Steve Gibson (61:57)
Yeah. So, okay, there's that. Steam reports that they're being pressured, you'll pardon the pun, over some of their content by the payment processors, believe it or not, that they use in response, rather than risk losing their payment flows. Steam has reportedly removed thousands of games containing adult content, though what that is remains unclear. Like, that's, like what exactly the content should be. Last Friday, Eurogamer asked Valve for some clarification and then wrote this of their response. They said in response to questions from Eurogamer regarding Steam's new guidelines preventing, quote, certain types of adult content, unquote, from being distributed on the platform. Valve has provided some general background on the events leading to the decision. A Valve spokesperson told Eurogamer, quote, we were recently notified that certain games on Steam may violate the rules and standards set forth by our payment processors and their related card networks and banks. As a result, we are retiring those games from being sold on the Steam store because loss of payment methods would prevent customers from being able to purchase other titles and game content on Steam. So, okay, in this case, thousands of titles are being removed without regard for the age of the user in what appears to be a case of I'm looks like blackmail, censorship by Valve's payment providers. So I'm sure it must be clear to everyone by now that the need to verify the age of Internet users is not off. Someday in the future, you know, we need the W3C or the IETF or perhaps the FIDO Alliance. You know, if any of Them could move at anything other than glacial speed to get busy, go and whip up some standards because we need some technology here, you know, then we need Google and, and Apple to implement them in their biometrically equipped devices. And, and, and my concern is that these things are so expensive, you know, these high end smartphones that there would be a place for someone like a next generation yo you know, to create cute, inexpensive little spoof resistant thumbprint authenticators that would follow the same specification, which unfortunately doesn't yet exist. You know, and we need all of that yesterday because the need for age verification is today. So you know, imagine that a, a Yubico type thumbprint sensor age verification verifier existed. If you, if you have a biometrically lockable smartphone, then you wouldn't need an extra gadget because the phone you've got would be able to do that. But as I said, my concern is that such smartphones are very expensive. So we need a, you know, a 20, 30, $40 alternative. If you don't have some suitably equipped smartphone, you buy an inexpensive gadget from a local retailer, a neighborhood electronics, you know, store outlet, whatever. So in, in my little thought experiment here, how do we, how do we arrange to create the binding between the user's biometric and an assertion of their age? And how do we do it at scale? Someone who wishes to enroll their iPhone, their biometric Android device or some inexpensive theoretical thumbprint verifier takes their chosen device to any US post office. They, in the US the DMV maybe AAA if you have a membership or any notary like is available at any UPS store in, in, in the United States. You show them your government issued ID proving your age, you know, they check it carefully for forgery, you know, look at, you look at your ID and then have the user in front of them authenticate with their chosen biometric, you know, their face or their thumbprint depending upon their device, after which the agent uses their own device, any NFC equipped phone or terminal or, or Bluetooth or whatever to essentially bless and activate and lock that biometric to age binding. Now this individual is in the possession of a biometrically locked age assertion which they can use on demand anywhere in cyberspace that it's needed. Again, we don't have the protocols, we don't have as far as I know, any little, well there is no protocol, so there's nothing for anybody to implement, you know, on any platform at this point. But you know, there's a, you know, a little bit of brainstorming about how we might begin to solve this problem. And this is no, it's a good thing, Leo, that I'm very committed right now to the projects that I have in front of me because you know, this is pulling me in the same way that squirrel pulled me 10 years ago. And we know how that went and went seven years of my life. But anyway, it seems to me this is like so necessary. A bit later in today's podcast, in answer to one of our listeners questions, I'm going to sketch out an example of a cryptographic protocol to provide again just a rough sense of for some more of the details of this. But my overall point is that this, the problem is not intractable, but it's not easy either and people need to get moving on this and I don't see any sign of this happening. You know, even though Yubico's founder Stina Arensford has moved on to other passions. I dropped her a note yesterday as I was writing this. You know, she's the perfect kind of person to, to shake things up and get the industry's attention and get this moving. I did get email back from her. I, I found it waiting for me this morning saying that she does have a not she's established a non profit which is, it doesn't seem focused on age but she's still on the identity crusade. She did you know I did tell her about my, my, my concern over the need for some sort of workable privacy respecting age verification and she said that that's what she was doing and wanted to set up a conference and see how we could collaborate. And I again I don't want to get too sucked into something because I've got work to do. But this just to me this seems like like one of the biggest needs we have because the world is starting to wake up to the Internet it seems and the age of the people using it is suddenly a big deal. So we need protocols. I hope somewhere that's beginning to happen. In other news, it appears that Microsoft remains unsure what to do about the fact that that no one appears to actually want their new crap. Especially in light of the fact that Exchange Server in this case is switching to a subscription. What a surprise. You know, I guess you no one should be surprised that no one is in a big hurry to switch to subscription mode. Everyone wants to just keep using the stuff they already have that's working just as well as any of the new stuff probably would, especially when they already paid for the stuff that they have that's all installed and running and configured and working just fine. So in this case, we're talking about Exchange 2016 and 2019 server, whose end of life is scheduled for that same fateful day approaching us on October 14, when Windows 10 and some other Microsoft products that no one wants to be forced to stop using were originally scheduled to stop receiving their security updates. But because users of Exchange Server are not just some rando consumers, you know, anyone who has so far refused to jump at the opportunity to switch to their marvelous new pay as you go subscription plan for Exchange Server is going to need to pay up. And Microsoft says that's it. We're serious this time. No, really, no kidding. This is it. You're actually going to have to, you know, do this. They actually, they actually wrote don't even bother asking for more. So last Tuesday's Exchange Team blog posting under the headline announcing Exchange 20162019 Extended Security Update program, they wrote, with both Exchange 2016 and 2019 going out of support in October 2025. We've heard, I bet they have. We've heard from some of our customers that they've started their migrations to Exchange Subscription Edition. Literally, it's SE for Exchange Subscription Edition, but might need a few extra months of security updates for their Exchange 20162019 servers while they're finalizing their migrations. We are announcing that we now have a solution for such customers starting on August 1, 2025. So the end of this month, August 1 customers can contact their Microsoft account team to get information about and purchase an additional 6 month extended security update ESU for their Exchange 20162019 servers. Your account teams will have information related to per server cost and additional details on how to purchase and receive ESUs starting August 1, 2025. Now logic would suggest, you know, that the, the, the stay right where I am for the next six months plan will cost more than the, you know, that subscription sounds great, sign me up plan. And you know, no one ever accused Microsoft of leaving any money on the table, so it will almost certainly cost those foot draggers more than getting on with the new plan. Microsoft continued writing. So what does this mean? They said first this ESU is not an extension of the support life cycle. And they said Microsoft Lifecycle Policy Microsoft Learn for Exchange 2016 2019. Those servers still go out of support on October 14, 2025 and you will not be able to open support cases for them unless directly related to an issue with a SU released to esu. That is a a service update released to ESU customers during the ESU period. So they said the ESU is not an extension of the support life cycle. Okay, I don't understand why because that's what they're selling you. They said this ESU is a way for customers who might not be able to to finalize their migrations to Exchange SE the subscription edition before October 14th to receive critical and important updates as currently defined by Microsoft Security Resource center scoring as SUS security updates that we might release after October 2025. Okay, so I guess what they're saying is you have to have signed up for the subscription, but you may we understand you may not have yet finished migration to the subscription servers or the subscription from your non subscribed Servers Exchange Server 2016 and 2019 so you can buy additional support for them in order to bridge they said Exchange 20162019 sus these service updates will not be released on Public Download center or Windows update after October 2025. So they're still trying to be as as strict here as they can. They also said we are not committing to actually releasing any service updates during the ESU period, meaning you pay for it and you may not get anything. They said Exchange Server does not necessarily receive security updates every month on Patch Tuesday as security updates are released only if there are critical or important security product changes. Therefore, if there are no issues that we need to release during the time of esu, there will be no SO update, no such updates provided. We will however confirm with ESU participants each Patch Tuesday whether an SU was provided or not. This ESU will be valid they said for six months only through April 14, 2026. And they wrote this period will not be extended past April 2026. You do not need to ask. So anyway, that's the story. If you are an enterprise, you're not going to be ready by October 14th to stop receiving any security updates for your existing Exchange 20162019 servers. Then you can buy any that may occur. I wonder if you could wait to see if any occur and then buy them then. I I don't know. Anyway, they they they finished explaining. They said customers using Exchange 2019 should in place upgrade to Exchange SE quickly and switch to the Exchange SE Modern Life Cycle policy. Meaning yes, the Modern Life Cycle Policy, also known as the will no longer allow you to purchase it in these modern times. You now keep paying for it forever. So anyway, for what it's worth, the the wonder and clever folks over at 0patch. You know it's numeric 0p a t c h.com the 0patch guys do provide patches for Exchange Server and they do so on very reasonable terms. So it might be more cost effective to consider remaining with the already paid for in full Exchange Server you already own and then having the zero patch folks keep it up to date for you. You know, basically they recreate Microsoft's patches, they reverse engineer them and then offer them like they don't even have to reboot Exchange Server. Right? I mean it's like way better than Microsoft until April 14th when that when those older servers will no longer be receiving security updates for the micro patch guys to reverse engineer. And I don't know whether they can look at the security updates for the next generation of Exchange servers and backport them to the earlier editions of Exchange Server. We'll have to see at that point. But don't forget those zero patch guys. They're going to be friends of Windows 10 users also starting October 14th as we talked about before. Okay so wow. A new Russian law has get this LEO criminalized online searches for controversial content. Russia previously criminalized the sharing of such content or obtaining it, but with officials saying that censorship during wartime is justified, that is they're they're using their war with Ukraine as the context here. They're saying restrictive digital laws are justified and being tightened. The Washington Post reported this on last on this last Thursday, writing Russian lawmakers passed controversial legislation Thursday, meaning last Thursday that would dramatically expand the government's ability to punish Internet users not for sharing forbidden content, but for simply looking it up, like putting the search term in. The new measures, which sailed through the Russian Parliament and will take effect in September, envision fining people who, quote, deliberately searched for knowingly extremist materials, unquote, and gained access to them through means such as virtual private networks or VPNs, which lets users bypass government blocks. VPNs are already widely used in Russia to circumvent the many blocks on websites, the Washington Post wrote. Russia defines extremist materials rather broadly as content officially added by a court to a government maintained registry, a running list of about 5,500 entries at the moment, or content produced by extremist organizations ranging from LGBT movement to Al Qaeda. The new law also covers materials that promote alleged Nazi ideology or incite extremist actions. Until now, Russian law stopped short of punishing individuals who for seeking information online, only creating or sharing such content was prohibited. The new amendments follow remarks by high ranking officials that censorship is justified in wartime. Adoption of the measures would mark a significant tightening of Russia's already restrictive digital laws. Similar legislation they wrote, passed recently in neighboring Belarus, Russia's close ally, ruled by authority authoritarian leader Alexander Lukashenko and has been used to justify prosecution of government critics. The fine for searching for banned content in Russia would be about $65, while the penalty for advertising circumvention tools such as VPN services would be steeper $2,500 for individuals and up to $12,800 for companies. Sarkis Darbinian, an Internet freedom activist whom the Russian authorities have labeled a foreign agent, said the fines imposed for searching for extremist materials in this iteration may be minor, but this can be grounds for detention, pressure or a pretext to be escorted to the police station. I am most afraid that in the next iteration, administrative fines will turn into criminal cases. Previously, the most significant expansion of Russia's restrictions on Internet use and freedom of speech occurred shortly after the February 2022 full scale invasion of Ukraine, when sweeping laws criminalized the spread of so called fake news and discrediting the Russian military. The new amendment was introduced Tuesday, attached to a mundane bill on regulating freight companies, according to documents published by Russia's lower house of parliament, the State Duma. We talked about before Net Freedoms, an advocacy group said in a statement. Lawmakers have repeatedly used this cunning tactic of quietly inserting repressive measures into dormant, previously introduced bills. It allows them to accelerate the legislative process, moving through the second and third readings in a single day and to avoid public scrutiny. On Wednesday, as news of the censorship amendment sparked widespread concern in Russian media, lawmakers pushed the bill sought to down pushing. The bill sought to downplay fears that citizens would be penalized for browsing the web. Senator Artem Sheikin, one of the bill's authors, told state controlled news agencies that the new measures are not intended to punish individuals for accessing prohibited websites, using VPNs, reading Facebook or scrolling through Instagram, Sakin said, does not constitute an administrative offense. The main focus is on regulating providers, he said. There's no plan for mass punishment of users. He claimed that liability would only attach in cases of knowingly searching for and accessing content officially designated as extremists by a court and added to a Ministry of justice blacklist. However, he did not explain how authorities would determine whether an individual knew the access content was deemed extremist. Anyway, things are tightening up in Russia and they they they used the term throttling, talking about how Russia is also has also expanded its use of deep packet inspection technologies, enabling more precise blocking of traffic and committed millions of dollars to fortify what we Know, as, you know, Russia Net or RU Net, it's creating this sovereign Internet infrastructure that allows them to pull the switch and disconnect Russia from the rest of the global Internet. They also said that telecom providers have been ordered as, and we talked about this before, to provide detailed user data while citizens are being pressured to use domestic platforms instead of the foreign ones by throttling or restricting platforms such as YouTube X and Instagram as the Russian government seeks to limit access. And you know, we talked about the use of the term throttling because Cloudflare sites were recently added to this throttle technology where a page was limited to 16k bytes if it came from Cloudflare, which as I observed was really not enough to run any, like even begin to get a modern web page off the ground. Maybe you could do a 301 redirect. Well, you could do that in 16K. And that was the only explanation that I could come up with. But as we've said, any site that was, that had content that want from that was of interest to Russians could just move to a Russian hosting provider in order to get around that block, which is probably the whole goal here. So for me, this news is disturbing. I'm not in Russia, but Russia is an extreme example of what we're seeing everywhere. This general tendency globally from the world's governments, the UK and the EU are chafing over encryption and arguing against fundamental privacy rights. Here in the US we've seen the Supreme Court just approve the means by which various extreme special interest groups will be able to, to criminalize, essentially enter any Internet speech that they dislike or deem to be unwholesome. The, the definition of in. In the legislation that the, the U.S. supreme Court just approved is very worrisomely broad. And as I was saying, Leo before, it feels as though for the first 50 years of the Internet, you know, it was not well understood and sort of remained out of bounds for the world's governments and politicians. Or as we noted, perhaps it just didn't matter all that much until just the past decade or so. You know, we enthusiasts were all having a great time playing in our sandboxes with our technologies, but now the political adults have returned and they're scowling at the things that we've been up to. Yeah, I don't know.
