Blue Apples, privacy, and Web Bugs at FR

5/10/2004 | self

[Sabertooth]

So, the second time I see such graphics, I almost automatically skip over such posts and don't read them. For this reader, your message goes a-begging.

That's my point. Icons make posters more easily identifiable, and one can decide much more quickly whether or not one is interested in reading a post.

Folks have different tastes at FR. Some don't like ping lists. I'm on dozens. Some like Barf Alerts. I never click. Some like live and daily threads. I avoid them. Some don't like icons, some do. We'll all survive, I suspect.

[T'wit]

Did you say something?

:-) :-)

[TigersEye]

I beleive you misunderstand me and miss the point of my post. I don't have hard feelings that you didn't respond. Given the position you were taking it isn't even surprising that you didn't respond. But addressing the Schiavo case is not what this thread is about. I think this thread looks like a retaliatory sideswipe at you and, whether you appreciate it or not, I don't think that's a good avenue for Terri supporters to go down.

[general_re]

I have not been following the Schiavo threads - I have no idea who here is on which "side" there, nor do I have any clue about some newbie getting zapped on one of them. My only points have been about the technical issues involved here, and to dispute - by the judicious application of Occam's Razor - the notion that something sneaky happened. As for the larger context, I know naught, nor do I care.

[Future Useless Eater]

>> If we all ignore his messages, he may go away.
>>Is that what this thread is about, FL-engineer?

No, absolutely not. I'm sorry to even SEE this turning
into a Terri thread. I posted it under SOFTWARE ISSUES
in order to discuss security/abuse/ and web-bugs.

Sure I have gripes with WT. who doesn't. But he can take
that back to the Terri threads instead of following me around trying to harrass me.

I pinged my Terri friends to this because they were told
this weekend by a naive admin moderator that a simple
3rd-party picture like the blueapple CANNOT POSSIBLY be
used as a web-bug. I KNOW better, and John agrees.

Enough about WT. thats not what this thread is about.
I used his EXAMPLE because it seemed one of the most obvious
of secutity/abuse issues going on here at FR.

I'll continue this explanation in response to another
post... be right back.

[Future Useless Eater]

>>notice that it's a timeline for a posting history, and let's walk though what we'd have to do to produce that by the method you suggest.

I'm sorry, I mis-read what you were saying earlier.
It must have sounded like I was giving you a flippant answer.

Your original premise is wrong. I was NEVER suggesting that
ANYONE is or was using a web-bug to GENERATE those detailed
24-hour-posting-patterns.

I full well know that they come from posting histories,
but that requires a lot of effort and dedication, just like
digging up your neighbors divorce records, as robertpaulsen
said. No one at FR expects people here are going to dredge
up all those detailed dates and times and use a computer to
try to detect a pattern and use that pattern against them.

So this thread really covered 3 separate security/abuse issues:

1) Springing those posting-patterns on someone unannounced
and unrequested, followed by, in most cases, disparaging
remarks about the freepers' use, or abuse of FR.
THAT was often occurring during the course of heated arguments.
And that was having the effect of shutting off all debate. The abuser and his tag-team wins. Everyone else gets intimidated away.

2) Certain things pop out as possibly strange or suspicious
in virtually everyones 'pattern'. That can spur the devious
vindictive 'haters' here at FR to further 'go after' someone
if they think there is a 'chink' in the other guy's armor,
and try to do them damage in their home life, or work life,
or invade their computer (ala sasser virus/open ports, etc).
Sometimes just the 'threat' seems believable enough to
drive other freepers away.

3) but the 'pattern' alone isn't enough. a web-bug can be
the tool they need to find out more personal stuff
before they launch a really dasterdly attack.
Most sheeple just think thats not possible. Even one
admin moderator this weekend said that is not possible.

[TigersEye]

FWIW my suspicions were aroused long before amdgmary's post. If you just randomly picked William Terrel for your bug-tech example, having nothing to do with your admitted gripes with him, then at best you didn't select very wisely. He didn't follow you here to pick up old arguments either and it was a little less than polite not to ping him considering his prominence in your example.

I'm not trying to hammer you about it but the objective impression I formed (being a techno-dolt) was that you were saying (at the very least strongly suggesting) that WT's graphic had subliminal spyware in it. Your supporting post of his 'user-post chart' adds more weight to the feeling that this was personal and it has been handily shown that no special software or skills are necessary to plot such a chart.

I want to clarify all this because you are a great poster who does a lot of good work and doesn't need the baggage of a feud or the appearance that you ambush FReepers you don't like.

(I will now strip down to nothing but tin-foil undies and prepare to be flamed from both directions. A novel position for me! /sarcasm)

[general_re]

Well, that's a bit different. I readily concede that someone could use outside images as part of a plan to gain information about posters - in fact, there are at least two outside servers run by a now-banned poster that I am personally blocking image-loading from, for exactly that reason.

However, my point was that it is much, much, much simpler to use a poster's history page to compile their habits, than it would be to track you with a bug. Why go to all that trouble?

Remember this post?

Did anyone just see report on FL cases on MSNBC

Posted by FL_engineer to rolling_stone On News/Activism 10/09/2001 2:13:16 AM EDT #62 of 62 I have not seen any follow-up on the article about the pipe bomb and container marked anthrax found in Palm Bay, Fla reported by AP on 9/13/01(and Naples Daily News).....Anyone have an update, could this be from the same wacko? That pipe bomb/anthrax story from Palm Bay Florida was mistakenly reported here on F.R. as occurring 2 days AFTER the attack. Actually it was 363 days BEFORE the attack. (9/13/2000) Check the headline on the Naples Daily News article and you will see. As for any followup, I've searched the archives of that paper and could find no followup report. Maybe if someone there in Brevard county cared to call the Sheriff mentioned in the article, he should remember, and we could all get informed? Post Reply | Private Reply | To 18 | View Replies

No? Well, FR remembers it, and I can readily manipulate the parameters on your posting history page to give me every single post you've ever made since that one in October, 2001. Give me some time to mess with it, and I'll figure out a way to recover the posts from before that date, too. And then I'd have every single word you've ever posted on this site in my hands, to examine at my leisure, and to scrutinize in minute detail.

Would I do such a thing? No, not at all - I fully understand that this would be intrusive, and possibly quite alarming to the subject of such a thing. However, I very easily could do such a thing, without a doubt, and I don't need web bugs to do it. Hell, I don't even have to be a registered poster here to do it - that information is available to anyone in the world who can find FR in the first place.

The moral of the story, I think, is twofold here. One, the fact that information is not immediately obvious to you does not mean that it is nonexistent or unattainable. Obviously, in this case, quite a lot is available to a suitably motivated investigator. Two, because of that, no one here is nearly as anonymous as they tend to think they are - we all have a long, long electronic trail here, those of us who've been here a while, that some clever person could potentially use to find out quite a lot about any one of us. That's simply the nature of the beast, although we like to pretend it isn't so. But it is so, and people really need to be aware of that, and at least keep that thought in the back of their minds as they post.

Most people are not of a mind to abuse this sort of thing - the shock that greeted WT's feat testifies to that much, but that doesn't mean it can't or won't be done again. Once those words leave your keyboard and enter the ether, you've lost your ability to control them, forever, and we would be wise to understand the implications of that as we continue on here.

[L.N. Smithee]

-- As I commented at #29, there are valid uses to such posting info.

You didn't provide support for any valid use in post #29. Try again. And this time, try to be intellectually honest.

[Future Useless Eater]

whoa... the first time around, yesterday, I accidently did not hear
what you were saying....

THIS time around, you are not hearing me...

I KNOW that a web-bug is NOT used for tracking.
I KNOW that the posting history comes from a special utility
here at F.R.
I KNOW that the web-bug can help reveal a persons IP address
and other computer variables. How that is abused... I won't say.

(and There is no nead to suck all of a person's posts
offline to find if they've ever posted before on a
subject. Its a very simple google search with the site: option)
Sure, its simple to find stuff before 2001, I know that too.

I have never been concerned about people studying the
words I make public. I figure its like pee in a pool...
hard or impossible to get out. And besides I CHOSE to
make that public.

>>no one here is nearly as anonymous as they tend to think they are

Yes that became painfully obvious when i/we connected the
dots about security.

[Future Useless Eater]

maybe we were each typing responses to each other at
the same time and did not realize it.

[Future Useless Eater]

>> in fact, there are at least two outside servers run by a now-banned poster that I am personally blocking image-loading from, for exactly that reason.

WOW. thats spooky. A lot of us are concerned along
those same lines because we are succeeding in getting
some very evil lawyers in Florida very angry at us.

[general_re]

I think we're talking past each other. All I meant to do is show that you can find out quite a lot without resorting to web bugs. Yes, I understand that you're not claiming that web bugs were used here ;)

That being said, there are some possible changes to how the posting history pages work, that might help in the future. One, posters should have access to all of their own past posts. Two, posters should only have access to a limited set of other people's posts - maybe the last two weeks or month or so. Three, people who are not registered or logged in should not have any access at all to the posting histories of users. Period. Granted, you can still find out a lot from Google, but FR archives all your posts, whereas Google actually only catches a small fraction of the posts that you make here.

As far as web bugs go, there isn't a heck of a lot anyone here can do about it. If you don't trust someone, don't load images from them, is about the extent of it.

[Future Useless Eater]

>>If you just randomly picked William Terrel for your bug-tech example,

I shouldn't have implied it was random. His seemed
like the BEST overall example.

I have often considered the images at FR potential web-bugs
and I used to turn off images, but that was a pain to
turn on/off/on/off, and besides MOST images here are
very useful to the threads.

Not only did friends ask about that apple, but I myself was
INTIMIDATED AWAY from chiming in one of the
"DRUGS ARE GOOD/DRUGS ARE BAD" threads, because of the
apparent abuse going on there.

It was the 'posting-patterns'
that added emphasis to the web-bug vulnerability.

oh, and as for pinging him, I never seem to need to.
Someone beat me to pinging him to this thread, and he
follows me around on other threads.

>> the objective impression I formed was that you were saying that WT's graphic had subliminal spyware in it.

Yes, Thats not exactly the right term, but close enough.
I believed it did, OR COULD HAVE revealed identity. And John agrees
that any 3rd party picture could be a web-bug.
Combining THAT with the FR drug-crowd's incessant demand for
peoples posting habits and it fit perfectly
with people who might be trying to run a web-bug.

>>it has been handily shown that no special software or skills are necessary to plot such a chart.

Well you're underestimating there. Only 3,or maybe 4 people
have done it (and it is non-triveal). 99.9% of
freepers would never attempt that. Yes, anyone can call
up pages of post, but downloading that data to a computer,
writing some software to crunch it, and display a pattern,
thats just not done, and besides, why bother? Unless you
perhaps have bigger plans.

(You can suit back up now, did that hurt?)

[William Terrell]

I agree, retaliation isn't the right road for any person with a position to go down. I wouldn't respond to your post on this thread, of course; I would respond on that thread.

If you prefer to think that I didn't respond because I'm aware of the inherent wrongness of my position, think again. I told why I didn't answer your post; I didn't answer any post beyond a certain point.

Do, feel free to point me to the post you think I can't reasonably answer, or don't refer to the fact that I didn't. That's all.

[Future Useless Eater]

>>Two, posters should only have access to a limited set of other people's posts - maybe the last two weeks or month or so.

Whats the purpose in that?
What if you KNOW you want to go back six months because
you remember seeing the person back then?

Are you trying to limit the value of the 'pattern-generator'?

That can be thwarted by not listing a
time-of-day if older than a day or two.

[Future Useless Eater]

Maybe I'm repeating myself, but I don't see any point in
excluding what someone said or did 3 month ago, or 3 years
ago.

If a freeper becomes so ashamed of something they said
last year, let them disappear and come back with a new
handle.

[general_re]

Are you trying to limit the value of the 'pattern-generator'?

Partly that, but partly for another reason. Do you know how intelligence agencies gather information in the absence of real agents working for them on the inside? They take little tidbits of public information, gathered here, there - everywhere - and then sit down and collate all those little factoids, those little nuggets of information, into a bigger picture, allowing them to learn things that you might not reveal directly, and draw conclusions about things you don't openly talk about.

Look at this (and I'll make some stuff up about you for illustrative purposes) - in March 2002, FL_engineer mentioned that his family vacations on Sanibel Island every year. Oh, well, look at this - in November of last year, FL_engineer discussed how his wife was thinking about trading in the family Ford for a Toyota. Hey, and then there was the time in 2001 when FL_engineer shared the fact that his son was just admitted to medical school in Texas. And notice that he wished himself a happy birthday on April 10'th of last year.

And so on. Give me several years worth of off-the-cuff comments like that, and I'll be able to learn quite a bit about you, without you having to post a formal biography of yourself. That's the sort of thing that hiding histories will help protect against - it'll insure just a bit more anonymity. No, it won't protect you entirely, but it'll raise the bar a bit, and thereby make more work for someone who wants to pierce your veil of privacy.

[William Terrell]

Well, I'm flattered you think I was the BEST.

If you had the technical knowledge to be afraid, did you bother to download my .GIF and look in the binary for hidden code? It's very small picture.

Abuse on the drug threads? You mean from people that have convictions that differ from yours? I read this to mean you can't hold you own, or express a logical reason in support of your position?

Posting patterns? So what?

I believe all your paranoid fears concerning web bugs from me were satisfactorily answered, no? Not to mention the fact you could have easily verified that yourself.

I'm concerned you think I have so much knowledge and expertise, that I strike such fear into your heart. I don't want to be afraid, just use your head. Fear blocks your ability to reason.

Now, look at the binary coding for the .GIF. Even I can do that, though I may not understand what I see, but surely you do. Let us know what you find.

[Future Useless Eater]

>>Do you know how intelligence agencies gather information in the absence of real agents working for them on the inside? They take little tidbits of public information, gathered here, there - everywhere - and then sit down and collate all those little factoids...

OK, fine, that's connecting the dots. and it reveals LIARS
quite well because they can't always remember their last
lie.

For those who are afraid of that kind of intelligence agency
scrutiny they should change their handles often. OR not
come here at all.

I'm more concerned about the angry nut-job or quack lawyer
that I angered last week, coming after me next week.