This cialis no rx idea is consistent with recent research, suggesting that empagliflozin reduces lumigan sale the risk of CKD progression. This is laryngeal pharyngeal reflux buy generic artane online (LPR), a condition typically affecting the upper esophageal sphincter. When order estrace a person has cirrhosis, their liver does not heal, and buy zoloft online scar tissue begins to replace healthy tissue. Opdivo is FDA-approved zyprexa cheap price to treat gastric cancer (stomach cancer) as well as gastroesophageal purchase generic drops prescription delivery junction cancer (cancer in the area where the esophagus joins buy cheapest cialis on line the stomach). However, if the side effects last longer than buy 60 online cheap that, bother you, or become severe, be sure to talk cheap compazine overnight delivery with your doctor or pharmacist. A generic drug and its brand-name.

A few hours ago, the MIT faculty adopted a resolution that makes our scholarly articles freely and openly available to the entire world, though the MIT DSpace Institutional Repository. The policy applies to all of MIT:

Passed by Unanimous Vote of the Faculty, March 18, 2009

The Faculty of the Massachusetts Institute of Technology is committed to disseminating the fruits of its research and scholarship as widely as possible. In keeping with that commitment, the Faculty adopts the following policy: Each Faculty member grants to the Massachusetts Institute of Technology nonexclusive permission to make available his or her scholarly articles and to exercise the copyright in those articles for the purpose of open dissemination. In legal terms, each Faculty member grants to MIT a nonexclusive, irrevocable, paid-up, worldwide license to exercise any and all rights under copyright relating to each of his or her scholarly articles, in any medium, provided that the articles are not sold for a profit, and to authorize others to do the same. The policy will apply to all scholarly articles written while the person is a member of the Faculty except for any articles completed before the adoption of this policy and any articles for which the Faculty member entered into an incompatible licensing or assignment agreement before the adoption of this policy. The Provost or Provost’s designate will waive application of the policy for a particular article upon written notification by the author, who informs MIT of the reason.

To assist the Institute in distributing the scholarly articles, as of the date of publication, each Faculty member will make available an electronic copy of his or her final version of the article at no charge to a designated representative of the Provost’s Office in appropriate formats (such as PDF) specified by the Provost’s Office.

The Provost’s Office will make the scholarly article available to the public in an open- access repository. The Office of the Provost, in consultation with the Faculty Committee on the Library System will be responsible for interpreting this policy, resolving disputes concerning its interpretation and application, and recommending changes to the Faculty.

The policy is to take effect immediately; it will be reviewed after five years by the Faculty Policy Committee, with a report presented to the Faculty.

The Faculty calls upon the Faculty Committee on the Library System to develop and monitor a plan for a service or mechanism that would render compliance with the policy as convenient for the faculty as possible.

I chaired the committee that drafted the resolution and led faculty discussions on it throughout the fall. So I’m particularly gratified that the vote was unanimously in favor. In the words of MIT Faculty Chair Bish Sanyal, the vote is ‚Äúa signal to the world that we speak in a unified voice; that what we value is the free flow of ideas.”

Our resolution was closely modeled on similar ones passed last February by Harvard’s Faculty of Arts and Sciences and by the Harvard Law School, also passed by unanimous vote. Stanford’s School of Education did the same, as did Harvard’s Kennedy School of Government just last Monday.

Harry blogged last month about the execrable “Fair Copyright in Research Act” introduced by Rep. Conyers of Michigan, which would repeal the National Institute of Health mandate on open-access publishing and forbid government agencies from imposing similar mandates. This act is harmful to the progress of science and should be scuttled. Now that there are unanimous votes supporting open access by faculty at world-leading institutions, Rep. Conyers should recognize what everyone else does, and deflate his ill-conceived trial balloon.

iPhones are prisons: iPhones have software locks to ensure that the only applications that run on them are applications you get from Apple.  The Trusted Platform Module (TPM) technology for constructing such locks is explained in chapter 6 of Blown to Bits, illustrated there with the fictitious example of Fortress Publishers.   Now Apple is playing the role of Fortress, and the example is anything but fictitious.

The process of removing those TPM locks, a process called jailbreaking, violates the anticircumvention provision of the Digital Millennium Copyright Act (DMCA).  Apple wants to keep it that way.

As chapter 6 of B2B explains, Congress in the DMCA charged the Librarian of Congress with conducting hearings every three years on proposed exemptions.¬† In 2006, Americans got the right to undo the lock-in on their mobile phones for the purpose of shifting to a new service provider.¬† Last October, the Electronic Frontier Foundation requested a new exemption to let smart-phone owners undo the locks for the purpose of letting the phones run legally-acquired software of their choosing.¬† In the words of EFF, this would “foster competition in the software market, thereby encouraging innovation and expanding consumer choice.”

When we we buy computers, we’re used to the idea that we can use them to run whatever software we like, and that for someone to create new successful software requires only talent and ideas, not permission from Apple or MIcrosoft.¬†¬† Jonathan Zittrain’s highly recommended book The Future of the Internet and How to Stop It (see my review of Zittrain’s book in American Scientist) argues that this “openness” in the personal computer is has been a critical enabler for the digital explosion’s enormous outpouring of innovation.

Not so for the smart phone, if Apple has its way.

Yesterday Apple filed an objection to the proposed exemption, on the grounds the letting users run unauthorized software could result in “potential damage to the device and other potential harmful physical effects.”¬† More to the point, Apple says that the lock-in is necessary for their business model for the iPhone (Apple gets 30% of the proceeds from applications sold through the iPhone Store) and argues that the DMCA doesn’t give the Copyright Office the power to make decisions based on business models.

This is another example, like the ones in chapter 6, of why the DMCA’s anticircumvention provision might be better described as an anticompetition provision.¬†¬† Congress passed this in 1998 in an attempt to crack down on music file sharing.¬† It didn’t work; and as I blogged last September, the recording industry itself is largely abandoning DRM for software distribution. Yet anticircumvention remains as a legal club that enables technology lock-in and prevents competition in areas having little connection to the original motivation for the law.

We passed another milestone on the road to digital copyright sanity yesterday when Apple announced that it would be removing Digital Rights Management (DRM) from the music in the iTunes Music Store catalog by the end of the first quarter. Along with that, Apple backed off its insistence that all tracks should cost the same: big hits will cost more in the new pricing scheme.

So in a couple of months, there will be 10 million iTunes songs available for purchase on line, songs that can be freely copied from one player to another. This plays out the scenario that began two years ago with Steve Jobs’s public letter to the recording industry proposing that they relax the licensing restrictions that required iTunes to implement DRM. We’ve come a long way since February 2007, when the recording industry’s response was to flat-out reject Jobs’s proposal was ‚Äúcompletely without logic or merit,‚Äù in the words of Warner Music CEO Edgar Bronfman.

Yesterday’s announcement was welcome news, but not a big surprise. Apple had already been offering a limited number of DRM-free tracks; consumers had shown a preference for them and were even willing to pay a premium for them. And of course, the big breakthrough, as documented in Blown to Bits, came in the fall of 2007 when Amazon began selling DRM-free tracks.

I’ve never bought any music from the iTunes store. I didn’t want to include tracks in my music library where I have to worry about whether I can move them between my iMac and my PC and my GNU/Linux box, copy them to my portable MP3 player or my cell phone, or extract a few seconds of music for a sound effect or background to a video. But once Apple switches over, I’ll happily become an iTunes Music Store customer.

I bet I’m not alone in this reaction. The New York Times article that reported the announcement included:

The music companies are hoping that their eagerly awaited compromise with Apple will give a lift to digital downloads. They will be able to make more money on their best-selling songs and increase the appeal of older ones.

Hallelujah! After a decade of fighting the Internet and Internet users, the recording industry is finally getting the message: Letting go of restrictions on the use of your product can make your product more valuable and more popular, to the degree that you’ll end of making more money, even allowing for an increase in ‚Äúleakage‚Äù when the restrictions are lifted. Hopefully, we’ll see that scenario play out with on-line music.

The next group that needs to get the ‚ÄúDRM is dumb‚Äù message is the movie industry. And despite the encouraging developments in music, this will still be a long haul. As we explained in B2B, DRM is the muscle behind the studios effective control over digital video consumer technology, letting them veto new features that they don’t like. Weaning them away from that privileged position will be tough.

As always, the group that most needs to get the message is Congress, whose Digital Millennium Copyright Act, with its anti-circumvention provision, is the lynch-pin of the entire anti-technology, anti-competitive contraption. That damper on innovation is precisely what we don’t need at a time when it’s more important than ever to to foster competitiveness. As we wrote in B2B, the Internet does not have to become your enemy ‚Äì unless you make it your enemy. We’re seeing a truce emerge around music. Video is still a ways away, but we can expect that the realities of the marketplace will let rationality emerge there, too. But Congress has never been a paragon of rationality, and laws passed in the grip of copyright hysteria and not easily overturned.

About an hour ago, the Wall Street Journal confirmed that the RIAA has fired MediaSentry. That’s the company, as explained in B2B, that the RIAA has been using for gathering evidence in the lawsuits against accused file sharers.

One case mentioned in the book was that of Jammie Thomas, who was fined $222,000 in October 2007 for allegedly sharing 24 songs. The judge in the case subsequently set aside the jury’s verdict, as I noted in this blog last September. Thomas is currently awaiting retrial. Only this time, the RIAA would have to prove that she actually distributed music from her computer, not merely that there were music files on her hard drive (which was basis for setting the original verdict aside). Going along with this, the RIAA has claimed that it’s stopped filing new lawsuits, although suits already filed are still ongoing.

As hinted in chapter 6 of the book, we may be on a path to de-escalation in the copyright wars, at least in music, now that there are an increasing number of legitimate ways to obtain DRM-free tracks. Of course, the film industry still seems ready to continue the “file sharing as threat to civilization” drumbeat, and Congress still seems all too willing to listen.

When you browse to a Web page, there’s sometimes a little padlock in the corner of the window.¬† The padlock is supposed to indicate security: that the Web connection is encrypted and the server at the other end of the connection is authentic, not an impostor.¬† That’s why you’re supposed to feel secure in sending your credit card number or your bank account information across the Web.¬† On December 30, we learned¬† that this padlock isn’t so trustworthy after all, when a group of cryptography researchers announced that they have been able to create a forged digital certificate.

Digital certificates, as we explained in Blown to Bits, are the basic mechanism that browsers use to validate the integrity of Web connections.  A message is authenticated by means of a mark called a digital signature (see B2B chapter 5) operating on a compressed version of the message called the message digest. The signature itself is signed in turn by an organization certification authority; a signed signature is called a certificate.. When you browse to the web site for Bank of America, for example, the BofA site presents its certificate, your browser checks the signature, if the signature checks out, then your browser turns on the padlock to let you know that the remote Web site really is the one for BofA and you can proceed in safety — supposedly. The researchers were able to constructed the bogus certificate so that it to appeared to have been signed by one of the certification authorities whose certificates are automatically trusted by almost all browsers.

A single forged certificate on the Web might not seem like such a big deal, but that certificate could be used to sign other certificates, which would also be trusted, and those certificates used to create new bogus trusted certificated, and so on, potentially flooding the Web with bogus certificates. Until now, if evil Eve creates a Web site that masquerades as Bank of America and tricks people into visiting it (that’s a fraud called phishing), careful users would know to check that the connection is secure and the padlock is showing before entering sensitive information. But, now, if Eve gets hold of one of the forgeries, she can create a message claiming whatever she likes, sign this using the forgery, and have her fake site present the result as the “Bank of America” certificate. When browsers connect to the fake site, the certificate is checked, the padlock appears, and even careful users will be fooled into thinking they are talking to the authentic bank site.

The reality isn’t actually that bad.¬† The researchers who made the announcement are top cryptographers, and although they’ve published a great explanation here), of how they accomplished the forgery, they don’t give all the details. Also, to forestall damage if their certificate falls into wrong hands, they constructed it so that appears to have already expired.

The forgery was accomplished by exploiting a weakness in the method of producing message digests, which uses an algorithm called MD5.¬† Tuesday’s announcement wasn’t a big surprise to anyone in the cryptographic community, because the theoretical basis for the exploit was described at a cryptography conference in 2004.¬† We mention this in chapter 5, along with 2004 recommendation that Web product vendors stop using MD5 and switch to a stronger method called SHA.

And yet, as B2B describes has been so common throughout the history of cryptography, the vendors didn’t stop, at least not right away.¬†¬† And so Tuesday”s announcement was followed yesterday by a predictable “it’s not our fault” scramble.

Microsoft released a security advisory pointing out that “this is not a vulnerability in a Microsoft product”.¬† Ahem … it’s just a vulnerability in a related product that Microsoft relies on in order to function.¬† It’s like when the construction company involved in the Boston Big Dig tunnel ceiling panel collapse protested they didn’t make the glue, they only glued in the panels.¬† Microsoft did point out, however, that it had stopped using MD5 in its own products.

Microsoft’s advisory also pointed out that “the techniques to perform these attacks and the underlying cryptography that facilitate them were not released by the researchers. Attacks would be very unlikely to be implemented at this point in time.”¬†¬† The technical term for that approach is: denial.

As for what Windows users should do, Microsoft’s answer is that there’s pretty much nothing to do, except to install the latest Windows updates, which are unrelated to this issue.

Mozilla’s response was even more lame, pointing out that “this is not an attack on a Mozilla product” and advising users to “exercise caution when interacting with sites that require sensitive information.”

Neither Microsoft nor Mozilla said they would provide some actual protection, for example — as recommended by the researchers — patching their browsers to signal a warning when a certificate uses MD5, or even to reject such certificates outright, thereby forcing the certification authorities to immediately produce alternatives to MD5 signatures.

As for those certification authorities, the only one I noticed a response from was Verisign, whose RapidSSL brand of certificate was the one forged, and which is apparently the largest supplier of MD5 certificates.  Verisign issued a quick response saying that they had been planning to eliminate MD5 certificates by the end of January anyway, and they were on track to do this.  (Where were they in 2004?) They also offered to replace any MD5 certificates free of charge.  (But notice that it is the user who relies on the certificate, not the firm presenting the certificate, who is at risk here.) As the researchers write in their report:

And what none of the responses consider is that if these four researchers were able to pull of this exploit, then someone else, less benign and better funded, may have already done it.  A suspicious person might wonder whether the Internet is already polluted with bogus certificates.

Overall, this was a tour de force of cryptographic skill, but it was not a proud moment for an industry supplying an infrastructure that’s becoming increasingly critical to the entire world and that has been telling us for years how importantly it takes security.¬†¬† As the researchers write,

It was quite surprising that so many so many CAs are still using MD5, considering that MD5 has been known to be insecure since … 2004. Since these CAs had ignored all previous warnings by the cryptographic community, we felt that it would be appropriate to attempt a practical attack to demonstrate the risk they present to everybody using a web browser that includes their root CA certificates.

The eighteenth century-diplomatic officers, who kept on using substitution ciphers 800 years after that method had been broken (see B2B), would have felt right at home here.

Then again, if these past months have taught us anything, it’s that you don’t need Web spoofing to commit financial fraud on a massive scale.¬† Merely subverting Internet security seems downright petty-anty in comparison.

As the New Year approaches, and you are wrapping up 2008, please
consider making a charitable contribution in support of Creative
Commons, by donating at http://support.creativecommons.org/join.

I’m immensely proud to be a founder of Creative Commons.
Our planning for Creative Commons started in the summer of 2000, with
the recognition of the  dissonance between copyright law and the
hopes and reality of the  Internet age. Blown to Bits chapter 6
explores some of that dissonance.

Over the past 8 years, Creative Commons has blossomed to become a
central part of the Intenet’s open economy, with an international
network of licenses designed to facilitate sharing over the  Net, and
a large family of volunteers who promote values of open sharing in
education, science, and culture.

Just a few weeks ago, we released the Creative Commons Network, which
lets you identify yourself as a CC supporter, and also provides an
authentication mechanism (based on Open ID) designed for
interoperability with CC licenses, and a visible way to signify your
support for an Open Net.

Please join the CC Network and make donate generously.  The future of
the open Internet rests with all of us.

http://support.creativecommons.org/join

Check out my review in the current issue of American Scientist of Jonathan Zittrain’s The Future of the Internet – and How to Stop It, online at http://www.americanscientist.org/bookshelf/pub/keeping-the-net-stupid.

And read Zittrain’s book.,

Earlier this month, Harry blogged about the proposal by Google and others to open up some of the white space in the TV band for more unlicensed use.  the FCC will be voting on this proposal on November 4.  You can support this effort by signing the petition at www.FreeTheAirWaves.com.

“Based on feedback from our customers,”¬† Walmart announced today that it’s put on ice the plan to shut down its DRM music server, a move that would have stranded its customers, as I reported here two weeks ago.¬†¬† This new announcement from the Walmart says that they have decided to maintain the servers “for the present time,” but adds, “we continue to recommend that you back up your songs by burning them to a recordable audio CD.”¬† It looks like Digital Rights Management is turning out to be a tarpit for companies as well as for consumers.

Just when you thought it might be safe to go back into the water …. the DMCA anticircumvention sharks have started circling again.

Last week I blogged about how it is becoming more and more apparent, to the content industry as well as to consumers, that Digital Rights Management (DRM), enshrined in law through the DMCA’s anticircumvention provision, is a dead-end business model as well as a drag on innovation. See Signs of a Move Towards Balance? (Part 2 of 2).

But not everyone has gotten the message, in particular not the Motion Picture Association of America, which today filed a lawsuit against Real Networks, charging it with violating the DMCA by distributing RealDVD.¬† The RealDVD software lets consumers copy DVDs to their personal computers.¬† It doesn’t permit unlimited copying, but rather uses its own form of DRM to lock the copy to be playable on only a single PC; additional PCs require additional licenses.

What we’re seeing here is another example of the dynamic described in B2B, where the industry uses the Copy Control Association (CCA) licensing scheme to squelch innovations that they don’t like: innovations like RealDVD that (horrors!) make DVDs more friendly¬† for consumers.

Real Networks, for its part, has filed its own suit, asking court to rule that RealDVD is in compliance with the CCA license.¬†¬† That’s not unreasonable: at first blush, RealDVD seems a lot like the Kaleidescape case described in chapter 6 of B2B, where the content industry huffed and puffed, but where the court found there was no license violation.¬† Yet, that was a different court.

Regardless of who wins in court, the fact is that this continues the DMCA’s track record as a dead weight hanging over the head of innovation.¬† Decisions that should be made on the basis of technology and consumer choice are instead being made by courts struggling to interpret a law that was a bad idea when it appeared in 1998 and has revealed itself to be a worse and worse idea every year.