Monday Morning: Falling

This morning feels like a fall from great height — disorienting yet certain to end only one way.

Should have rolled over and gone back to sleep instead of mixing it up about politics during the wee hours. ~ yawn ~

The embedded video actually launches a playlist of Afro Celt Sound System. They’re a favorite mood lifter, a perfect example of diverse music styles meeting to create something even more special. Cuts I’ve worn out besides When You’re Falling (with Peter Gabriel) are Lagan, Life Begin Again (both with Robert Plant), and North — yes, I think my favorite album is Volume 3 – Further in Time.

Let’s fall forward.

Oracle v. Google: The most important technology case not about privacy and security
Yet another reminder/disclosure before I start on this case: I own $GOOG, $GOOGL, and $AAPL. I do not own $ORCL or $MSFT, nor did I ever own Sun before it was acquired.

That said, Oracle v. Google is about the gift economy, the march of time and its effect on technology companies, and patent/intellectual property trolling as a business model. The gift economy I’ve followed for years; I was hired to provide competitive intelligence on open source software because the company seeking my services felt it was a threat to their business. And it was, it very much was, though the threat changed over the last decade from free open source software (FOSS) to free software as a service (SaaS) provided with cloud storage.

In a nutshell, Oracle is suing Google for $9 billion — the amount it feels it is due as the heir to Java, acquired when it bought the former Sun Microsystems in 2010. You’ll recall that Sun Micro was once a moderately competitive producer of servers and the creator of open source operating system OpenSolaris (based on Solaris Unix) as well as Java.

Java is a software language used as an alternative to C and C++. Its creators at Sun wanted “Write Once, Run Anywhere” capability so that software written in Java could run on any hardware platform. Contrast this to Microsoft software which runs on Windows-compatible PCs only. Sun did not sell Java licenses but instead sold developers’ kits to encourage the propagation of both the language and its Java-friendly hardware and Solaris Unix operating system. Java was a loss leader offering — like the dozen eggs for free if your total grocery order is $50 or more. This is the gift economy at work.

Java’s creation was initially a response to the lock-in of the desktop PC environment. However, IBM began using Java, allowing the same language to be used on everything from its mainframes to IBM-supported handheld devices.

Handheld devices now include smartphones and tablets running the Android operating system, a variant of Linux now owned by Google after its acquisition of Android, Inc. in 2005. Android’s popularity ate away at cellphone market share running Symbian, Nokia OS, and Windows-based mobile OS. Approximately 80% of the world’s smartphones now run on Android and with it Java application programming interfaces (Java APIs). It’s this installed user base from which Oracle insists it deserves a cut of the revenues.

Oracle is a software company, though unless you are in a larger enterprise, you’ve probably not used their products. Initially, a relational database management system company, over time Oracle has purchased a number of middleware businesses which rely on databases. Like PeopleSoft, a human resource management software — human resource information in a database, manipulated and managed by a middleware application above it. It has also acquired software and businesses with which its products once competed. Innobase, an open-source relational database management system (RDBMS) developer, was acquired in 2005; its application was based on MySQL, another open-source RDBMS.

MySQL’s parent company MySQL AB was itself purchased by Sun in 2008, and acquired by Oracle with Sun in 2010. MySQL remains open source and underpins many commonly used applications used across the internet, though Oracle is now its owner/developer.

You can see the ownership chain gets incredibly messy over time. But it’s also easy to see that Oracle is predatory; its business model relies on consuming other businesses to ensure the survival of its underlying database software, not merely to flesh out its offerings. It has acquired software to build an enterprise stack, or it buys nascent threats to its database software and closes them off in a way to ensure no leak of profit-making opportunities (ex: killing OpenSolaris, the FOSS version of Sun’s Solaris operating system). It also buys businesses and applications used to monitor intellectual property and competitive intelligence.

Not a surprise, really, when one considers the founders — Larry Ellison, Bob Miner and Ed Oates — all once worked on a CIA project code-named Oracle.

A test of the gift economy and the open source movement are at the heart of this case. FOSS relies on it, and now the internet does, too. Anyone connecting to the internet is touched by software and hardware consisting of or shaped by FOSS. Many believe the roots of the open source movement are in software, but the underlying premise goes even further back, to the late 1700s and the first freedom of information law (Sweden’s Freedom of the Press Act, c. 1766). Based on freedom of information, some contemporary governments demand FOSS as a means to ensure citizens have access to information without regard to proprietary business models.

Read any of the links above and your head will spin with the Byzantine convolutions of the software industry over the last two decades. Add the snark-laden quirks of geekdom shaping the decision-making process — quirks which are inside baseball and define one’s belonging to the industry.

Top it off with the inexorable co-development and emergence of the gift economy, and it’s utterly beyond the comprehension of the average Joe or Josephine on the street. Unfortunately, Joe and Josephine are seated as jurors, directed by an equally clueless judge appointed by a neoliberal president (who likewise cannot grok anything created and given to benefit all without some immediate upfront cost benefit in an offshore account). The concepts behind APIs are particularly hard for the judge and jury to understand, exacerbated by testimony from people who did not rise to the top of their industry because of their facility with spoken English.

Read Sarah Jeong’s piece in Motherboard about this case. Read others, like the overview at Ars Technica (read the enlightening comments, too), but keep in mind that everyone who has a stake in the success of technology also has an agenda. Sometimes it’s as simple as their stock portfolio or the type of phone they hold in their hand.

Sometimes their agenda is more complex and based on the concepts of free open-source software and the gift economy. What is open-source if it can be bought and retroactively used as a profit center long after the horses have been freed from the barn? What did the progenitors and decades of collaborators intend Java to be: a profit center in itself for a company they couldn’t see coming more than a decade later, or a means by which users/owners could freely choose more than a single software or hardware company to accomplish their tasks?

And will this case discourage and suppress the explosion of technology developed using a variety of open source licenses?

Phew, this was more than I expected to write about this. Swamped my usual morning roundup, which I’ll save for tomorrow morning.

One more thing: after reading the above about the legal war between the Titans of Technology, you might find this speculative mythological fiction rather entertaining. Where do these Titans fit in this mythology?

Monday Morning: Brittle

The Emperor’s Palace was the most splendid in the world, all made of priceless porcelain, but so brittle and delicate that you had to take great care how you touched it. …

— excerpt, The Nightingale from The Yellow Fair Book by Andrew Lang

Last week I’d observed that Apple’s stock value had fallen by ~7% after its financial report was released. The conventional wisdom is that the devaluation was driven by Apple’s first under-performing quarter of iPhone sales, indicating weaker demand for iPhones going forward. Commenter Ian remarked that Apple’s business model is “brittle.” This perspective ignores the meltdown across the entire stock global market caused by China’s currency devaluation, disproportionately impacting China’s consumption habits. It also ignores great untapped or under-served markets across other continents yet to be developed.

But more importantly, this “wisdom” misses a much bigger story, which chip and PC manufacturers have also reflected in their sales. The video above, now already two years old, explains very neatly that we have fully turned a corner on devices: our smartphones are and have been replacing our desktops.

Granted, most folks don’t go through the hassle of purchasing HDMI+USB connectors to attach larger displays along with keyboards. They continue to work on their phones as much as possible, passing content to and from cloud storage when they need to work from a keyboard attached to a PC. But as desktops and their attached monitors age, they are replaced in a way that supports smartphones as our main computing devices — flatscreen monitors, USB keyboards and mice, more powerful small-footprint external storage.

And ever increasing software-as-a-service (SaaS) combined with cloud storage.

Apple’s business model isn’t and hasn’t been just iPhones. Not since the debut of the iPod in October 2001 has Apple’s business model been solely focused on devices and the operating system required to drive them. Heck, not since the debut of iTunes in January 2001 has that been true.

Is there a finite limit to iPhones’ market? Yeah. Same for competing Android-driven devices. But is Apple’s business just iPhones? Not if iTunes — a SaaS application — is an indicator. As of 2014, there were ~66 million iPhones in the U.S., compared to ~800 million iTunes users. And Apple’s current SaaS offerings have exploded over time; the Apple store offers millions of apps created by more than nine million registered developers.

At least nine million registered developers. That number alone should tell you something about the real business model.

iPhones are a delivery mechanism, as are Android-based phones. The video embedded above shows just how powerful Android mobile devices can be, and the shift long underway is not based on Apple’s platform alone. If any business model is brittle right now, it’s desktop computing and any software businesses that rely solely on desktops. How does that change your worldview about the economy and cybersecurity? Did anyone even notice how little news was generated about the FBI accessing the San Bernardino shooter’s PCs? Was that simply because of the locked Apple iOS account, or was it in part because the case mirrored society’s shift to computing and communications on mobile devices?

File under ‘Stupid Michigan Legislators‘: Life sentences for automotive hackers?
Hey. Maybe you jackasses in Michigan’s state senate ought to deal with the permanent poisoning of nearly 8000 children in Flint before doing something really stupid like making one specific kind of hacking a felony worthy of a life sentence. And maybe you ought to do a little more homework on hacking — it’s incredibly stupid to charge a criminal with a life sentence for a crime as simple as entry permitted by wide-open unlocked doors. Are we going to allocate state money to chase hackers who may not even be in this country? Are we going to pony up funds for social media monitoring to catch hackers talking about breaching wide-open cars? Will this law deter citizen white hats who identify automakers’ vulnerabilities? File this mess, too, under ‘Idiotic Wastes of Taxpayers’ Money Along with Bathroom Legislation by Bigots‘. This kind of stuff makes me wonder why any smart people still live in this state.

File this, too, under ‘Stupid Michigan Legislators‘: Lansing Board of Water and Light hit by ransomware
Guess where the first ransomware attack on a U.S. utility happened? Do I need to spell it out how ridiculous it looks for the electric and water utility for the state’s capitol city to be attacked by ransomware while the state’s legislature is worrying about who’s using the right bathroom? Maybe you jackasses in Lansing ought to look at funding assessment and security improvements for ALL the state’s utilities, including both water safety and electricity continuity.

Venezuela changes clocks to reduce electricity consumption
Drought-stricken Venezuela already reduced its work week a month ago to reduce electricity demand. Now the country has bumped its clocks forward by 30 minutes to make more use of cooler early hour during daylight. The country has also instituted rolling blackouts to cutback on electricity. Cue the right-wing pundits claiming socialism has failed — except that socialism has absolutely nothing to do with a lack of rainfall to fill reservoirs.

Coca Cola suing for water as India’s drought deepens
This is a strong piece, worth a read: Whose Water Is It Anyway?

After a long battle, the UN declared in 2010 that clean water was a fundamental right of all citizens. Easier said than done. The essential, alarming question has become, ‘Who does the groundwater belong to?’ Coca Cola is still fighting a case in Kerala where the farmers rebelled against them for using groundwater for their bottling plants. The paddy fields for miles around dried up as water for Coke or the company’s branded bottled water was extracted and transported to richer urban consumers.

Who did that groundwater belong to? Who do our rivers belong to? To the rich and powerful who can afford the resources to draw water in huge quantities for their industries. Or pollute the rivers with effluent from their industries. Or transport water over huge distances at huge expense to turn it into profit in urban areas.

Justus Rosenberg: One of Hannah Arendt’s rescuers
Ed Walker brought this piece to my attention, a profile of 95-year-old Justus Rosenberg featured in this weekend’s New York Times. I love the last two grafs especially; Miriam Davenport characterized Rosenberg as “a nice, intelligent youngster with no family, no money, no influence, no hope, no fascinating past,” yet he was among those who “…were a symbol of sorts, to me, in those days […] Everyone was moving Heaven and earth to save famous men, anti-fascist intellectuals, etc.” Rosenberg was a superhero without a cape.

That’s our week started. See you tomorrow morning!

See you tomorrow morning!

Friday Morning: This Thing Called Life

It’s Friday, when we usually cover a different jazz genre. But we’re playing these sorry cards we’ve been dealt this week and observing the passing of a great artist.

We’ll probably all be sick of seeing this same video, but it is one of the very few of Prince available for embedding with appropriate intellectual property rights preserved. It’s a result of Prince’s tenacious control over his artistic product that we won’t have ready access to his past performances, but this same tenacity taught many artists how to protect their interests.

It’s worth the hour and a quarter to watch the documentary Prince in the 1980s; the enormity of his talent can’t be understood without reactions by professionals to his abilities.

The way his voice slides easily into high registers at 05:44, his guitar playing beginning at 06:53, offer us just the smallest glimpses of his spectacular gifts.

Good night, sweet Prince, may flights of angels sing thee to thy rest.

Great Google-y moogley

• European Community’s Antitrust Commission issued a Statement of Objections regarding perceived breaches of antitrust laws by Google’s Android operating system (European Commission press release) — The EU has a problem with Android’s ~90% market share in some member states. They may have a tough time with their case as the EU did very little to preserve the Nokia Symbian OS when Microsoft bought Nokia phone business. Their point about lack of application interoperability and portability between mobile devices is also weak as they did not make that case with Windows-based applications on personal computers. Further, Google has been aggressive to the point of annoyance in its efforts to segregate Android and Google apps — I can attest to this, having a handful of Android devices which have required irritating application upgrades to facilitate this shift over the last year and a half. This will be an interesting case to watch.
• The second annual Android Security Report was released on Google’s blog this week (Google Blog) — Some interesting numbers in this report, including Google’s revelation that it scans 400 million devices a day. Gee, a figure intelligence agencies must envy.
• Roughly 29% of Android devices can’t be accessed to issue monthly security patches (Naked Security) — Sophos has a bit of an attitude about the back-of-the-envelope number it scratched out, calculating a little more than 400 million Android devices may not be running modern Android versions Google can patch, or may not be accessible to scanning for patching. You’d think a cybersecurity vendor would revel in this opportunity to sell product. Or that an otherwise intelligent and successful security firm would recognize the numbers reflect Android’s continued dominance in the marketplace with more than 1.4 billion active devices. The risk is big, but how much of that risk is due to the success of the devices themselves — still highly usable if aging, with insufficient memory for upgrades? Sounds so familiar (*cough* Windows XP)…
• Google passed a benchmark with mobile version of Chrome browser on more than 1 billion devices (Business Insider) — Here’s another opportunity to screw up interpretation of data: mobile Chrome works on BOTH Android and iOS devices. I know for a fact the latest mobile Chrome will NOT work on some older Android devices.

Under Not-Google: Opera browser now has free built-in VPN
A lesser-known browser with only 2% of current market share, Opera is a nice alternative to Chrome and Firefox. Its new built-in free VPN could help boost its market share by offering additional privacy protection. It’s not clear this new feature will protect users against censorship tools, though — and this could be extremely important since this Norwegian software company may yet be acquired by a Chinese company which placed a bid on the firm a couple of months ago.

Definitely Not-Google: Apple cracker cost FBI more than $1 million
Can’t swing an iPad without hitting a report on FBI director James Comey’s admission at the Aspen Security Forum this week in Londn that cracking the San Bernardino shooter’s work iPhone cost “more than I will make in the remainder of this job, which is 7 years and 4 months,” or more than $1 million dollars. Speaking of exorbitant expenses, why was Comey at this forum in London? Oh, Comey was the headliner for the event? Isn’t that interesting…wonder if that speaking gig came with speaker’s fee?

That’s it for this week’s morning roundups. Hope you have a nice weekend planned ahead of you!

FBI Claimed It Consulted a Manual Rather Than Cellebrite Directly

Yesterday, I suggested that the initial docket pertaining to efforts to search Syed Rizwan Farook's Lexus and the work phone found in it is consistent with FBI first asking Cellebrite (or some other outside party) to break into the phone before asking the court to use an All Writs Act to compel Apple to help.

In an article today in the wake of possibly incorrect reports the outside entity now helping FBI is Cellebrite, the NYT claims that FBI did try them.

The F.B.I. has tried many ways to get into the iPhone used by Mr. Farook, such as exploiting a previous bug that allowed unsigned code to be loaded and run on the device, Stacey Perino, an electronics engineer with the F.B.I. has said in a court filing in the case.

The F.B.I. also tried tools made by the agency and a mobile forensics company, Cellebrite, which let older iPhones load and run code that could crack a device passcode, Ms. Perino wrote. Cellebrite describes itself on its website as a subsidiary of Sun Corporation, a publicly traded Japanese company; it has done work for a number of government agencies.

Yet none of those tools worked, Ms. Perino wrote in the court document that was filed March 10.

I think this misreads Perino's declaration, which in the section in question basically repeats what she found in the standard law enforcement tool UFED manual.

Those previous tools that are available cannot be used on the Subject Device because they are not signed by Apple, and the current chain of trust on the Subject Device requires Apple to have signed any software that will be allowed to run

[snip]

From this open source research, several forensic tools were developed that combined (1) the boot ROM code signing defeat, and (2) brute-force passcode guessing. Examples include the Cellebrite UFED tool and an FBI-developed tool. Both the Cellebrite13 and FBI tools utilize the boot ROM exploit, allowing iPhone 3GS and iPhone 4 devices to load and boot an unsigned RAMdisk containing code to brute force the device passcode. The passcode recovery process operated from RAM, and did not alter the system or user data area

[snip]

Apple addressed the bug, and subsequently a jailbreak (i.e., allowing code unsigned by Apple) could only occur on an iPhone after it had been booted and unlocked.
13Cellebrite is a private company that makes forensic data recovery tools for mobile devices. While I have not examined the source code for the UFED tool, based on the Cellebrite Physical Extraction Manual for iPhone and iPad (Rev 1.3) and the fact that the Cellebrite tool no longer supports iPhone 4S and later devices, I believe the UFED tool relied on the same ROM exploit. The manual states: “The extraction application does not load iOS but instead loads a special forensic utility to the device. This utility is loaded to the device’s memory (RAM) and runs directly from there.” The utility is loaded from recovery mode.

It does not reveal that DOJ agencies continue to request Cellebrite's help on more sophisticated phones, nor that Cellebrite advertises the ability to crack iOS 8 phones (which is still an earlier operating system than Farook's phone runs).

Perino's passage is one that Apple's Erik Neuenschwander discussed, dismissively, at length.

21. Paragraphs 25 through 28 of the Perino Declaration describe supposedly already existing software that Mr. Perino suggests Apple use as a starting point to create GovtOS. For example, Mr. Perino points to a security exploit that supposedly allowed an iPhone to load a minimal operating system in RAM that had not been signed by Apple, which is what the government is requesting here. Similarly, Mr. Perino points to a hacking tool the FBI created that supposedly allowed it to brute force the device passcode on older iPhones.

22. These descriptions show that the FBI, along with its partners, currently have, and have had in the past, the capability to develop the types of code that Apple is being asked to create.

23. Mr. Perino is incorrect, however, in his suggestion that Apple can use these third-party items, add Apple’s signature, and load the finished product on to the subject device to accomplish the result that the government seeks with less effort than what I described in my initial declaration.

24. Using the allegedly already existing software code that Mr. Perino identifies would not be an appropriate way to accomplish what the government wants. Setting aside the legal question of whether Apple can incorporate a software tool created by some other party (such as the Cellebrite UFED tool Mr. Perino identifies) for this purpose, Apple would not save time and effort by incorporating unfamiliar third-party code that has never been used and deployed by Apple before, and it would introduce a host of new issues and potential risks that would need to be addressed. [my emphasis]

Of particular note, Neuenschwander noted that "FBI, along with its partners, currently have...the capability to develop the types of code that Apple is being asked to create." Cellebrite was the only partner listed by name.

Neuenschwander went on to note that the jailbreaking Perino described is precisely why Apple works so hard to improve its security.

The NYT wants to claim FBI researched all possibilities before repeatedly claiming, more than 19 times (I did not include Perino's declaration in my count), that only the FBI or Apple could open this phone.

But Perino's declaration understates what Cellebrite itself claims to be able to do -- and that DOJ asks Cellebrite to do.

That still doesn't mean Cellebrite is the entity now helping FBI crack the phone. It does mean FBI and DOJ engaged in affirmatively misleading briefing on whether Cellebrite might be able to do so.

Monday Morning: Synthesized Brain

When you need a break this hectic Monday morning, take five minutes and watch ANA from Factory Fifteen. I'm intrigued by the props and set -- how much is CGI, and how much is actual production line? What company allowed this production company access to their equipment? Though snappy and visually engaging, the story's not realistic -- yet. But much of the equipment on the production line is very close to that used in manufacturing today. And just as depicted in this short film, the weakest link is the human. Worth keeping in mind this week as we plow deeper into the conflict at the intersection of humans and devices. Speaking of which... Apple-heavy week ahead

• Hearing in California tomorrow in front of Judge Sheri Pym over the San Bernardino's shooter's iPhone. Be sure to read Marcy's take on the hearing and witnesses.
• WLTX of Columbia SC posted a timeline of #AppleVsFBI events -- unfortunately, it starts on February 16 with Judge Pym's order to Apple.
• NYT reported last week that Apple employees may quit if Apple is ordered to cooperate and write security-undermining code. But is this a deliverable in itself? The article offered an incredible amount of detail about Apple's operations; if employees quit, any entities observing the technology company will know even more. Has this shakedown been designed to yield information about Apple's operations, while risking corporate and personal security?
• Apple will release information about new products today at a media event. The buzz may be less about the new products than the hearing tomorrow.
• An iPhone 6 bursting into flames during a flight to Hawaii didn't help Apple. One might wonder why this particular phone flamed out so spectacularly as it's a relatively new device.

HEADS UP TECH USERS

• Kindle users: Amazon is forcing a mandatory update across all its older Kindle reader devices. Deadline: TOMORROW MARCH 22 -- after that date, users will have to manually update devices and download books via PC and not over the internet.
• Tweetdeck users: Owner Twitter will kill the Windows app on April 15th. After that time, Windows-based users will need to use a browser. Can't blame Twitter--it's ridiculously expensive to write and service so many apps when the same devices usually have a browser.
• Android users: 1) Protect your privacy and security by checking these settings; 2) Check this setting, stat, to prevent unauthorized access.
• Nexus users: Make sure you have the latest patch issued last week. All other Android users should nag their equipment makers for their version of the same patch.

Before the machines complete their occupation of our world...

• Nice read on law emerging with the rise of robots. Too bad none of them really incorporate Asimov's Three Laws of Robotics. (The Atlantic)
• Want to bet the overlords will argue workers should be paid less because they don't have to work as hard wearing an exoskeleton -- like these at Panasonic? (By the way, DARPA, that's yet another commercially-developed exoskeleton near release; where's yours/ours?) (Mashable)
• Artificial intelligence already pitted against humans by those bloody banksters. Watch this video and ask yourself if this guy from Global Capital Acquisitions realizes there are humans at the nodes of the investment network whose lives are affected by his blah-blah-blah-babbling about artificial intelligence. STG he could be a machine himself. (Bloomberg)
• Myths about AI busted - another solid read. Combined with the preceding Bloomberg bankster video it reinforces AI threat awareness. (Gizmodo)

After watching that video at Bloomberg, I think we're a lot closer to ANA than we realized. Watch your backs -- Monday is certainly gaining on you, if robots aren't.