Facebook

Microsoft Spyware Now Being Installed On Win 7

Monday, August 24, 2015 

If you’re the sort of person who isn’t entirely happy about the idea of Microsoft claiming the right to copy your personal files, photos, emails, chat logs, diary entries, medical records, etc over to their own servers to sell to whoever they want for whatever they can get for your personal data – into markets that already exist for insurance companies to deny you insurance based on algorithmic analysis of your habits or your friends habits or for financial institutions to set your interest rates based on similar criterion, or perhaps even for law enforcement to investigate you without a warrant, then OBVIOUSLY you would never, ever install Windows 10 under any circumstances.

Well, Microsoft seems to have fully jumped on the Google/Facebook gravy train and is now completely invested in stealing your data and selling it to the highest bidder (Apple has been exfiltrating your data for a long time, but so far for internal use).  I’ve become more suspect of Microsoft’s updates since they made the Windows 10 advertisement an important (not optional) update (important for what? their bottom line, obviously).  Turns out that the latest updates to Windows 7 are pushing Microsoft’s new business model of stealing your data for profit to Windows 7 and 8.

Staying safe is going to require ever more vigilance.  It may be possible to block windows components from reaching out to microsoft’s servers at the personal firewall level and certainly it can be done at the corporate firewall level (and should be), but blocking Microsoft is a somewhat complex issue.  You can’t run Windows safely without installing security patches because the underlying OS is so completely insecure that new, critical, exploitable flaws are discovered every single week.  If you don’t constantly patch these security failures, you will be hacked by people other than microsoft.  If you install the wrong microsoft patch, you will be hacked by microsoft.  Debian anyone? Also, software developers developing enterprise software, please, please, please stop developing for that horrible, insecure, performance hobbling abomination of a tarted-up single-user OS “Server” and focus on a secure, stable server OS like FreeBSD.  Please.  I hate, hate having to fork over $1k to microsoft for each box to run their horrible OS just so I can run your software.  Why do you support that extortion? Do you despise your customers that much? Stop.

If you care about corporate governance and data security or HIPAA compliance, you are probably violating some critical requirements by installing windows 10 or these new updates to your existing Win7/8 base if you do not block data exfiltration to Microsoft’s servers.  This is spyware.  These updates are stealing your data and sending it to Microsoft.  If your business is subject to data privacy laws, these updates put you in violation of those laws.  Microsoft is doing something that is extremely significant and extremely evil and completely wrong.  Take action or you may very well be facing personal or corporate consequences.  srsly.

I am a strong believer in data privacy and extremely suspect of what I consider highly disingenuous business practices like Google’s but I recognize that there are reasonable people out there who think Google isn’t evil.  However, this windows 10 issue, now being pushed to windows 7, goes well beyond Google taking advantage of people’s historical assumptions about the security of email to offer them a free look-alike honey trap to gather their data.  Windows 10 and these Win 7 updates are intrusive, not merely misleading.  Do not update.  Srsly.  Do not update.  Block the spyware “hotfixes.”

Stop Gap Fixes

In researching these updates, I came across this article on techworm that has a nice summary of the Malware updates Microsoft is pushing out (with some additional amendments I found):

With a whiff of irony, this google search “telemetry site:https://support.microsoft.com/en-us/kb” shows these patches and many more…

Do not automatically install Microsoft updates.  You must turn that feature off or you will keep getting additional spyware installed.  Go to windows update and verify your settings.  I have mine set so windows downloads the updates (so the updates are waiting locally), but I don’t let windows install them automatically.  That gives me a chance to review the updates and look for spyware.

windows_update_settings

When you get updates, you now have to check each one of them to find out if it is spyware or not.  The list above is current as far as I know, but clicking on the “more information” link to the right of the updates list will get you microsoft’s marketing speak obfuscation of the true purpose.  Any update that “adds telemetry points” or something like that is spyware.  Uncheck the install and hide the update.  Note that some of these were moved from “optional” to “important.”  Microsoft is absolutely intent on stealing your data and is taking some pretty underhanded steps to make it difficult for you to avoid it.

block_microsoft_spyware

 

If updates get past you or it turns out later that a seemingly important or innocuous update was spyware (the fun part is that you now have to be vigilant and look all this stuff up), then you can uninstall them from the “installed updates” control panel.

uninstall_microsoft_spyware

Work to be done

I’ll start looking into firewall settings to block communication to microsoft’s servers.  This is a standard anti-malware technique and should work here, except that microsoft has so many servers it is more challenging to block them than your typical malware botnet.

We need something like a variant of Peer Guardian to block microsoft’s servers using the standard P2P crowd-sourcing model to keep the list up to date. I’m not aware of anything like this yet, but I’m looking.  Microsoft has become more of an enemy to privacy than the RIAA ever was.

UPDATE:  this superuser answer includes a list of telemetry endpoints to block at your firewall or router.  Alternatively you can edit your hosts file and add these entries from DSL reports.

Larger Significance

This shift in business focus by Microsoft from providing a product people are willing to pay for to stealing data from people to sell on the commercial market has some significant lessons for the entire software model.

It isn’t just that Microsoft is now adopting Google’s business model of giving away “free” goodies as traps to collect product (you) to sell to the highest bidder, but that the model of corporate trust that underpins most of the security assumptions the internet is built on is manifestly false and unsustainable.  If any hacker tried to create these spyware updates, locked-down computers that only install signed code would refuse to install them.  Ignoring for the moment that the signed code model is idiotically flawed as signing keys are stolen all the time, this microsoft spyware is properly signed with legitimate keys.  It will be installed on locked down computers without complaint and will not show up in commercial anti-virus software.  But it is spyware.  It contains keyloggers and extremely productive data exfiltration code that is currently copying wholesale data dumps from unfortunate victims to Microsoft’s servers in such volume that their data caps are being hit.

If a non-commercial third party (e.g. “hacker”) did this, they’d be prosecuted.  It makes no difference to you that your data is being stolen by Microsoft rather than by some clever teenager in a former eastern block country: your data is being stolen.  But the model that has been promoted, a model of centralized corporate trust to validate the “security” of your system has been utterly and irrevocably shattered.  This isn’t an accident, isn’t something that better data management might have prevented, this is an intentional ex post facto rewrite of the usual, customary, and regular assumptions we have about the privacy of our computer systems and one that significantly impacts the security of almost everyone in the world: military, medical, legal, fiduciary, as well as personal.

And even if you trust Microsoft (for whatever bizarre, irrational reason), Microsoft is creating a whole series of security holes in their already crappy and insecure operating system that will be exploited by third parties.  By adding keyloggers and data exfiltration tools to the core OS, they’re making it even easier for non-corporate hackers to jump on the data theft gravy train. Everyone profits but you. You lose.

Posted at 04:19:18 UTC

Category: Privacytechnology

Better Cabling May Fix The Internet

Sunday, February 8, 2015 

Do you find that the internet seems harsh? Do you find Facebook unclear and that it lacks dynamic contrast? Is there less detail than there should be? Do you notice a loss of energy from the Internet?

It might all come down to the network cables themselves.

AudioQuest Diamond Ethernet Cable

Well designed cables like these have perfect-surface extreme-purity silver conductors minimizing distortion caused by grain boundaries in inferior OFHC, OCC, or 8N conductors for better clarity and reduced harshness. Explanations and arguments will be both more clearly constructed and less confrontational.

Noise and other distractions are reduced by a 3-layer noise dissipation system, not just shielding your data but preventing modulation of your ground plane by noisy RFI.  Even more problematically for those doing research on the web, the untested orientation of standard network cables results in inferior data quality.

Standard network cables either don’t enforce orientation of the pairs at all (Cat 5e and below) or merely segregate pairs with a flexible spacer (Cat 6 and above). These cables use solid polyethylene insulation to ensure critical geometry is preserved to minimize phase errors. Phase errors can easily result in Doppler shifts manifest in either an unnaturally shrill tone or affected bass (sometimes manifest as “mansplaining”).

Most remarkably, the dielectric bias system puts a 72V bias on the insulation and thus organizes the molecules of the insulation to minimize energy loss which creates a surprisingly black background, more essential than ever in the wake of Ferguson.

Only $10,521 for a 12m cable. Now that the internet has become our primary source of information, understanding, and personal communication this is a tiny price to pay for clear, undistorted data.

Posted at 19:24:18 UTC

Category: oddtechnology

Sony-style Attacks and eMail Encryption

Friday, December 19, 2014 

Some of the summaries of the Sony attacks are a little despairing of the viability of internet security, for example Schneier:

This could be any of us. We have no choice but to entrust companies with our intimate conversations: on email, on Facebook, by text and so on. We have no choice but to entrust the retailers that we use with our financial details. And we have little choice but to use butt services such as iButt and Google Docs.

I respectfully disagree with some of the nihilism here: you do not need to put your data in the butt. Butt services are “free,” but only because you’re the product.  If you think you have nothing to hide and privacy is dead and irrelevant, you are both failing to keep up with the news and extremely unimaginative. You think you have no enemies?  Nobody would do you wrong for the lulz?  Nobody who would exploit information leaks for social engineering to rip you off?

Use butt services only when the function the service provides is predicated on a network effect (like Facebook) or simply can’t be replicated with individual scale resources (Google Search).  Individuals can reduce the risk of being a collateral target by setting up their own services like an email server, web server, chat server, file server, drop-box style server, etc. on their own hardware with minimal expertise (and the internet is actually full of really good and expert help if you make an honest attempt to try), or use a local ISP instead of relying on a global giant that is a global target.

Email Can be Both Secure AND Convenient:

But there’s something this Sony attack has made even more plain: eMail security is bad.  Not every company uses the least insecure email system possible and basically invites hackers to a data smorgasborg like Sony did by using outlook (I mean seriously, they can’t afford an IT guy who’s expertise extends beyond point-n-click?  Though frankly the most disappointing deployment of outlook is by MIT’s IT staff.  WTF?).

As lame as that is, email systems in general suffer from an easily remediated flaw: email is stored on the server in plain text which means that as soon as someone gets access to the email server, which is by necessity of function always globally network accessible, all historical mail is there for the taking.

Companies institute deletion policies where exposed correspondence is minimized by auto-deleting mail after a relatively short period, typically about as short as possible while still, more or less, enabling people to do their jobs.  This forced amnesia is a somewhat pathetic and destructive solution to what is otherwise an excellent historical resource: it is as useful to the employees as to hackers to have access to historical records and forced deletion is no more than self-mutilation to become a less attractive target.

It is trivial to create a much more secure environment with no meaningful loss of utility with just a few simple steps.

Proposal to Encrypt eMail at Rest:

I wrote in detail about this recently.  I realize it is a TLDR article, but as everyone’s wound up about Sony, a summary might serve as a lead-in for the more actively procrastinating. With a few very simple fixes to email clients (which could be implemented with a plug-in) and to email servers (which can be implemented via mail scripting like procmail or amavis), email servers can be genuinely secure against data theft.  These fixes don’t exist yet, but the two critical but trivial changes are:

Step One: Server Fix

  • Your mail server will have your public key on it (which is not a security risk) and use it to encrypt every message before delivering it to your mailbox if it didn’t come in already encrypted.

This means all the mail on the sever is encrypted as soon as it arrives and if someone hacks in, the store of messages is unreadable.  Maybe a clever hacker can install a program to exfiltrate incoming messages before they get encrypted, but doing this without being detected is very difficult and time consuming.  Grabbing an .ost file off some lame Windows server is trivial. I don’t mean to engage in victim blaming, but seriously, if you don’t want to get hacked, don’t go out wearing Microsoft.

Encrypting all mail on arrival is great security, but it also means that your inbox is encrypted and as current email clients decrypt your mail for viewing, but then “forget” the decrypted contents, encrypted messages are slower to view than unencrypted ones and, most crippling of all, you can’t search your encrypted mail.  This makes encrypted mail unusable, which is why nobody uses it after decades. This unusability is a tragic and pointless design flaw that originated to mitigate what was then, apparently, a sore spot with one of Phil’s friends who’s wife had read his correspondence with another woman and divorce ensued; protecting the contents of email from client-side snooping has ever since been perceived as critical.1I remember this anecdote from an early 1990’s version of PGP.  I may be mis-remembering it as the closest reference I can find is this FAQ:

It was a well-intentioned design constraint and has become a core canon of the GPG community, but is wrong-headed on multiple counts:

  1. An intimate partner is unlikely to need the contents of the messages to reach sufficient confidence in distrust: the presence of encrypted messages from a suspected paramour would be more than sufficient cause for a confrontation.
  2. It breaks far more frequent use such as business correspondence where operational efficiency is entirely predicated on content search which doesn’t work when the contents are encrypted.
  3. Most email compromises happen at the server, not at the client.
  4. Everyone seems to trust butt companies to keep their affairs private, much to the never-ending lulz of such companies.
  5. Substantive classes of client compromises, particularly targeted ones, capture keystrokes from the client, meaning if the legitimate user has access to the content of the messages, so too does the hacker, so the inconvenience of locally encrypted mail stores gains almost nothing.
  6. Server attacks are invisible to most users and most users can’t do anything about them.  Users, like Sony’s employees, are passive victims of sysadmin failures. Client security failures are the user’s own damn fault and the user can do something about them like encrypting the local storage of their device which protects their email and all their other sensitive and critical selfies, sexts, purchase records, and business correspondence at the same time.
  7. If you’re personally targeted at the client side, that some of your messages are encrypted provides very little additional security: the attacker will merely force you to reveal the keys.

Step Two: Client Fix

  • Your mail clients will decrypt your mail automatically and create local stores of unencrypted messages on your local devices.

If you’ve used GPG, you probably can’t access any mail you got more than a few days ago; it is dead to you because it is encrypted.  I’ve said before this makes it as useless as an ephemeral key encrypted chat but without the security of an ephemeral key in the event somebody is willing to force you to reveal your key and is interested enough to go through your encrypted data looking for something.  They’ll get it if they want it that bad, but you won’t be bothered.

But by storing mail decrypted locally and by decrypting mail as it is downloaded from the server, the user gets the benefit of “end-to-end encryption” without any of the hassles.

GPG-encrypted mail would work a lot more like an OTR encrypted chat.  You don’t get a message from OTR that reads “This chat message is encrypted, do you want to decrypt it?  Enter your password” every time you get a new chat, nor does the thread get re-encrypted as soon as you type something, requiring you to reenter your key to review any previous chat message.  That’d be idiotic.  But that’s what email does now.

Adoption Matters

These two simple changes would mean that server-side mail stores are secure, but just as easy to use and as accessible to clients as they are now.  Your local device security, as it is now, would be up to you.  You should encrypt your hard disk and use strong passwords because sooner or later your personal device will be lost or stolen and you don’t want all that stuff published all over the internet, whether it comes from your mail folder or your DCIM folder.

It doesn’t solve a targeted attack against your local device, but you’ll always be vulnerable to that and pretending that storing your encrypted email on your encrypted device in an encrypted form adds security is false security that has the unfortunate side effect of reducing usability and thus retarding adoption of real security.

If we did this, all of our email will be encrypted, which means there’s no additional hassle to getting mail that was encrypted with your GPG key by the sender (rather than on the server).  The way it works now, GPG is annoying enough to warrant asking people not to send encrypted mail unless they have to, which tags that mail as worth encrypting to anyone who cares.  By eliminating the disincentive, universally end-to-end encrypted email would become possible.

A few other minor enhancements that would help to really make end-to-end, universally encrypted email the norm include:

  • Update mail clients to prompt for key generation along with any new account (the only required option would be a password, which should be different from the server-log-in password since a hash of that has to be on the server and a hash crack of the account password would then permit decryption of the mail there, so UX programmers take note!)
  • Update address books, vcard, and LDAP servers so they expect a public key for each correspondent and complain if one isn’t provided or can’t be found.  An email address without a corresponding key should be flagged as problematic.
  • Corporate and hierarchical organizations should use a certificate authority-based key certification system, everyone else should use web-of-trust/perspectives style key verification, which can be easily automated to significantly reduce the risk of MitM attacks.

This is easy. It should have been done a long time ago.

 

Footnotes   [ + ]

1. I remember this anecdote from an early 1990’s version of PGP.  I may be mis-remembering it as the closest reference I can find is this FAQ:
Posted at 16:21:29 UTC

Category: FreeBSDPrivacySecuritytechnology

You Now Have Hemorrhoids

Friday, July 27, 2012 

I sign into Facebook and am greeted with the following diagnosis: You how have timeline.

I resisted as long as I could, but sooner or later really bad interface design always seems to poop over everything.

youve got timeline.JPG

Posted at 11:43:44 UTC

Category: -

Facebook Lose

Sunday, November 13, 2011 

For some time now I’ve used Facebook as a broadcast channel for my content. That is, I post to my personal, self-hosted, on my own server, in my own house blog so I actually, unambiguously own my content. Then I let facebook rebroadcast it. That is, apparently, going to end.

They have decided that they will make it more difficult to use facebook to disseminate content facebook doesn’t own – that is any content you actually enter into the facebook interface is facebook’s and they chose whether to keep it or delete it, make money off it or bury it. You’re just an unpaid worker troll feeding their advertising revenue machine, and you will no longer let to play with their toys if you don’t play along.

Social networks are kind of cool, but it will be a good thing when facebook jumps the shark and we get the next iteration. It’ll be a sad day for everyone who has put a lot of effort into gifting facebook with as much content as they can though, when all that UGC goodness ends up on ebay’s used hard disks section for bargain hunters to sift through with disk recovery tools for their own amusement.

facebook_lose.jpg

Posted at 09:27:52 UTC

Category: -

Fight ProtectIP/SOPA

Thursday, October 27, 2011 

I am a constituent and I urge you to reject the Internet Blacklist Bills (PROTECT IP Act in the Senate and the Stop Online Piracy Act in the House).

This bill is deeply, deeply flawed and fails completely to live up to the fundamental constitutional basis for copyright: “to promote the progress of science and the useful arts.”

I am deeply concerned by the danger these bills pose to Internet security, free speech online, and innovation. The Internet Blacklist Legislation is dangerous and short-sighted, and I urge you to join Senator Wyden and other members of Congress in opposing it.

If this bill passes, those entire “middle class” of moderately successful collaborative and user-generated sites will be driven out of the internet. The 1% sites like Google or Facebook can afford tier one lawyers to protect themselves from the prima facia unconstitutionality of this absurdly ill-considered bill, but the vast 99% can’t afford the legal resources or the infrastructure resources this bill mandates and they will vanish, hobbling the internet as the most fruitful incubator of science and the useful arts so far created.

Promote science and the useful arts by blocking ProtectIP/SOPA.

Posted at 16:19:49 UTC

Category: Negativepolitics

Google-

Tuesday, September 13, 2011 

I was searching for something random on Google (no, not that, regular expression examples) and noticed that funny little bar they put up there a while back when Google+ had the world all a-flutter. My little box had a [1] in it. Hmmm.. A few people I’d never heard of had “circled” me. Nobody I knew. I think I last checked G+ a few weeks ago, maybe it was a month. Oh well, so much for that one. Facebook will eventually do a MySpace, taking everyone’s cleverly crafted content out with it, but G+ won’t be the Facebook that does it. Or something like that.

Typing of Google, anyone else notice that Google has become much more aggressive about implicit substitution? I’m used to it autocorrecting typing, which actually led to ever more lazy typing, at least on my part. But I thought it always let me know when it was making a presumptive change. Search for [Congres] (using square brackets to denote the text box since “” has meaning in this context) and it used to note “Do you mean “Congress”” Yeah yeah, just fat-fingered the last letter, NP. Now it just silently corrects unless you use quotes. Maybe you actually wanted to find the “Hotel Du Congres.”

OK, annoying, but not fatal. But what is actually quite tedious is when you search for something slightly esoteric like [“white screen of death” client certificate]. 122,000 results. Whee. Oh, wait, most have nothing to do with client certificates – how can that be? [“white screen of death” “client” “certificate”] yields 367 results, almost all relevant. So for about 121,000 results Google assumes I just accidentally typed “client” and/or “certificate”? Those do not seem like common typos for [ ] (blank). If I went to all the trouble of typing out the words “client” and “certificate” does it not generally undermine the utility of a search function if it arbitrarily decides to ignore any inconvenient terms?

I find my self quote-forcing ([“white screen of death” +client +certificate] yields the same 367 results) most of my searches. Since when did my search terms become optional? WTF Google? Search is the one thing you do well. Well, that and advertising. Please don’t break it. Trust me, if you blow search you are not going to make up the difference with Social Networking.

Update: I recently searched for a scholarly article to back an assumption that document collections stored in structured databases can be accessed faster than document collections stored in file systems.  I used the word “median” rather than “average” in my search, but clever Google knows the two are often synonyms and rather than limit my search to documents that use the typically academic “median,” I got almost entirely useless results referencing various colloquial “average” constructions.

Posted at 01:37:41 UTC

Category: Negativereviewstechnology

Is it time to leave FaceBook

Tuesday, August 16, 2011 

So somebody added me to a FaceBook group – I haven’t yet looked into how, but facebook lets me opt out later (rather than opt in) which means I’m getting dozens of messages a day and I’ll have to get around to unsubscribing when I can.

Wow…. this is amazing. Somebody you don’t like? Subscribe them to high volume facebook groups. Their inboxes will fill with random crap. That’s awesome – other people can put you in a group and you have to opt out. That’s even better than G+ leaking “circle” names; fortunately, I read about that one before populating my “annoying morons I follow only because I have to for business reasons” circle. Now where are those “Fans of Pedobear” and “10% For Al Queda” groups? Lets see how long it takes to get all the FaceBook employees on the no fly list.

Seems like Facebook is responding badly to the perceived pressure from G+ (isn’t that dead yet?). I have no idea how long the groups opt out has been in place, but one of my favorite recent moves is the mobile snarf function whereby your facebook mobile app scrapes your mobile phone directory to populate everyone’s mobile phone numbers in their database and then default suggest that direct messages be sent to mobile devices. If nothing else convinced people that facebook messaging is a horrible substitute for email, this should.

This is a great example of why putting information in the “cloud” means ceding all control to entities who’s motivations may not align with yours. Facebook has decided that their best interests are served by snarfing mobile numbers, running up phone bills, and stuffing inboxes and there’s nothing you can do but write a whiny letter. They have your data on their hardware, so they own it.

Posted at 14:46:01 UTC

Category: technologyvanity sites

Will G+ Eat RSS, or Insist on Sole Ownership?

Thursday, July 21, 2011 

Weird: I have yet to find a way to import an RSS feed into G+. This is one of those things that significantly undermines Google’s “your data” cred. Anyone know of a way to do it? I haven’t found an “import RSS feed into your feed” the way facebook kinda does and the wordpress/facebook plugin does.

I’m a very strong believer in “he who owns the hardware, owns the data,” so, for example, posting this on G+ means that this text is Google’s (note, this was originally published on G+, then I stole it back!). And since it didn’t originate on my personal wordpress installation (free as in speech, free as in beer) running on my server at home (free as in speech, not absurdly expensive as in cheap beer), it isn’t mine.

My server also runs my mail server, my file server, my web server etc. all from my garage meaning that’s my data and my hardware and fully protected by law, while any data on Google’s server is effectively shared with every good and bad government in the world and my only legal recourse if it gets hacked or stolen or sold or given away or simply deleted is to… write an angry post on my blog and swear never to trust a cloud service again.

This is, obviously, exactly the same at FaceBook and every other cloud service. I use Facebook as a syndication service: I post on my own servers and syndicate via RSS to FaceBook, which becomes, in effect, the most frequently used RSS reader should people who haven’t gotten around to blocking me in their streams might find and by which perhaps occasionally be amused. This means I still own my data and my data has no particular dependence on FaceBook’s survival.

This post is visible only as long as Google wants it to be.  If Google changes the rules, I lose the data.  OK, I can download it – as long as they choose to let me, but it isn’t my data. When I post on my server then give FaceBook permission to republish the data, I control my data and they get only what I decide to give them. When I post this on Google and then ask “please, sir, may I recover my post for another use?” the power relationship is reversed: Google owns and controls everything and my rights and usage are only what they deign to offer me.

That almost everyone trusts the billionaire playboys who put king sized beds in their 767 party plane as “do no evilparagons of virtue is odd to me, but nothing better validates Erich Fromm’s thesis than the pseudo-religious idolatry of Google and Apple.  Still, even the True Believers should realize that the founders of these Great Empires are not truly immortal and that even if Google is doing no evil now, it will change hands and those that inherit every search you’ve ever done, every web page you’ve ever visited, every email you’ve ever sent, every phone call you’ve ever made or received, the audio of every message ever left for you, the GPS traces of every step you’ve ever taken, every text and chat and tweet might think, say, that Doing Good means something different than you think it does.  One should also remember the Socratic Paradox that renders tautological Google’s vaunted motto.

Unfortunately, at least so far, Google won’t let me use G+ to syndicate my data – they insist on owning it and dictating the terms by which I can access it. If I want to syndicate content through my G+ network, it seems I have to fully gift Google that content. I’m hoping there’s a tool to populate my “posts” from RSS so the canonical will remain on my server. Because it is the Right Thing To Do.

(Shhhh..  I’m going to copy and paste this into my own wordpress installation, even though I wrote it here on the G+ interface.  They probably won’t send me a DMCA takedown, but I do run the risk that they’ll hit me with a “duplicate content penalty” and set my page rank to 0 thus ensuring nobody ever finds my site again.  Ah, absolute power, so reassuring to remember that it is absolutely incorruptible.)

Posted at 11:47:35 UTC

Category: politicsself-publishingtechnology

FB vs. G+

Tuesday, July 12, 2011 

An interesting artifact of the FB vs. G+ debate is the justification by a lot of tech-savvy people in moving to G+ from FB because they believe Google to be less evil.  It is an odd comparison to make, both companies are in essentially the same business: putting out honey pots of desirable web properties, attracting users, harvesting them, and selling their data.

Distinguishing between grades of evil in companies that harvest and sell user data seems a little arbitrary.  I’d think it would make more sense to use each resource for what it does well rather than arbitrarily announce that you’re one or the other.

However, if one is making the choice as to what service to call home on the basis of least “evil” and assuming that metric is derived in some way from the degree to which the company in question harvests your data and sells it, then it is somewhat illuminating to look at real numbers.  One can assume that the more deeply one probes each user captured by the honey pot, the more data extracted, the more aggressively sold, the more money one makes. The company that makes the most money per user is probing the deepest and selling the hardest.

From Technology Review May/June 2011, annual revenue per monthly unique US visitor:

Facebook: $ 12.10
Google:     $163.60

Google squeezes out and sells more than 13.5x the data per user. Google wins. But Facebook is gathering $12.10 worth of user data, why should Google allow Facebook to have it? If Google wins that last morsel of data to take to market and takes out Facebook, Google can increase their gross revenue by 7%.

I’ve also heard people argue that Zuckerberg seems more personally avaricious, mean, or evil than Google’s founders, comparing Google’s marketing spin to “The Social Network”

Zuckerberg’s only newsworthy purchase was a $7m house in Palo Alto. Google co-founders were in the news over a lawsuit between them over whether their 767 “party plane” (Eric Schmidt) could house Brin’s California king bed. This is in addition to their 757 and two Gulfstream Vs they talked NASA into letting them park at Moffet under the pretense that the planes would be retrofit with instruments for NASA. When they couldn’t do that (FAA regs, who knew?), they bought a Dornier Alpha, but still get to park their jumbo jets and gulfstreams inside NASA hangers for some reason. Suck on that, Ellison!

Posted at 01:25:13 UTC

Category: technologyvanity sites