UPDATE - AOL apologizes (not as if it makes a difference at this point, though):

"This was a screw-up, and we're angry and upset about it. It was an innocent enough attempt to reach out to the academic community with new research tools, but it was obviously not appropriately vetted, and if it had been, it would have been stopped in an instant," AOL, a unit of Time Warner, said in a statement. "Although there was no personally identifiable data linked to these accounts, we're absolutely not defending this. It was a mistake, and we apologize. We've launched an internal investigation into what happened, and we are taking steps to ensure that this type of thing never happens again."

AOL, over on their research wiki site, on Sunday posted an article describing their release of search data collected for more than a half million AOL users over a three month period. They claimed the data was made "anonymous," and that it was being released for research reasons. Problem is, it's not anonymous enough. Each unique user was replaced with a unique random identifier. That means you can see everything that user 336072 searched for. What if someone examined everything you searched for over three months? Even without knowing your name explicitly, do you think they might be able to find out some interesting things? Have you ever done a "vanity" search?

It's just not anonymous enough. I have a copy of the data that I downloaded before it was taken offline, and I've poked around in it a bit, so I know. Not only that, but spammers and search engine "optimizers" out there are going to have a field-freakin-day with this data. No, I won't share it with anyone else. It never should have been released in the first place, so I am not going to add fuel to the fire.

Michael Arrington at TechCrunch wrote about it in his blog entry entitled "AOL Proudly Releases Massive Amounts of Private Data," and updated his post a couple times as AOL mysteriously removed the data file from the web, as well as the page announcing the availability.

Arrington: "AOL must have missed the uproar over the DOJ's demand for "anonymized" search data last year that caused all sorts of pain for Microsoft and Google. That's the only way to explain their release of data that includes 20 million web queries from 650,000 AOL users."

When you consider that AOL search is - get this one - actually Google's search with a different face on it, you can imagine what the emails and phone calls that went flying around between the two companies on Sunday afternoon might have sounded like. Ouch.

Yeah, and so much for the privacy of AOL's users. If you're an AOL user, is that what you signed up for, to be a guinea pig in AOL's poorly-planned foray into academia? I think not. This is identity theft just waiting to happen, that's what this is. Again from Arrington:

"The data includes personal names, addresses, social security numbers and everything else someone might type into a search box. The most serious problem is the fact that many people often search on their own name, or those of their friends and family, to see what information is available about them on the net. Combine these ego searches with porn queries and you have a serious embarrassment. Combine them with "buy ecstasy" and you have evidence of a crime. Combine it with an address, social security number, etc., and you have an identity theft waiting to happen. The possibilities are endless. "

Google says "do no evil" and keeps this kind of data under wraps when challenged in federal court. AOL? Not so much.

Any would-be AOL boycotters better be prepared, though. Last we checked, you can't even cancel your account at AOL without being put through the ringer. Several years ago when I canceled mine it was a several-months-long experience before I was able to decipher enough to get the billing truly stopped. Coming and going, that's how they get ya in Dulles... There's a reason PC Magazine ranked AOL "Number One" in a list of things you'd really rather not be on...

Technorati : AOL, privacy, private data, release

The U.S. Senate on Thursday ratified the first and only international treaty designed exclusively to combat computer crime. You can read the full text of the Council of Europe Convention on Cybercrime here.

What does this mean? Well, a lot of things. But all told, it means law enforcement officials from around the world will have a more agile, speedier, and more capable framework for cooperating in combating bad guys that are out to hurt others on the Internet. For those of us working to stop bad guys, it makes doing so more possible and can help remove some barriers that tend to get in the way. For those of us in the United States, the provisions are not really anything new. But for other countries that ratify, it means a much enhanced ability to work together.

The Senate did not consider an optional provision of the convention that deals with combating Internet hate speech, which would likely have run afoul of the First Amendment to the U.S. Constitution.

Summary of the Senate activity is in an article at news.com.

Technorati : cybercrime, fraud, treaty

A new spoof video on YouTube take a different direction (as in, levity used to make a point rather than get a laugh) on making fun of the Apple marketing TV campaign and, well... just watch it. Not sure how accurate it is (but I bet someone will research this and let me know).

"That's iLife!" OUCH...

Click to watch:

(via MacSpoofs)

Technorati : Mac, advertising, pc vs mac, spoof

There are a couple interesting security-related headlines on ZDNet this morning, coming out of the Black Hat event. The first discusses how Microsoft's handing out a beta version of Vista to Black Hat attendees and says their security testing of Vista is the largest commercial penetration vulnerability test in history. In the other article, SPI Dynamics points out that many potential threats and gaps exist today in the use and consumption of RSS and ATOM feeds, and that many feed readers don't do security checks to ensure a feed is not malicious before - for example - running script that is delivered in an entry. A large number of common feed aggregators/readers (including the one I use) are on the list. This is something for the authors of those programs to address, for sure.

Microsoft issues Vista challenge
News Focus: Software giant wins over the Black Hat crowd by stressing its commitment to Vista security--and asking for help.

Blog feeds may carry security risk
Popular RSS and Atom feeds could carry malicious JavaScript code that would compromise a PC, an expert warned.

Technorati : ATOM, RSS, black hat, security, vista

I just downloaded and installed Zoundry's Blog Writer over lunch, a free and ultra-feature-filled blog editor. This thing is slick! I am writing this post with the new editor.

I think I found my new blog editing app that I have been dreaming of for so long. At least it's going to get a real trial run. I have fought with Rocketpost so many times (it has never worked for me, and the authors don't seem to answer email anymore), and while I love BlogJet, the feature set in Zoundry is pretty incredible.

I'll write more about it tonight, after I get a chance to play around with it some more.

UPDATE: I am having a hard time getting the app to play nicely with my web hosts's FTP. Seems to upload image files, but the "test" mechanism says it does not work correctly, which is kind of strange. I have filed a post on the support forums, we'll see how that goes. I can upload images, as witnessed at right...

UPDATE AGAIN: One super cool feature I noticed was that Zoundry totally used the newly-implemented blog autodiscovery calabilities that have recently been baked into dasBlog by Omar. None of the old manually setting up and remembering the URL for the blogger API or any of that stuff. Nice!!

I have a tendency to bleed a little on this blog, meaning I grab the latest source code version and compile it myself to run it on the server almost all the time. The last official release of dasBlog (which is an open-source .NET blogging server application) was v1.8 and it was born nearly a year ago (wow, that long?). But for those who compile it themselves from source, it's been changing regularly over the past year and we've been enjoying the trickle-flow of feature enhancements.

And sometime soon now, says Scott, the official dasBlog v1.9 release will be out.

v1.9 will include some significant feature enhancements. Here is a mostly complete list (at least at this point -- the list is blatantly stolen from Scott's blog):

• Much better multi-user/blogger support including a Top Posters macro and total comments - from Christoph De Baene
• TagCloud - from Scott
• Huge (100x+) speedup in Macro execution - from Scott
• Support for If-Not-Modified to speed up execution, improve RSS bandwidth and CPU cycles - from Scott
• Direct Feedburner Support with 301 redirection for RSS and Atom feeds. Don't lose a single subscriber. We're the only blog with direct support for Feedburner and Feedflare I believe. - from Scott
• Delete comments directly from your mail reader - from Omar
• New themes out of the box, 18 at last count - from Many Folks
• New XML-RPC support for newMediaObject - from Omar and Giuseppe Dipietro
• New support for RSD so client software can autoconfigure itself - from Omar
• Pluggable Rich Text Editor, choose from FreeTextBox or FCKEditor or write your own adapter - from Josh Flanagan
• Support for CoComment - from Scott
• Organized source, build, and packing for clarity - from Josh Flanagan
• New Feed Icons - from Omar
• Automatic disabling of Comments after a certain number of days. Also manual "close comments" support - from Omar
• ContentLookAhead show future dated posts - from Josh Flanagan
• Other misc fixes and suggestions from Tomas Restrepo, Jason Follas, Rene Lebherz and Steven Rockarts. Added entry CPU usage optimizations from George V. Reilly.
• Better strings and support for Portuguese, Turkish and Vietnamese from Ph?m Ð?c H?i.

If you're a sourceforge nut, know how to use Subversion and want to compile it yourself, go for it. Or wait a bit longer for the release. I am running the latest code on this weblog, and it's pretty darned slick.