Traffic control

The decision has been made: The German government passed a law, that requires all major ISPs to block suspicious web sites with a stop sign.

The BKA, the German Federal Criminal Police Office, provides a list with current web sites that have to be blocked.

At the page with the stop sign the user will be informed about the reason of the lock and he will be informed about the serious consequences of child pornography for abused children. At the same time the law outlines, that a bypass of the lock is illegal. The law is supposed to come into effect this legislature period.

All providers agree, that child pornography has to be banned. But is censoring single web sites and making them only partly accessible the right way?

The official statement is to stop all users accessing such sites by accident.

Have you ever seen a child pornography site by accident?

It’s also very interesting, that a bypass of the lock is now penalized in Germany. Basically the locks are working with the domain name system (DNS), which resolves domain names. The list of pages that have to be blocked are applied on the name servers of the access provider. But technically it’s not required to use the providers name servers. Each user can easily configure his own name servers. Therefore the user has the possibility to chose which name servers he would like to use. A custom configuration can be made for different reasons; not only to avoid locked pages. Such a configuration should be a crime?

Proponents of such locks argue, that the Internet is legal free space. This argument lacks, since the Internet itself is not its own space, it is a medium used in our society. In society there are rules and laws that apply, whether virtual or real.

The Internet does not cause child abuse. The Internet is used as medium to show child pornography, and also other crimes and perversities. There is no doubt that children must be protected from sexual abuse and we have get rid of documentation and publication of it. However, the most important thing is to find the perpetrators to stop child pornography and to protect children.

The difficulty to access such sites neither stops child pornography nor prevents the web site operators to run their dirty business. An other wide spread argument is, that a lock would cut the producer’s business base. However, if a real “customer base” exists, it is not necessary for these people to use the Internet to share their dirty content. That means child abuse does not stop if these web sites are blocked, it will merely move back to the underground. Is that the goal to protect children? How honest is the desire to protect children?

The Internet is just a medium. Censoring a medium does not prevent the causes nor does it eliminate a social evil.

If users should be protected by law from such content, what is the next harmful content, where the user should be protected?

emerion’s position on the censorship question is quite clear:
The internet should not be censored in any way, the perpetrators must be found and be held accountable.

Why emerion think that locking pages does not make any sense:

1. Who is the target of the network lock against child pornography?
Actually “real” child pornography can be found on the internet only, if you know exactly where to look for it. A click by accident, even on legal porn sites almost never happens, because the legal porn industry dissociates strictly from the child porn scene due of its own legal interests. Blocking sites is only against people who are consciously searching for child pornography. However, even if “curious” people were prevented from looking at such material, it would be irrelevant for the prevention of child abuse, since those people would not pay for that material.

2. Are network locks effective?
Network locks could be bypassed easily in any form, for example through the use of other name servers, open proxy server or through freely available anonymizing services. Instructions are available on the Internet and easy to find. The installation or configuration of such a bypass strategy only takes a few minutes. Most likely are consumer of child pornography capable of such modifications, even despicte the fact that this is now made punishable.

3. What are the side effects of network locks?
Because of the mandatory introduction of network locks through the provider, he is forced to separate the internet in “good” and “bad” sites. Due to the necessary infrastructure it is virtually inevitable that the data provider sees, who tried to access “evil” sites. Although if this data is initially neither stored nor released, it would be easy to force the providers by law to disclose user data (for example, prosecute child-consumer). It does not need much imagination to guess what democratic political consequences almost inevitably arise, because this type of infrastructure is also able to record and evaluate other type of user behavior.

4. Why should there be a connection to the music industry?
The music industry has a keen interest in the prosecution of child consumers. Once the infrastructure works for the providers, it is foreseeable that they will start massive lobbying to block file-sharing sites. The German University Professor, Dr. Thomas Hoeren from the Institute for Information, Telecommunications and Media at the University of Munster said in an interview: “I have the impression that the Family Minister does not know whose interests she represents. For the music industry, which tries to criminalize users for private copying, what happens now in the minors, is the the best thing that could happen for and the Minister is instrumentalized by the industry.”

This relationship is also supported by the music industry by itself: Dieter Gorny, Chairman of the Federal Association Music Industry, followed the Minister: “The thrust of the Family Minister for the prohibition of child pornography on the Internet is a correct signal. It is about regulation in the social internet, including the protection of intellectual property.”

5. What other democratic political consequences are predictable?

Soon after the introduction of the network lock it will turn out, that it is largely useless. Thus the next logical step is to prohibit the bypass of the lock by law as described above. The consequence is that every Internet user who wants to be anonymous in the Internet – completely legitimate – due to any reasons, will be criminalized. Ultimately this will lead to a massive restriction of fundamental rights to information and freedom of expression, as well as the protection of privacy. In other words: The usage of the Internet will only be possible if the user accepts, that access providers and the government know, or are at least able to determine, which web sites the user visited.

6. What can we really do against child pornography?
As with any crime the most sensible option is to prosecute the criminals, as it has already been done successfully on the basis of international cooperation between authorities, Internet service providers and child protection organizations (for example see eg https://www.inhope.org/).

Additionally the effect of blocking the sites can be achieved with less effort, by asking the provider hosting the material, to remove it.
A German child rights organization, invested 1 day and wrote emails to 20 providers which hosted sites, found on the Danish lock list. 16 providers shut down the affected sites immediately. This is another way, not the only one, but more successful than Internet blocking.

7. Conclusion:
Network locks are largely ineffective against spread or production of child pornography. In further consequence the music industry benefits from the locks, however the democracy and socio-political consequences, are unpredictable.

Special thanks to Michael Eisenriegler.

Web browser: Gateway for Viruses

The web browser is the gateway to the internet to browse web pages, but cyber criminals are using the bugs of the software to make them the gateway for viruses. But not only the security leaks of web browsers are used by hackers, they also use vulnerabilities of the software installed on the hosted website.

Popular targets are well-known programs like Joomla, Wordpress or Typo3, but also Java script, which one is widely used for web 2.0 applications and user friendly interfaces.

Hackers are using cross site scripting to execute malicious code from a remote server.

What does malicious code do?

Hackers try to get control over the surfers computer with malicious code, so that the criminals are able to use it for their needs. In most cases they use it for spamming, but also for attacking other servers. The users PC will be added to a botnet, which is a seperate network controlled by the hackers.

Important: Regular Updates.

Actually there exists no software, which one has no security leak. Criminals try to detect such security leaks in well-known software, like in web browsers, because they can use it as gateways to install a virus on the victims computer. There are security leaks in software used for web sites, and it can be used to spread out a virus, because this sites are often visited with web browsers containing security leaks.

Once such a security leak is detected and officially confirmed, the software vendor publishes an update of the software. The most common problem is, that a lot of users do not implement the update. So the really important thing is, to update the browser immediately, once a new update is available from the vendor.

Updates of software used by the web site.

The software used by your web site is also very important. Every contact form or even a whole content management system you use, can have a security leak, where it is possible to execute malicious code. It is important to keep this software up to date all the time. Otherwise it may happen that you as operator of the web site become a distributor of viruses.

If you are just a surfer, you should keep your web browser up to date. If you operate a web site, you also have to take care to update the installed software on your web server.

What about the web hoster, shouldn’t he take care about security of the systems?

Reliable hosting companies like emerion operate all web hosting packages on well-maintained servers. The servers themselves have an operating system, which must be continuously maintained, as well as the server software and management software.

With a web hosting package the customer gets his own space on the server, where he can install his “own software”. This can be a popular script as well as a complex program. The variety of such scripts is very large, and so the possibility of security leaks, which can be abused by hackers.

Software installed by the customer on his own web space cannot be maintained by the web hoster. For the self installed programs the customer has to take care about updates.

Due to security leaks in scripts a customer installs on his web space, it could be possible that the hacker gets access to the whole server system, if the OS is not up to date, or if the system is not configured properly. Security has a high priority for emerion. The software, as well as the operating systems are always up to date. Basically the systems are configured that they are easy to use for the customer, but there is no possibility to break in. But this does not release the customer from the responsibility to maintain his self-installed software.

Domain names - the identity in the web

A web address is an important marketing tool. In the interest of improving readability the registration of a well selected domain name is recommended. A short name is easy to remember for the user and the domain name should communicate the company name, the brand name or the slogan.

Domain names are not only for business usage, also privat persons can register a domain name. It could be the lastname, a combination of first and lastname, or maybe a nickname. With an own domain name you save your identity in the web, you look professional and you are independend. Even if you change your access provider you web address will be yours all the time and the web site and email addresses under your own domain will remain the same. Registering your own domain you should take care who will be the registrant. The registrant should also be the administrative contact who is the only one who is responsible for the domain name. He has the authority to modify the domain name. It is annoying, if you detect after the registration that you are not the registrant and administration contact of the domain name. Reliable web hosters and registrars like emerion will always enter the customer as registrant and administrative contact.

A domain name should be meaningful. If a domain contains terms which one are also in the content of the web site, this could affect the search engine ranking positive. But it also important that a web address can be printed. It should look nice on your stationery. It does not look good if the domain name needs two lines. Can you imagine how it might look, if you read a domain name on the rear of a car, containing a line break?

A domain name is very important, a lot of domains are already taken. So it is important to register your domain for your name, your idea, or your for your brand name.

Top Level Domains

What is a Top Level Domain? A Top Level Domain is the extension of a domain name, like .com, .uk, .biz, .de, .at. There are two types of Top Level Domains. The generic Top Level Domains, which one are not associated with a country, like .com, .net, .org, .biz, .info, and the Top Level Domains associated with a country, called country code Top Level Domains, short ccTLDs like .uk, .at, .de and so on.

Under a country code domain the user expect local content of the website. Even users complete domain names with their own country extensions. So British people may have mainly .uk in their mind, Germans .de and Austrians .at. For local companies the own country code domain is very important. The policies of the country code domains are made by the registries of each country and sometimes it’s not easy to register such a domain if the registrant is not a citizen of the appropriate country. For .de domains the registrant must be a german citizen to be able to register a .de domain name. Not so for .at domains. Everyone can register a .at domain name!

Gimmicks

It is recommended to register also slogans beside your brand, name or company name, because will also be found on the internet if users are using your slogan. But it can happen that the domain name is not readable anymore in that case.
To improve readability you can use dashes in a domain name like “register-a-domain.org”. You also can use different cases writing a domain name for better readability. It is easier to read HostingNewsBlog.com than hostingnewsblog.com. You can use the domain name itself in the address field of the browser in any case. But attention: everthing after the domain name is case sensitive! www.HostingNewsBlog.com/Index.php results in an error, while www.HostingNewsBlog.com/index.php shows the correct page.
It is also not recommended to use capitals for the whole domain name, it is less readable and does not look good for the customer.

It is also not recommended to publish domain names with subdirectories like http://www.emerion.com/domain/cms/products/. It is better readable to use a sub domain and point it to the long URL, like http://products.emerion.com/.

Now let’s have a look at mistyped domain names. Longer or complicated names are subject to be mistyped. Sometimes it can happen, that the user is redirected to a competitor, because he registered a mistyped domain. To avoid this situation it is recommended that you also register wrong spelled domain names of your own name, brand name or slogan. So it is ensured, that the user sees your web site, even if he mistyped the domain name. For example emerion is also reachable under www.emerin.com.

Spring Special Offer for .at Domain Names