-<p>Having a fresh copy of the license text was useful, and knowing
-that the definition of Title-by-Title required payment per title made
-me aware that my earlier understanding of that phrase had been wrong.
-But I still had a few questions:</p>
-
-<p><blockquote>
-<p>I have a small followup question. Would it be possible for me to get
-a license with MPEG LA even if there are no royalties to be paid? The
-reason I ask, is that some video related products have a copyright
-clause limiting their use without a license with MPEG LA. The clauses
-typically look similar to this:
-
-<p><blockquote>
- This product is licensed under the AVC patent portfolio license for
- the personal and non-commercial use of a consumer to (a) encode
- video in compliance with the AVC standard ("AVC video") and/or (b)
- decode AVC video that was encoded by a consumer engaged in a
- personal and non-commercial activity and/or AVC video that was
- obtained from a video provider licensed to provide AVC video. No
- license is granted or shall be implied for any other use. additional
- information may be obtained from MPEG LA L.L.C.
-</blockquote></p>
-
-<p>It is unclear to me if this clause mean that I need to enter into
-an agreement with MPEG LA to use the product in question, even if
-there are no royalties to be paid to MPEG LA. I suspect it will
-differ depending on the jurisdiction, and mine is Norway. What is
-MPEG LAs view on this?</p>
-</blockquote></p>
-
-<p>According to the answer, MPEG LA believe those using such tools for
-non-personal or commercial use need a license with them:</p>
-
-<p><blockquote>
-
-<p>With regard to the Notice to Customers, I would like to begin by
-clarifying that the Notice from Section 7.1 of the AVC License
-reads:</p>
-
-<p>THIS PRODUCT IS LICENSED UNDER THE AVC PATENT PORTFOLIO LICENSE FOR
-THE PERSONAL USE OF A CONSUMER OR OTHER USES IN WHICH IT DOES NOT
-RECEIVE REMUNERATION TO (i) ENCODE VIDEO IN COMPLIANCE WITH THE AVC
-STANDARD ("AVC VIDEO") AND/OR (ii) DECODE AVC VIDEO THAT WAS ENCODED
-BY A CONSUMER ENGAGED IN A PERSONAL ACTIVITY AND/OR WAS OBTAINED FROM
-A VIDEO PROVIDER LICENSED TO PROVIDE AVC VIDEO. NO LICENSE IS GRANTED
-OR SHALL BE IMPLIED FOR ANY OTHER USE. ADDITIONAL INFORMATION MAY BE
-OBTAINED FROM MPEG LA, L.L.C. SEE HTTP://WWW.MPEGLA.COM</p>
-
-<p>The Notice to Customers is intended to inform End Users of the
-personal usage rights (for example, to watch video content) included
-with the product they purchased, and to encourage any party using the
-product for commercial purposes to contact MPEG LA in order to become
-licensed for such use (for example, when they use an AVC Product to
-deliver Title-by-Title, Subscription, Free Television or Internet
-Broadcast AVC Video to End Users, or to re-Sell a third party's AVC
-Product as their own branded AVC Product).</p>
-
-<p>Therefore, if a party is to be licensed for its use of an AVC
-Product to Sell AVC Video on a Title-by-Title, Subscription, Free
-Television or Internet Broadcast basis, that party would need to
-conclude the AVC License, even in the case where no royalties were
-payable under the License. On the other hand, if that party (either a
-Consumer or business customer) simply uses an AVC Product for their
-own internal purposes and not for the commercial purposes referenced
-above, then such use would be included in the royalty paid for the AVC
-Products by the licensed supplier.</p>
-
-<p>Finally, I note that our AVC License provides worldwide coverage in
-countries that have AVC Patent Portfolio Patents, including
-Norway.</p>
-
-<p>I hope this clarification is helpful. If I may be of any further
-assistance, just let me know.</p>
-</blockquote></p>
-
-<p>The mentioning of Norwegian patents made me a bit confused, so I
-asked for more information:</p>
-
-<p><blockquote>
-
-<p>But one minor question at the end. If I understand you correctly,
-you state in the quote above that there are patents in the AVC Patent
-Portfolio that are valid in Norway. This make me believe I read the
-list available from &lt;URL:
-<a href="http://www.mpegla.com/main/programs/AVC/Pages/PatentList.aspx">http://www.mpegla.com/main/programs/AVC/Pages/PatentList.aspx</a>
-&gt; incorrectly, as I believed the "NO" prefix in front of patents
-were Norwegian patents, and the only one I could find under Mitsubishi
-Electric Corporation expired in 2012. Which patents are you referring
-to that are relevant for Norway?</p>
-
-</blockquote></p>
-
-<p>Again, the quick answer explained how to read the list of patents
-in that list:</p>
-
-<p><blockquote>
-
-<p>Your understanding is correct that the last AVC Patent Portfolio
-Patent in Norway expired on 21 October 2012. Therefore, where AVC
-Video is both made and Sold in Norway after that date, then no
-royalties would be payable for such AVC Video under the AVC License.
-With that said, our AVC License provides historic coverage for AVC
-Products and AVC Video that may have been manufactured or Sold before
-the last Norwegian AVC patent expired. I would also like to clarify
-that coverage is provided for the country of manufacture and the
-country of Sale that has active AVC Patent Portfolio Patents.</p>
-
-<p>Therefore, if a party offers AVC Products or AVC Video for Sale in
-a country with active AVC Patent Portfolio Patents (for example,
-Sweden, Denmark, Finland, etc.), then that party would still need
-coverage under the AVC License even if such products or video are
-initially made in a country without active AVC Patent Portfolio
-Patents (for example, Norway). Similarly, a party would need to
-conclude the AVC License if they make AVC Products or AVC Video in a
-country with active AVC Patent Portfolio Patents, but eventually Sell
-such AVC Products or AVC Video in a country without active AVC Patent
-Portfolio Patents.</p>
-</blockquote></p>
-
-<p>As far as I understand it, MPEG LA believe anyone using Adobe
-Premiere and other video related software with a H.264 distribution
-license need a license agreement with MPEG LA to use such tools for
-anything non-private or commercial, while it is OK to set up a
-Youtube-like service as long as no-one pays to get access to the
-content. I still have no clear idea how this applies to Norway, where
-none of the patents MPEG LA is licensing are valid. Will the
-copyright terms take precedence or can those terms be ignored because
-the patents are not valid in Norway?</p>
+<p>Jeg klarer ikke helt å se hvordan analyse av de besøkendes
+IP-adresser for å se hvem som sender inn meldekort via web fra en
+IP-adresse i utlandet kan gjøres uten å komme i strid med påstanden om
+at «ingen av opplysningene vil bli brukt til å identifisere
+enkeltpersoner». Det virker dermed for meg som at NAV bryter sine
+egen personvernerklæring, hvilket
+<a href="http://people.skolelinux.org/pere/blog/Er_lover_brutt_n_r_personvernpolicy_ikke_stemmer_med_praksis_.html">Datatilsynet
+fortalte meg i starten av desember antagelig er brudd på
+personopplysningsloven</a>.
+
+<p>I tillegg er personvernerklæringen ganske misvisende i og med at
+NAVs nettsider ikke bare forsyner NAV med personopplysninger, men i
+tillegg ber brukernes nettleser kontakte fem andre nettjenere
+(script.hotjar.com, static.hotjar.com, vars.hotjar.com,
+www.google-analytics.com og www.googletagmanager.com), slik at
+personopplysninger blir gjort tilgjengelig for selskapene Hotjar og
+Google , og alle som kan lytte på trafikken på veien (som FRA, GCHQ og
+NSA). Jeg klarer heller ikke se hvordan slikt spredning av
+personopplysninger kan være i tråd med kravene i
+personopplysningloven, eller i tråd med NAVs personvernerklæring.</p>
+
+<p>Kanskje NAV bør ta en nøye titt på sin personvernerklæring? Eller
+kanskje Datatilsynet bør gjøre det?</p>
+</description>
+ </item>
+
+ <item>
+ <title>Where did that package go? &mdash; geolocated IP traceroute</title>
+ <link>http://people.skolelinux.org/pere/blog/Where_did_that_package_go___mdash__geolocated_IP_traceroute.html</link>
+ <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Where_did_that_package_go___mdash__geolocated_IP_traceroute.html</guid>
+ <pubDate>Mon, 9 Jan 2017 12:20:00 +0100</pubDate>
+ <description><p>Did you ever wonder where the web trafic really flow to reach the
+web servers, and who own the network equipment it is flowing through?
+It is possible to get a glimpse of this from using traceroute, but it
+is hard to find all the details. Many years ago, I wrote a system to
+map the Norwegian Internet (trying to figure out if our plans for a
+network game service would get low enough latency, and who we needed
+to talk to about setting up game servers close to the users. Back
+then I used traceroute output from many locations (I asked my friends
+to run a script and send me their traceroute output) to create the
+graph and the map. The output from traceroute typically look like
+this:
+
+<p><pre>
+traceroute to www.stortinget.no (85.88.67.10), 30 hops max, 60 byte packets
+ 1 uio-gw10.uio.no (129.240.202.1) 0.447 ms 0.486 ms 0.621 ms
+ 2 uio-gw8.uio.no (129.240.24.229) 0.467 ms 0.578 ms 0.675 ms
+ 3 oslo-gw1.uninett.no (128.39.65.17) 0.385 ms 0.373 ms 0.358 ms
+ 4 te3-1-2.br1.fn3.as2116.net (193.156.90.3) 1.174 ms 1.172 ms 1.153 ms
+ 5 he16-1-1.cr1.san110.as2116.net (195.0.244.234) 2.627 ms he16-1-1.cr2.oslosda310.as2116.net (195.0.244.48) 3.172 ms he16-1-1.cr1.san110.as2116.net (195.0.244.234) 2.857 ms
+ 6 ae1.ar8.oslosda310.as2116.net (195.0.242.39) 0.662 ms 0.637 ms ae0.ar8.oslosda310.as2116.net (195.0.242.23) 0.622 ms
+ 7 89.191.10.146 (89.191.10.146) 0.931 ms 0.917 ms 0.955 ms
+ 8 * * *
+ 9 * * *
+[...]
+</pre></p>
+
+<p>This show the DNS names and IP addresses of (at least some of the)
+network equipment involved in getting the data traffic from me to the
+www.stortinget.no server, and how long it took in milliseconds for a
+package to reach the equipment and return to me. Three packages are
+sent, and some times the packages do not follow the same path. This
+is shown for hop 5, where three different IP addresses replied to the
+traceroute request.</p>
+
+<p>There are many ways to measure trace routes. Other good traceroute
+implementations I use are traceroute (using ICMP packages) mtr (can do
+both ICMP, UDP and TCP) and scapy (python library with ICMP, UDP, TCP
+traceroute and a lot of other capabilities). All of them are easily
+available in <a href="https://www.debian.org/">Debian</a>.</p>
+
+<p>This time around, I wanted to know the geographic location of
+different route points, to visualize how visiting a web page spread
+information about the visit to a lot of servers around the globe. The
+background is that a web site today often will ask the browser to get
+from many servers the parts (for example HTML, JSON, fonts,
+JavaScript, CSS, video) required to display the content. This will
+leak information about the visit to those controlling these servers
+and anyone able to peek at the data traffic passing by (like your ISP,
+the ISPs backbone provider, FRA, GCHQ, NSA and others).</p>
+
+<p>Lets pick an example, the Norwegian parliament web site
+www.stortinget.no. It is read daily by all members of parliament and
+their staff, as well as political journalists, activits and many other
+citizens of Norway. A visit to the www.stortinget.no web site will
+ask your browser to contact 8 other servers: ajax.googleapis.com,
+insights.hotjar.com, script.hotjar.com, static.hotjar.com,
+stats.g.doubleclick.net, www.google-analytics.com,
+www.googletagmanager.com and www.netigate.se. I extracted this by
+asking <a href="http://phantomjs.org/">PhantomJS</a> to visit the
+Stortinget web page and tell me all the URLs PhantomJS downloaded to
+render the page (in HAR format using
+<a href="https://github.com/ariya/phantomjs/blob/master/examples/netsniff.js">their
+netsniff example</a>. I am very grateful to Gorm for showing me how
+to do this). My goal is to visualize network traces to all IP
+addresses behind these DNS names, do show where visitors personal
+information is spread when visiting the page.</p>
+
+<p align="center"><a href="www.stortinget.no-geoip.kml"><img
+src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geoip-small.png" alt="map of combined traces for URLs used by www.stortinget.no using GeoIP"/></a></p>
+
+<p>When I had a look around for options, I could not find any good
+free software tools to do this, and decided I needed my own traceroute
+wrapper outputting KML based on locations looked up using GeoIP. KML
+is easy to work with and easy to generate, and understood by several
+of the GIS tools I have available. I got good help from by NUUG
+colleague Anders Einar with this, and the result can be seen in
+<a href="https://github.com/petterreinholdtsen/kmltraceroute">my
+kmltraceroute git repository</a>. Unfortunately, the quality of the
+free GeoIP databases I could find (and the for-pay databases my
+friends had access to) is not up to the task. The IP addresses of
+central Internet infrastructure would typically be placed near the
+controlling companies main office, and not where the router is really
+located, as you can see from <a href="www.stortinget.no-geoip.kml">the
+KML file I created</a> using the GeoLite City dataset from MaxMind.
+
+<p align="center"><a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy.svg"><img
+src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy-small.png" alt="scapy traceroute graph for URLs used by www.stortinget.no"/></a></p>
+
+<p>I also had a look at the visual traceroute graph created by
+<a href="http://www.secdev.org/projects/scapy/">the scrapy project</a>,
+showing IP network ownership (aka AS owner) for the IP address in
+question.
+<a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy.svg">The
+graph display a lot of useful information about the traceroute in SVG
+format</a>, and give a good indication on who control the network
+equipment involved, but it do not include geolocation. This graph
+make it possible to see the information is made available at least for
+UNINETT, Catchcom, Stortinget, Nordunet, Google, Amazon, Telia, Level
+3 Communications and NetDNA.</p>
+
+<p align="center"><a href="https://geotraceroute.com/index.php?node=4&host=www.stortinget.no"><img
+src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-small.png" alt="example geotraceroute view for www.stortinget.no"/></a></p>
+
+<p>In the process, I came across the
+<a href="https://geotraceroute.com/">web service GeoTraceroute</a> by
+Salim Gasmi. Its methology of combining guesses based on DNS names,
+various location databases and finally use latecy times to rule out
+candidate locations seemed to do a very good job of guessing correct
+geolocation. But it could only do one trace at the time, did not have
+a sensor in Norway and did not make the geolocations easily available
+for postprocessing. So I contacted the developer and asked if he
+would be willing to share the code (he refused until he had time to
+clean it up), but he was interested in providing the geolocations in a
+machine readable format, and willing to set up a sensor in Norway. So
+since yesterday, it is possible to run traces from Norway in this
+service thanks to a sensor node set up by
+<a href="https://www.nuug.no/">the NUUG assosiation</a>, and get the
+trace in KML format for further processing.</p>
+
+<p align="center"><a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-kml-join.kml"><img
+src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-kml-join.png" alt="map of combined traces for URLs used by www.stortinget.no using geotraceroute"/></a></p>
+
+<p>Here we can see a lot of trafic passes Sweden on its way to
+Denmark, Germany, Holland and Ireland. Plenty of places where the
+Snowden confirmations verified the traffic is read by various actors
+without your best interest as their top priority.</p>
+
+<p>Combining KML files is trivial using a text editor, so I could loop
+over all the hosts behind the urls imported by www.stortinget.no and
+ask for the KML file from GeoTraceroute, and create a combined KML
+file with all the traces (unfortunately only one of the IP addresses
+behind the DNS name is traced this time. To get them all, one would
+have to request traces using IP number instead of DNS names from
+GeoTraceroute). That might be the next step in this project.</p>
+
+<p>Armed with these tools, I find it a lot easier to figure out where
+the IP traffic moves and who control the boxes involved in moving it.
+And every time the link crosses for example the Swedish border, we can
+be sure Swedish Signal Intelligence (FRA) is listening, as GCHQ do in
+Britain and NSA in USA and cables around the globe. (Hm, what should
+we tell them? :) Keep that in mind if you ever send anything
+unencrypted over the Internet.</p>
+
+<p>PS: KML files are drawn using
+<a href="http://ivanrublev.me/kml/">the KML viewer from Ivan
+Rublev<a/>, as it was less cluttered than the local Linux application
+Marble. There are heaps of other options too.</p>
+
+<p>As usual, if you use Bitcoin and want to show your support of my
+activities, please send Bitcoin donations to my address
+<b><a href="bitcoin:15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&label=PetterReinholdtsenBlog">15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b</a></b>.</p>
projects / homepage.git / blobdiff