Apparently he denied this remark in messages to Michael Geist (and the video posted on balancedcopyrightforcanada.ca conveniently omits it):

I signed up for a Balanced Copyright for Canada account to see what sort of astroturfing points they had in their “Daily Action Items” section. My account was deleted shortly after taking these screenshots.

You can see that they instruct their members to swarm any anti-Bill-C32 articles as well as engaging anyone who retweets them. Members are instructed to support any pro-Bill-C-32 articles or comments.

While the screenshots here are copyrighted by the owner of balancedcopyrightforcanada.ca, I believe that I have a fair dealing defence for publishing them here for analysis.

The Purpose of the Dealing Is it for research, private study, criticism, review or news reporting? It expresses that “these allowable purposes should not be given a restrictive interpretation or this could result in the undue restriction of users’ rights.” In particular, the Court gave a “a large and liberal interpretation” to the notion of research, stating that “lawyers carrying on the business of law for profit are conducting research”.

First quick impressions of Safari extensions:

1. Close enough to Chrome extensions that it won’t take much to port something over. (good)
2. Settings API is interesting. I missed the point originally, but apparently Safari will build you a settings page from these. Will probably work for simple settings, but not sure if it’ll scale.
3. Different API for buttons/context menus, but no real winner in terms of API design.
4. Really don’t like having to get a certificate from Apple to develop. Regardless of Apple’s policies, this is the first browser that you need central approval to deploy to (not IE, Firefox, Chrome or Opera needed it).
5. No solution provided to build from command-line (we had to hand-roll one for Chrome too). Browser vendors need to get their act together here.
6. The extension builder is a strange experience: you need to drop files in the directory, then head back to the builder to update things.

I can’t imagine it’ll take us longer than a few days to port the DotSpots extension from Chrome to Safari. It’ll take a while for us to integrate this into our automated build process though.

UPDATE: Sprint just pushed an OTA update for these phones that may patch the root hole we’re using. Don’t install any OTA updates yet if you want root!

We (ozzeh, joshua, shadowmite and I) just put the teaser site together for the EVO root. More info coming soon!

http://unrevoked.com, Twitter: @unrevoked

Painless root for your HTC EVO 4G.

UPDATE (July 7, 2010) Daniel Herding sent me a story about his adventures with Avira’s latest version. Looks like they’ve just paved over the problem.

We’ve been seeing a number of reports that our DotSpots Chrome extension is being reported as infected with the HTML/Crypted.Gen malware. There’s not a lot of information on Avira’s site about this malware, except that it’s a ‘trojan’ with ‘low damage potential‘.

I previously submitted a sample of the false positive which solved the problem until we pushed out a new version of our code. Since we can’t submit each of our builds ahead of time to Avira for approval, I had to spend some time figuring out exactly what was causing them to think our code was malicious.

I started by downloading a trial version of their anti-virus product. Immediately after restart, it detected the HTML/Crypted.Gen malware in the Chrome extension that was already installed. I extracted the script from the extension to my desktop and it continued to pop up infection warnings on the file. Now that I had a reliable reproduction case, I could start working on narrowing down what triggered the alert.

I loaded up the file in my trusty analysis tool, Notepad. Starting from the original file, I deleted large swaths of code until it was no longer detected as a virus, then restored those pieces and deleted smalled chunks. Eventually I reduced it down to a couple of lines, which were then reduced down to a few strings of characters. At the end, a file with only a few hundred characters would trigger the signature:

.fromCharCode
.charCodeAt
for
eval
0,0,0,0,0,0
Math.min

Aside: my original set of pattern strings included “nodeValue” rather than “eval”. The patterns are all case-insensitive and don’t ensure matches happen on JS token boundaries. When I went character-by-character to simplify the triggers further, I discovered that it was the ‘eVal’ in ‘nodeValue’ causing issues.

When I create a file with those six strings in it on a website, Avira will attempt to block the download. This appeared to be the most specific components of the signature. Putting those keywords into Google, I found a few references to the malware it detected. The malicious script seems to construct an iframe from an array of characters, then inserts it into the document to download malware from a third-party site.

Unfortunately, these keywords also end up in the compiled Javascript of nearly every Google Web Toolkit application, giving Avira anti-virus users false-positives when viewing many of these applications.

I posted a report to the GWT contributor Google Group with my findings. I had expected that since I posted the offending signature in the message, Avira would warn me that the web page I was reading was malicious. It didn’t.

I ran the message page through the same process that I used to figure out what triggered the signature, this time looking for the smallest piece of text that disables detection of the virus. It turns out that this text is the phrase google. So, the heuristic looks for the presence of the six character strings above, but also the absence of the word Google.

It’s a little disappointing to see how poorly this anti-virus product implements heuristic detection of this particular scripting pattern. It was trivial for me to figure out the pattern. I could have worked around any number of ways- by adding whitespace to the array of zeros, using Math['min'], or String['from' + 'CharCode'], all of which breaks this pattern recognition. Having the phrase ‘google’ disable detection of the virus made my job even easier. It’s possible that there are a set of other safewords that do the same thing. If I were writing malware or viruses, I’d definitely spend time altering it to work around this sort of heuristic.

Considering that the risk of false positives is so high (and users might be trained to ignore other, potentially valid virus warnings), I’d say that users are worse off with this virus definition than they are without.

You can find me on twitter as @mmastrac