporate any protectable expression, however, the district court rewrote the definition altogether. If the court’s analysis were correct, rightsholders would suddenly have a new default veto right in all kinds of works that are intended to “interact and be useable with” their software. Unfortunately, they are all too likely to use that right to threaten add-on innovation, security, and repair.

Defenders of the district court’s approach might argue that interoperable software will often be protected by fair use. As copyrightable software is found in everything from phones to refrigerators, fair use is an essential safeguard for the development of interoperable tools, where those tools might indeed qualify as derivative works. But many developers cannot afford to litigate the question, and they should not have to just because one federal court misread a decades-old case.

Save Your Twitter Account

By: Rory Mir
25 January 2024 at 19:02

We're taking part in Copyright Week, a series of actions and discussions supporting key principles that should guide copyright policy. Every day this week, various groups are taking on different elements of copyright law and policy, addressing what's at stake and what we need to do to make sure that copyright promotes creativity and innovation.

Amid reports that X—the site formerly known as Twitter—is dropping in value, hindering how people use the site, and engaging in controversial account removals, it has never been more precarious to rely on the site as a historical record. So, it’s important for individuals to act now and save what they can. While your tweets may feel ephemeral or inconsequential, they are part of a greater history in danger of being wiped out.

Any centralized communication platform, particularly one operated for profit, is vulnerable to being coopted by the powerful. This might mean exploiting users to maximize short-term profits or changing moderation rules to silence marginalized people and promote hate speech. The past year has seen unprecedented numbers of users fleeing X, Reddit, and other platforms over changes in policy

But leaving these platforms, whether in protest, disgust, or boredom, leaves behind an important digital record of how communities come together and grow.

Archiving tweets isn’t just for Dril and former presidents. In its heyday, Twitter was an essential platform for activists, organizers, journalists, and other everyday people around the world to speak truth to power and fight for social justice. Its importance for movements and building community was noted by oppressive governments around the world, forcing the site to ward off data requests and authoritarian speech suppression

A prominent example in the U.S. is the movement for Black Lives, where activists built momentum on the site and found effective strategies to bring global attention to their protests. Already though, #BlackLivesMatter tweets from 2014 are vanishing from X, and the site seems to be blocking and disabling  tools from archivists preserving this history.

In documenting social movements we must remember social media is not an archive, and platforms will only store (and gate keep) user work insofar as it's profitable, just as they only make it accessible to the public when it is profitable to do so. But when platforms fail, with them goes the history of everyday voices speaking to power, the very voices organizations like EFF fought to protect. The voice of power, in contrast, remains well documented.

In the battleground of history, archival work is cultural defense. Luckily, digital media can be quickly and cheaply duplicated and shared. In just a few minutes of your time, the following easy steps will help preserve not just your history, but the history of your community and the voices you supported.

1. Request Your Archive

Despite the many new restrictions on Twitter access, the site still allows users to backup their entire profile in just a few clicks.

  • First, in your browser or the X app, navigate to Settings. This will look like three dots, and may say "More" on the sidebar.

  • Select Settings and Privacy, then Your Account, if it is not already open.

  • Here, click Download an archive of your data

  • You'll be prompted to sign into your account again, and X will need to send a verification code to your email or text message. Verifying with email may be more reliable, particularly for users outside of the US.

  • Select Request archive

  • Finally—wait. This process can take a few days, but you will receive an email once it is complete. Eventually you will get an email saying that your archive is ready. Follow that link while logged in and download the ZIP files.

2. Optionally, Share with a Library or Archive.

There are many libraries, archives, and community groups who would be interested in preserving these archives. You may want to reach out to a librarian to help find one curating a collection specific to your community.

You can also request that your archive be preserved by the Internet Archive's Wayback Machine. While these steps are specific to the Internet Archive. We recommend using a desktop computer or laptop, rather than a mobile device.

  • Unpack the ZIP file you downloaded in the previous section.
  • In the Data folder, select the tweets.js file. This is a JSON file with just your tweets. JSON files are difficult to read, but you can convert it to a CSV file and view them in a spreadsheet program like Excel or LibreOffice Calc as a free alternative.
  • With your accounts and tweets.js file ready, go to the Save Page Now's Google Sheet Interface and select "Archive all your Tweets with the Wayback Machine.”

  • Fill in your Twitter handle, select your "tweets.js" file from Step 2 and click "Upload."

  • After some processing, you will be able to download the CSV file.
  • Import this CSV to a new Google Sheet. All of this information is already public on Twitter, but if you notice very sensitive content, you can remove those lines. Otherwise it is best to leave this information untampered.
  • Then, use Save Page Now's Google Sheet Interface again to archive from the sheet made in the previous step.
  • It may take hours or days for this request to fully process, but once it is complete you will get an email with the results.
  • Finally, The Wayback Machine will give you the option to also preserve all of your outlinks as well. This is a way to archive all the website URLs you shared on Twitter. This is an easy way to further preserve the messages you've promoted over the years.

3. Personal Backup Plan

Now that you have a ZIP file with all of your Twitter data, including public and private information, you may want to have a security plan on how to handle this information. This plan will differ for everyone, but these are a few steps to consider.

If you only wish to preserve the public information you already successfully shared with an archive, you can delete the archive. For anything you would like to keep but may be sensitive, you may want to use a tool to encrypt the file and keep it on a secure device.

Finally, even if this information is not sensitive, you'll want to be sure you have a solid backup plan. If you are still using Twitter, this means deciding on a schedule to repeat this process so your archive is up to date. Otherwise, you'll want to keep a few copies of the file across several devices. If you already have a plan for backing up your PC, this may not be necessary.

4. Closing Your Account

Finally, you'll want to consider what to do with your current Twitter account now that all your data is backed up and secure.

(If you are planning on leaving X, make sure to follow EFF on Mastodon, Bluesky or another platform.)

Since you have a backup, it may be a good idea to request data be deleted on the site. You can try to delete just the most sensitive information, like your account DMs, but there's no guarantee Twitter will honor these requests—or that it's even capable of honoring such requests. Even EU citizens covered by the GDPR will need to request the deletion of their entire account.

If you aren’t concerned about Twitter keeping this information, however, there is some value in keeping your old account up. Holding the username can prevent impersonators, and listing your new social media account will help people on the site find you elsewhere. In our guide for joining mastodon we recommended sharing your new account in several places. However, adding the new account to one's Twitter name will have the best visibility across search engines, screenshots, or alternative front ends like nitter.

It's Copyright Week 2024: Join Us in the Fight for Better Copyright Law and Policy

22 January 2024 at 14:12

We're taking part in Copyright Week, a series of actions and discussions supporting key principles that should guide copyright policy. Every day this week, various groups are taking on different elements of copyright law and policy, addressing what's at stake and what we need to do to make sure that copyright promotes creativity and innovation.

Copyright law affects so much of our daily lives, and new technologies have only helped make everyone more and more aware of it. For example, while 1998’s Digital Millennium Copyright Act helped spur the growth of platforms for creating and sharing art, music and literature, it also helped make the phrase “blocked due to a claim by the copyright holder” so ubiquitous.

Copyright law helps shape the movies we watch, the books we read, and the music we listen to. But it also impacts everything from who can fix a tractor to what information is available to us to when we communicate online. Given that power, it’s crucial that copyright law and policy serve everyone.

Unfortunately, that’s not the way it tends to work. Instead, copyright law is often treated as the exclusive domain of major media and entertainment industries. Individual artists don’t often find that copyright does what it is meant to do, i.e. “promote the progress of science and useful arts” by giving them a way to live off of the work they’ve done. The promise of the internet was to help eliminate barriers between creators and audiences, so that voices that traditional gatekeepers ignored could still find success. Through copyright, those gatekeepers have found ways to once again control what we see.

12 years ago, a diverse coalition of Internet users, non-profit groups, and Internet companies defeated the Stop Online Piracy Act (SOPA) and the PROTECT IP Act (PIPA), bills that would have forced Internet companies to blacklist and block websites accused of hosting copyright-infringing content. These were bills that would have made censorship very easy, all in the name of copyright protection.

We continue to fight for a version of copyright that truly serves the public interest. And so, every year, EFF and a number of diverse organizations participate in Copyright Week. Each year, we pick five copyright issues to highlight and promote a set of principles that should guide copyright law and policy. This year’s issues are:

  • Monday: Public Domain
    The public domain is our cultural commons and a crucial resource for innovation and access to knowledge. Copyright should strive to promote, and not diminish, a robust, accessible public domain.
  • Tuesday: Device and Digital Ownership 
    As the things we buy increasingly exist either in digital form or as devices with software, we also find ourselves subject to onerous licensing agreements and technological restrictions. If you buy something, you should be able to truly own it – meaning you can learn how it works, repair it, remove unwanted features, or tinker with it to make it work in a new way.
  • Wednesday: Copyright and AI
    The growing availability of AI, especially generative AI trained on datasets that include copyrightable material, has raised new debates about copyright law. It’s important to remember the limitations of copyright law in giving the kind of protections creators are looking for.
  • Thursday: Free Expression and Fair Use 
    Copyright policy should encourage creativity, not hamper it. Fair use makes it possible for us to comment, criticize, and rework our common culture.
  • Friday: Copyright Enforcement as a Tool of Censorship
    Freedom of expression is a fundamental human right essential to a functioning democracy. Copyright should encourage more speech, not act as a legal cudgel to silence it.

Every day this week, we’ll be sharing links to blog posts and actions on these topics at https://www.eff.org/copyrightweek and at #CopyrightWeek on X, formerly known as Twitter.

❌
❌