Google Cloud Platform 也開始玩 Reserved Instances 的想法了 (Committed use discounts)

看到 Google Cloud PlatformGoogle Cloud Engine 也開始提供 RI 的想法了:「Committed use discounts」。

本來就有 Sustained use discounts,當你用到一定的量時就會自動折扣,不需要人工介入,不過對於 7x24 開機的 instance 來說,能得到的折扣還是比不上 AWS 的 RI。

這次 Committed use discounts 折扣的方式跟 Amazon EC2 類似,一樣是一年與三年。計價方式不同的原因是因為 GCE 提供 custom type,使用者可以自己選 vCPU 與 Memory,所以折扣的方式也是圍繞在這兩個選擇上規劃。

不過小台機器是不提供折扣的,這點就不像 AWS 上所有種類的機器都可以買 RI:

You can only use committed use discounts for predefined machine types and custom machine types. Small machine types, such as f1-micro and g1-small, are not eligible for committed use discounts.

目前是 beta:

This is a Beta release of Committed Use Discounts. This feature is not covered by any SLA or deprecation policy and may be subject to backward-incompatible changes.

STARTTLS 的不完整性以及大規模監控電子郵件

在「Don’t count on STARTTLS to automatically encrypt your sensitive e-mails」這邊提到了 STARTTLS 的問題,引用「Neither Snow Nor Rain Nor MITM ... An Empirical Analysis of Email Delivery Security」這篇論文的說明。

SMTP 裡 STARTTLS 的設計雖然可以加密,但仲所皆知,可以阻擋 EHLO 回應結果避免建立 STARTTLS 連線,而讓發送端改用傳統未加密的 SMTP 傳輸。而研究發現其實目前就有大規模的這種監控行為:

可以看到突尼西亞的監控情況遠超過想像...

目前的想法是發展一套類似 HSTS 的 Trust on first use 設計,也許在這份報告出來後可以加速催生...

Google 的書本掃描服務被認定為「合理使用」

Google 的書本掃描服務被認定為合理使用:「Google's Book-Scanning Project Ruled to Be Legal `Fair Use'」。

“Google’s unauthorized digitizing of copyright-protected works, creation of a search functionality and display of snippets from those works are non-infringing fair uses,” U.S. Circuit Judge Pierre Leval wrote on behalf of the court. “The purpose of the copying is highly transformative, the public display of text is limited and the revelations do not provide a significant market substitute for the protected aspects of the originals.”

看起來是一路打到第二巡迴上訴法院了?(負責紐約地區)

第九巡迴上訴法院:DMCA takedown notification 必須先確認是否為合理使用 (Fair Use)

出自 EFF 的「Takedown Senders Must Consider Fair Use, Ninth Circuit Rules」這篇,案件可以參考「Lenz v. Universal Music Corp.」這篇,或是 EFF 整理的「Lenz v. Universal」這篇,由 EFF 發起訴訟控告環球侵犯合理使用權:

The Electronic Frontier Foundation (EFF) filed suit against Universal Music Publishing Group (UMPG) asking a federal court to protect the fair use and free speech rights of a mother who posted a short video of her toddler son dancing to a Prince song on the Internet.

起因在於 Stephanie Lenz 上傳了一段 29 秒的影片,背景有 Let's Go Crazy 這首歌的音樂,而被環球發 DMCA takedown notification 下架:

Stephanie Lenz's 29-second recording shows her son bouncing along to the Prince song "Let's Go Crazy " which is heard playing in the background. Lenz uploaded the home video to YouTube in February to share it with her family and friends.

後來 Stephanie Lenz 發出 counter notification 並且控告環球濫用 DMCA notification:

In late June 2007, Lenz sent YouTube a counter-notification, claiming fair use and requesting the video be reposted. Six weeks later, YouTube reposted the video. In July 2007, Lenz sued Universal for misrepresentation under the DMCA and sought a declaration from the court that her use of the copyrighted song was non-infringing. According to the DMCA 17 U.S.C. § 512(c)(3)(A)(v), the copyright holder must consider whether use of the material was allowed by the copyright owner or the law.

而環球直接挑明不在意 fair use:

In September 2007, Prince released statements that he intended to "reclaim his art on the internet." In October 2007, Universal released a statement amounting to the fact that Prince and Universal intended to remove all user-generated content involving Prince from the internet as a matter of principle.

於是雙方就從 2007 年開始一路打官司,首先的判決是地方法院認為 DMCA takedown 必須確認侵權事實才能發,這包括了要確認 fair use:

The district court held that copyright owners must consider fair use before issuing DMCA takedown notices. Thus, the district court denied Universal's motion to dismiss Lenz's claims, and declined to dismiss Lenz's misrepresentation claim as a matter of law.

同時認為環球濫用 DMCA takedown notification:

The district court believed that Universal's concerns over the burden of considering fair use were overstated, as mere good faith consideration of fair use, not necessarily an in-depth investigation, is sufficient defense against misrepresentation. The court also explained that liability for misrepresentation is crucial in an important part of the balance in the DMCA.

然後就是一路往上打,打到前幾天第九巡迴上訴法院宣佈維持原來判決定案。這是官方放出的 PDF:「UNITED STATES COURT OF APPEALSFOR THE NINTH CIRCUIT (PDF)」。Summary 的部份提到這次判決的結論:

The panel held that the DMCA requires copyright holders to consider fair use before sending a takedown notification, and that failure to do so raises a triable issue as to whether the copyright holder formed a subjective good faith belief that the use was not authorized by law.

這個判決使得目前使用機器自動無條件送 takedown notification 的程式也會受到規範,後續看 EFF 怎麼出招了...

.onion 的域名保護

.onion 被用在 Torhidden service,而現在從不同的面向要保護這個 root domain 不被註冊,在 IETF 的 blog 上看到「.onion」這篇文章就是其中一個方向。

這邊的計畫是把 .onion 域名當作像是 .local.localhost.example 這樣的特殊域名保護 (參考 RFC 6761「Special-Use Domain Names」) 而提了一個新的 RFC (目前是 draft):「The .onion Special-Use Domain Name」。

如果通過的話,就有一個標準可以遵循,不然現在對 .onion 一直都是 De-facto standard...

維基百科的使用條款更新,強制揭露利益衝突問題

維基百科昨天的使用條款修訂公告中,提到了「揭露利益衝突」的問題:「Making a change to our Terms of Use: Requirements for disclosure」,這份文件的最後方有簡體中文版的說明,對於看英文比較不通順的人可以先看中文版的說明。

在新版的「Terms of Use」裡面,有一個專門的章節「Paid contributions without disclosure」:

These Terms of Use prohibit engaging in deceptive activities, including misrepresentation of affiliation, impersonation, and fraud. As part of these obligations, you must disclose your employer, client, and affiliation with respect to any contribution for which you receive, or expect to receive, compensation. You must make that disclosure in at least one of the following ways:

  • a statement on your user page,
  • a statement on the talk page accompanying any paid contributions, or
  • a statement in the edit summary accompanying any paid contributions.

這段修正可以從「Difference between revisions of "Terms of Use" - Wikimedia Foundation」這邊看到完整的 diff。

這是對於「付費編輯」的反制:國外甚至有專門收費找人編輯維基百科的公司在運作 (可以參考 2013 年 10 月的「Wikimedia Foundation Executive Director Sue Gardner’s response to paid advocacy editing and sockpuppetry」這篇文章),這次在使用條款內直接增訂這一部份,將本來只是社群規範的項目變成直接上法院反制。

早該這麼做了,這件事情意義重大...

微軟的 IE6+ 安全性更新

即使 Windows XP 在上個月就已經停止安全性更新,但這次的 CVE-2014-1776 影響層面還是太廣,微軟還是提供 Windows XP 用戶相關的 patch (透過 Windows Update 發送):

Use-after-free vulnerability in VGX.DLL in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in April 2014.

在「Security Update Released to Address Recent Internet Explorer Vulnerability」也可以看到說明。

看到 use-after-free 這個詞就想到 OpenSSL 前陣子也來一發 CVE-2010-5298 (居然是 2010 年的 CVE),讓人... XD