The BT-bound IPStream/Datastream providers can't possibly afford
the capacity they'd need to offer real unlimited connections to
users, at current market prices. Whilst the LLU providers potentially
could (after recouping higher initial costs), they're not available
everywhere, and they still have to compete with the low prices of
other ISPs all falsely claiming to have unlimited capacity.
Why someone (Advertising Standards? Office of Fair Trading? Ofcom in
general? Anyone?) isn't doing anything about this false advertising I can't
fathom. Customers are being lied to, short-changed, and then locked
into lengthy contracts it can be difficult to get out of when they
discover the deception. And as VoD adoption continues the situation
is going to get increasingly untenable.
One technical nugget was dropped in on this front, though: cable
op Virgin Media is planning to add capacity by upgrading to
DOCSIS 3.0 this year. This is encouraging, as the cash-starved
collection of various old-school networks they inherited when
buying up the UK's various cable providers is already starting
to feel the strain, to which Virgin have responded in many areas with
brutal traffic limiting. But from my memories of Virgin's predecessor
companies, I woudn't hold my breath for it actually going out in any
widespread fashion this year.
Maybe I'm just spoiled by the excellent connections at low prices
available to me in countries like Germany and Japan, but it's curious
how the UK and US, who pride themselves on free markets, actually
end up with such mediocre choice.
The long tail is broke
Everyone was talking about the forthcoming BBC/ITV/C4 VoD service
codenamed ‘Kangaroo’, which is a bit silly as still no-one knows anything
about it, and is basing their discussion on the technical prognostication
technique of ‘guessing’. Except presumably the representatives from BBC and
C4, and they're pretty tight-lipped about it.
What we do know (thanks to C4's Sarah Rose) is the service is expected to carry
third-party submissions. Whether that's to be simply extended material from
existing production houses, or more of a free-for-all isn't clear. The only other
news — less of a revelation than a confirmation of what we glumly expected — is
that there are no plans for Kangaroo or any other service to touch markets
outside the UK.
This is desperately short-sighted. UK TV has enormous global potential, not
just with ex-pats like me, but amongst all of the English-speaking world. UK
programming is already surprisingly popular at TV and general torrent sites
worldwide, and should be attracting viewers in the same general market as
US media giants.
At the moment, though, the country's content is woefully under-exploited. If you're in
the US, you might possibly be able to get BBC America, but if so your cable operator
will be charging you a premium for what amounts to 24-hour daytime television.
Goodness knows how BBC Worldwide came to the conclusion that what the US
market needs is endless provincial inconsequentia like Cash in the Attic,
but that's inexplicably how the schedule ended up. The rest of the world has to
make do with a bitty little patchwork of difficult-to-receive channels in different
countries with similarly lacklustre schedules if you can even manage to get hold
of them.
Sure, clearing rights worldwide is a problem, but a wide-ranging VoD service
with some content available worldwide would be a perfect way to
encourage rights-holders to stick some of the programmes on that are never
going to get shown on foreign channels otherwise. I hesistate to mention iTunes
since I personally dislike it for other reasons, but make it that easy and they
will come.
There was a lot of talk about the long
tail: how, once you make everything available, there's a surprising total demand
for obscure and niche item. Virgin's Malcolm Wall proudly explained that
over half of their views were already coming from shows outside the top 50 — and
that's with only a very short ‘long tail’. (Virgin and the others may be boasting about
a few thousand hours of material available on demand as if this is a huge
quantity, but between DVD box sets and downloaded UK telly I've got
more than that in my own personal shiny-disc collection.)
Yet if broadcasters stick to the attitude that — to paraphrase Rose from memory — ‘any
show there's demand for will obviously be picked up by foreign broadcasters’ (and
similarly obscure archive content is not worth providing at all to anyone), there's no
chance of the long tail ever coming into fruition, and potential viewers outside the
UK will have to stick with what commercial broadcasters have seen fit to import,
which is bugger all. And unauthorised services like UKNova will need to carry on
making up the difference for a good long time yet.
29th January 2008
What ho there chaps. Over at DOXdesk it's been plenty busy, but there'll
be actual new stuff here this year... promise. There's a fair amount of code we've been using in production for
ages that just needs a little polish so it can be released publically. That last little polish that always
mysteriously takes weeks and keeps getting put off whilst doing other projects, you know the kind of
thing. But still.
In particular you can expect some web-related releases soon: there's a new, vastly improved replacement for
form.py (the first Python module we ever gave away!), a new
major release of PXTL and a whole new bulletin board
package. For some reason there's a real dearth of Python BB software available at the moment so
hopefully this should fill one of them there holes. I don't know about you but I'm fed up of PHP
board software, with its spaghetti code, endless security holes and dismal Unicode support.
But the first software of 2008 from DOXdesk is better than any of
that. In fact it's the best* anti-virus
package ever!
Anti-malware: state of play
The end of last year saw a slew of articles proclaiming the anti-spyware market dead, and not
without reason. With many of the commercial anti-spyware players moving their products into the traditional
anti-virus space, and the original anti-virus vendors including a wider threat base into their
software, the noticeable difference between the two is diminishing, and in this environment the AV
behemoths must have the upper hand.
And it has to be said, the nature of the malware threat has changed too. The traditional
Unsolicited Commercial Software pushers, whose parasites were always the central focus of
anti-spyware apps, are a shadow of their former selves. Just a few weedy lawsuits and
slaps on the wrist from the FTC seem to have made Direct Revenue (Transponder),
180 Solutions (nCase/Zango and now Hotbar and CDT) and IST rein in their worst
excesses... and saw Direct Revenue give up, unable to make money without abuse.
The FTC did manage to shut down the ghastly Roings/Media-Motor, and Holland's
equally-foul DollarRevenue were similarly stopped. It's a pity they will all get away
with the ill-gotten gains of non-consensual installations, but at least we're rid of
their despicable fat faces for now.
Not that things have necessarily got any better. The Russian-language malware market — that
chaotically-organised tangle of relationships and affiliations between adult webmasters,
hackers and fraudsters — originally known as ‘CWS’, continues to grow beyond all hope
of getting it under control. It generates literally hundreds of thousands of payloads, beyond
any signature-based AV tool's capacity to keep up. It compromises internet servers on a
massive scale, making it impossible to be sure you're browsing to a ‘safe’ site. It has
put away the simple homepage hijackers and traditional partnerships with the trad
spyware vendors mentioned above, in favour of stealthy keylogging/bank-targeting trojans
and brutal promotion of rogue anti-spyware applications operated by other CWS partners.
Meanwhile the Chinese are starting to move in on the same exploit 'n' botnet model in
ever greater volumes.
Ryan Naraine on the ZDNet blog
spots the trend, but somewhat misattributes the blame IMO:
For the most part, this was a definitions game played to perfection by both sides — the
noxious adware vendors who wanted to be viewed as legitimate; and the slick anti-malware
vendors who were only too happy to play along to sell a brand new product.
That really wasn't the way it originally happened. When spyware started to hit the headlines
around 2001-2002, the anti-virus companies wouldn't touch it with a barge pole.
No matter how hard customers complained that the software was unwanted, harmful, and installed
without permission, the AV companies ignored the problem.
Maybe they didn't understand it... more likely they were afraid of the spyware vendors,
the great big farty cowards.
The anti-spyware response was anything but slick. Lavasoft was once a grass-roots
company run by a few enthusiasts; it, Spybot, myself and the others that followed were in it
to hurt the spyware scumbags, not to sell a product. Our response was ragged software and
personal anger, not professionalism.
Now it's become clear there's a market for it, and most of us have escaped or won the constant
lawyer attacks intact, the AV companies want in.
But their products are just as hopeless as ever.
AV is rubbish
I'll probably lose my special Security Club hat for saying so, of course. We all know the reeived wisdom
that must be handed down to users for their own protection, and it must not be questioned or
the poor souls might get confused.
Thou shalt run anti-virus. Thou shalt install a personal firewall. Thou shalt not visit dodgy sites.
Thou shalt be a good boy and eat all thy definitions updates or thou shall not grow up to become
strong and healthy. That'll be another $30 please.
There's only one minor problem: it's a crock. Personal firewalls are pointless for many users
(another rant for another time there, I think); avoiding ‘dodgy sites’ won't protect you from
the mountain of compromised ‘legit’ servers or advertising networks, and as for AV... it's well
past time for a backlash.
Sure, it looks good on the surface. All AV packages claim to detect 99.9% of ‘in the wild’ viruses.
But when I happen across a new web exploit infection source and submit it to the multi-AV-checker
services, typically less than half the AV engines notice anything wrong. And those that do pick it
up often identify it wildly wrongly.
This is not atypical, judging by other malware handlers' reports. And it's not atypical judging by
the machines I end up having to drag in and fix. I've got the neighbour's PC here, loaded up with
anti-spyware and anti-virus scanners. They're even up-to-date — good boy! — but he's still infected,
with a keylogger rootkit, a banking-focused password stealer BHO and a rogue-AV promo.
Anti-virus, you have lost. You sit there filling up our system trays with your little icons and
flashing bubbles, constantly seeking attention with your false positives and pleas for updates
and money. Your ugly self-advertising user interfaces make us feel physically sick.
You cripple our machines' performance and stability with your hundred processes
and services loading at bootup and klunging up the system hooks. It takes a lot to bring a
modern, powerful PC to its knees with swapping and bluescreens, but you manage it.
Yet despite all this, you still don't protect us. Oh, sure, AV is still effective against old-school
viruses and the more widespread mail worms. But come on, what idiot still gets infected by
those? No, the bulk of today's infections — including my neighbour's — are driven by
web browser-based exploits and related fake-software downloads, against which today's AV tools
are woefully ineffective.
The payloads involved are enormous in quantity and range, and are mutated constantly. Against
this, signature-based AV has no chance to keep up. Woollier signatures and heuristic-based
detection increases the chances of detection a little, but at the cost of so many false positives
the user can't trust it any more. Or worse, they do trust it and end up deleting a
bunch of random files that happened to be compressed using an application compressor
(packer=virus, according to stupid AV). Oh, and
Windows
Explorer.
Oh sure, you might get an alert from your AV when visiting an exploit, because it peeks into your
internet cache folder and manages to recognise part of the payload, or an intermediate
downloader file, or the original exploit itself. “I've removed a virus for you!” it says, “aren't I super!
It's ‘Delf’, or ‘Agent’, or ‘Small’, or one of the other names we give to specimens we don't really know
what they are but they're probably not good”.
By that point it's far too late; either your browser wasn't vulnerable, and the AV has valiantly
protected you from nothing at all, or the suspect code has already been run, downloading a whole bunch
of other bad stuff. Even if it did miraculously catch all of those (and the odds aren't looking good),
how could you possibly know for sure you were still clean? There are some very hard-to-spot rootkits out there that your
average PC-using clod hasn't the faintest hope of detecting.
(That's the point at which flattening the OS and restoring from a clean image comes in handy. You did
image the system disc, didn't you? You did partition the system disc separately from data, so you don't
lose all your documents, right? Oh, your machine came from the idiot manufacturer with a default
single partition, and a recovery CD that writes the whole partition? Oh bad luck there mister.)
One day, per-program permissions will be the norm at an OS level, and we'll have the benefits of
proper sandboxing without the usability and stability problems of today's primitive behaviour-blocking
AVs. Until then...
The interim solution
Today's AV is a dead loss. But you can't simply not install any, or everyone will complain. That's
where PlaceboAV comes in! It's the fantasic anti-virus solution that's super-fast
and absolutely reliable... because it does nothing at all.