July 2006

Wal-Mart’s monopsony power damages its vendors

business, law / /

From Barry C. Lynn’s “The Case for Breaking Up Wal-Mart” (Harper’s: 24 July 2006):

Instead, the firm is also one of the world’s most intrusive, jealous, fastidious micromanagers, and its aim is nothing less than to remake entirely how its suppliers do business, not least so that it can shift many of its own costs of doing business onto them. In addition to dictating what price its suppliers must accept, Wal-Mart also dictates how they package their products, how they ship those products, and how they gather and process information on the movement of those products. Take, for instance, Levi Strauss & Co. Wal-Mart dictates that its suppliers tell it what price they charge Wal-Mart’s competitors, that they accept payment entirely on Wal-Mart’s terms, and that they share information all the way back to the purchase of raw materials. Take, for instance, Newell Rubbermaid. Wal-Mart controls with whom its suppliers speak, how and where they can sell their goods, and even encourages them to support Wal-Mart in its political fights. Take, for instance, Disney. Wal-Mart all but dictates to suppliers where to manufacture their products, as well as how to design those products and what materials and ingredients to use in those products. Take, for instance, Coca-Cola [… Wal-Mart decided that it did not approve of the artificial sweetener Coca-Cola planned to use in a new line of diet colas. In a response that would have been unthinkable just a few years ago, Coca-Cola yielded to the will of an outside firm and designed a second product to meet Wal-Mart’s decree.]. …

Wal-Mart and a growing number of today’s dominant firms, by contrast, are programmed to cut cost faster than price, to slow the introduction of new technologies and techniques, to dictate downward the wages and profits of the millions of people and smaller firms who make and grow what they sell, to break down entire lines of production in the name of efficiency. The effects of this change are clear: We see them in the collapsing profit margins of the firms caught in Wal-Mart’s system. We see them in the fact that of Wal-Mart’s top ten suppliers in 1994, four have sought bankruptcy protection.

Wal-Mart’s monopsony power damages its vendors Read More »

Antitrust suits led to vertical integration & the IT revolution

business, history, law, tech in changing society, technology / /

From Barry C. Lynn’s “The Case for Breaking Up Wal-Mart” (Harper’s: 24 July 2006):

As the industrial scholar Alfred D. Chandler has noted, the vertically integrated firm — which dominated the American economy for most of the last century — was to a great degree the product of antitrust enforcement. When Theodore Roosevelt began to limit the ability of large companies to grow horizontally, many responded by buying outside suppliers and integrating their operations into vertical lines of production. Many also set up internal research labs to improve existing products and develop new ones. Antitrust law later played a huge role in launching the information revolution. During the Cold War, the Justice Department routinely used antitrust suits to force high-tech firms to share the technologies they had developed. Targeted firms like IBM, RCA, AT&T, and Xerox spilled many thousands of patents onto the market, where they were available to any American competitor for free.

Antitrust suits led to vertical integration & the IT revolution Read More »

The mirror of monopoly: monopsony … which may be worse

business, law / /

From Barry C. Lynn’s “The Case for Breaking Up Wal-Mart” (Harper’s: 24 July 2006):

Popular notions of oligopoly and monopoly tend to focus on the danger that firms, having gained control over a marketplace, will then be able to dictate an unfairly high price, extracting a sort of tax from society as a whole. But what should concern us today even more is a mirror image of monopoly called “monopsony.” Monopsony arises when a firm captures the ability to dictate price to its suppliers, because the suppliers have no real choice other than to deal with that buyer. Not all oligopolists rely on the exercise of monopsony, but a large and growing contingent of today’s largest firms are built to do just that. The ultimate danger of monopsony is that it deprives the firms that actually manufacture products from obtaining an adequate return on their investment. In other words, the ultimate danger of monopsony is that, over time, it tends to destroy the machines and skills on which we all rely.

Examples of monopsony can be difficult to pin down, but we are in luck in that today we have one of the best illustrations of monopsony pricing power in economic history: Wal-Mart. There is little need to recount at any length the retailer’s power over America’s marketplace. For our purposes, a few facts will suffice — that one in every five retail sales in America is recorded at Wal-Mart’s cash registers; that the firm’s revenue nearly equals that of the next six retailers combined; that for many goods, Wal-Mart accounts for upward of 30 percent of U.S. sales, and plans to more than double its sales within the next five years.

… The problem is that Wal-Mart, like other monopsonists, does not participate in the market so much as use its power to micromanage the market, carefully coordinating the actions of thousands of firms from a position above the market.

The mirror of monopoly: monopsony … which may be worse Read More »

Corporate consolidation reigns in American business, & that’s a problem

business, law, politics / /

From Barry C. Lynn’s “The Case for Breaking Up Wal-Mart” (Harper’s: 24 July 2006):

It is now twenty-five years since the Reagan Administration eviscerated America’s century-long tradition of antitrust enforcement. For a generation, big firms have enjoyed almost complete license to use brute economic force to grow only bigger. And so today we find ourselves in a world dominated by immense global oligopolies that every day further limit the flexibility of our economy and our personal freedom within it. There are still many instances of intense competition — just ask General Motors.

But since the great opening of global markets in the early 1990s, the tendency within most of the systems we rely on for manufactured goods, processed commodities, and basic services has been toward ever more extreme consolidation. Consider raw materials: three firms control almost 75 percent of the global market in iron ore. Consider manufacturing services: Owens Illinois has rolled up roughly half the global capacity to supply glass containers. We see extreme consolidation in heavy equipment; General Electric builds 60 percent of large gas turbines as well as 60 percent of large wind turbines. In processed materials; Corning produces 60 percent of the glass for flat-screen televisions. Even in sneakers; Nike and Adidas split a 60-percent share of the global market. Consolidation reigns in banking, meatpacking, oil refining, and grains. It holds even in eyeglasses, a field in which the Italian firm Luxottica has captured control over five of the six national outlets in the U.S. market.

The stakes could not be higher. In systems where oligopolies rule unchecked by the state, competition itself is transformed from a free-for-all into a kind of private-property right, a license to the powerful to fence off entire marketplaces, there to pit supplier against supplier, community against community, and worker against worker, for their own private gain. When oligopolies rule unchecked by the state, what is perverted is the free market itself, and our freedom as individuals within the economy and ultimately within our political system as well.

Corporate consolidation reigns in American business, & that’s a problem Read More »

AACS, next-gen encryption for DVDs

business, security, tech in changing society, technology / /

From Nate Anderson’s “Hacking Digital Rights Management” (Ars Technica: 18 July 2006):

AACS relies on the well-established AES (with 128-bit keys) to safeguard the disc data. Just like DVD players, HD DVD and Blu-ray drives will come with a set of Device Keys handed out to the manufacturers by AACS LA. Unlike the CSS encryption used in DVDs, though, AACS has a built-in method for revoking sets of keys that are cracked and made public. AACS-encrypted discs will feature a Media Key Block that all players need to access in order to get the key needed to decrypt the video files on the disc. The MKB can be updated by AACS LA to prevent certain sets of Device Keys from functioning with future titles – a feature that AACS dubs “revocation.” …

AACS also supports a new feature called the Image Constraint Token. When set, the ICT will force video output to be degraded over analog connections. ICT has so far gone unused, though this could change at any time. …

While AACS is used by both HD disc formats, the Blu-ray Disc Association (BDA) has added some features of its own to make the format “more secure” than HD DVD. The additions are BD+ and ROM Mark; though both are designed to thwart pirates, they work quite differently.

While the generic AACS spec includes key revocation, BD+ actually allows the BDA to update the entire encryption system once players have already shipped. Should encryption be cracked, new discs will include information that will alter the players’ decryption code. …

The other new technology, ROM Mark, affects the manufacturing of Blu-ray discs. All Blu-ray mastering equipment must be licensed by the BDA, and they will ensure that all of it carries ROM Mark technology. Whenever a legitimate disc is created, it is given a “unique and undetectable identifier.” It’s not undetectable to the player, though, and players can refuse to play discs without a ROM Mark. The BDA has the optimistic hope that this will keep industrial-scale piracy at bay. We’ll see.

AACS, next-gen encryption for DVDs Read More »

How DVD encryption (CSS) works … or doesn’t

business, tech in changing society, technology / /

From Nate Anderson’s “Hacking Digital Rights Management” (Ars Technica: 18 July 2006):

DVD players are factory-built with a set of keys. When a DVD is inserted, the player runs through every key it knows until one unlocks the disc. Once this disc key is known, the player uses it to retrieve a title key from the disc. This title key actually allows the player to unscramble the disc’s contents.

The decryption process might have been formidable when first drawn up, but it had begun to look weak even by 1999. Frank Stevenson, who published a good breakdown of the technology, estimated at that time that a 450Mhz Pentium III could crack the code in only 18 seconds – and that’s without even having a player key in the first place. In other, words a simple brute force attack could crack the code at runtime, assuming that users were patient enough to wait up to 18 seconds. With today’s technology, of course, the same crack would be trivial.

Once the code was cracked, the genie was out of the bottle. CSS descramblers proliferated …

Because the CSS system could not be updated once in the field, the entire system was all but broken. Attempts to patch the system (such as Macrovision’s “RipGuard”) met with limited success, and DVDs today remain easy to copy using a multitude of freely available tools.

How DVD encryption (CSS) works … or doesn’t Read More »

Where we are technically with DRM

business, law, security, tech in changing society, technology / /

From Nate Anderson’s “Hacking Digital Rights Management” (Ars Technica: 18 July 2006):

The attacks on FairPlay have been enlightening because of what they illustrate about the current state of DRM. They show, for instance, that modern DRM schemes are difficult to bypass, ignore, or strip out with a few lines of code. In contrast to older “patches” of computer software (what you would generally bypass a program’s authorization routine), the encryption on modern media files is pervasive. All of the software mentioned has still required Apple’s decoding technology to unscramble the song files; there is no simple hack that can simply strip the files clean without help, and the ciphers are complex enough to make brute-force cracks difficult.

Apple’s response has also been a reminder that cracking an encryption scheme once will no longer be enough in the networked era. Each time that its DRM has been bypassed, Apple has been able to push out updates to its customers that render the hacks useless (or at least make them more difficult to achieve).

Where we are technically with DRM Read More »

Apple iTunes Music Store applies DRM after download

business, law, security, tech in changing society, technology / /

From Nate Anderson’s “Hacking Digital Rights Management” (Ars Technica: 18 July 2006):

A third approach [to subverting Apple’s DRM] came from PyMusique, software originally written so that Linux users could access the iTunes Music Store. The software took advantage of the fact that iTMS transmits DRM-free songs to its customers and relies on iTunes to add that gooey layer of DRM goodness at the client end. PyMusique emulates iTunes and serves as a front end to the store, allowing users to browse and purchase music. When songs are downloaded, however, the program “neglects” to apply the FairPlay DRM.

Apple iTunes Music Store applies DRM after download Read More »

To combat phishing, change browser design philosophy

business, law, science, tech in changing society, technology / /

From Federico Biancuzzi’s “Phishing with Rachna Dhamija” (SecurityFocus: 19 June 2006):

We discovered that existing security cues are ineffective, for three reasons:

1. The indicators are ignored (23% of participants in our study did not look at the address bar, status bar, or any SSL indicators).

2. The indicators are misunderstood. For example, one regular Firefox user told me that he thought the yellow background in the address bar was an aesthetic design choice of the website designer (he didn’t realize that it was a security signal presented by the browser). Other users thought the SSL lock icon indicated whether a website could set cookies.

3. The security indicators are trivial to spoof. Many users can’t distinguish between an actual SSL indicator in the browser frame and a spoofed image of that indicator that appears in the content of a webpage. For example, if you display a popup window with no address bar, and then add an image of an address bar at the top with the correct URL and SSL indicators and an image of the status bar at the bottom with all the right indicators, most users will think it is legitimate. This attack fooled more than 80% of participants. …

Currently, I’m working on other techniques to prevent phishing in conjunction with security skins. For example, in a security usability class I taught this semester at Harvard, we conducted a usability study that shows that simply showing a user’s history information (for example, “you’ve been to this website many times” or “you’ve never submitted this form before”) can significantly increase a user’s ability to detect a spoofed website and reduce their vulnerability to phishing attacks. Another area I’ve been investigating are techniques to help users recover from errors and to identify when errors are real, or when they are simulated. Many attacks rely on users not being able to make this distinction.

You presented the project called Dynamic Security Skins (DSS) nearly one year ago. Do you think the main idea behind it is still valid after your tests?

Rachna Dhamija: I think that our usability study shows how easy it is to spoof security indicators, and how hard it is for users to distinguish legitimate security indicators from those that have been spoofed. Dynamic Security Skins is a proposal that starts from the assumption that any static security indicator can easily be copied by attacker. Instead, we propose that users create their own customized security indicators that are hard for an attacker to predict. Our usability study also shows that indicators placed in the periphery or outside of the user’s focus of attention (such as the SSL lock icon in the status bar) may be ignored entirely by some users. DSS places the security indicator (a secret image) at the point of password entry, so the user can not ignore it.

DSS adds a trusted window in the browser dedicated to username and password entry. The user chooses a photographic image (or is assigned a random image), which is overlaid across the window and text entry boxes. If the window displays the user’s personal image, it is safe for the user to enter his password. …

With security skins, we were trying to solve not user authentication, but the reverse problem – server authentication. I was looking for a way to convey to a user that his client and the server had successfully negotiated a protocol, that they have mutually authenticated each other and agreed on the same key. One way to do this would be to display a message like “Server X is authenticated”, or to display a binary indicator, like a closed or open lock. The problem is that any static indicator can be easily copied by an attacker. Instead, we allow the server and the user’s browser to each generate an abstract image. If the authentication is successful, the two images will match. This image can change with each authentication. If it is captured, it can’t be replayed by an attacker and it won’t reveal anything useful about the user’s password. …

Instead of blaming specific development techniques, I think we need to change our design philosophy. We should assume that every interface we develop will be spoofed. The only thing an attacker can’t simulate is an interface he can’t predict. This is the principle that DSS relies on. We should make it easy for users to personalize their interfaces. Look at how popular screensavers, ringtones, and application skins are – users clearly enjoy the ability to personalize their interfaces. We can take advantage of this fact to build spoof resistant interfaces.

To combat phishing, change browser design philosophy Read More »

1% create, 10% comment, 89% just use

business, social software, tech in changing society, technology / /

From Charles Arthur’s “What is the 1% rule?” (Guardian Unlimited: 20 July 2006):

It’s an emerging rule of thumb that suggests that if you get a group of 100 people online then one will create content, 10 will “interact” with it (commenting or offering improvements) and the other 89 will just view it.

It’s a meme that emerges strongly in statistics from YouTube, which in just 18 months has gone from zero to 60% of all online video viewing.

The numbers are revealing: each day there are 100 million downloads and 65,000 uploads – which as Antony Mayfield (at http://open.typepad.com/open) points out, is 1,538 downloads per upload – and 20m unique users per month.

That puts the “creator to consumer” ratio at just 0.5%, but it’s early days yet …

50% of all Wikipedia article edits are done by 0.7% of users, and more than 70% of all articles have been written by just 1.8% of all users, according to the Church of the Customer blog (http://customerevangelists.typepad.com/blog/).

Earlier metrics garnered from community sites suggested that about 80% of content was produced by 20% of the users, but the growing number of data points is creating a clearer picture of how Web 2.0 groups need to think. For instance, a site that demands too much interaction and content generation from users will see nine out of 10 people just pass by.

Bradley Horowitz of Yahoo points out that much the same applies at Yahoo: in Yahoo Groups, the discussion lists, “1% of the user population might start a group; 10% of the user population might participate actively, and actually author content, whether starting a thread or responding to a thread-in-progress; 100% of the user population benefits from the activities of the above groups,” he noted on his blog (www.elatable.com/blog/?p=5) in February.

1% create, 10% comment, 89% just use Read More »

Open sources turns software into a service industry

business, tech in changing society, technology / /

From Eric Steven Raymond’s “Problems in the Environment of Unix” (The Art of Unix Programming: 19 September 2003):

It’s not necessarily going to be an easy transition. Open source turns software into a service industry. Service-provider firms (think of medical and legal practices) can’t be scaled up by injecting more capital into them; those that try only scale up their fixed costs, overshoot their revenue base, and starve to death. The choices come down to singing for your supper (getting paid through tips and donations), running a corner shop (a small, low-overhead service business), or finding a wealthy patron (some large firm that needs to use and modify open-source software for its business purposes).

Open sources turns software into a service industry Read More »

Differences between Macintosh & Unix programmers

business, history, tech in changing society, technology / /

From Eric Steven Raymond’s “Problems in the Environment of Unix” (The Art of Unix Programming: 19 September 2003):

Macintosh programmers are all about the user experience. They’re architects and decorators. They design from the outside in, asking first “What kind of interaction do we want to support?” and then building the application logic behind it to meet the demands of the user-interface design. This leads to programs that are very pretty and infrastructure that is weak and rickety. In one notorious example, as late as Release 9 the MacOS memory manager sometimes required the user to manually deallocate memory by manually chucking out exited but still-resident programs. Unix people are viscerally revolted by this kind of mal-design; they don’t understand how Macintosh people could live with it.

By contrast, Unix people are all about infrastructure. We are plumbers and stonemasons. We design from the inside out, building mighty engines to solve abstractly defined problems (like “How do we get reliable packet-stream delivery from point A to point B over unreliable hardware and links?”). We then wrap thin and often profoundly ugly interfaces around the engines. The commands date(1), find(1), and ed(1) are notorious examples, but there are hundreds of others. Macintosh people are viscerally revolted by this kind of mal-design; they don’t understand how Unix people can live with it. …

In many ways this kind of parochialism has served us well. We are the keepers of the Internet and the World Wide Web. Our software and our traditions dominate serious computing, the applications where 24/7 reliability and minimal downtime is a must. We really are extremely good at building solid infrastructure; not perfect by any means, but there is no other software technical culture that has anywhere close to our track record, and it is one to be proud of. …

To non-technical end users, the software we build tends to be either bewildering and incomprehensible, or clumsy and condescending, or both at the same time. Even when we try to do the user-friendliness thing as earnestly as possible, we’re woefully inconsistent at it. Many of the attitudes and reflexes we’ve inherited from old-school Unix are just wrong for the job. Even when we want to listen to and help Aunt Tillie, we don’t know how — we project our categories and our concerns onto her and give her ‘solutions’ that she finds as daunting as her problems.

Differences between Macintosh & Unix programmers Read More »

The first movie theater

business, history, tech in changing society, technology / /

From Adam Goodheart’s “10 Days That Changed History” (The New York Times: 2 July 2006):

APRIL 16, 1902: The Movies

Motion pictures seemed destined to become a passing fad. Only a few years after Edison’s first crude newsreels were screened — mostly in penny arcades, alongside carnival games and other cheap attractions, the novelty had worn off, and Americans were flocking back to live vaudeville.

Then, in spring 1902, Thomas L. Tally opened his Electric Theater in Los Angeles, a radical new venture devoted to movies and other high-tech devices of the era, like audio recordings.

“Tally was the first person to offer a modern multimedia entertainment experience to the American public,” says the film historian Marc Wanamaker. Before long, his successful movie palace produced imitators nationally, which would become known as “nickelodeons.”

The first movie theater Read More »

The day FDR was almost assassinated

history / /

From Adam Goodheart’s “10 Days That Changed History” (The New York Times: 2 July 2006):

FEB. 15, 1933: The Wobbly Chair

It should have been an easy shot: five rounds at 25 feet. But the gunman, Giuseppe Zangara, an anarchist, lost his balance atop a wobbly chair, and instead of hitting President-elect Franklin D. Roosevelt, he fatally wounded the mayor of Chicago, who was shaking hands with F.D.R.

Had Roosevelt been assassinated, his conservative Texas running mate, John Nance Garner, would most likely have come to power. “The New Deal, the move toward internationalism – these would never have happened,” says Alan Brinkley of Columbia University. “It would have changed the history of the world in the 20th century. I don’t think the Kennedy assassination changed things as much as Roosevelt’s would have.”

The day FDR was almost assassinated Read More »

The date Silicon Valley (& Intel) was born

business, history, tech in changing society, technology / /

From Adam Goodheart’s “10 Days That Changed History” (The New York Times: 2 July 2006):

SEPT. 18, 1957: Revolt of the Nerds

Fed up with their boss, eight lab workers walked off the job on this day in Mountain View, Calif. Their employer, William Shockley, had decided not to continue research into silicon-based semiconductors; frustrated, they decided to undertake the work on their own. The researchers — who would become known as “the traitorous eight” — went on to invent the microprocessor (and to found Intel, among other companies). “Sept. 18 was the birth date of Silicon Valley, of the electronics industry and of the entire digital age,” says Mr. Shockley’s biographer, Joel Shurkin.

The date Silicon Valley (& Intel) was born Read More »

Where we are now

history, politics / /

From Gary Kamiya’s “License to lie” (Salon: 23 June 2006):

We are in a peculiar moment, one in which our politicians seem unable to articulate or even grasp the train wreck unfolding in front of them. Someday in the future, if the Democratic Party manages to transform itself from a cowering shadow to something approaching sentience, perhaps what really happened during the Bush era will be publicly debated.

Perhaps then we can ask how it happened that the government of the United States was hijacked by a bullying, fact-averse religious fanatic and his puppetmaster, an evil courtier out of Shakespeare. How we were plunged into a disastrous war simply because a cabal of ideologues and right-wing zealots, operating in autocratic secrecy, decided they wanted war. And how all of the normal workings of a democratic government — objective analysis, checks and balances, transparency — were simply trashed by an administration waving the bloody shirt of “terror.”

Where we are now Read More »

The origin of broadcast journalism

history, technology / /

From Nicholas Lemann’s “The Murrow Doctrine” (The New Yorker: 23 & 30 January 2006: 38-43):

There is a memorable entry in William Shirer’s Berlin Diary in which he describes – as, in effect, something that happened at work one day – the birth of broadcast journalism. It was Sunday, March 13, 1938, the day after Nazi troops entered Austria. Shirer, in London, got a call from CBS headquarters, in New York, asking him to put together a broadcast in which radio correspondents in the major capitals of Europe, led by Shirer’s boss, Edward R. Murrow, who was on the scene in Vienna, would offer a series of live reports on Hitler’s move and the reaction to it.

The origin of broadcast journalism Read More »

DRM converts copyrights into trade secrets

business, law, tech in changing society, technology / /

From Mark Sableman’s “Copyright reformers pose tough questions” (St. Louis Journalism Review: June 2005):

It goes by the name “digital rights management” – the effort, already very successful, to give content owners the right to lock down their works technologically. It is what Washington University law professor Charles McManis has characterized as attaching absolute “trade secret” property-type rights to the content formerly subject to the copyright balance between private rights and public use.

DRM converts copyrights into trade secrets Read More »

Writers take a while to attain full power

art, on writing / /

From Thomas Babington Macaulay’s “A Speech Delivered In The Committee of the House Of Commons On The 6th Of April 1842” (Prime Palaver #4: 1 September 2001):

It is the law of our nature that the mind shall attain its full power by slow degrees; and this is especially true of the most vigorous minds. Young men, no doubt, have often produced works of great merit; but it would be impossible to name any writer of the first order whose juvenile performances were his best. That all the most valuable books of history, of philology, of physical and metaphysical science, of divinity, of political economy, have been produced by men of mature years will hardly be disputed. The case may not be quite so clear as respects works of the imagination. And yet I know no work of the imagination of the very highest class that was ever, in any age or country, produced by a man under thirty-five. Whatever powers a youth may have received from nature, it is impossible that his taste and judgment can be ripe, that his mind can be richly stored with images, that he can have observed the vicissitudes of life, that he can have studied the nicer shades of character. How, as Marmontel very sensibly said, is a person to paint portraits who has never seen faces? On the whole, I believe that I may, without fear of contradiction, affirm this, that of the good books now extant in the world more than nineteen-twentieths were published after the writers had attained the age of forty.

Writers take a while to attain full power Read More »

Macaulay in 1841: copyright a tax on readers

art, business, history, law, politics / /

From Thomas Babington Macaulay’s “A Speech Delivered In The House Of Commons On The 5th Of February 1841” (Prime Palaver #4: 1 September 2001):

The principle of copyright is this. It is a tax on readers for the purpose of giving a bounty to writers. The tax is an exceedingly bad one; it is a tax on one of the most innocent and most salutary of human pleasures; and never let us forget, that a tax on innocent pleasures is a premium on vicious pleasures. I admit, however, the necessity of giving a bounty to genius and learning. In order to give such a bounty, I willingly submit even to this severe and burdensome tax. Nay, I am ready to increase the tax, if it can be shown that by so doing I should proportionally increase the bounty. My complaint is, that my honourable and learned friend doubles, triples, quadruples, the tax, and makes scarcely any perceptible addition to the bounty.

Macaulay in 1841: copyright a tax on readers Read More »