The meming of security

Stanford law professor Lawrence Lessig threw an interesting anecdote into a recent panel discussion, claiming the internet has a Patriot Act of its own waiting in the wings:

Lessig: "I had dinner once with Richard Clark at the table and I said 'is there an equivalent to the Patriot Act -- an iPatriot Act -- just sitting waiting for some substantial event just waiting for them to come have the excuse for radically changing the way the Internet works?' And he said, 'Of course there is' -- and I swear this is what he said, and quote -- 'and Vint Cerf is not going to like it very much.'"

Cerf had a huge part in founding, and some call him the father of, the internet.

Okay, we expect our government to be proactive, to plan ahead. How many would argue, for instance, that the Patriot Act sprang full-blown from someone's head in three weeks following 9/11? (It took six weeks to be enacted.)

Crackpot theory? Paranoia? Stay tuned while you can. More at boingboing, including some interesting discussion.

Into your heart it will creep

That's a somewhat minor internet meme, and I've tracked a few of its threads, but there's a wider meme that comes into play: the constant drumroll bemoaning identity theft and general internet security.

A honking big vulnerability in the Domain Name System has been in the news lately, finally making it to the mainstream media in articles like Leaks in Patch for Web Security Hole. (New York Times)

Foremost to the MSM? Security for banks and financial institutions. Ominous background music please:

"The root of the problem lies in the fact that the address system, which was invented in 1983, was not meant for services like electronic banking that require strict verification of identity," moaned the Times.... "A number of Internet security engineers point out that if a solution is found for the deeper problem of identity and authentication on the Internet, it will go a long way toward stopping many of the identity-related crimes that are now commonplace."

"It is now almost certain that there will be an escalating number of attacks, Mr. Woodcock said. Before the patch, which has now been distributed to more than three-quarters of the affected servers in the world, it would have taken as little as one second to insert false information into the address database. Now, even with the patch, attacks will be possible in a matter of minutes or hours, he said."

What's the response if this allows a major attack on a few big banks?

But that's just paranoia.