First things first: WordPress themes are GPL, they have to be redistributable under the GNU General Public License. Necessarily, the PHP code (although not the CSS or image elements of a theme) has to be, since it is based on WordPress’ GPL code, GPL. Legal wording:

The PHP elements, taken together, are clearly derivative of WordPress code. The template is loaded via the include() function. Its contents are combined with the WordPress code in memory to be processed by PHP along with (and completely indistinguishable from) the rest of WordPress. The PHP code consists largely of calls to WordPress functions and sparse, minimal logic to control which WordPress functions are accessed and how many times they will be called. They are derivative of WordPress because every part of them is determined by the content of the WordPress functions they call. As works of authorship, they are designed only to be combined with WordPress into a larger work.

Speaking of our specific case of Thesis again, the logic is probably less sparse than in your everyday theme, but every other word except “sparse” fully holds, so I guess it’s not that exceptional in this regard. Or can anybody with legal training assist me, am I wrong there?

The guys at Thesis now go and forbid owners of Thesis to remove the backlink to the Thesis site. I appreciate that such a backlink is a great marketing and SEO measure, but I don’t see the legal grounds for such a thing really. They can certainly sell push-style upgrades, and the images they provide with the theme, and of course their support and forums. But the theme itself seems to be necessarily open source, so the Thesis pricing model seems to need re-evaluation.

Edit 2009-07-19 16:20: Just do clarify, unless I am mistaken they can certainly ask money from people for the theme – there are no limits for monetizing distribution in the GPL. However, they don’t seem to be allowed to restrict people’s rights to redistribute and alter the theme.

Particularly in the Swiss blogosphere, with the recent Thesis craze, I think this is fairly important information. What do you think? Or did I misunderstand some legal background?

Anyway, something completely different: The financial crisis explained with a really nice visualization (and its homepage), very worth posting -- it’s both informative and well-made:

Via purzlbaum.ch.

Update 2009-03-06 13:49: Similar, but in German and using a bar metaphor, and found on Rogue’s Blog:

Ich schreibe diesen Post unter anderem auch als Antwort auf diesen Blogpost auf tou.ch (und spezifisch auf den Kommentar von “Blocher”). Ich finde ja, eine einzige Person als “Schuldigen” herauszustellen, wenn auch 121 andere Leute anders hätten wählen können, etwas seltsam – jeder einzelne Parlamentarier war ein pivotaler Wähler.

Wirtschaftspolitisch ein erfreuliches Ereignis, eigentlich. Aber dies soll nicht das Thema dieses Blogposts sein. Das hier hingegen schon (Video aus Late Service Public):

In der politischen Diskussion wurde in letzter Zeit regelmässig das Schlagwort der “Konkordanz” für diverse Positionen benutzt. Ich denke, dass wir uns hier vor allem deshalb nicht verstehen, weil jeder das Wort etwas anders definiert; ein typisch sprachphilosophisches Problem. Ich würde gerne die folgenden Arten der Konkordanz unterscheiden (Nomenklatur recht willkürlich, lediglich die arithmetische Konkordanz ist schon im Sprachgebrauch), über die gängige Definition der Konkordanzdemokratie hinaus:

• Arithmetische Konkordanz – jede Partei muss gemäss ihrer prozentualen Vertretung im Parlament auch prozentual im Bundesrat vertreten sein.
• Gleichschaltende Konkordanz – jeder Bundesrat sollte das denken und fühlen, was der Gesamtbundesrat beschlossen hat, und kann somit gar nichts dagegen sagen wollen. Er wird auch in Zukunft im BR gemäss vergangener Bundesratsbeschlüsse argumentieren.
• Inhaltliche Konkordanz – jeder Bundesrat sollte das vertreten, was der Gesamtbundesrat beschlossen hat, und sollte seinen Kollegen nicht in den Rücken fallen. (Auch: Kollegialitätsprinzip)
• Positionale Konkordanz – die Kernbotschaften jeder Partei müssen durch ihren Vertreter im Bundesrat vertreten sein.
• Personelle Konkordanz – die Kernbotschaften jeder Partei müssen durch die Vertreter, die sie designiert und vorgeschlagen haben, im Bundesrat vertreten sein.

Positionen

Die positionale und arithmetische Konkordanz werden von niemandem ernsthaft bestritten. Die inhaltliche Konkordanz wird nur von einigen wenigen radikaleren SVP-Exponenten in Frage gestellt, ich glaube, auch diese sollten wir als „Konsens“ abtun. Das Parlament hat ja bei der Abwahl von Alt-BR Blocher, die es bis in den Deutschen Blick geschafft hat, recht deutlich gemacht, was es von dieser Einstellung hält.

Bei den anderen Arten von Konkordanz jedoch gehen die Meinungen auseinander.

Die SVP: Sie findet, personelle Konkordanz sei wichtig, und stellt sie mit arithmetischer und positionaler Konkordanz gleich. Weiter stellt die SVP-Rhetorik inhaltliche und gleichschaltende Konkordanz oft gleich, und benutzt diese Gleichstellung als Argument gegen die inhaltliche Konkordanz (oder tat dies zumindest, diese Position hat sich mittlerweile wieder aufgeweicht – Worte widersprechen hier Taten).

Die anderen Parteien: Sie können besser unterscheiden und sind nur nach “Zwängerei” der SVP mit knappster Mehrheit auf die personelle Konkordanz eingetreten, weil die SVP (nicht die anderen Parteien) sonst die arithmetische Konkordanz zerstört hätte.

Ueli Maurer

BR Maurer: Er scheint sich im Moment tatsächlich der inhaltlichen Konkordanz zu verschreiben. Diese beinhaltet ja nicht, dass er seine Position während BR-Beratungen nicht mehr vertreten und dafür argumentieren dürfte, beinhaltet aber sehr wohl, dass er Entschlüsse des Gesamtbundesrates vertritt und damit der Wirtschaft und Gesellschaft klare Zeichen von der Regierung sendet. BR Maurer scheint sie auch nicht mit einer gleichschaltenden Konkordanz zu verwechseln. Ich traue ihm zu, dass er uns alle noch positiv überrascht.

Weitere Betrachtungen

Die personelle Konkordanz ist ein Streitpunkt, bei dem in der Vergangenheit alle Parteien „schuldig“ sind. Gerade auch bei der SP wurden aber ja schon diverse Male (unter anderem durch die SVP) andere Vertreter in das Bundesratsamt gewählt, als von der Partei vorgeschlagen worden waren. Dies aber natürlich unter anderem auch deshalb, weil die dann gewählten Personen die Inhalte ihrer Partei anders und mehr im Sinne der wählenden Parteien vertreten hat – entsprechend sind tatsächlich personelle und positionale Konkordanz bis zu einem gewissen Grad miteinander verknüpft, aber natürlich nie in dem Ausmass, das die SVP uns weismachen möchte.

Schön ist ja, dass jetzt mit dem SVP-Anspruch auf einen Sitz von der SP oder FDP nun auch die arithmetische Konkordanz von rechter Seite in Frage gestellt wird – nachdem mit eben dieser arithmetischen Konkordanz für den Sitz, den sie nun mit BR Maurer erhalten hat, gekämpft wurde. Ich enthalte mich diesbezüglich eines Kommentars.

Ganz interessant in diesem Zusammenhang übrigens ist auch, dass die SVP bei den letzten kantonalen Wahlen es tatsächlich geschafft hat, aus der Exekutive aller urbanen Räume geworfen zu werden.

Update 2008-12-15 15:05: Im Stadtwanderer findet sich eine gute Übersicht bezüglich der Etymologie der Konkordanz, und wie sich das Prinzip in der Schweizer Politik entwickelt hat. Absolut lesenswert.

Samuel Schmid

Disclaimer: Swiss politics, so many links lead to German pages.

Samuel Schmid, member of the Swiss Federal Council (Bundesrat), is stepping back as per December 31th, as he just announced 10am this morning. It was, as sad to say as it is, inevitable.

The SVP, which was Schmids party until the end of last year, was partially torn apart by internal struggles when Christoph Blocher wasn’t re-elected for the Swiss Federal Council (the Swiss main executive body, consisting of 7 members) and Eveline Widmer-Schlumpf was elected instead. That election was a true tour de force with opposition to Blocher that originally sparked in the center and the left of the political spectrum, mainly the SP and the Green, but gained supporters deep into the SVP. Later on, Schmid and Widmer-Schlumpf were kicked from the SVP, quite a few moderate members quit the party only weeks later, and found themselves in a newly formed (and less extreme) party, the BDP. A true polit thriller, we live in interesting times.

Blocher was the man who shaped the SVP for decades before that point, a populist and controverter, isolationist where it fits national-oriented voters and global where it fits his own industrial empire or the interest groups that he profits from, pretending to speak for the small and powerless while being a millionaire himself. When he was part of the Federal Council, he intended to do politics like he does economics, and he thinks economic leadership should be executed just like military leadership – so in effect, he tried to militarize politics. Which just won’t work, not in a democracy. Add his all the way anti-european stance and things that could be interpreted as racism, and you have one heck of a right wing politician.

I don’t like Blocher’s political style nor position, if that hasn’t become obvious yet, and apparently, so did the majority of our Federal Convention. The SVP threatened to enter the opposition, which on one hand isn’t entirely possible in Switzerland due to our many involved parties, and on the other hand is nothing new since the SVP always was in the opposition wherever possible. Anyway.

Much mud-slinging later, Samuel Schmid (who was called “half a Bundesrat” early on in his career in the federal council already by not-so-democratic elements in the SVP) has given in to the pressure, and is leaving. Both due to political and health reasons, it seems in the end the constant stress and pressure affected his healthiness, too.

It’s sad, because while he may not have represented the radical right-wing elements that so cling to and like their power, he certainly did represent the less extreme right, just like Moritz Leuenberger doesn’t follow through with positions from the extreme left but rather proposes solutions that are capable of winning a majority. We lose a down-to-earth, calm and reasonable council member, one from near the other end of the political spectrum from where I find myself that I could thoroughly respect, and that always had reasons for his actions and positions that I could follow and understand. It is a sad day for democracy when a man like that is successfully mobbed out of the position he was elected into.

Sources: 20min, NZZ, Twitter.

Update 2008-11-12 11:22: admin.ch already has a statement regarding the resignation of BR Schmid. Via tou.ch.

Of course they can! Like 20min.ch:

NaN Votes

NaN votes, great stuff Too bad it’s fixed already.

Scenario 1: Terrorist operative “A” uses Twitter with… a cell phone camera/video function to send back messages, and to receive messages, from the rest of his [group]… Other members of his [group] receive near real time updates (similar to the movement updates that were sent by activists at the RNC) on how, where, and the number of troops that are moving in order to conduct an ambush.

Scenario 2: Terrorist operative “A” has a mobile phone for Tweet messaging and for taking images. Operative “A” also has a separate mobile phone that is actually an explosive device and/or a suicide vest for remote detonation. Terrorist operative “B” has the detonator and a mobile to view “A’s” Tweets and images. This may allow “B” to select the precise moment of remote detonation based on near real time movement and imagery that is being sent by “A.”

Scenario 3: Cyber Terrorist operative “A” finds U.S. [soldier] Smith’s Twitter account. Operative “A” joins Smith’s Tweets and begins to elicit information from Smith. This information is then used for… identity theft, hacking, and/or physical [attacks]. This scenario… has already been discussed for other social networking sites, such as My Space and/or Face Book.

Yeah, what the 304th Military Intelligence Battalion (which is so utterly well-versed in information technology that their security certificate doesn’t fit their URL) writes in their PDF report makes a lot of sense. And the PDF report likening all muslims to jihadist terrorists is tremendously coherent as well, after all, it’s what our media tells us, and our media is Always Right™.

I think my stupidity allergy is acting up, I’ll have to stop writing for now.

Via Matthias Gutfeld, who had it via Ugugu.

Update 08-10-30, 15:18: Meanwhile, Schneier has a post about this as well. Apparently, somebody on Slashdot commented:

Wait until they find out about email and chatrooms!!!!

Sarah Palin

Apart from her being rather incompetent (“cramming a lot of information”, as if, she just doesn’t find her way around the notes others have prepared for her), Sarah Palin apparently really likes fashion. And hairdressers. And makeup.

According to financial disclosure records, the accessorizing began in early September and included bills from Saks Fifth Avenue in St. Louis and New York for a combined $49,425.74.

The records also document a couple of big-time shopping trips to Neiman Marcus in Minneapolis, including one $75,062.63 spree in early September.

The RNC also spent $4,716.49 on hair and makeup through September after reporting no such costs in August.

Ah well. I refrained from posting about the US election so far, it’s just too hyped up even in European media, and the US voters seem to be less informed by the day, start being openly and no longer covertly racist again, but this is just silly.

Although, on second thought, maybe the money is better spent that way.

Via tou.ch (German).

In short, again, the reasons why I think biometric passports as per the current proposal are not reasonable:

• Too open access to the collected data, private institutions and foreign governments can access it without notice
• Privacy goes out the window when you can be tracked everywhere
• RFID is readable from meters away without line of sight
• Current RFID encryption is not secure, your passport can be read by crooks
• The only reason why the Swiss government wants those passports is because the USA told us so

I expanded upon all of those points in my earlier post.

Please, do something while you still can! Sign the referendum now. You will have to have your signatures verified already, meanwhile, as they write:

Senden Sie uns jetzt keine UNBEGLAUBIGTEN Bögen mehr. Gehen Sie mit den Bögen die Sie bis am Montag, 29.9. noch ausfüllen können direkt auf die zuständige Gemeindeverwaltung um die Unterschriften beglaubigen zu lassen. Oder senden Sie die Unterschriftenbögen DIREKT an die zuständige Gemeindeverwaltung.

You will then need to send this cover letter along.

Update: We’re there, voting will be May next year or so.

Yes, that just was my meager tribute to today’s Talk like a Pirate Day

Ingame Map

Washington Map

It’s a fact that there’s 10 million WoW players (by official count), and that not all ingame chat is about the game itself. It’s also a fact however that some CIA folks have seen too many conspiracy movies. You might have heard about it: A Pentagon researcher gave a presentation early this month (via Wired, heise), where he alerted the world to the inherent dangers in such online worlds: Jargon! Coded messages! To the left, you see an ingame map, to the right the overlaid secret attack plan. Boo!

Now … yes. Of course, this is theoretically possible. Of course terrorists could forfeit encrypted mails, a private Ventrillo server, or some other secure means of communication, in favour of in-WoW chat. But it’s a prime example of a movie plot threat, a term coined by security expert Bruce Schneier. He clearly illustrates why defending against those is a very bad idea:

The problem with movie plot security is that it only works if we guess right. If we spend billions defending our subways, and the terrorists bomb a bus, we’ve wasted our money. To be sure, defending the subways makes commuting safer. But focusing on subways also has the effect of shifting attacks toward less-defended targets, and the result is that we’re no safer overall.

Seems those Pentagon researchers haven’t read that, though. Nor have they heard about his later movie plot threat contest (which made it to the NY Times), just you wait until they expand on more of those possible dangers – here’s a long inspirational list.

Terror in Lineage

I particularly like this broken toys post, where the blogger draws parallels in other popular MMOs.

Indeed, the point can be made that they only use the above WoW picture as a clever way to make even politicians realize that “emerging media” are something that has to be watched for potential terrorist attacks. But the main issue remains: However many movie plot threats you watch, however many communication channels you supervise, we’re gladly living in a not-quite-yet-1984 world, which has the downside that terrorists have plenty of communication alternatives.

And once again I’m quoting Schneier, in his brilliant analysis of the subject matter:

My guess is still that some clever Pentagon researchers have figured out how to play World of Warcraft on the job, and they’re not giving that perk up anytime soon.

I guess that’s the best explanation for all this.

RFID - How It Works

The Swiss government has decided that our passports, like a few before ours, should store data on RFID chips. Meaning, the following data would be stored in that chip:

• fingerprints
• a digital photograph
• all the data that’s also available in printed form (name, gender, date of birth, eye color, and so on)

All this data could then be read out via electrical readers (as pictured in the diagram to the right, labels German).

That in and of itself isn’t necessarily evil! The current proposal concerning regulations and technology lets it be implemented in ways that make it evil though. Let me lay out why that is.

About RFID

If you haven’t heard of RFID before, it’s high time you read up at Wikipedia – and even if you did, there’s quite intriguing things I haven’t read before in there too. Short version:

An RFID tag is an object that can be applied to or incorporated into a product, animal, or person for the purpose of identification and tracking using radio waves. Some tags can be read from several meters away and beyond the line of sight of the reader.

Additionally, the RFID chip can be passive – meaning, it has no energy source of its own and thus potentially lives forever. And as I’ll explain later more in-depth, you can’t track who obtains information from it. There are also active RFID chips, but since the ones used in passports are passive and there are no other fundamental differences beyond range between active and passive types, I’ll neglect active RFID chips for the rest of this post.

There are places where RFID chips make sense and most privacy concerns don’t apply (like race tracking, inventory systems, some kinds of animal tracking). But passports definitely aren’t one of them.

The Referendum

The referendum (a federal facultative referendum, that is) is carried from a surprisingly (in a very positive way) large number of independent political forces.

The referendum was launched because there is a vast number of unresolved issues that are introduced with biometric RFID passes (details see below).

Here is the RFID referendum website

If you’re Swiss, I strongly urge you to sign it within the next 10 days, if you haven’t already, and spread it among your friends and coworkers. Time is running out, the referendum only runs until September 22th, and apparently, over 30′000 more signatures are needed. Signature sheets are available on their site.

Privacy

It is not a coincidence that the RFID chip started out, originally, as an espionage device. Its passive nature and long life make it perfect for stealth placement and readout.

Accesses to the chip are not trackable, and while the chips in passports are protected by a metal mesh covering them that shields them against malicious scans, this (just like other things when it comes to RFID) doesn’t work as it should. Uncovered at the Blackhat 2006, a proof of concept showed:

The problem, according to Flexilis, is that the shielding does not fully protect passport against remote scans. Kevin Mahaffey from Flexilis says a medium powered scanner could detect a partially opened passport from four to six inches away. The theoretical maximum detection range is more than 10 feet, but Mahaffey said that would require a “huge amount of power.”

So, when you have such a passport, you’re trackable, identifiable, by anyone who has access to that kind of technology. Which is just about anyone who’s determined enough.

Furthermore, even “legitimate” (as per the legal text) kinds of tracking can go way beyond what we’re comfortable with. Airline companies, other companies with special permissions, your own and foreign governments, can and may track your every move. And once enough companies have your data in their databases, it’s bound to be stolen and out in the open eventually – data leaks do happen.

If you’re in the fortunate position to understand German, the StopRFID pages of the FoeBuD e.V. have way more info.

Security

There is a simple fact about RFID chips that no lobbyist will openly admit:

They are not secure.

You may have heard of MythBusters. It’s a Discovery Channel series that … busts myths. Often funny, like “can you surf on a wave created by a dynamite explosion”, but also stuff like “can you hack security fingerprint systems”. They tried to do an episode on RFID, and they were shut down by the industry. You draw the conclusions. References here: tom’s hardware, cnet news, the consumerist, all via Bruce Schneier.

“But”, I hear you say, “they’re meant to be made secure!” Well … yes. Read for yourself, in the federal Swiss decree:

Der Datenchip ist gegen Fälschungen und unberechtigtes Lesen zu schützen. Der Bundesrat bestimmt die entsprechenden technischen Anforderungen.

More or less, the chip is to be protected against malicious readouts, and details are to be determined by the executive.

But, there’s a problem with this: The same thing was meant to happen with the British passes’ RFID chips. And what happened? They were hacked a couple weeks after they were released. Read the details on The Guardian:

“The reader – I bought one for £250 – has to say hello to the chip and tell it that it is authorised to make contact. The key to that is in the date of birth, etc. Once they communicate, the conversation is encrypted, but I wrote some software in about 48 hours that made sense of it.”

More info on TechNewsWorld. Now, this was a white hat hacker. Who tells us that black hats have problems with what he achieved in 48 hours? We already know that it’s easy to access credit card numbers like that, why should full blown identity theft be made as easy as the (too easy) credit card theft?

Teleology

As we know, the main reason for adding those RFID chips in the first place is that the US wants everybody to do so. In their Enhanced Border Security and Visa Reform Act of 2002, we find:

Additionally, by October 26, 2004, in order for a country to remain eligible for participation in the visa waiver program its government must certify that it has a program to issue to its nationals machine-readable passports that are tamper-resistant and which incorporate biometric and authentication identifiers that satisfy the standards of the International Civil Aviation Organization (ICAO).

Why is it that the US government wants everybody to use those RFID chips in the first place then? Bruce Schneier has, yet again, brilliant vista:

The Bush administration is deliberately choosing a less secure technology without justification. If there were a good offsetting reason to choose that technology over a contact chip, then the choice might make sense.

Unfortunately, there is only one possible reason: The administration wants surreptitious access themselves. It wants to be able to identify people in crowds. It wants to surreptitiously pick out the Americans, and pick out the foreigners. It wants to do the very thing that it insists, despite demonstrations to the contrary, can’t be done.

This, of course, is speculation. I haven’t seen another reasonable explanation to date yet though.

The fun thing is that the US government keeps pursuing that course, despite even large independent bodies like the Smart Card Alliance (who actually represents RFID vendors, among others, and thus has it in their best economic interest that RFID chips are used) warning them from privacy and security dangers. If you have a long breath, you might want to read this extensive report from May 2006.

The future

Maybe some time in the future, the technology will be where it needs to be in order to make a private, secure chip that makes international travel easy without exposing its users to unnecessary risks. The proposed RFID chips certainly aren’t that technology.

Of course, even when we eventually do have the technology, other things like better tolerance and education would be more effective in preventing terrorism. But that’s an entirely different discussion.