Tag Archives: Daily

Новоезични

Post Syndicated from Григор original http://www.gatchev.info/blog/?p=2082

– Тате, тате, какво е това патриотизъм?

– Това, сине, е когато цял народ работи здраво и упорито, за да можем ние политиците да живеем като царе, да сме милиардери без да работим, да имаме купища имоти и тайни сметки в чужбина, и така нататък.

– Тате, абе народът не е ли несъгласен да се гърби за нас? Не протестира ли?

– Понякога да, момчето ми. Когато народът не е съгласен да се гърби за нас, това е екстремизъм. А когато протестира, това е тероризъм.

Inside the MPAA, Netflix & Amazon Global Anti-Piracy Alliance

Post Syndicated from Andy original https://torrentfreak.com/inside-the-mpaa-netflix-amazon-global-anti-piracy-alliance-170918/

The idea of collaboration in the anti-piracy arena isn’t new but an announcement this summer heralded what is destined to become the largest project the entertainment industry has ever seen.

The Alliance for Creativity and Entertainment (ACE) is a coalition of 30 companies that reads like a who’s who of the global entertainment market. In alphabetical order its members are:

Amazon, AMC Networks, BBC Worldwide, Bell Canada and Bell Media, Canal+ Group, CBS Corporation, Constantin Film, Foxtel, Grupo Globo, HBO, Hulu, Lionsgate, Metro-Goldwyn-Mayer (MGM), Millennium Media, NBCUniversal, Netflix, Paramount Pictures, SF Studios, Sky, Sony Pictures Entertainment, Star India, Studio Babelsberg, STX Entertainment, Telemundo, Televisa, Twentieth Century Fox, Univision Communications Inc., Village Roadshow, The Walt Disney Company, and Warner Bros. Entertainment Inc.

The aim of the project is clear. Instead of each company considering its anti-piracy operations as a distinct island, ACE will bring them all together while presenting a united front to decision and lawmakers. At the core of the Alliance will be the MPAA.

“ACE, with its broad coalition of creators from around the world, is designed, specifically, to leverage the best possible resources to reduce piracy,”
outgoing MPAA chief Chris Dodd said in June.

“For decades, the MPAA has been the gold standard for antipiracy enforcement. We are proud to provide the MPAA’s worldwide antipiracy resources and the deep expertise of our antipiracy unit to support ACE and all its initiatives.”

Since then, ACE and its members have been silent on the project. Today, however, TorrentFreak can pull back the curtain, revealing how the agreement between the companies will play out, who will be in control, and how much the scheme will cost.

Power structure: Founding Members & Executive Committee Members

Netflix, Inc., Amazon Studios LLC, Paramount Pictures Corporation, Sony Pictures Entertainment, Inc., Twentieth Century Fox Film Corporation, Universal City Studios LLC, Warner Bros. Entertainment Inc., and Walt Disney Studios Motion Pictures, are the ‘Founding Members’ (Governing Board) of ACE.

These companies are granted full voting rights on ACE business, including the approval of initiatives and public policy, anti-piracy strategy, budget-related matters, plus approval of legal action. Not least, they’ll have the power to admit or expel ACE members.

All actions taken by the Governing Board (never to exceed nine members) need to be approved by consensus, with each Founding Member able to vote for or against decisions. Members are also allowed to abstain but one persistent objection will be enough to stop any matter being approved.

The second tier – ‘Executive Committee Members’ – is comprised of all the other companies in the ACE project (as listed above, minus the Governing Board). These companies will not be allowed to vote on ACE initiatives but can present ideas and strategies. They’ll also be allowed to suggest targets for law enforcement action while utilizing the MPAA’s anti-piracy resources.

Rights of all members

While all members of ACE can utilize the alliance’s resources, none are barred from simultaneously ‘going it alone’ on separate anti-piracy initiatives. None of these strategies and actions need approval from the Founding Members, provided they’re carried out in a company’s own name and at its own expense.

Information obtained by TorrentFreak indicates that the MPAA also reserves the right to carry out anti-piracy actions in its own name or on behalf of its member studios. The pattern here is different, since the MPAA’s global anti-piracy resources are the same resources being made available to the ACE alliance and for which members have paid to share.

Expansion of ACE

While ACE membership is already broad, the alliance is prepared to take on additional members, providing certain criteria are met. Crucially, any prospective additions must be owners or producers of movies and/or TV shows. The Governing Board will then vet applicants to ensure that they meet the criteria for acceptance as a new Executive Committee Members.

ACE Operations

The nine Governing Board members will meet at least four times a year, with each nominating a senior executive to serve as its representative. The MPAA’s General Counsel will take up the position of non-voting member of the Governing Board and will chair its meetings.

Matters to be discussed include formulating and developing the alliance’s ‘Global Anti-Piracy Action Plan’ and approving and developing the budget. ACE will also form an Anti-Piracy Working Group, which is scheduled to meet at least once a month.

On a daily basis, the MPAA and its staff will attend to the business of the ACE alliance. The MPAA will carry out its own work too but when presenting to outside third parties, it will clearly state which “hat” it is currently wearing.

Much deliberation has taken place over who should be the official spokesperson for ACE. Documents obtained by TF suggest that the MPAA planned to hire a consulting firm to find a person for the role, seeking a professional with international experience who had never been previously been connected with the MPAA.

They appear to have settled on Zoe Thorogood, who previously worked for British Prime Minister David Cameron.

Money, money, money

Of course, the ACE program isn’t going to fund itself, so all members are required to contribute to the operation. The MPAA has opened a dedicated bank account under its control specifically for the purpose, with members contributing depending on status.

Founding/Governing Board Members will be required to commit $5m each annually. However, none of the studios that are MPAA members will have to hand over any cash, since they already fund the MPAA, whose anti-piracy resources ACE is built.

“Each Governing Board Member will contribute annual dues in an amount equal to $5 million USD. Payment of dues shall be made bi-annually in equal shares, payable at
the beginning of each six (6) month period,” the ACE agreement reads.

“The contribution of MPAA personnel, assets and resources…will constitute and be considered as full payment of each MPAA Member Studio’s Governing Board dues.”

That leaves just Netflix and Amazon paying the full amount of $5m in cash each.

From each company’s contribution, $1m will be paid into legal trust accounts allocated to each Governing Board member. If ACE-agreed litigation and legal expenses exceed that amount for the year, members will be required to top up their accounts to cover their share of the costs.

For the remaining 21 companies on the Executive Committee, annual dues are $200,000 each, to be paid in one installment at the start of the financial year – $4.2m all in. Of all dues paid by all members from both tiers, half will be used to boost anti-piracy resources, over and above what the MPAA will spend on the same during 2017.

“Fifty percent (50%) of all dues received from Global Alliance Members other than
the MPAA Member Studios…shall, as agreed by the Governing Board, be used (a) to increase the resources spent on online antipiracy over and above….the amount of MPAA’s 2017 Content Protection Department budget for online antipiracy initiatives/operations,” an internal ACE document reads.

Intellectual property

As the project moves forward, the Alliance expects to gain certain knowledge and experience. On the back of that, the MPAA hopes to grow its intellectual property portfolio.

“Absent written agreement providing otherwise, any and all data, intellectual property, copyrights, trademarks, or know-how owned and/or contributed to the Global Alliance by MPAA, or developed or created by the MPAA or the Global Alliance during the Term of this Charter, shall remain and/or become the exclusive property of the MPAA,” the ACE agreement reads.

That being said, all Governing Board Members will also be granted “perpetual, irrevocable, non-exclusive licenses” to use the same under certain rules, even in the event they leave the ACE initiative.

Terms and extensions

Any member may withdraw from the Alliance at any point, but there will be no refunds. Additionally, any financial commitment previously made to litigation will have to be honored by the member.

The ACE agreement has an initial term of two years but Governing Board Members will meet not less than three months before it is due to expire to vote on any extension.

To be continued……

With the internal structure of ACE now revealed, all that remains is to discover the contents of the initiative’s ‘Global Anti-Piracy Action Plan’. To date, that document has proven elusive but with an operation of such magnitude, future leaks are a distinct possibility.

Source: TF, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

A Hardware Privacy Monitor for iPhones

Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2017/09/a_hardware_priv.html

Andrew “bunnie” Huang and Edward Snowden have designed a hardware device that attaches to an iPhone and monitors it for malicious surveillance activities, even in instances where the phone’s operating system has been compromised. They call it an Introspection Engine, and their use model is a journalist who is concerned about government surveillance:

Our introspection engine is designed with the following goals in mind:

  1. Completely open source and user-inspectable (“You don’t have to trust us”)
  2. Introspection operations are performed by an execution domain completely separated from the phone”s CPU (“don’t rely on those with impaired judgment to fairly judge their state”)

  3. Proper operation of introspection system can be field-verified (guard against “evil maid” attacks and hardware failures)

  4. Difficult to trigger a false positive (users ignore or disable security alerts when there are too many positives)

  5. Difficult to induce a false negative, even with signed firmware updates (“don’t trust the system vendor” — state-level adversaries with full cooperation of system vendors should not be able to craft signed firmware updates that spoof or bypass the introspection engine)

  6. As much as possible, the introspection system should be passive and difficult to detect by the phone’s operating system (prevent black-listing/targeting of users based on introspection engine signatures)

  7. Simple, intuitive user interface requiring no specialized knowledge to interpret or operate (avoid user error leading to false negatives; “journalists shouldn’t have to be cryptographers to be safe”)

  8. Final solution should be usable on a daily basis, with minimal impact on workflow (avoid forcing field reporters into the choice between their personal security and being an effective journalist)

This looks like fantastic work, and they have a working prototype.

Of course, this does nothing to stop all the legitimate surveillance that happens over a cell phone: location tracking, records of who you talk to, and so on.

BoingBoing post.

Играта на доверие

Post Syndicated from Григор original http://www.gatchev.info/blog/?p=2081

Напоследък навсякъде – а в България май повече, отколкото на много други места – си струва човек да си зададе няколко прости въпроса.

Кога хората си вярват? Кога не си вярват? Защо си вярват, или не си вярват? И как да направим така, че да могат да си вярват повече?

Достатъчно лъганите почват да имат усещането, че тези въпроси не са по силите на обикновените смъртни, че единствено някое божество може да ги разреши.

Има ли такова божество? За щастие, да. И вярващите, и атеистите си приличат по едно – безусловната вяра в него. За всички неговата воля е непоклатима, и неговото слово е пример за истина от последна инстанция, нерушима при никакви обстоятелства. Името на това божество е математика, а словото му е „2 + 2 = 4“.

Можем ли да призовем математиката на помощ за тези отговори? Оказва се, че да. За пръв път го е направил още през 1984 г. Робърт Акселрод, в книгата си „Еволюцията на сътрудничеството“. По-късно темата също е чоплена от много други учени. Трудовете им обаче често са обемисти и трудносмилаеми за простосмъртните.

Затова се въодушевих толкова, когато един читател тук пусна в коментар един интересен линк. Намерих на него интересна, весела и увлекателна игра, която направо ми грабна вниманието. И пътем обясни на прост човешки език основите на това, което ни кара да се доверяваме или да не се доверяваме на другите.

Идеята ме запали. Скалъпих набързо български превод и го пратих на автора на играта – двайсетинагодишно момче на име Ники Кейс. След няколко дни получих линк към българоезична версия на играта онлайн – и доказателство колко любопитен и дълбок ум има този „младок“.

Препоръчвам играта на всички. Пробвайте я и се учете. И най-вече разпространявайте линковете. Мисля, че всички имаме нужда от нейните простички, ясни и разбираеми обяснения и изводи.

Англоезичната версия можете да откриете на http://ncase.me/trust/. Преведената от мен на български (моля, не ма бийте много) – на http://ncase.me/trust-bg/.

Приятна игра! 🙂

Просякинята

Post Syndicated from Григор original http://www.gatchev.info/blog/?p=2079

Видях я, когато излизах от магазина.

Обикновено не давам пари на просяци. Мразя отработения им професионализъм. Преструвката, че са бедни, която прикрива обикновен мързел или смотаност… И още повече мразя мафията, за която те работят и за която отива лъвският пай от събраното. Пасмината добре охранени престъпници, пътуващи в луксозни возила и нареждащи по телефона на полицейски началници и кметове да държат подчинените си настрана. (Освен ако не трябва да бъде разкаран някой нещастник, наистина стигнал дотам да разчита на милостта на хората.) Даването на пари на тази измет е инвестиция в това, което превръща една страна в помийна яма.

Тази жена обаче я познавам.

Виждам я из квартала вече няколко години. Как рови из кофите и внимателно прибира всяко парченце храна или нещо друго, което може да бъде полезно. Как старателно чисти с часове около някое заведение срещу паничка чорба и засъхнало крайче хляб, вероятно останали от някой клиент. Как благодари от сърце на ужасния си цигански диалект за всяка проядена от молци дрипа, която някой решава да ѝ подхвърли, и я прибира с трепет, все едно е съкровище. Често – как, не намерила друга работа, просто мете около блоковете с надеждата някой да се трогне и да ѝ подхвърли нещичко.

В началото гледаше един-двама тинейджъри, които не приличаха на нея нито на капка. По-късно те изчезнаха кой знае къде и тя остана сама. Горе-долу по това време артритът докара ръцете ѝ дотам да нямат сили да държат метлата за дълго – където и да спи, надали е на топло. А гръбнака ѝ – дотам да не може да го изправи и да бърка в големите кофи на колела, в които събира боклук нашият квартал. Каквато и иначе е дребничка…

Отначало смееше да проси само около малките магазинчета вътре в квартала. Очевидно знаеше, че видят ли я мафиотите, ще ѝ съкратят мъките… Някои от магазинерите я гонеха. Някои я търпяха, ако не седи твърде близо до магазина. И тя търсеше къде и как да застане, че хем да я виждат купувачите, хем да не пречи… Понякога някой продавач ѝ подхвърляше по някое парче недоядена пица или баничка, или кесия тръгнали да се развалят домати или краставици.

Хлябът обаче се купува с пари. Ако е закъсала дотам да ѝ трябва някое лекарство – и то. И малко по малко беше събрала смелост да се появява и пред бакалията на по-централна улица. Настрани от нея, на стъпалото пред входа на сградата, да не ѝ се карат. Непрекъснато трепереща и оглеждаща се, да не се зададе отнякъде джип с „наказателен отряд“, или пък полицай. И тихо, ненатрапливо призовава Господа да благослови тези, които минават. Без значение ще ѝ дадат ли нещо, или не…

Бяха ми останали лев и нещо на стотинки, и банкнота от петдесет лева. Пуснах монетките в чашката, която тя стискаше в скута си – ако дойдат „юнаците“, да успее да я скрие. Мургавото ѝ лице направо изгря – тя се усмихна до ушите, заповтаря по-енергично благословиите си и се опита да ги подсили с жест. Уви, ръката ѝ едва се движеше, сгърчена и с подути стави.

Когато отминах на десетина метра разстояние, нещо ме накара да хвърля поглед назад. Тя продължаваше да гледа след мен, усмихната до уши, и да мърмори нещо нечуто. Хвана ме срам, че не ѝ дадох петдесетачката… След това се замислих – сигурно няма да е лоша идея да ѝ купя нещичко за артрита. Твърде напреднал е, за да го излекувам, но поне ще ѝ облекча малко болките.

Обикновено не давам пари на просяци. Който дава пари на измамници, е глупак… Но тази жена беше истински останала да разчита единствено на милостта на другите. А който има как, но не помага на човек в такава нужда, е боклук.

Продължих нататък, умислен в грижите си. И внезапно се стреснах – усещах се с десетина години по-млад. Не физически – душевно. Усещах се този, който някога започна блога, който четете сега. И който се сещаше да пише в него за истински важните неща. За красотата пред очите ни, която пропускаме да видим. За мъдростта наоколо, която прозяпваме. За истинските неща.

Без да го подозирам, си бях купил срещу тези стотинки връщане към достойното ми аз. Това, което мечтая да бъда.

… Утре или вдругиден сигурно пак ще ида да пазарувам. И може би тази жена отново ще е там и ще проси. Ще ѝ дам пак. И дано не забравя да ѝ купя и нещичко против артрит. Не защото някое божество ще ме благослови – заради себе си. Искам и заслужавам да съм достоен човек, поне в своите собствени очи, и тази цена е смешно малка.

—-

П.П. Един американски писател и философ – Елберт Хъбард – е казал веднъж следното:

„Ние биваме наказвани не заради греховете ни, а от тях.“

Бих добавил – ние биваме възнаграждавани не заради добрините ни, а от тях.

Да, истински са тези добрини, които се правят с ум – за това ще пиша може би следващия път. „Инвестирането“ в дарения за мафиоти категорично е глупост. Но мисля, че помагането на онеправданите от живота е мъдрост.

Live Mayweather v McGregor Streams Will Thrive On Torrents Tonight

Post Syndicated from Andy original https://torrentfreak.com/live-mayweather-v-mcgregor-streams-will-thrive-on-torrents-tonight-170826/

Tonight, August 26, at the T-Mobile Arena in Las Vegas, Floyd Mayweather Jr. will finally meet UFC lightweight champion Conor McGregor in what is being billed as the biggest fight in boxing history.

Although tickets for inside the arena are still available for those with a lot of money to burn, most fans will be viewing on a screen of some kind, whether that’s in a cinema, sports bar, or at home in front of a TV.

The fight will be available on Showtime in the United States but the promoters also say they’ve done their best to make it accessible to millions of people in dozens of countries, with varying price tags dependent on region. Nevertheless, due to generally high prices, it’s likely that untold thousands around the world will attempt to watch the fight without paying.

That will definitely be possible. Although Showtime has won a pre-emptive injunction to stop some sites offering the fight, many hundreds of others are likely to fill in the gaps, offering generally lower-quality streams to the eager masses. Whether all of these sites will be able to cope with what could be unprecedented demand will remain to be seen, but there is one method that will thrive under the pressure.

Torrent technology is best known for offering content after it’s aired, whether that’s the latest episode of Game of Thrones or indeed a recording of the big fight scheduled for the weekend. However, what most ‘point-and-click’ file-sharers won’t know is that there’s a torrent-based technology that offers live sporting events week in, week out.

Without going into too many technical details, AceStream / Ace Player HD is a torrent engine built into the ever-popular VLC media player. It’s available on Windows, Android and Linux, costs nothing to install, and is incredibly easy to use.

Where regular torrent clients handle both .torrent files and magnet links, AceStream relies on an AceStream Content ID to find streams to play instead. This ID is a hash value (similar to one seen in magnet links, but prefaced with ‘acestream://’) which relates to the stream users want to view.

Once found, these can be copied to the user’s clipboard and pasted into the ‘Open Ace Stream Content ID’ section of the player’s file menu. Click ‘play’ and it’s done – it really is that simple.

AceStream is simplicity itself

Of course, any kind of content – both authorized and unauthorized – can be streamed and shared using AceStream and there are hundreds of live channels available, some in very high quality, 24/7. Inevitably, however, there’s quite an emphasis on premium content from sports broadcasters around the world, with fresh links to content shared on a daily basis.

The screenshot below shows a typical AceStream Content ID indexing site, with channels on the left, AceStream Content IDs in the center, plus language and then stream speed on the far right. (Note: TF has redacted the links since many will still be live at time of publication)

A typical AceSteam Content ID listing

While streams of most major TV channels are relatively easy to find, specialist channels showing PPV events are a little bit more difficult to discover. For those who know where to look, however, the big fight will be only a cut-and-paste away and in much better quality than that found on most web-based streaming portals.

All that being said, for torrent enthusiasts the magic lies in the ability of the technology to adapt to surging demand. While websites and streams wilt under the load Saturday night, it’s likely that AceStream streams will thrive under the pressure, with viewers (downloaders/streamers) also becoming distributors (uploaders) to others watching the event unfold.

With this in mind, it’s worth noting that while AceStream is efficient and resilient, using it to watch infringing content is illegal in most regions, since simultaneous uploading also takes place. Still, that’s unlikely to frighten away enthusiasts, who will already be aware of the risks and behind a VPN.

Ace Streams do have an Achilles heel though. Unlike a regular torrent swarm, where the initial seeder can disappear once a full copy of the movie or TV show is distributed around other peers, AceStreams are completely reliant on the initial stream seeder at all times. If he or she disappears, the live stream dies and it is all over. For this reason, people looking to stream often have a couple of extra stream hashes standing by.

But for big fans (who also have the money to spend, of course), the decision to pirate rather than pay is one not to be taken lightly. The fight will be a huge spectacle that will probably go down in history as the biggest combat sports event of all time. If streams go down early, that moment will be gone forever, so forget telling your kids about the time you watched McGregor knock out Mayweather in Round Two.

Source: TF, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

TVAddons Decimated Without Trial, Here’s a View of the Damage

Post Syndicated from Andy original https://torrentfreak.com/tvaddons-decimated-without-trial-heres-a-view-of-the-damage-170820/

On June 2, a collection of Canadian telecoms giants including Bell Canada, Bell ExpressVu, Bell Media, Videotron, Groupe TVA, Rogers Communications and Rogers Media, filed a complaint in Federal Court against Montreal resident Adam Lackman, the man behind TVAddons.

They claimed that by developing, hosting, distributing or promoting Kodi add-ons, Lackman infringed their copyrights.

On June 9 the Federal Court handed down an interim injunction against Lackman which restrained him from various activities in respect of TVAddons. The process took place ex parte, meaning in secret, without Lackman being able to mount a defense.

The plaintiffs were also granted an Anton Piller order, a civil search warrant that granted access to Lackman’s premises and allowed him to be interrogated.

As previously reported, the plaintiffs abused the process and only later did a court recognize that the search was designed as both a fishing exercise and a means to take down TVAddons, in advance of any trial on the merits of the case.

In the meantime, with the process grinding through an early appeal, the plaintiffs’ aim of destroying TVAddons has been at least partially achieved. After prolonged downtime, Lackman recently brought the site back under a new URL, TVAddons.co. However, he informs TF that serious damage has been done to a project that previously enjoyed great momentum.

“Google is the most popular site on the internet. If Google was down for a day, you’d check back tomorrow. If it was down for a week, you’d check back a week later. If it was down for a month, maybe you’d try once in a while,” Lackman says.

“However, if Google was down for more than six months, would you return in a year from now? Probably not. And that’s Google, not a small community site like TVAddons.”

Some people are coming back to the site now, but in nowhere near the volumes it previously enjoyed. Here’s a traffic analysis for a typical day at TVAddons.ag before the takedown.

TVAddons.ag daily traffic, before the takedown

And here is how the traffic for TVAddons.co looked a few days ago, a little two weeks after its revival and ten weeks after the initial takedown.

Part of the problem is not being able to get in touch with former users. In addition to taking control of TVAddons’ domains, the legal process also deprived the site of its social media accounts.

For example, TVAddons’ original Twitter account is now dormant. It still has 141K followers but with its passwords in the hands of lawyers, Lackman has been forced to open a new account, TVAddonsco. However, he’s only been able to attract just over 8,000 followers.

Facebook tells a similar story. With no access to the old account (which had 174,229 likes), the new account facebook.com/tvaddonsco is stalling at around 1,600. The situations on YouTube and Instagram are just as bleak.

“They’ve completely muzzled us, there was never anything questionable on our social media, seizing it without actually winning a lawsuit against us is nothing less than censorship,” Lackman says.

“Since we never required user registration, we don’t have the ability to reach the majority of our users without having access to our old social media accounts and notification system, which doesn’t work without our domain name being active.”

Also seized were TVaddons’ Feedburner account, which was used to manage the site’s 100,000 RSS feed subscribers.

“It was in the same account as Google+ and YouTube so we lost that too. We could have easily used it to forward our RSS feed and keep all the subscribers otherwise,” Lackman adds.

This has left TVAddons having to do its best to spread the details of its new locations via social media and a contest that has thus far gained more than 87,000 entries and may be helping things along.

While it’s now common knowledge that many TVAddons-related domains and accounts were seized following the search, Lackman now reveals that other non-connected projects were affected too. Included were the social media pages of several unrelated businesses, the domain name of a hosting website that was around seven years old, and an entirely legal “cord-cutting” information resource.

“Since the cord-cutting phenomenon conflicts with their business interests, seizing that specific social media page effectively destroyed their direct competition,” Lackman says.

“The plaintiffs are trying to destroy their competition rather than innovating. TVAddons provided a lot of legitimate competition for them in terms of content for cordcutters, they’re trying to keep a grasp on the market at any cost.

“Their failure at innovating can be immediately demonstrated by the fact that the NFL recently canceled all broadcast contracts with Canadian TV operators, in favor of DAZN, a new legal sports streaming service that charges half the price they did, with way more content than their sports packages ever offered.”

But despite the setbacks, Lackman appears determined to continue not only with the resurrected TVAddons, but also the legal fight against the Canadian broadcasting giants intent on his destruction.

At the time of writing the site’s fundraiser has generated more than $27,000 in 15 days but TF understands that this might only be 5 to 10 percent of the final sum required when all bills are counted. It’s hoped that new methods of donating and assistance from friendly website operators might give the campaign an additional boost but in the meantime, Lackman is expressing gratitude for the efforts so far.

It’s hard to say whether TVAddons will once again reach the heights achieved at its peak but after taking years to build up a following, the odds are certainly stacked against it.

Source: TF, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

Announcement: IPS code

Post Syndicated from Robert Graham original http://blog.erratasec.com/2017/08/announcement-ips-code.html

So after 20 years, IBM is killing off my BlackICE code created in April 1998. So it’s time that I rewrite it.

BlackICE was the first “inline” intrusion-detection system, aka. an “intrusion prevention system” or IPS. ISS purchased my company in 2001 and replaced their RealSecure engine with it, and later renamed it Proventia. Then IBM purchased ISS in 2006. Now, they are formally canceling the project and moving customers onto Cisco’s products, which are based on Snort.

So now is a good time to write a replacement. The reason is that BlackICE worked fundamentally differently than Snort, using protocol analysis rather than pattern-matching. In this way, it worked more like Bro than Snort. The biggest benefit of protocol-analysis is speed, making it many times faster than Snort. The second benefit is better detection ability, as I describe in this post on Heartbleed.

So my plan is to create a new project. I’ll be checking in the starter bits into GitHub starting a couple weeks from now. I need to figure out a new name for the project, so I don’t have to rip off a name from William Gibson like I did last time :).

Some notes:

  • Yes, it’ll be GNU open source. I’m a capitalist, so I’ll earn money like snort/nmap dual-licensing it, charging companies who don’t want to open-source their addons. All capitalists GNU license their code.
  • C, not Rust. Sorry, I’m going for extreme scalability. We’ll re-visit this decision later when looking at building protocol parsers.
  • It’ll be 95% compatible with Snort signatures. Their language definition leaves so much ambiguous it’ll be hard to be 100% compatible.
  • It’ll support Snort output as well, though really, Snort’s events suck.
  • Protocol parsers in Lua, so you can use it as a replacement for Bro, writing parsers to extract data you are interested in.
  • Protocol state machine parsers in C, like you see in my Masscan project for X.509.
  • First version IDS only. These days, “inline” means also being able to MitM the SSL stack, so I’m gong to have to think harder on that.
  • Mutli-core worker threads off PF_RING/DPDK/netmap receive queues. Should handle 10gbps, tracking 10 million concurrent connections, with quad-core CPU.
So if you want to contribute to the project, here’s what I need:
  • Requirements from people who work daily with IDS/IPS today. I need you to write up what your products do well that you really like. I need to you write up what they suck at that needs to be fixed. These need to be in some detail.
  • Testing environment to play with. This means having a small server plugged into a real-world link running at a minimum of several gigabits-per-second available for the next year. I’ll sign NDAs related to the data I might see on the network.
  • Coders. I’ll be doing the basic architecture, but protocol parsers, output plugins, etc. will need work. Code will be in C and Lua for the near term. Unfortunately, since I’m going to dual-license, I’ll need waivers before accepting pull requests.
Anyway, follow me on Twitter @erratarob if you want to contribute.

New – SES Dedicated IP Pools

Post Syndicated from Randall Hunt original https://aws.amazon.com/blogs/aws/new-ses-dedicated-ip-pools/

Today we released Dedicated IP Pools for Amazon Simple Email Service (SES). With dedicated IP pools, you can specify which dedicated IP addresses to use for sending different types of email. Dedicated IP pools let you use your SES for different tasks. For instance, you can send transactional emails from one set of IPs and you can send marketing emails from another set of IPs.

If you’re not familiar with Amazon SES these concepts may not make much sense. We haven’t had the chance to cover SES on this blog since 2016, which is a shame, so I want to take a few steps back and talk about the service as a whole and some of the enhancements the team has made over the past year. If you just want the details on this new feature I strongly recommend reading the Amazon Simple Email Service Blog.

What is SES?

So, what is SES? If you’re a customer of Amazon.com you know that we send a lot of emails. Bought something? You get an email. Order shipped? You get an email. Over time, as both email volumes and types increased Amazon.com needed to build an email platform that was flexible, scalable, reliable, and cost-effective. SES is the result of years of Amazon’s own work in dealing with email and maximizing deliverability.

In short: SES gives you the ability to send and receive many types of email with the monitoring and tools to ensure high deliverability.

Sending an email is easy; one simple API call:

import boto3
ses = boto3.client('ses')
ses.send_email(
    Source='[email protected]',
    Destination={'ToAddresses': ['[email protected]']},
    Message={
        'Subject': {'Data': 'Hello, World!'},
        'Body': {'Text': {'Data': 'Hello, World!'}}
    }
)

Receiving and reacting to emails is easy too. You can set up rulesets that forward received emails to Amazon Simple Storage Service (S3), Amazon Simple Notification Service (SNS), or AWS Lambda – you could even trigger a Amazon Lex bot through Lambda to communicate with your customers over email. SES is a powerful tool for building applications. The image below shows just a fraction of the capabilities:

Deliverability 101

Deliverability is the percentage of your emails that arrive in your recipients’ inboxes. Maintaining deliverability is a shared responsibility between AWS and the customer. AWS takes the fight against spam very seriously and works hard to make sure services aren’t abused. To learn more about deliverability I recommend the deliverability docs. For now, understand that deliverability is an important aspect of email campaigns and SES has many tools that enable a customer to manage their deliverability.

Dedicated IPs and Dedicated IP pools

When you’re starting out with SES your emails are sent through a shared IP. That IP is responsible for sending mail on behalf of many customers and AWS works to maintain appropriate volume and deliverability on each of those IPs. However, when you reach a sufficient volume shared IPs may not be the right solution.

By creating a dedicated IP you’re able to fully control the reputations of those IPs. This makes it vastly easier to troubleshoot any deliverability or reputation issues. It’s also useful for many email certification programs which require a dedicated IP as a commitment to maintaining your email reputation. Using the shared IPs of the Amazon SES service is still the right move for many customers but if you have sustained daily sending volume greater than hundreds of thousands of emails per day you might want to consider a dedicated IP. One caveat to be aware of: if you’re not sending a sufficient volume of email with a consistent pattern a dedicated IP can actually hurt your reputation. Dedicated IPs are $24.95 per address per month at the time of this writing – but you can find out more at the pricing page.

Before you can use a Dedicated IP you need to “warm” it. You do this by gradually increasing the volume of emails you send through a new address. Each IP needs time to build a positive reputation. In March of this year SES released the ability to automatically warm your IPs over the course of 45 days. This feature is on by default for all new dedicated IPs.

Customers who send high volumes of email will typically have multiple dedicated IPs. Today the SES team released dedicated IP pools to make managing those IPs easier. Now when you send email you can specify a configuration set which will route your email to an IP in a pool based on the pool’s association with that configuration set.

One of the other major benefits of this feature is that it allows customers who previously split their email sending across several AWS accounts (to manage their reputation for different types of email) to consolidate into a single account.

You can read the documentation and blog for more info.

Cloudflare Kicking ‘Daily Stormer’ is Bad News For Pirate Sites

Post Syndicated from Ernesto original https://torrentfreak.com/cloudflare-kicking-daily-stormer-is-bad-news-for-pirate-sites-170817/

“I woke up this morning in a bad mood and decided to kick them off the Internet.”

Those are the words of Cloudflare CEO Matthew Prince, who decided to terminate the account of controversial Neo-Nazi site Daily Stormer.

Bam. Gone. At least for a while.

Although many people are happy to see the site go offline, the decision is not without consequence. It goes directly against what many saw as the core values of the company.

For years on end, Cloudflare has been asked to remove terrorist propaganda, pirate sites, and other possibly unacceptable content. Each time, Cloudflare replied that it doesn’t take action without a court order. No exceptions.

“Even if it were able to, Cloudfare does not monitor, evaluate, judge or store content appearing on a third party website,” the company wrote just a few weeks ago, in its whitepaper on intermediary liability.

“We’re the plumbers of the internet. We make the pipes work but it’s not right for us to inspect what is or isn’t going through the pipes,” Cloudflare CEO Matthew Prince himself said not too long ago.

“If companies like ours or ISPs start censoring there would be an uproar. It would lead us down a path of internet censors and controls akin to a country like China,” he added.

The same arguments were repeated in different contexts, over and over.

This strong position was also one of the reasons why Cloudflare was dragged into various copyright infringement court cases. In these cases, the company repeatedly stressed that removing a site from Cloudflare’s service would not make infringing content disappear.

Pirate sites would just require a simple DNS reconfiguration to continue their operation, after all.

“[T]here are no measures of any kind that CloudFlare could take to prevent this alleged infringement, because the termination of CloudFlare’s CDN services would have no impact on the existence and ability of these allegedly infringing websites to continue to operate,” it said.

That comment looks rather misplaced now that the CEO of the same company has decided to “kick” a website “off the Internet” after an emotional, but deliberate, decision.

Taking a page from Cloudflare’s (old) playbook we’re not going to make any judgments here. Just search Twitter or any social media site and you’ll see plenty of opinions, both for and against the company’s actions.

We do have a prediction though. During the months and years to come, Cloudflare is likely to be dragged into many more copyright lawsuits, and when they are, their counterparts are going to bring up Cloudflare’s voluntary decision to kick a website off the Internet.

Unless Cloudflare suddenly decides to pull all pirate sites from its service tomorrow, of course.

Source: TF, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

Game of Thrones Episode “S07E06” Leaks Online Early

Post Syndicated from Ernesto original https://torrentfreak.com/game-of-thrones-episode-s07e06-leaks-online-early-170816/

Trouble continues for HBO as another episode of the popular Game of Thrones series has just leaked online, days ahead of the official premiere.

Copies of the sixth episode of the current season, titled ‘Death is the Enemy,’ are currently circulating on various streaming portals, direct download, and torrent sites.

The first copy only just appeared on the Pirate Bay, but others were shared elsewhere earlier. One of the leaked videos is 64 minutes long and of high quality, and there are also versions that consist of two separate parts.

Early on, the two parts were circulating on the video streaming site Dailymotion, but these were swiftly removed.

At the moment it’s still unclear how the leak came about but some suggest that it was leaked by HBO itself in Spain. TorrentFreak has not been able to confirm this, but there are no visible watermarks that point elsewhere.

Game of Thrones “S07E06” leak screenshot

This isn’t the first time that a Game of Thrones episode has leaked online early. Two years ago the same happened with the first four episodes of season 5. Nonetheless, that season still broke previous viewership records.

Two weeks ago the fourth episode of the current season was also pirated before its official release. This leak, which carried a prominent “Star India Pvt Ltd” watermark, triggered a lot of interest from impatient Game of Thrones fans as well.

Earlier this week, news broke that four men had been arrested in connection with the breach, which is still being investigated. The arrested men all worked for the local media processing company Prime Focus Technologies, where the leak reportedly originated.

The current leak is not in any way related to the hack on HBO’s system, which occurred earlier and revealed several preliminary Game of Thrones scripts.

This hack has also resulted in leaks of various high profile shows, including the upcoming ninth season of ‘Curb Your Enthusiasm.’ Initially, these were hard to find online, but they are now widely available on the usual pirate sites.

Source: TF, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

Internet Archive Blocked in 2,650 Site Anti-Piracy Sweep

Post Syndicated from Andy original https://torrentfreak.com/internet-archive-blocked-in-2650-site-anti-piracy-sweep-170810/

Reports of sites becoming mysteriously inaccessible in India have been a regular occurance over the past several years. In many cases, sites simply stop functioning, leaving users wondering whether sites are actually down or whether there’s a technical issue.

Due to their increasing prevalence, fingers are often pointed at so-called ‘John Doe’ orders, which are handed down by the court to prevent Internet piracy. Often sweeping in nature (and in some cases pre-emptive rather than preventative), these injunctions have been known to block access to both file-sharing platforms and innocent bystanders.

Earlier this week (and again for no apparent reason), the world renowned Internet Archive was rendered inaccessible to millions of users in India. The platform, which is considered by many to be one of the Internet’s most valued resources, hosts more than 15 petabytes of data, a figure which grows on a daily basis. Yet despite numerous requests for information, none was forthcoming from authorities.

The ‘blocked’ message seen by users accessing Archive.org

Quoted by local news outlet Medianama, Chris Butler, Office Manager at the Internet Archive, said that their attempts to contact the Indian Department of Telecom (DoT) and the Ministry of Electronics and Information Technology (Meity) had proven fruitless.

Noting that site had previously been blocked in India, Butler said they were no clearer on the reasons why the same kind of action had seemingly been taken this week.

“We have no information about why a block would have been implemented,” he said. “Obviously, we are disappointed and concerned by this situation and are very eager to understand why it’s happening and see full access restored to archive.org.”

Now, however, the mystery has been solved. The BBC says a local government agency provided a copy of a court order obtained by two Bollywood production companies who are attempting to slow down piracy of their films in India.

Issued by a local judge, the sweeping order compels local ISPs to block access to 2,650 mainly file-sharing websites, including The Pirate Bay, RARBG, the revived KickassTorrents, and hundreds of other ‘usual suspects’. However, it also includes the URL for the Internet Archive, hence the problems with accessibility this week.

The injunction, which appears to be another John Doe order as previously suspected, was granted by the High Court of the Judicature at Madras on August 2, 2017. Two film productions companies – Prakash Jah Productions and Red Chillies Entertainment – obtained the order to protect their films Lipstick Under My Burkha and Jab Harry Met Sejal.

While India-based visitors to blocked resources are often greeted with a message saying that domains have been blocked at the orders of the Department of Telecommunications, these pages never give a reason why.

This always leads to confusion, with news outlets having to pressure local government agencies to discover the reason behind the blockades. In the interests of transparency, providing a link to a copy of a relevant court order would probably benefit all involved.

A few hours ago, the Internet Archive published a statement questioning the process undertaken before the court order was handed down.

“Is the Court aware of and did it consider the fact that the Internet Archive has a well-established and standard procedure for rights holders to submit take down requests and processes them expeditiously?” the platform said.

“We find several instances of take down requests submitted for one of the plaintiffs, Red Chillies Entertainments, throughout the past year, each of which were processed and responded to promptly.

“After a preliminary review, we find no instance of our having been contacted by anyone at all about these films. Is there a specific claim that someone posted these films to archive.org? If so, we’d be eager to address it directly with the claimant.”

But while the Internet Archive appears to be the highest profile collateral damage following the ISP blocks, it isn’t the only victim. Now that the court orders have become available (1,2), it’s clear that other non-pirate entities have also been affected including news site WN.com, website hosting service Weebly, and French ISP Free.fr.

Also, in a sign that sites aren’t being checked to see if they host the movies in question, one of the orders demands that former torrent index BitSnoop is blocked. The site shut down earlier this year. The same is true for Shaanig.org.

This is not the first time that the Internet Archive has been blocked in India. In 2014/2015, Archive.org was rendered inaccessible after it was accused of hosting extremist material. In common with Google, the site copies and stores huge amounts of data, much of it in automated processes. This can leave it exposed to these kinds of accusations.

Source: TF, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

Transparency in Cloud Storage Costs

Post Syndicated from Roderick Bauer original https://www.backblaze.com/blog/transparency-in-cloud-storage-costs/

cloud storage cost calculator

Backblaze’s mission is to make cloud storage that’s affordable and astonishingly easy to use. Backblaze B2 embodies that mission for those looking for an object storage solution.

Another Backblaze core value is being transparent, from releasing our Storage Pod designs to detailing our cloud storage cost of goods sold. We are an open book in the Cloud Storage industry. So it makes sense that opaque pricing policies that require mind numbing calculations are a no-no for us. Our approach to pricing is to be transparent, straight-forward, and predictable.

For Backblaze B2, this means that no matter how much data you have, the cost for B2 is $0.005/GB per month for data storage and $0.02/GB to download data. There are no costs to upload. We also throw in 10GB of storage and 1GB of downloads for free every month.

Cloud Storage Price Comparison

The storage industry does not share our view of making pricing transparent, or affordable. In an effort to help everyone, we’ve made a Cloud Storage Pricing Calculator, where anyone can enter in their specific use case and get pricing back for B2, S3, Azure, and GCS. We’ve also included the calculator below for those interested in trying it out.

B2 Cost Calculator

Backblaze provides this calculator as an estimate.

Initial Upload:

GB

Data over time

Monthly Upload:

GB

Monthly Delete:

GB

Monthly Download:

GB


Period of Time:

Months

Storage Costs

Storage Cost for Initial Month:
x

Data Added Each Month:
x

Data Deleted Each Month:
x

Net Data:
x

Download Costs

Monthly Download Cost:
x

Total

Total Cost for x Months
x

Amazon S3
Microsoft Azure
Google Cloud

x
x
x
x
x
x
* Figures are not exact and do not include the following: Free first 10 GB of storage, free 1 GB of daily downloads, or $.004/10,000 class B Transactions and $.004/1,000 Class C Transactions.

Sample storage scenarios:

Scenario 1

You have data you wish to archive, and will be adding more each month, but you don’t expect that you will be downloading or deleting any data.

Initial upload: 10,000GB
Monthly upload: 1,000GB

For twelve months, your costs would be:

Backblaze B2 $990.00
Amazon S3 $4,158.00 +420%
Microsoft Azure $4,356.00 +440%
Google Cloud $5,148.00 +520%

 

Scenario 2

You wish to store data, and will be actively changing that data with uploads, downloads, and deletions.

Initial upload: 10,000GB
Monthly upload: 2,000GB
Monthly deletion: 1,000GB
Monthly download: 500GB

Your costs for 12 months would be:

Backblaze B2 $1,100.00
Amazon S3 $3.458/00 +402%
Microsoft Azure $4,656.00 +519%
Google Cloud $5,628.00 +507%

We invite you to compare our cost estimates against the competition. Here are the links to our competitors’ pricing calculators.

B2 Cloud Storage Pricing Summary

Provider
Storage
($/GB/Month)

Download
($/GB)
$0.005 $0.02
$0.021
+420%
$0.05+
+250%
$0.022+
+440%
$0.05+
+250%
$0.026
+520%
$0.08+
+400%

The Details


STORAGE
$0.005/GB/Month
How much data you have stored with Backblaze. This is calculated once a day based on the average storage of the previous 24 hours.
The first 10 GB of storage is free.

DOWNLOAD
$0.02/GB
Charged when you download files and charged when you create a Snapshot. Charged for any portion of a GB. The first 1 GB of data downloaded each day is free.

TRANSACTIONS
Class “A” transactions – Free
Class “B” transactions – $0.004 per 10,000 with 2,500 free per day.
Class “C” transactions – $0.004 per 1,000 with 2,500 free per day.
View Transactions by API Call

DATA BY MAIL
Mail us your data on a B2 Fireball – $550
Backblaze will mail your data to you by FedEx:
• USB Flash Drive – up to 110 GB – $89
• USB Hard Drive – up to 3.5TB of data – $189

PRODUCT SUPPORT
All B2 active account owners can contact Backblaze support at help.backblaze.com where they will also find a free-to- use knowledge base of B2 advice, guides, and more. In addition, a B2 user can pay to upgrade their support plan to include phone service, 24×7 support and more.

EVERYTHING ELSE
Free
Unlike other services, you won’t be nickeled and dimed with upload fees, file deletion charges, minimum files size requirements, and more. Everything you can possibly pay Backblaze is listed above.

 

Visit our B2 Cloud Storage Pricing web page for more details.


Amazon S3
Storage Costs
Initial upload cost:
x
Data added each month:
x

Data del. each month:
x

Net data:
x

Download Costs

Monthly Download Cost:
x

Total

Total Cost for x Months
x

Microsoft
Storage Costs
Initial upload cost:
x
Data added each month:
x

Data del. each month:
x

Net data:
x

Download Costs

Monthly Download Cost:
x

Total

Total Cost for x Months
x

Google
Storage Costs
Initial upload cost:
x
Data added each month:
x

Data del. each month:
x

Net data:
x

Download Costs

Monthly Download Cost:
x

Total

Total Cost for x Months
x

The post Transparency in Cloud Storage Costs appeared first on Backblaze Blog | Cloud Storage & Cloud Backup.

TVStreamCMS Brings Pirate Streaming Site Clones to The Masses

Post Syndicated from Ernesto original https://torrentfreak.com/tvstreamcms-brings-pirate-streaming-site-clones-to-the-masses-170723/

In recent years many pirates have moved from more traditional download sites and tools, to streaming portals.

These streaming sites come in all shapes and sizes, and there is fierce competition among site owners to grab the most traffic. More traffic means more money, after all.

While building a streaming from scratch is quite an operation, there are scripts on the market that allow virtually anyone to set up their own streaming index in just a few minutes.

TVStreamCMS is one of the leading players in this area. To find out more we spoke to one of the people behind the project, who prefers to stay anonymous, but for the sake of this article, we’ll call him Rick.

“The idea came up when I wanted to make my own streaming site. I saw that they make a lot of money, and many people had them,” Rick tells us.

After discovering that there were already a few streaming site scripts available, Rick saw an opportunity. None of the popular scripts at the time offered automatic updates with freshly pirated content, a gap that was waiting to be filled.

“I found out that TVStreamScript and others on ThemeForest like MTDB were available, but these were not automatized. Instead, they were kinda generic and hard to update. We wanted to make our own site, but as we made it, we also thought about reselling it.”

Soon after TVStreamCMS was born. In addition to using it for his own project, Rick also decided to offer it to others who wanted to run their own streaming portal, for a monthly subscription fee.

TVStreamCMS website

According to Rick, the script’s automated content management system has been its key selling point. The buyers don’t have to update or change much themselves, as pretty much everything is automatized.

This has generated hundreds of sales over the years, according to the developer. And several of the sites that run on the script are successfully “stealing” traffic from the original, such as gomovies.co, which ranks well above the real GoMovies in Google’s search results.

“Currently, a lot of the sites competing against the top level streaming sites are using our script. This includes 123movies.co, gomovies.co and putlockers.tv, keywords like yesmovies fmovies gomovies 123movies, even in different Languages like Portuguese, French and Italian,” Rick says.

The pirated videos that appear on these sites come from a database maintained by the TVStreamCMS team. These are hosted on their own servers, but also by third parties such as Google and Openload.

When we looked at one of the sites we noticed a few dead links, but according to Rick, these are regularly replaced.

“Dead links are maintained by our team, DMCA removals are re-uploaded, and so on. This allows users not to worry about re-uploading or adding content daily and weekly as movies and episodes release,” Rick explains.

While this all sounds fine and dandy for prospective pirates, there are some significant drawbacks.

Aside from the obvious legal risks that come with operating one of these sites, there is also a financial hurdle. The full package costs $399 plus a monthly fee of $99, and the basic option is $399 and $49 per month.

TVStreamCMS subscription plans

There are apparently plenty of site owners who don’t mind paying this kind of money. That said, not everyone is happy with the script. TorrentFreak spoke to a source at one of the larger streaming sites, who believes that these clones are misleading their users.

TVStreamCMS is not impressed by the criticism. They know very well what they are doing. Their users asked for these clone templates, and they are delivering them, so both sides can make more money.

“We’re are in the business to make money and grow the sales,” Rick says.

“So we have made templates looking like 123movies, Yesmovies, Fmovies and Putlocker to accommodate the demands of the buyers. A similar design gets buyers traffic and is very, very effective for new sites, as users who come from Google they think it is the real website.”

The fact that 123Movies changed its name to GoMovies and recently changed to a GoStream.is URL, only makes it easier for clones to get traffic, according to the developer.

“This provides us with a lot of business because every time they change their name the buyers come back and want another site with the new name. GoMovies, for instance, and now Gostream,” Rick notes.

Of course, the infringing nature of the clone sites means that there are many copyright holders who would rather see the script and its associated sites gone. Previously, the Hollywood group FACT managed to shut down TVstreamScript, taking down hundreds of sites that relied on it, and it’s likely that TVStreamCMS is being watched too.

For now, however, more and more clones continue to flood the web with pirated streams.

Source: TF, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

FossHub Forced to Pull Google Ads From qBitTorrent Downloads

Post Syndicated from Andy original https://torrentfreak.com/fosshub-forced-to-pull-google-ads-from-qbittorrent-downloads-170721/

There are no shortage of sites on the Internet that promise free software downloads but few do so with no strings attached. Thousands bundle adware and worse with ‘free’ software, while others bombard visitors with ads.

FossHub, on the other hand, does things very differently.

FossHub only offers free software, with no adware, spyware or malware attached. It doesn’t bombard users with advertising either. In fact, its download pages only have a single ad at the top. Well, that’s the plan at least but when it comes to BitTorrent software, things haven’t been so straightforward recently.

The problem centered around qBitTorrent, the free and open-source torrent client developed as an alternative to µTorrent. FossHub makes the client available in its file-sharing section and as the image below shows, has racked up close to 18 million downloads.

Previously, when people viewed the qBitTorrent page, they were presented with a single advert, courtesy of Google. However, a couple of months ago the guys at FossHub contacted the people behind the client to say they’d had problems with AdSense persistently flagging the qBitTorrent page as “unauthorized file sharing.”

“The consequence was that it stopped generating revenue for that page for FossHub,” a member of the qBitTorrent team explains.

TorrentFreak spoke with Sam at FossHub who provided more details.

“FossHub has hosted qBittorrent and other free projects binaries for almost a decade. For qBitorrent, we hosted its files for at least three years by now. We provide all the necessary bandwidth and other things that the project might need,” Sam said.

“It was not a problem for the last three years to show the single Google Adsense ad until the beginning of last month (June 2017) when we noticed a Policy violation message appearing under our account.

“Since we didn’t have any major issues with our account, we thought it must be a false positive. We tried to get in touch with Google AdSense team, but unfortunately, we received some (at least that what we think) standard canned responses.”

Sam says that FossHub wrote to Google AdSense support several times but never got to the bottom of the problem. Then, something catastrophic happened.

During June, presumably due to the problems with the qBitTorrent page, the entire FossHub site was banned by AdSense for seven days, thereby stopping the site from generating any revenue on any of the software offered.

“We wrote on a daily basis and attempted to request another review, but there was no human so that we can talk and try to obtain an answer,” Sam explained.

In the absence of any feedback, FossHub then took the decision to stop placing ads on any of the software available in its file-sharing section, despite none of the tools being illegal or infringing anyone’s copyrights. In a follow-up post on Reddit this week, FossHub underlined that fact.

“qBitorrent and other similar apps are legit software. You are responsible for what you choose to download and share,” a representative from the site wrote.

“Many free projects and sites publish their files via .torrent files. Just an excellent example of how qBitorrent and other similar clients can help you download files and allow GIMP project to save bandwidth: https://www.gimp.org/downloads/.”

The qBitTorrent team say they have made this matter public out of “frustration and protest”, not only due to the legality of file-sharing software but also in support of FossHub, who have helped qBitTorrent many times over the years.

“I keep wondering why the multitude of other unofficial sites, which are very popular and place ads on their qBittorrent pages too, aren’t being flagged too?” a member of the team responded.

“In any case, I am writing this to inform our user base about Google’s shenanigans. And if any of you works at AdSense, then please help FossHub talk to a real person or treat all sites fair by allowing or not allowing BitTorrent clients.”

Whether Google will take the opportunity to clarify the situation remains to be seen but it’s abundantly clear that the qBitTorrent software is not only entirely legal, it’s also one of the most respected torrent clients around.

“Despite this unpleasant incident we will support and help free projects such as qBitorrent as much as we can,” FossHub concludes.

Source: TF, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

Basic API Rate-Limiting

Post Syndicated from Bozho original https://techblog.bozho.net/basic-api-rate-limiting/

It is likely that you are developing some form of (web/RESTful) API, and in case it is publicly-facing (or even when it’s internal), you normally want to rate-limit it somehow. That is, to limit the number of requests performed over a period of time, in order to save resources and protect from abuse.

This can probably be achieved on web-server/load balancer level with some clever configurations, but usually you want the rate limiter to be client-specific (i.e. each client of your API sohuld have a separate rate limit), and the way the client is identified varies. It’s probably still possible to do it on the load balancer, but I think it makes sense to have it on the application level.

I’ll use spring-mvc for the example, but any web framework has a good way to plug an interceptor.

So here’s an example of a spring-mvc interceptor:

@Component
public class RateLimitingInterceptor extends HandlerInterceptorAdapter {

    private static final Logger logger = LoggerFactory.getLogger(RateLimitingInterceptor.class);
    
    @Value("${rate.limit.enabled}")
    private boolean enabled;
    
    @Value("${rate.limit.hourly.limit}")
    private int hourlyLimit;

    private Map<String, Optional<SimpleRateLimiter>> limiters = new ConcurrentHashMap<>();
    
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
            throws Exception {
        if (!enabled) {
            return true;
        }
        String clientId = request.getHeader("Client-Id");
        // let non-API requests pass
        if (clientId == null) {
            return true;
        }
        SimpleRateLimiter rateLimiter = getRateLimiter(clientId);
        boolean allowRequest = limiter.tryAcquire();
    
        if (!allowRequest) {
            response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());
        }
        response.addHeader("X-RateLimit-Limit", String.valueOf(hourlyLimit));
        return allowRequest;
    }
    
    private SimpleRateLimiter getRateLimiter(String clientId) {
        return limiters.computeIfAbsent(clientId, clientId -> {
            return Optional.of(createRateLimiter(clientId));
        });
    }

	
    @PreDestroy
    public void destroy() {
        // loop and finalize all limiters
    }
}

This initializes rate-limiters per client on demand. Alternatively, on startup you could just loop through all registered API clients and create a rate limiter for each. In case the rate limiter doesn’t allow more requests (tryAcquire() returns false), then raturn “Too many requests” and abort the execution of the request (return “false” from the interceptor).

This sounds simple. But there are a few catches. You may wonder where the SimpleRateLimiter above is defined. We’ll get there, but first let’s see what options do we have for rate limiter implementations.

The most recommended one seems to be the guava RateLimiter. It has a straightforward factory method that gives you a rate limiter for a specified rate (permits per second). However, it doesn’t accomodate web APIs very well, as you can’t initilize the RateLimiter with pre-existing number of permits. That means a period of time should elapse before the limiter would allow requests. There’s another issue – if you have less than one permits per second (e.g. if your desired rate limit is “200 requests per hour”), you can pass a fraction (hourlyLimit / secondsInHour), but it still won’t work the way you expect it to, as internally there’s a “maxPermits” field that would cap the number of permits to much less than you want it to. Also, the rate limiter doesn’t allow bursts – you have exactly X permits per second, but you cannot spread them over a long period of time, e.g. have 5 requests in one second, and then no requests for the next few seconds. In fact, all of the above can be solved, but sadly, through hidden fields that you don’t have access to. Multiple feature requests exist for years now, but Guava just doesn’t update the rate limiter, making it much less applicable to API rate-limiting.

Using reflection, you can tweak the parameters and make the limiter work. However, it’s ugly, and it’s not guaranteed it will work as expected. I have shown here how to initialize a guava rate limiter with X permits per hour, with burstability and full initial permits. When I thought that would do, I saw that tryAcquire() has a synchronized(..) block. Will that mean all requests will wait for each other when simply checking whether allowed to make a request? That would be horrible.

So in fact the guava RateLimiter is not meant for (web) API rate-limiting. Maybe keeping it feature-poor is Guava’s way for discouraging people from misusing it?

That’s why I decided to implement something simple myself, based on a Java Semaphore. Here’s the naive implementation:

public class SimpleRateLimiter {
    private Semaphore semaphore;
    private int maxPermits;
    private TimeUnit timePeriod;
    private ScheduledExecutorService scheduler;

    public static SimpleRateLimiter create(int permits, TimeUnit timePeriod) {
        SimpleRateLimiter limiter = new SimpleRateLimiter(permits, timePeriod);
        limiter.schedulePermitReplenishment();
        return limiter;
    }

    private SimpleRateLimiter(int permits, TimeUnit timePeriod) {
        this.semaphore = new Semaphore(permits);
        this.maxPermits = permits;
        this.timePeriod = timePeriod;
    }

    public boolean tryAcquire() {
        return semaphore.tryAcquire();
    }

    public void stop() {
        scheduler.shutdownNow();
    }

    public void schedulePermitReplenishment() {
        scheduler = Executors.newScheduledThreadPool(1);
        scheduler.schedule(() -> {
            semaphore.release(maxPermits - semaphore.availablePermits());
        }, 1, timePeriod);

    }
}

It takes a number of permits (allowed number of requests) and a time period. The time period is “1 X”, where X can be second/minute/hour/daily – depending on how you want your limit to be configured – per second, per minute, hourly, daily. Every 1 X a scheduler replenishes the acquired permits (in the example above there’s one scheduler per client, which may be inefficient with large number of clients – you can pass a shared scheduler pool instead). There is no control for bursts (a client can spend all permits with a rapid succession of requests), there is no warm-up functionality, there is no gradual replenishment. Depending on what you want, this may not be ideal, but that’s just a basic rate limiter that is thread-safe and doesn’t have any blocking. I wrote a unit test to confirm that the limiter behaves properly, and also ran performance tests against a local application to make sure the limit is obeyed. So far it seems to be working.

Are there alternatives? Well, yes – there are libraries like RateLimitJ that uses Redis to implement rate-limiting. That would mean, however, that you need to setup and run Redis. Which seems like an overhead for “simply” having rate-limiting. (Note: it seems to also have an in-memory version)

On the other hand, how would rate-limiting work properly in a cluster of application nodes? Application nodes probably need some database or gossip protocol to share data about the per-client permits (requests) remaining? Not necessarily. A very simple approach to this issue would be to assume that the load balancer distributes the load equally among your nodes. That way you would just have to set the limit on each node to be equal to the total limit divided by the number of nodes. It won’t be exact, but you rarely need it to be – allowing 5-10 more requests won’t kill your application, allowing 5-10 less won’t be dramatic for the users.

That, however, would mean that you have to know the number of application nodes. If you employ auto-scaling (e.g. in AWS), the number of nodes may change depending on the load. If that is the case, instead of configuring a hard-coded number of permits, the replenishing scheduled job can calculate the “maxPermits” on the fly, by calling an AWS (or other cloud-provider) API to obtain the number of nodes in the current auto-scaling group. That would still be simpler than supporting a redis deployment just for that.

Overall, I’m surprised there isn’t a “canonical” way to implement rate-limiting (in Java). Maybe the need for rate-limiting is not as common as it may seem. Or it’s implemented manually – by temporarily banning API clients that use “too much resources”.

Update: someone pointed out the bucket4j project, which seems nice and worth taking a look at.

The post Basic API Rate-Limiting appeared first on Bozho's tech blog.

China Denies User VPN Crackdown, Blames False “Foreign Media” Reports

Post Syndicated from Andy original https://torrentfreak.com/china-denies-user-vpn-crackdown-blames-false-foreign-media-reports-170713/

A notice published by China’s Ministry of Industry and Information Technology in January said that the government had launched a 14-month campaign to crack down on local ‘unauthorized’ Internet platforms.

The idea is that all Internet services such as data centers, ISPs, CDNs, and VPNs, will eventually need pre-approval from the government to operate. Operating such a service without a corresponding telecommunications business license will constitute an offense.

After the news broke, a source with contacts at a high-level telecoms company in the region told TF that, in his opinion, user-based VPNs were not the target and that MPLS VPNs were. These types of VPN (pdf) allow businesses, including those in China, to connect their geographically separated business locations, such as those in Hong Kong, Singapore, and Indonesia, for example.

This week, however, Bloomberg broke the news that China’s Government had ordered telecommunications carriers to block individuals’ access to Virtual Private Networks. This, the publication said, would stop citizens from accessing the global Internet.

According to the report, the government ordered at least three state-run telecommunications firms, including China Mobile, China Unicom and China Telecom, to stop people from using VPNs which allow people to circumvent censorship restrictions, otherwise known as the Great Firewall, by February next year.

Jake Parker, Beijing-based vice president of the US-China Business Council, agreed that the move “seems to impact individuals,” but last evening the Chinese authorities were attempting to pour cold water on the report.

In comments to China-based media outlet The Paper, the Ministry of Industry and Information Technology denied issuing a notice to the telecoms companies requiring them to block user VPNs. It said that “foreign media reports” were inaccurate.

“Our subordinate Secretary did not issue the relevant notice, what foreign media reported was false,” the Ministry said.

The local media report then has the Ministry citing news that previously broke in January, detailing the new government measures that require cross-border enterprise-level VPN systems to be authorized and licensed.

“Foreign trade enterprises and multinational companies, due to office for personal use and other reasons, need to access cross-border networking,” the Ministry said, adding that licensing is available and won’t have a detrimental effect on normal operations.

Given this statement, the announcement in January, and the comments made to TF regarding the government targeting enterprise-level VPNs, it raises the question whether the term ‘VPN’ has perhaps been interpreted too widely, to include user-based services.

Nevertheless, in a follow-up report last evening, Bloomberg repeated its claims that Beijing had ordered state-run telecoms firms to stop people from using VPNs that route traffic overseas to avoid censorship.

“The clampdown will shutter one of the main ways in which people both local and foreign still manage to access the global, unfiltered web on a daily basis,” the report said.

Only time will tell how the landscape will pan out, but it’s safe to say that China would like a tighter hold on the web than it has now and that VPNs of all kinds will continue to undermine that control, unless something is done.

Source: TF, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

Daily Mail Sued For ‘Pirating’ Dozens of Viral Videos

Post Syndicated from Ernesto original https://torrentfreak.com/daily-mail-sued-for-pirating-dozens-of-viral-videos-170711/

A cat playing a game of whack-a-mole, a goat hitching a ride on the back of donkey, and a flying squirrel that’s eaten too much.

Besides being animals, they have something else in common. They’re all stars in viral videos.

With millions of views these lucky clips draw a lot of eyeballs. This is good news for the creators, who can monetize the views. And mainstream news sites and tabloids like them as well, since ithey can add some amusement to their online publications.

The problem, however, is that quite a few websites don’t pay for the viral content they put up. In some cases, they assume that videos can be shared freely, while others ignore the copyright issue on purpose.

According to a complaint submitted to a US District Court late last week,
popular British tabloid Daily Mail is guilty of the latter. The lawsuit was filed by Rumble, a company that manages the rights of hundreds of thousands of viral videos.

Rumble informs the court that it’s representing small creators who often don’t have the means to put up a fight against companies that ‘steal’ their content.

“By themselves, these individual content creators cannot effectively police and enforce their copyrights against those infringers who use their videos without approval, authorization or paying anything,” Rumble writes.

“These serial infringers can and do make very large sums of money using these copyright-protected videos without ever paying one penny to the content-creator,” the company adds.

Initially, Rumble and the Daily Mail had a license agreement to use the videos on their website. However, according to the complaint, the British tabloid continued to publish them after the license expired.

When the infringing usage continued, Rumble retained legal counsel to solve the matter, but that didn’t help either. This eventually culminated in legal action.

“Rumble asserts that the infringement here is of the most bold and bald-faced kind, exhibiting an utter disrespect for the copyrights of others,” the complaint reads.

“That [the infringment] is ‘willful’ in the factual and legal sense of the word is beyond dispute, such that the ultimate damages to be awarded will be reasonably and justifiably enhanced, including an award of Rumble’s attorneys fees as well.”

Rumble expects that Daily Mail will claim that they were not aware of the infringing activities so cautions the court not to fall for these type of excuses. The video platform stresses that turning a blind eye to the copyrights of others is part of the tabloid’s playbook, and plans to prove this at trial.

With dozens of videos listed in the legal paperwork, the potential piracy damages requested by the company are around $10,000,000. In addition, Rumble asks for an injunction to stop the infringing activity as soon as possible.

While Rumble prides itself for sticking up for the small guy, as the main rightsholder it has a direct financial interest in the case, of course. We asked the company whether the creators will also get a share of any potential damages, but at the time of publication, we have yet to hear back.

A copy of the complaint is available here (pdf).

Source: TF, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

Court Orders Advertisers to Freeze Revenue of ‘Pirate’ Sites

Post Syndicated from Ernesto original https://torrentfreak.com/court-orders-advertisers-to-freeze-revenue-pirate-sites-170707/

When one thinks of anti-piracy efforts in the United States, the MPAA and RIAA are often the first groups that come to mind.

While that may be true, there’s another player which has made a massive impact, while barely being noticed at all.

ABS-CBN, the largest media and entertainment company in the Philippines, has filed a series of lawsuits against pirate sites in the US, with the popular streaming portal Fmovies as the biggest target.

The company has already won several cases with damages ranging from a few hundred thousand to millions of dollars. However, the associated injunctions in these cases are perhaps even more significant.

We previously covered how ABS-CBN managed to get court orders to seize domain names, without the defendants getting actively involved. This is also the case in a recent lawsuit where a Florida federal court signed a broad injunction targeting more than two dozen sites.

The websites, including dramasget.com, latestpinoymovies.com, pinoydailyshows.com, tvnijuan.org and weeklywarning.org, may not ring a bell with a wide audience but their domain names have all been suspended, linking to a takedown message instead.

And there is another interesting element to the injunction, which hasn’t been widely used in the past. Hoping for a good shot at some damages down the road, ABS-CBN put in a request to freeze the advertising revenues of these sites at Google Adsense, MGID, Popads.net, and elsewhere.

The court signed off on this, and added it to the preliminary injunction. As a result, the advertisers must freeze the funds until further notice.

“…all funds in the advertising accounts related to Defendants as identified on Schedule B, including but not limited to those which are currently held by the advertising services […] are immediately restrained from movement, transfer, or otherwise being disturbed, as opposed to ongoing activity.”

None of the funds of the defendants are allowed to be moved. Instead, the court order directs the advertising companies to transfer everything to a holding account that is known to the court.

On top of that, Google Adsense, MGID, and the other advertising companies must send the copyright holder an overview of the revenue in each account and all transactions associated with it.

“(i) an accounting of the total funds restrained and identifies the advertising/financial account(s) which the restrained funds are related to, and (ii) the account transactions related to all funds transmitted into the advertising/financial account(s) which have been restrained.”

Needless to say, this injunction will have a pretty severe effect on alleged pirate sites. Not only do they lose their preferred advertising outlets, but they also miss out on any pending revenue.

The sites that are targeted in this case are relatively small, but it could, in theory, happen to the big players as well. While the RIAA and MPAA are not involved in this case, we’re pretty confident that they are watching this case very closely.

Finally, the injunction sheds an interesting light on which registrars and registries swiftly respond to US court orders. At the time of writing all .com, .org and .net domains are suspended, but some of the .ag, .ch and .ph domains are still operational. With new ads, of course.

A copy of the preliminary injunction is available here (pdf).

Source: TF, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.