CITP Blog - Formerly Freedom to Tinker

Year: 2006

  • USACM Policy Statement on DRM

    – by

    Comments

    I’m pleased to post here a new policy statement on DRM, issued by USACM, the U.S. public policy committee of ACM, the leading professional society for computer scientists. It’s a balanced yet strong statement of principles that can be applied to many public policy questions relating to DRM. I helped to draft it, and I…

  • Nuts and Bolts of Network Discrimination

    – by

    Comments

    One of the reasons the network neutrality debate is so murky is that relatively few people understand the mechanics of traffic discrimination. I think that in reasoning about net neutrality it helps to understand how discrimination would actually be put into practice. That’s what I want to explain today. Don’t worry, the details aren’t very…

  • Obligatory Summers Post

    – by

    Comments

    According to Section 4.3(c)(iii)(g) of the Code of Academic Blogging, I am required, on pain of banishment from the faculty club, to post about the departure of Lawrence Summers as Harvard president. Much e-ink has been spilled on this topic, and I for one feel no wiser for it. With some trepidation, let me offer…

  • How Watermarks Fail

    – by

    Comments

    I wrote Wednesday about Randy Picker’s suggestion of using digital watermarks to embed users’ personal financial information into media files, to discourage users from sharing the files. Today, I want to talk more generally about watermarks and how they tend to fail. First, some background. Watermarks are subtle signals embedded in the background of media…

  • Mistrust-Based DRM

    – by

    Comments

    Randy Picker has an interesting post on the Chicago Law Faculty blog, describing what he calls “mistrust-based DRM”. The idea is that when an online music store gives you a song, it embeds into the song a watermark that contains your credit card number, or some other information that would let a (dishonest) person spend…

  • Software Security: Creativity in a New Discipline

    – by

    Comments

    This is the last excerpt from my new book, Software Security: Building Security In. This might be a good time to buy the book. Creativity in a New Discipline We are experiencing a time of great creativity in computer security and must seize the opportunity presented by our current situation while we can. The diversity…

  • Software Security: A Case Study

    – by

    Comments

    Here is another excerpt from my new book, Software Security: Building Security In.. An Example: Java Card Security Testing Doing effective security testing requires experience and knowledge. Examples and case studies like the one I present here are thus useful tools for understanding the approach. In an effort to enhance payment cards with new functionality—such…

  • Software Security: The Badness-ometer

    – by

    Comments

    Here is another excerpt from my new book, Software Security: Building Security In. Application Security Tools: Good or Bad? Application security testing products are being sold as a solution to the problem of insecure software. Unfortunately, these first-generation solutions are not all they are cracked up to be. They may help us diagnose, describe, and…

  • Software Security: The Trinity of Trouble

    – by

    Comments

    [Ed Felten says: Please welcome Gary McGraw as guest blogger for the next week. Gary is CTO at Cigital and co-author of two past books with me. He’s here to post excerpts from his new book, Software Security: Building Security In, which was released this week. The book offers practical advice about how to design…

  • Sony CD DRM Paper Released

    – by

    Comments

    Today Alex and I released our paper about the Sony CD DRM episode. This is the full, extended version of the paper, with a bunch of new material that hasn’t been published or posted before. As an experiment, we posted draft sections of the paper here and asked readers for comments and feedback. The experiment…