Allow me to introduce you to two script kiddies: David Kernell and Michael Mooney. One of which is currently on trial for accessing computers in an unauthorized manner, the other is currently scott free for doing the same. Why is one being prosecuted for his crimes while the other is not? I think it’s a symptom of a larger problem in the legal system in the United States.

First off, a little background: In 2008, David Kernell aka “rubico” correctly guessed then Alaskan Governor Sarah Palin’s password reset question on her Yahoo mail account using public information sources such as Wikipedia. Kernell then proceeded to post the screenshots and other bits of information found in the account in a public forum on the Internet. A few months later, Michael Mooney aka “Mikeyy” found a security hole in the Twitter service which allowed a user to post Javascript in their “Bio” section. Mooney then decided that instead of doing the responsible thing and reporting this to Twitter, he should instead use the hole to hijack people’s Twitter account to at first promote a site he ran, then to sing his praises. You may remember me writing an article about what unfolded next, but that’s another discussion entirely.

Now, today, Kernell is currently awaiting trial for his crimes in a Federal court in Knoxville. Mooney would have long faded into obscurity in my mind, but he decided to do some Google vanity searches on himself, came across my article, and decided to convince himself that I was somehow jealous of his… hmm… nope, not sure on that one, but anyway… After telling him in no uncertain terms about what I thought of him, we got in a classic Internet argument.

After dealing with his inane ramblings and him trying trying to convince me that despite him admitting what he did broke the law what he did wasn’t illegal (Obviously, Mooney retained Erwin Schrödinger as counsel), I got to wondering why is Mooney free to drink Martinis, watch the sun rise, and fancy himself as some kind of security consultant, while Kernell is currently staring down a sentence in FPMITA prison? I understand that the Feds don’t have the time and inclination to investigate every little event, but the facts that Mooney admitted to doing it, his information is publicly available (Heck! Check his Twitter stream or his website and find his mobile number!), and that he’s admitted to breaking the law, the Feds are saying that while it’s not OK to break into a Vice Presidential candidate’s e-mail, you can hijack thousands of user’s computers to promote your website and get away with it, provided you don’t  do anything really nasty.

Something that has always concerned me is the selective prosecution of one computer crime and not of another. As someone who deals with the endless streams of attacks and scans coming down the SuperInfoBahn, “getting the bad guys” is a all too infrequent event. When incidents like the Mikeyy worm go un-prosecuted I feel that we are continuing to send the message to people that compromising a computer, website, or whatever, is fine provided that, you know, don’t do anything really bad, whatever that means. I think we’re essentially already looking at the Fixing Broken Windows theory at work: we’re not going after the crimes when their small, and thus, we’re continuing to see problems escalate. While I’m not suggesting that if we go after the small crimes we’ll see ZeuS drop off the face of the planet next week, it might start to take a bite out of younger people trying to compromise each other via Rouge Neopets Paintbrush Generators.

I don’t know how it’s come to be that Kernell is being prosecuted while Mooney is not, I’m sure going after such a high profile target under USSS protection definitely made it hard for Kernell to slide back into obscurity. I’m not suggesting that Kernell be let off  the hook for his crimes, but, I don’t think anyone can disagree that it’s fair that Mooney isn’t being held responsible for his crimes, while Kernell is.

Then Google Wave came out, and I couldn’t pick my handle for my username. My response being: “Oh, for f*ck’s sake.”

So, this was the straw that broke the proverbial camel’s back. I have moved all my settings over to my “GMail account” and wiped out my old account. Unfortunately, this means that if you followed me on one of Google’s services (like my Reader Feed) that just went up in a puff of electronic smoke. However, this allows me to give Google even MORE of my information and like an idiot, I have: I now have a publicly accessible Google Profile that has links to the various social services I use.

Also, I am starting to resume doing stuff on my Tumblr which is mostly my Google Reader feed and stuff that is too long to fit on Twitter.

Share and Enjoy!

The problem is simple. On twitter there are two ways to reference another twit, a reply and a mention. The difference is subtle, but it’s kind of important. First, if I start off my message with an @ and a username, it’s a reply. Twitiquette states that replies are usually used when addressing someone directly or replying to something they said via the reply feature on Twitter. For example:

@kd0bik Loved this week’s Practical Radio Amateur podcast!

A mention on the other hand is usually just a reference to someone inside a mention, not a message directly to them, but something that they may wish to know about:

Received an interesting e-mail from @ke9v discussing Twitter replies versus mentions.

Now, why are replies an mentions important? By mentioning someone in a message, that message gets displayed on their replies page or depending on if they’re using a 3rd party client, highlighted someway. For example, I use twhirl, and when someone does a reply or mention, it alerts me with a different sound and it highlights the tweet.

Now, why are replies and mentions different? Simple. Twitter has certain rules when displaying replies for your followers. If I do a reply to @ke9v, it will only show up in the stream, aka that list of tweets on your homepage of twitter, of people who follow @ke9v. If people aren’t following Jeff, it won’t show up. No big deal right? Well, for the most part, yes. However, this has interesting implications consider the following tweets:

@ke9v @ka3ddr @kd0bik #followfriday

@kd0bik has a great podcast! Everyone interested in Ham Radio should listen to it!

What’s wrong with those? Normally, I would want both these messages to go out to everyone that follows me. However, because I prefixed it with a @ and a username, it will only show up to people who are already following that user. Whoops. However, these are both simple to fix:

#followfriday @ke9v @ka3ddr @kd0bik

Wow! @kd0bik has a great podcast! Everyone interested in Ham Radio should listen to it!

These are just two examples, however, it’s a good rule to be mindful of when tweeting: If you’re not replying to someone, you should try to stay away from starting your message with a @ and a username, otherwise, it may not reach as many people as you want it to.

And, of course, Chris Boyd comes up with the most direct worm prevention technique.

Hey, i found a website with your pic on it… LOL check it out here <link>

As soon as it arrived, my spidey sense went off:

• Unsolicted? Check.
• Vague message? Yup.
• Wants me to click on a link? Indeed.

This  instantaneously causes me to think “Bad link! Do not click!” and I quickly tweeted my concerns. Thankfully many people did the same which probably saved more then a few people from clicking the link. It did garner a fair bit of attention since this was the first-ever phish that came via DMs on Twitter and some people are seeing strange activity on certain accounts, but for the most part it has faded back into the noise of a usual Monday morning on Twitter.

This was bad, and I feel it was the opening salvo in a major change in the way spammers operate on Twitter, but I think the worse may be yet to come. For those of you not on Twitter, the way spammers have been operating is by setting up an account, following a lot of people, then waiting for the unsuspecting users to follow back. Once they feel that enough people have started following them, they start spamming their links. Now, with the phishing attempts, they can cut out the middle man and start spamming your follower lists with their links. Ruh Roh Shaggy…

Now, lets ratchet this up to the next level. Imagine if the phishing page had some kind of exploit embedded into it? Let’s say @britneyspears posts “Hey guys, check out my new track at (link)!” Thousands of devoted Britney Spears fans clamor to hear their idol’s screeches talents and are directed to a page telling them to log in with their twitter ID. That page exploits their browser and assigns them to a botnet. The few who think Twitter is trustworthy fork over their credentials, at which point a PHP script logs into their Twitter account and DMs all their friends the same link with a random headline.

Lather.
Rinse.
Repeat.

Congratulations! We now have the first Twitter worm! With Twitters somewhat notorious instability under high load, at which point would we see a Twitter DoS?

This Twitter phish was bad. However, I think the community dodged a bullet and we may not be so lucky next time. Many people think Twitter is a safe sandbox on the Internet and not the same as their e-mail or IM. The million dollar question is how can we teach people that Twitter can be a nasty place before “the big one” hits?

I’m slowing my Twitter “Tweets” and following of Twitter based on a difficult to use Signal/Noise Ratio.

…

One very active Twittering Ham has a goal of posting 10,000 Tweet posts during the year.

If everyone of those Tweets takes but a second or two out of my attention, that is asking me as a Twitter Follower to give up 5-6 hours of accumulated time.

It’s simply not going to happen.

This was followed up by N0HR’s Twitter Overload post:

Steve notes that one ham has a goal of “tweeting” 10,000 times in a year. Yikes. What possible value could that have to anyone? I could see some value in group using Twitter to meet at the Dayton Hamvention – when you’re all trying to meet you’d know that Frank’s at Denny’s having breakfast, Chuck’s in the flea market and Stan is lugging a boat anchor to the car. That’s about it though.

First off, let me state for the record that I am the said “active Twittering Ham”, but I do not have a “goal” of having 10000 tweets in a year. I did wonder if I’ll hit that number which is looking more and more likely now that I’m less then 50 shy of 9000, but I wouldn’t consider it a goal. Next off, I’m not pissed at Steve for unfollowing me at all. I did mention it in a tweet, but I am not saying that I am sad, angry, or disappointed in Steve.  I am very much in @mediaphyter’s corner regarding following:

…let me make a list of what Twitter is not:

1. A venue for a popularity contest
2. An obligatory mutual instant message system
3. A place where anyone has anything to prove

Exactly. Twitter is different things to different people. Suit your follow list to what you want to see. I’ll be the first to admit that I am a prolific tweeter. My sister never added me to her phone because it she was overwhelmed by texts. I tweet about Ham Radio, InfoSec, the MBTA not working, and any other completely random thing that floats into my head. A lot of my friends are the same. However, I know that this does not suit everyone. I have no problems with someone unfollowing me because I tweet so much, if you’re not going to follow a smaller group of people, I’m going to quickly overwhelm your “stream” on your page, likely providing more signal with noise. There are ways to sift through volumes of tweets, but a lot of people have neither the time or inclination to do so.  Don’t feel the need to follow anyone because “everyone else does it” or if they’re following you. Only follow the people that tweet topics that you’re interests and tweet at your pace. Also, look at the option of turning of

If you’re on Twitter, don’t think you’re going to hurt someones feeling by unfollowing them. I occasionally go through my lists and “purge” people that no longer interest me. If I no longer intrest you, unfollow me! Please! If I follow you, I’ll still reply when you say something I want to comment on and it will still show up in your stream.

Steve, I’m still following you, as you’re one of the Hams who’s tweets I always enjoy. I hope to see you around, and I look forward to you live-tweeting Dayton.

I, like any other red-blooded netizen, posted comments on the post and the YouTube page saying in no uncertain terms on how I thought his thoughts bore a striking resemblence to a large pile of edible offal from the stomachs of various domestic animals (“a load of tripe”). I don’t think Morse is the cat’s meow, but I do know it (despite being one of the dumb no-code hams) The bile flowed from my fingertips and my circle of Hams on twitter was abuzz at the video, most of the talk being negative.

Then it was gone…

Steve, K9ZW tweeted that he couldn’t get to the video via the weblog post. Sure enough, the video had been removed. I forwarded him the YouTube link, which he replied he also couldn’t get too. Looks like someone had second thoughts. Finally, the title and all the comments were deleted from the post and all further comments needed to be moderated. All that was left was a non-functional little nubbin of a post that previously had about six people’s comments. I assumed that it was over and that the creator of the video retreated. I would have preferred some kind of discussion or an apology, but it’s his call.

Flash forward to Friday morning, where I see that the video has been reposted. I was glad I can now link to it to talk about it some more, but it did ruffle my feathers that the creator, rjkd732, essentially tossed all the previous discussion down the memory hole. About ten people commented on the various postings and he has seen fit to flush it all down the tubes. I posted my comments regarding this and reposted my original comment regarding offal. This time, he did reply saying that he took down the video because (para-phrasing here) I was being rude and calling other people names.

He then took it down again…

Then this little gem showed up in my Youtube INBOX:

those who passed code ARE BETTER! stick that in your pipe, whiner.

Hahahaha!

Oh wait… You’re serious…

Let me laugh even louder….

HAHAHAHAHAHAHA!!!!!!

OK. So I’m not a saint. What?

The Internet is a great place for meeting people that say things that make your blood boil and pray for the ability to punch people via TCP/IP. I seem to have a silly habit of tilting at windmills and trying to engage them and talk. What annoys me is when people do the electronic equivalent of “taking their marbles and going home” by deleting threads and comments. Although he’s well within his rights to do these things, it sets off a giant flashing red light that says he’s not interested in hearing an alternate viewpoint.

Growth is always a good thing, but, it quickly came apparent that the list, maintained as HTML in my CMS, was not the easiest thing to maintain. So, I contacted Peter Goodhall, M3PHP (aka magicbug) and asked him to help me come up with a design for a new website. That, combined with the generous donation of the HamTwits.com domain name by Dan Dawson, KI6ESH (aka DanDawson), allowed me to design a good looking, database driven website for the Ham Twit list.

Check it out at www.hamtwits.com

I am still working on it, but the basic features are there. Twits are classified under their DXCC entity and are currently sorted by region. I’ve also added the QTH and the FriendFeed name of those twits who have accounts there.I’ll be working expanding the information gathered and adding sorting and the ability for twits to update their own information. Not quite there yet, but as I believe in releasing early and often, I have opted to unleash the site in it’s fully-baked-but-still-nice-and-chewy-in-the-middle state.

As always, if you would like to be added, shoot me a e-mail, DM, or an @, and I’ll be happy to add you!

Share and Enjoy!

Corey, KB9JHU (aka cshields) posted a great comment that linked to his University Club’s website. Now, *that* is what a Ham Radio club website should look like! CMS! RSS! Clean interface! Brilliant! Thanks Corey!

The downtime has caused a bit of a chain reaction across the entire Twitter community, and the Hams are no exception. Some people have stopped tweeting altogether, others have severely curtailed their usage, and a couple of prominent people who have jumped ship to other services. The resultant landscape has left me scratching my head and pondering as to if there is any way to sucessfully leverage these services into Ham Radio.

The social web seems to be here to stay and it is starting cross the chasm into the mainstream. I looked at the Ham Twits list as a way of trying to get Hams onto Twitter and quickly find like-minded individuals. However, with the recent splintering of the landscape makes me wonder if trying to leverage such tools on the Ham Radio community is a foolhardy venture.

Ham Radio operators, for the most part, can be rather geeky, but are still a bit behind the curve on the computing side of things. While there are some bright people out there, just simply look at any Ham Radio club’s webpage and you’re treated to a trip back to the late 1990s/early 2000s. More often or not, the home page of your organization is your face on the web. Having it look like something straight out of the dot-com era does not help Ham Radio look “cutting edge”, which seems to be something that most Hams try to pass the hobby off as.

When I started to try to get Ham Twits off the ground, I pictured it as the first step in trying to get more Hams onto the social web. After I compiled a sizeable list, I was going to try to start talking up Twitter in various ham radio related venues. However, now that some of the more active community members have gone over to FriendFeed, Jaiku, or identica, it kind of torpedos the idea of trying to market a single service as a way to communicate with fellow hams. It’s easier to say “Hey! Twitter is easy to use! Look at some of the cool stuff we discuss!” rather then saying “There is some cool stuff on this social web thing! Sign up for Twitter. Oh, and Jaiku if you want to talk to these guys over here, oh, and FriendFeed if you want to talk to those guys over there.” It makes it less likely to sell people on the benefits.

Some people are taking a different tack and trying to make Ham Radio specific socail websites. Chris Matthieu has set up 73s.org and a group of Ham Radio operators in the UK is working on DXAnywhere. Both seem to be solid, good coded websites. However, I think the strongest plus of using existing social networks is that non-Hams use it as well. If we provide Ham Radio with good exposure, we can help shake off the stoddy image of Ham Radio being a dead technological area. I stirred up some interest when I posted my SEEDS Captures on Twitter and quite enjoyed explaining to people how simple it was. Stuff like that is great PR! We should be doing it more often!

In conclusion, I don’t know where Ham Twits is going. I also don’t know if trying to leverage non-Ham-Radio-specific social web services to Hams is a good idea at this point. I wouldn’t be surprised if in six months we’ll see everyone on a new twittagsocialblogcloudweb2.0-thing anyway…