disaster

Opera on iPhone proxies all request (privacy fail)

Yes, the very fast Opera browser on the iPhone proxies all request! In normal language, every webpage you visit from your iPhone with the opera browser is send towards Opera. Thereby, they get al the information from you. If you submit a form, it is send to Opera. If you search in Google, it is send to opera. If you login to a website, your password is send to Opera!

They wil claim the need to do this because of the prorpietary way they handle images and HTML to speed up a website. And it is a speedy browser:

I think part of the speed comes form the fact that they proxy all traffic and some funky stuff with preloading images. However, it is absurd that a browser gets /all/ the data I send, all the websites I visit, all the passwords I submit, all the search queries I do. It might not be spyware but sure gets close to this.

How did I found out?

I visitied Facebook on Opera and got this message from facebook:
Facebook security

Then I visited Facebook form my iMac and saw:

Opera on iPhone proxies via Norway?!

Then I did a test on my own host and grepped the logging:

Opera on iPhone proxyes all request!

Ans here is the code:

pimsbb2@newborn:~$ sudo tail -f /var/log/apache2/access.log | grep -i test
[sudo] password for pimsbb2:
94.246.126.161 - - [17/Apr/2010:21:05:24 +0200] "GET /test HTTP/1.1" 404 500 "-" "Opera/9.80 (iPhone; Opera Mini/5.0.0176/764; U; en) Presto/2.4.15"
^C
pimsbb2@newborn:~$ whois 94.246.126.161
% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: This output has been filtered.
% To receive output for a database update, use the "-B" flag.

% Information related to '94.246.126.0 - 94.246.127.255'

inetnum: 94.246.126.0 - 94.246.127.255
netname: IPO-OPERA
descr: Opera Software ASA

I am not the first person to finds out about it, see for example pcworld.com. But I am the person to tell you that you should be aware that you send all your data cleartext towards Opera when using the app (https is fine however). And I am the person to tell you I will not use the app anymore. Bad Opera! Bad! No cookie.

Mail this to a friend, stupid functionality!

Every now and then, I get customers for my employer Dutch Open Projects that have the weirdest functional requirements. Do not get me wrong, the customer is always right but it helps some time if we can discuss and ask why they want certain functionality.

Take for example the "mail this to a friend" function that is still popular in many designs. First of all, it is stupid functionality. If I want to notify a friend about a page, I bookmark it to delicious. If I really want to make sure (s)he sees it, I use instant messaging and as a last resort, mail.

But I'll never use the mailservice of the website, I have to give my and his email address and I do not think that giving aways another persons email address is a good thing to do, and will never give away my address if there is no need to. Then there is spam.

All User Generated Content suffers from:

  1. IP right problems
  2. Trolls
  3. and spam

Anything that can be used by spammers, WILL be used by spammers, including the "mail this to a friend" functionality.

To proof my point, see this mail I got. There is room for some remarks hence that is were the spam goes. And now, the "good" name of GE is associated with the spam and they did in fact send it to me. Stupid functionality (no-one uses it), stupid functionality (everyone can abuse it).

Mail-this-to-a-friend must die!

The GPL is the GPL... for good and bad (and even Ugly!)

Today I got a "follow" from Podblanc on my twitter account. I get dayly followers I do not know, mosty stupid bots disguised as attractive girls that folow 5k people and have 20 followers (extreem stupid people who fail the Turning test :-) ).

I always checkout my followers before follwing them, and it looked that this podblanc was human and ... is running a Drupal site at podblanc.com.

There are days that I feel proud. Proud to be part of a community that builds software that helps people to communicate. Proud to be in that community from the early days. So I have seen the tech communities that embraced Drupal as a tool to communicate. And then gave the media companies -new and old media- that had a good and cheap option to facilitate users. And then came the (from US PoV liberal) political parties in the US that enabled relativly unknown persons to run for president-candidate. Then the small local communities around churches, local red cross organisations and even the big ones like Amnesty. And I am proud that I was a very very small part in the world that enabled this.

But I never NEVER have been "proud" to be white. I never thought that one race, religion or sex is superiour above another. I have the luck to have old parents, who have been through what in central Europe is called "The War" (World War II) and have told me about the horrors. I have had the luck to have travelled around the world to see other people, get in touch with other cultures and to have visited Auschwitz. I know the horrors, I know the pain, I know about the waste of lifes.

I am not the hating kind of person, but somewhere deep in me, I hate people who hate people. And yes I do understand the paradox there. But I am not to keen on right winged Neo Nazi's who refuse to learn from the past, or even to accept the past.

So I am not proud that this white-site is using Drupal. I am sad that we created something that can be misused in this way. But like any tool, it can be used for good and bad. It is the person holding the knife that decides to create a sculpture or go for the kill, not the maker of the knife.

Sometime.. just like now. I wish the GPL was "a bit discriminating" for who it was legal to use and for who not. But you can not have a "bit of freedom"; you have it or you dont. And if that is what we are facing, I am proud that I am part of a freedom where stupid white (or black) people can say stupid things about (white or) black people ... using Drupal.

Proud but with a bad taste in my mouth.

Why did America go to war?

Why did America went to war in Iraq? To make sure barrels of oil would not be paid in Euros (as most oil countries want) but Dollars? For political purposes like a re-election? To leave a mark in history for a mad president? Who knows?

But not to find weapons of mass destruction, not to free a country and not for all the right reasons, if there are any right reasons to start a war in the first place. If you have some time to kill, checkout the videos on leadingtowar.com. Before you flame me for this posting, be sure to watch the video, in full.

The United States of America, misleading their own people, occupying a foreign country, prisoning "freedom fighters" in Cuba without trial, torturing people, legalising waterboarding.

And I thought that was in the past in another country? It is absurd that "the land of the free" seems to be nothing more then some "land". With a monkey in a white treehouse.

Microsoft, FUD, patents and Drupal

Some time ago, Microsoft started a new campaign against open source. They claim that different open source projects violate 235 patents. Now anyone with more historical knowledge then a gold fish and more then half the brain of a monkey [1], knows this is just the marketing department talking nonsense. To scare corporations away from using anything that smells like Free Software. In other words, it is just the old FUD once again.

([1] there is a reason hard drugs are prohibited in the Netherlands)

Now "Microsoft details patent charges". Mind you, all they /had/ to do is say what software project is violating what patent. That wouldn't have cost anything, wouldn't give away any proprietary information since all patents are open for the public anyway. But then, all they could win was egg. On they face of Bill. Since doing this would start people to investigate if the patent was legal in the first place . The patent office is braindead and there are numerous patents out there that have "prior art", maybe even from an open source project. And if it would be true that an OSS projects violated a real patant, active open source projects would -if possible- make a patch and fix any issues that might have been there.

Note that "deatils" means nothing here. All its says is:

...that the Linux kernel violates 42 patents, and the Linux GUI violates an additional 65; email programs infringe on 15, and other open source apps violate an additional 68 Microsoft patents. OpenOffice – a direct competitor with cash cow Microsoft Office – violates 45 patents, Microsoft claims.

Note that OpenOffice.org (no, not OpenOffice Intranetjournal!) is the only other project besides the Linux kernel that has been named. Linux and OpenOffice.org are two projects that will be seen by the general public as direct competitors of the MSFT offering. Mozilla being a good candidate as well but less in the corporate world.

So what are the other open source projects? According Webpronews there are some options. They state:

How will this affect you? If a court finds that these programs do infringe upon MSFT’s patents, programs like Linux, Mozilla, OpenOffice.org, Apache, Drupal, or Joomla will no longer be available.

Note that it is pure speculation, nobody knows what patent is violated by what open source project, even Microsoft doesn't until they start their randomizer. It might be Wine, close to Microsofts' business. But yes, It might also be Drupal. The journalist writing the article doesn't know more then we do. In fact she might know less even if she is writing on a Drupal site.

Drupal developers are not aware that it /might/ be the case and as Linus pointed out, that is a good thing! Yet, we -as a community but also the Drupal Association- must be aware that the ballgame will be harder. And playing against The Beast means there will be lot of mud throwing between the fastballs. Some think that "getting even" by countersuing is the solution, I am too European to think of that as a solution.

It also raises another question. Drupal owes much to the hosting party OSUSL. The quality of service we get, the bandwidth we use, it sums up to a couple of K's dollars per month if we would buy this commercially. However, they /are/ located in the United States and hence "spreading" Drupal is under American law where software patents are deeper embedded in the legal system then for example in the EU where they are still banned, despite Bolkestein's actions.

The rules are changing. We are no longer just a nice hobby project. We have top customers (including Sony and IBM to name a few) and hence we have entered the corporate arena where the bully is watching us. We are however amongst many friends.

XML feed