[00:06.940 --> 00:07.460] Announcements. [00:07.460 --> 00:11.940] Besides setting your mobile phone to vibrate so it doesn't break people's concentration. [00:13.860 --> 00:21.180] The Hotel Pennsylvania has been very good to us and they allow us to come back year after year or year after every other year. [00:21.380 --> 00:25.220] So please do your best to keep the hijinks outside of the hotel. [00:25.660 --> 00:27.820] For instance, if you've bought a TV, be gone. [00:28.660 --> 00:33.140] Stop turning the displays off in the foyer downstairs in the lobby. [00:34.300 --> 00:38.540] We offered them tape to put over the ports, but they said, no, we don't need it. [00:42.920 --> 00:47.640] But please, if you could, you know, don't rewire the elevators. [00:49.160 --> 00:50.280] Stay off the roof. [00:50.480 --> 00:51.620] I can attest to that one. [00:54.260 --> 01:01.300] And again, keep things outside of the hotel because they do let us come back each time and have been very good to us. [01:01.360 --> 01:02.840] So thank you very much for that. [01:02.840 --> 01:07.380] Also, remember, there's a lot of stuff to see and do down in the pavilion downstairs. [01:07.760 --> 01:16.540] Also, for the people that sort of congregate in the very back, if you could keep from speaking and talking and socializing back there because it does drift up here. [01:16.940 --> 01:19.940] This is a conference room and not sort of a social area. [01:20.220 --> 01:25.320] So, see if you can keep it down back there so as not to disturb people. [01:26.100 --> 01:29.900] DVD sales of all the talks are in the vendor area over here. [01:30.880 --> 01:36.440] And you can always sign up for the fourth track, which is in the room down the hall. [01:36.440 --> 01:40.720] Right now, there's a discussion called a solar compass for the human domain. [01:41.120 --> 01:50.040] Right now, we're going to get to Wikipedia, which people love to change and vandalize on a daily basis. [01:50.040 --> 01:55.780] This is called Wikipedia, you will never find a more wretched hive of scum and villainy with Virgil Griffith. [02:01.200 --> 02:01.560] Hi. [02:02.720 --> 02:03.080] Okay. [02:03.880 --> 02:04.440] So, hi. [02:04.560 --> 02:05.160] I'm Virgil. [02:05.380 --> 02:06.840] And this is going to be my talk. [02:08.060 --> 02:08.620] Let's see. [02:08.760 --> 02:10.280] You can see that's my contact information. [02:10.880 --> 02:13.200] I am officially a disruptive technologist. [02:13.380 --> 02:14.620] The Washington Post called me that. [02:14.780 --> 02:17.280] So, I put that on my label there. [02:18.100 --> 02:19.040] And there's my website. [02:20.100 --> 02:22.200] So, if you want to see the materials, you'll be able to get them there. [02:23.860 --> 02:26.560] And, well, I guess we should just go ahead and get started. [02:31.460 --> 02:35.560] So, to begin, a lot of you don't know... [02:35.560 --> 02:39.060] Well, this entire talk is basically a WikiScanner 2.0 talk. [02:39.160 --> 02:42.580] Those who don't know about WikiScanner, you'll be updated. [07:21.090 --> 07:21.650] Okay. [07:21.650 --> 07:23.890] Oh, that's still bad. [07:24.170 --> 07:24.430] All right. [07:28.490 --> 07:29.150] All right. [07:31.430 --> 07:33.990] So, this is a brief recap. [07:34.250 --> 07:37.130] Because, like, roughly, this is, I mean, we're largely doing the same trick. [07:37.290 --> 07:38.150] We're doing it in different ways. [07:38.330 --> 07:39.830] So, you know, we should cover that. [07:40.750 --> 07:43.390] So, in short, when you edit Wikipedia, you have two choices. [07:43.670 --> 07:46.150] You can register an account and you leave your account name. [07:46.530 --> 07:48.610] Or you can edit anonymously when you don't have an account. [07:49.010 --> 07:51.490] But, when you edit anonymously, it leaves your IP address. [07:52.050 --> 07:54.150] And, you know, but this is not meant to be sneaky. [07:54.350 --> 07:59.650] This was, ostensibly, this was done just to distinguish your anonymous edits from other people's anonymous edits. [07:59.890 --> 08:01.610] Because, you know, it would be kind of confusing otherwise. [08:02.810 --> 08:07.330] However, it has the caveat that sometimes IP address can be traced back to the location. [08:07.570 --> 08:08.390] But, it's kind of tricky. [08:09.450 --> 08:10.930] But, this gives one an idea. [08:11.930 --> 08:12.190] Oh. [08:12.630 --> 08:14.230] Oh, no, don't do that. [08:15.730 --> 08:16.390] There we go. [08:16.810 --> 08:16.990] Okay. [08:17.370 --> 08:18.990] So, um, so there's that. [08:19.230 --> 08:23.650] And, uh, Wikipedia provides monthly dumps of, of, of everything on Wikipedia. [08:23.950 --> 08:24.590] And you can just download it. [08:24.830 --> 08:27.730] If you just Google, download space Wikipedia, it'll be the first hit. [08:27.990 --> 08:28.690] It's, it's pretty easy. [08:29.450 --> 08:31.110] Um, and, uh, you just download them all. [08:31.410 --> 08:32.530] And you get all the anonymous edits out. [08:32.890 --> 08:33.750] It's about 21%. [08:33.750 --> 08:35.950] And, uh, tracing IP addresses is hard. [08:36.210 --> 08:37.650] But, you can buy it if they'll do it for you. [08:38.210 --> 08:40.090] Uh, there are three big databases that do this. [08:40.290 --> 08:41.490] Uh, unfortunately, they all cost money. [08:41.810 --> 08:42.530] But, eh, what you gonna do? [08:43.050 --> 08:50.270] Um, they, uh, in case of the companies, the companies are, uh, MaxMind.com, IP2location.com, and Quova.com. [08:50.450 --> 08:52.410] Um, and they're in that order of price. [08:52.850 --> 08:54.010] With Quova being the most expensive. [08:54.890 --> 08:56.170] Um, and they do it, you merge them together. [08:56.470 --> 08:58.090] And you have, and lulz happens. [08:59.290 --> 09:00.690] Um, okay. [09:01.050 --> 09:02.810] So, if you want, well, we can go, we can go through these. [09:02.970 --> 09:03.290] Why not? [09:03.610 --> 09:05.150] Um, in short, you can just kind of read them. [09:05.390 --> 09:06.890] Yes, a lot of people edit Wikipedia. [09:07.530 --> 09:08.770] Uh, you know, CIA does. [09:08.990 --> 09:09.670] It's kind of exciting. [09:10.230 --> 09:12.670] Um, well, here, so we'll, so we'll go through these. [09:13.090 --> 09:17.290] So, um, so the CIA, the CIA actually added, so it's related to the CIA. [09:17.630 --> 09:18.810] But it's not really that exciting. [09:18.870 --> 09:19.710] But we'll show it real quick. [09:20.010 --> 09:20.710] Do, do, do. [09:24.860 --> 09:25.820] hit the button. [09:26.970 --> 09:27.450] Oh. [09:33.550 --> 09:34.650] Well, I'll tell you about it. [09:34.930 --> 09:41.510] Anyway, so in, in, in the first edit, uh, it, it, it, it, it has the CIA making entry to lightsaber combat styles. [09:42.170 --> 09:46.370] Um, and presumably, uh, the CIA doesn't actually care about lightsaber combat. [09:46.750 --> 09:52.250] Um, uh, and in the second one, it has them editing, uh, entry about black September in Jordan. [09:52.710 --> 09:54.110] Um, and I'm showing these. [09:54.530 --> 09:55.030] Yeah, here we go. [09:55.110 --> 09:56.050] Here's the lightsaber combat. [09:56.290 --> 10:04.010] Now, I like this one because, like, if, when you think of, like, people editing Wikipedia, you think of these big, evil, monolithic corporations, or something like that. [10:04.130 --> 10:07.430] And the CIA's, like, the most, like, dark secret you could possibly think of. [10:07.590 --> 10:14.370] But no, these are just random people kind of goofing off, being really into Buffy the Vampire Slayer, Buffy the Vampire Slayer and lightsaber combat. [10:14.970 --> 10:20.350] Um, so, you know, so, uh, so just because the CIA's editing Wikipedia, Wikipedia doesn't mean they're doing nefarious deeds. [10:21.870 --> 10:23.590] Um, so here's another one here. [10:23.770 --> 10:29.770] So, this, this guy here was probably, like, an old retired CIA agent, and he kind of wrote, like, a whole personal memoir going on over here. [10:30.810 --> 10:34.770] Um, I have no idea if this is true or not, but, um, it's probably true. [10:35.310 --> 10:38.630] Um, you know, since, since it's written almost from the first person. [10:39.510 --> 10:46.830] But, um, but, uh, you know, so, and he, why, he just clearly, I mean, if you want to get your memoir read, Wikipedia's not a bad place for that. [10:47.930 --> 10:49.370] Um, but anyway, okay, so I'll just show you that. [10:50.150 --> 10:52.370] Um, see, there actually was a lawsuit filed about it. [10:52.510 --> 10:56.590] So, uh, uh, so, uh, someone from the Arkansas governor's office, yeah, okay, fine. [10:57.610 --> 11:03.610] Uh, someone from the Arkansas governor's, uh, state office, uh, whitewashed a page about, uh, about Mike Huckabee who was then a presidential candidate. [11:04.050 --> 11:08.570] And, uh, this was, this was very spicy because, you know, you shouldn't be doing that from government machines. [11:08.750 --> 11:11.070] You know, whitewashing your, um, your candidates pages. [11:11.290 --> 11:14.690] And there was a FOIA lawsuit filed, about it from some AP reporters. [11:15.350 --> 11:18.010] And, um, I don't know what the results that's going to be. [11:19.630 --> 11:24.870] And a Dutch princess was caught whitewashing her own page, covering her connection to a drug baron. [11:25.350 --> 11:37.570] And we know that because we were able to trace it back to the palace, but we didn't know it was her until the Dutch media said, oh, there's this salacious edit, and she immediately fessed up. [11:37.710 --> 11:38.570] So that was very nice. [11:39.930 --> 11:46.810] And yeah, publishers do higher stuff to police their Wikipedia pages, and yeah, they do that. [11:47.230 --> 11:47.930] See, here you go. [11:48.110 --> 11:49.310] So here's one for Conrad Burns. [11:49.510 --> 11:51.730] He went from a controversial speaker to a voice for the farmer. [11:55.410 --> 11:55.690] Yeah. [11:56.570 --> 11:58.150] So, but this isn't too uncommon. [11:58.330 --> 12:02.810] I mean, don't worry, this is all really fantastic, but I mean, but you know, this is, I mean, you get used to it. [12:02.910 --> 12:04.090] It doesn't become quite as awesome. [12:05.270 --> 12:07.510] But you know, but if you're enjoying it, that's good. [12:09.170 --> 12:10.370] Okay, so, next. [12:10.930 --> 12:15.330] Okay, so I'm going to show you, so before I get to the more recent stuff, I'm going to show you some other people's interesting stuff. [12:16.350 --> 12:20.170] So this is kind of neat, this, none of this is mine, but it's kind of cool, and I kind of want to spread it around. [12:21.030 --> 12:22.090] So, this is neat. [12:22.250 --> 12:23.190] So there's this website here. [12:23.390 --> 12:25.250] Oh, can I view the URL? [12:25.730 --> 12:26.590] There we go. [12:27.650 --> 12:28.050] Oh, here we go. [12:28.730 --> 12:30.110] It's stats.grok.c. [12:30.330 --> 12:33.690] And basically, it lets you see the number of hits to a particular Wikipedia page. [12:33.850 --> 12:35.490] This number of hits to the page, hope. [12:35.750 --> 12:40.110] And this is kind of nice, because if you have a Wikipedia user account, you can see how many people are looking at your page. [12:40.270 --> 12:41.250] And that's kind of interesting. [12:42.270 --> 12:44.010] So yeah, this is really all there is to it. [12:44.650 --> 12:46.790] I don't know, for people who are interested in Wikipedia, this is kind of neat. [12:48.730 --> 12:49.710] This is kind of neat, too. [12:51.550 --> 12:55.830] So you type in a particular page, and it will tell you various stats about the page. [12:56.590 --> 13:01.010] So, let's do hope again. [13:01.750 --> 13:02.470] Do, do, do. [13:04.930 --> 13:06.970] And again, there's nothing really huge here. [13:07.070 --> 13:10.050] But you can see who are the major users that edit the page. [13:10.390 --> 13:13.670] So in this case, we see this one user who is really into this page. [13:14.810 --> 13:15.830] This fellow right here. [13:17.530 --> 13:20.150] But you know, I mean, I don't know who this person is. [13:20.310 --> 13:22.070] But anyway, anyway, so this is Kennedy. [13:22.250 --> 13:27.150] So if you want to do your own Wikipedia-related work, these are some really nice stepping stones along the way. [13:27.610 --> 13:32.850] And here's some other stuff that's a bit more sophisticated, that I think deserve more press than they've gotten. [13:34.630 --> 13:43.130] So what this does, this is from, so what this does, this tries to, this tries to color the background of Wikipedia text based on how long it's existed in Wikipedia. [13:43.470 --> 13:45.990] So it says Wikipedia is fundamentally a Darwinian process. [13:46.230 --> 13:49.970] The really good text that's trustworthy and good stays around a long time. [13:50.090 --> 13:54.350] And you can measure the trustworthiness of a piece of text based on how long it's existed unchanged. [13:55.270 --> 13:56.210] And it colors it. [13:56.310 --> 13:57.830] And you can You can see a little pretty demo here. [13:58.290 --> 14:01.730] And suppose they have a new version of this coming out soon and that's kind of neat. [14:01.930 --> 14:04.650] So let's see if we can see a nice example. [14:05.430 --> 14:06.390] Do, do, do. [14:08.790 --> 14:09.190] Oh. [14:10.330 --> 14:10.930] Here we go. [14:11.670 --> 14:13.450] Vogue's narration added about cheerleading. [14:14.310 --> 14:21.250] So you see here the highlighted areas have recently been added and you should trust those less is sort of the idea. [14:21.450 --> 14:30.010] And I think this is actually very nice because one of the main criticisms leveled against Wikipedia is that, oh, well, you don't know if someone five minutes ago edited that page and added complete nonsense. [14:30.390 --> 14:32.530] But this, like, completely destroys that objection. [14:32.690 --> 14:35.430] Because if it adds five minutes ago, well, it'll be bright, bright orange. [14:35.610 --> 14:37.050] And, well, you know that. [14:37.450 --> 14:38.950] So there you go. [14:39.910 --> 14:40.990] So I thought that was very nice. [14:41.290 --> 14:42.650] And there's a thing called Vispedia. [14:42.710 --> 14:45.130] So this is brand new and this is from Stanford. [14:46.150 --> 14:50.710] And let's see, let's do, can I, I don't see the bookmarks bar. [14:51.410 --> 14:51.810] Okay. [14:52.010 --> 14:56.370] What this does is, this allows you to graph any tables you see on Wikipedia. [14:57.430 --> 15:00.610] And, um, this is still kind of in beta, but it's, it's, it's pretty neat anyway. [15:01.590 --> 15:02.270] Um, let's see. [15:02.410 --> 15:07.770] So let's pick one on the, um, oh, yeah, here we go. [15:07.930 --> 15:11.070] List of California mountains. [15:11.530 --> 15:12.170] Okay, so here's what we're going to do. [15:12.290 --> 15:13.050] So we're going to click here. [15:13.150 --> 15:14.490] We're going to go to visualize this. [15:14.750 --> 15:15.350] Click the button. [15:15.670 --> 15:16.650] We click the table. [15:18.110 --> 15:19.970] And I want to see a map of it, please. [15:21.590 --> 15:28.150] And I want, and on this map, I will, maybe, we'll do, we'll do, like, location of each mountain and maybe, like, the name of the mountain or something. [15:28.430 --> 15:31.910] I mean, I mean, I'm not really just going to advertise it for you, but it's just kind of neat. [15:32.450 --> 15:36.730] Um, so we want a, uh, um, mountain? [15:37.110 --> 15:37.630] Do, do, do. [15:38.530 --> 15:39.270] Maybe peak? [15:39.490 --> 15:39.730] Yeah. [15:40.810 --> 15:42.130] So peak lat, please. [15:43.610 --> 15:46.450] And then peak long. [15:48.190 --> 15:52.670] And maybe for the caption, we'll just put, uh, name. [15:53.750 --> 15:54.310] Let's see. [15:54.310 --> 15:55.310] There we go, mountain range. [15:55.850 --> 15:56.890] Okay, and we click the button. [15:58.630 --> 16:00.990] And if you want to, you can make it, show you a picture of each mountain or something. [16:01.270 --> 16:02.930] But, you know, we don't, I mean, it's not that big of a deal. [16:03.230 --> 16:04.130] So, and here they are. [16:04.330 --> 16:05.030] And you can click them. [16:06.670 --> 16:08.450] And there's the mountain range and lat and long. [16:08.930 --> 16:10.910] So, um, yeah, this is just kind of neat. [16:11.030 --> 16:12.030] I mean, I mean, it's, it's neat. [16:12.130 --> 16:13.390] You can graph anything in Wikipedia now. [16:13.710 --> 16:14.450] So, darn nifty. [16:16.610 --> 16:16.890] Okay. [16:17.370 --> 16:18.130] On to other stuff. [16:18.570 --> 16:18.690] Okay. [16:19.030 --> 16:20.510] Now, no, no, no, no, no, no, no, no. [16:20.510 --> 16:22.150] Now, I'm going to go into more, more, more, more security related things. [16:22.710 --> 16:25.990] Um, so in short, uh, the, the, the wiki scanner was all fun and all. [16:26.170 --> 16:27.990] But it was really easy, easy to circumvent. [16:28.330 --> 16:31.690] Most notably, if you just registered an account, you were completely invisible. [16:31.890 --> 16:33.570] Because this only worked on the anonymous edits. [16:34.250 --> 16:38.170] Uh, further, if you, if you just edited, like, not from your corporate IP range, that would work too. [16:38.290 --> 16:44.610] So if you went home and made your edits, like, you know, wiki scanner has no idea, you know, you know, um, who you are and to catch you. [16:44.890 --> 16:46.250] So, we can do much better than that. [16:48.190 --> 16:51.090] So, and to this I introduce the wiki watcher. [16:51.730 --> 16:54.090] The wiki watcher is kind of a super set of the wiki scanner. [16:54.390 --> 16:58.830] People ask about the plus plus, if you put the plus plus on the other side, the assignment isn't right. [16:59.130 --> 17:03.410] So, so, you know, if, if, so just for those of you paying attention. [17:04.510 --> 17:08.570] Um, oh, and the, uh, so in honor of HOPE, the, uh, the date there is 1984. [17:11.090 --> 17:14.310] So, okay, so, uh, so I, I, I'm going to show you some demo knows here. [17:14.510 --> 17:15.490] And then I'm going to show you some, some site. [17:15.630 --> 17:15.890] So I, some nice exhibits. [17:16.430 --> 17:19.950] So, in, in wiki scanner there are three tools, and there are four exhibits. [17:20.430 --> 17:22.210] Um, and the ones that are red, one's I'll be showing you. [17:22.950 --> 17:26.310] Um, so, um, and the tools are something interactive, you can play with. [17:26.610 --> 17:29.250] And the exhibits is just kind of a static thing, but it's still exciting. [17:29.850 --> 17:33.110] So, uh, let's go with the poor man check user first. [17:33.350 --> 17:41.630] So for those of you that don't know about check user, check user is a power that many wiki, well that some wiki administrators have to learn the IP address of a registered account. [17:41.990 --> 17:44.790] Um, not anybody A lot of people have this and it's kind of guarded. [17:45.290 --> 17:47.790] But we can do it in kind of a ghetto style. [17:48.690 --> 17:50.070] And I'll kind of show you how. [17:50.270 --> 17:52.610] So sometimes you can't have a registered account. [17:52.970 --> 17:53.450] Here's how. [17:54.190 --> 17:54.810] So we click the button. [17:55.470 --> 17:56.590] Nope, that's wrong. [17:58.990 --> 17:59.510] Nope. [18:00.010 --> 18:00.530] Here we go. [18:01.450 --> 18:03.010] Okay, so here's what happens. [18:03.390 --> 18:09.030] So sometimes people will be editing a long time on a talk page and they will submit using their IP address. [18:10.130 --> 18:10.830] Down here. [18:12.150 --> 18:13.890] Now this can happen for multiple reasons. [18:14.370 --> 18:20.910] It can happen if you just spend a very, very long time composing your response on a talk page. [18:21.130 --> 18:22.310] Your session will time out. [18:22.570 --> 18:26.210] And if you click submit, sometimes it will submit with your IP address. [18:26.470 --> 18:26.810] Naked. [18:28.150 --> 18:31.230] And the other thing that happens is people just forget to log in. [18:31.650 --> 18:34.190] But regardless, your IP address is now showing on the talk page. [18:34.310 --> 18:35.070] And you don't like that. [18:35.210 --> 18:36.810] So you very quickly log in. [18:37.070 --> 18:40.310] And you replace the IP address with your username. [18:40.830 --> 18:42.110] Now this is really convenient. [18:42.750 --> 18:46.250] Because this gives you a connection between an IP address and a username. [18:46.590 --> 18:50.410] So now you can go over all of Wikipedia looking just for those. [18:50.810 --> 18:51.930] And I have done that. [18:54.830 --> 18:56.670] So let's see that real quick. [18:59.130 --> 19:00.170] Let's do it in Opera. [19:00.430 --> 19:01.330] Because Opera is better. [19:03.570 --> 19:04.370] And here we go. [19:05.190 --> 19:07.530] So here are the different user names here. [19:07.990 --> 19:12.150] So I have the IP address for about 13,000 different user names. [19:13.050 --> 19:14.070] Not a bad yield. [19:14.790 --> 19:16.830] Especially considering that most of these user names. [19:17.230 --> 19:20.090] So this is more likely to happen to you the more you edit Wikipedia. [19:20.430 --> 19:23.290] So this 13,000 is from the most frequent contributors. [19:24.790 --> 19:25.750] It's really long. [19:26.430 --> 19:28.090] So we want to click here the evidence. [19:28.290 --> 19:30.770] So we think this user name is this IP address. [19:30.990 --> 19:31.910] And we'll just pick one. [19:36.850 --> 19:37.650] And there we go. [19:38.750 --> 19:40.550] And we can see this for a few exciting people. [19:44.600 --> 19:45.400] Oh, come on. [19:46.140 --> 19:48.520] Well, we're waiting for the page to load so we can see Jimbo Whales. [19:51.160 --> 19:51.660] There we go. [19:54.480 --> 19:55.980] So he's in there several times. [19:59.150 --> 20:03.730] And I like that Jimbo Whales, you know, because this shows that, I mean, this seems to be a really stupid mistake. [20:03.910 --> 20:04.850] But, I mean, it happens to everyone. [20:05.090 --> 20:06.230] And it only has to happen once. [20:06.350 --> 20:08.750] And if it ever happened once, you know, well, then you're gone. [20:09.190 --> 20:10.050] So this is nice. [20:11.230 --> 20:13.470] And most of the Wikipedia administrators here are on here. [20:18.480 --> 20:18.880] Okay. [20:19.300 --> 20:20.420] So an expansion to this. [20:20.580 --> 20:23.740] So the next obvious thing to do is to detect sock puppets using this. [20:23.940 --> 20:27.900] So sock puppet is a Wikipedia jargon for when you register multiple accounts. [20:28.300 --> 20:30.600] And you treat them as they're separate people. [20:30.740 --> 20:32.080] So you make them into arguments with each other. [20:32.360 --> 20:34.620] In short, you have multiple accounts that act like two different people. [20:34.820 --> 20:39.220] And the idea is that the term comes from you being like a puppet master and they're sock puppets. [20:39.720 --> 20:44.380] So, so, um, and this is really neat because now we can detect these things really trivially. [20:45.440 --> 20:47.340] Um, do, do, do, there we go. [20:48.240 --> 20:53.660] So what this does is we just go down the poor man's check user list and we just see which ones have the same IP address. [20:54.580 --> 20:56.560] And, uh, here are a lot of suspected sock puppets. [20:58.100 --> 20:59.920] Now, this can be made a little bit better. [21:00.040 --> 21:01.340] Now, I'm showing you to this one now. [21:01.540 --> 21:04.980] Uh, this, this one probably isn't going to be, be, the finances isn't going to be released quite yet. [21:05.180 --> 21:10.160] Uh, because it would be nice if you had this sorted by, uh, um, ISP instead of by IP address. [21:10.480 --> 21:13.400] And the, the, the sequel query is, for that is running, like, right now. [21:13.960 --> 21:15.960] So, um, it'll be done, like, probably within a day or two. [21:16.800 --> 21:26.860] Um, and, uh, so yeah, so, so, so in this case, like, like, if you had, so if you had many users that were all part of the same mom and pop ISP, even though they don't have exactly the same IP address, you might think they're the same person. [21:27.060 --> 21:28.860] But, as is, this is pretty darn good. [21:29.480 --> 21:36.080] Um, so yeah, so if you want to, so, um, so if your account's on here, you're probably going to get a letter from the administrators shortly. [21:37.980 --> 21:38.900] Um, let's see. [21:38.900 --> 21:41.020] So, okay, so with that, so those are the two main exhibits. [21:41.480 --> 21:45.780] Um, now I want to show you the, the, the, the, the new wiki scanner and a new tool called Wikiganda. [21:46.480 --> 21:48.880] Um, so let's do the wiki scanner right now. [21:51.400 --> 21:58.440] So, uh, oh, sorry, so I should say, so both of these tools, uh, they're, they're, they're, they're, they're made, made by some, uh, so some are students of mine at Caltech. [21:59.100 --> 22:00.780] Uh, Daniel Aaron Rich and Rishi Chandi. [22:01.100 --> 22:02.180] Uh, Daniel made this one. [22:02.300 --> 22:03.300] I'm much indebted. [22:03.600 --> 22:07.240] So, uh, two real problems with the wiki scanner, well, there were two major problems. [22:07.440 --> 22:11.860] Uh, the first one was that it was really really annoying to go through a large amount of edits. [22:12.000 --> 22:14.120] So, if you looked at say, uh, Department of Homeland Security. [22:14.320 --> 22:14.980] You want to see all their edits. [22:15.060 --> 22:16.100] There'll be thousands of those things. [22:16.280 --> 22:17.180] And you don't want to go through them all. [22:17.240 --> 22:17.860] It's really annoying. [22:18.480 --> 22:21.460] So, um, so we wanted to automate that process. [22:21.960 --> 22:23.280] So, uh, here's what you can do. [22:23.720 --> 22:25.220] Um, so, uh, the first idea came out. [22:25.320 --> 22:28.180] So, we're doing this using, well, so we're gonna automate the finding of the interesting things. [22:28.400 --> 22:30.880] We're doing this using the trademark database and link distance. [22:31.120 --> 22:40.680] So for example, if Microsoft edits the Zoom page, we will automatically flag this because we know, because from the, uh, trademark database, we have, uh, We know that Zoom is a trademark of Microsoft. [22:41.060 --> 22:44.180] And we can just automatically flag that and say this is interesting. [22:44.680 --> 22:46.460] The other one is that we can use link distance. [22:46.680 --> 22:55.980] So the .NET framework page, even if .NET framework is not a trademark of Microsoft, the .NET framework page links to the Microsoft page on Wikipedia. [22:56.340 --> 23:00.060] And we have a list of all the major corporations and Wikipedia pages. [23:00.400 --> 23:06.080] So anytime a company edits a page that links to their corporate page, then that's probably interesting as well. [23:06.480 --> 23:12.900] Um, and you can just flag all of those and you can have a nice, and a very nice, you know, RSS feed every single day for what's probably salacious on Wikipedia. [23:13.740 --> 23:15.820] Um, so, uh, I'll show you a quick demo here. [23:22.650 --> 23:24.150] Oh, should, should be in here. [23:24.310 --> 23:24.910] What did I do wrong? [23:25.690 --> 23:26.610] They erased it. [23:27.010 --> 23:29.550] Um, well, we'll do D-Bold, it'll be fine. [23:33.500 --> 23:36.340] So, so here's D-Bold, we can see all the little, fun little edits. [23:36.840 --> 23:37.340] Clicky, clicky. [23:39.540 --> 23:47.300] Um, so, and, and, uh, in this case, uh, the, the, the, the scanner automatically detected edits to the page D-Bold, uh, were interesting. [23:47.620 --> 23:51.940] So, um, in this case, the connection's pretty obvious, but we'll, but, but there are other ones. [23:52.060 --> 23:53.420] So we can say, Microsoft, for example. [24:02.070 --> 24:03.490] Oh, that's gonna be a lot. [24:03.790 --> 24:07.470] Um, let's pick just one of these. [24:09.050 --> 24:10.890] This might, this might be, oh, that's not so bad. [24:11.410 --> 24:11.730] Okay. [24:12.530 --> 24:17.030] So, um, so, so, so, so here's, so, uh, this is also including the user names. [24:17.150 --> 24:22.410] So these are all the user names we, we know that are from a Microsoft IP range, uh, that I showed you before. [24:22.790 --> 24:27.290] And these pages here, uh, are pages that link to the Microsoft page. [24:28.370 --> 24:34.010] And, uh, and these, I don't know, hmm, oh, they probably say Elder Scrolls for Microsoft Windows. [24:34.690 --> 24:36.950] Anyway, so, so, so, so, you just click these things and you can see them. [24:37.170 --> 24:39.350] And, uh, and you can quickly inspect and see if, see if, see if they're interesting. [24:40.130 --> 24:45.550] Um, and the, the hope behind this is that, is, is that this, uh, this, it makes it, makes it much faster to find the interesting stuff. [24:45.750 --> 24:47.270] And that's likely, uh, exciting. [24:48.550 --> 24:55.090] Um, and, uh, and I think this tool, um, will probably be publicly released in probably about a week or so. [24:55.250 --> 24:58.010] It needs to be, uh, it can't quite scale quite yet. [24:58.270 --> 25:00.550] Um, but, you know, but this is basically the, the base of the functionality. [25:02.510 --> 25:12.490] Um, yeah, where that will, so, so I should, so, just to be clear, the main, the, the, the main features in the new wiki scanner are, uh, are number one, it's, it's automatic detecting conflict of interest. [25:12.850 --> 25:15.750] And it's using the poor man's check user, uh, as well. [25:15.910 --> 25:17.930] So it, it's also searching the user, the registered edits. [25:18.510 --> 25:20.210] So, this next one here is Wikiganda. [25:20.850 --> 25:24.310] Uh, so, uh, this, this, this one, this one is, is different. [25:24.510 --> 25:29.050] So, I saw this discovery channel thing, like, like, maybe a few months ago. [25:29.250 --> 25:37.030] And it described Wikipedia as like this vast information war zone, where like these entrenched parties, you know, like going at each other, like all the time. [25:37.450 --> 25:43.670] As far as I know, this isn't, as far as I know, this is, this, I mean, as far as I know, this has never actually been shown. [25:44.110 --> 25:46.250] Um, it might, it might be true, but we really don't know. [25:46.490 --> 25:47.590] So I decided it'd be nice to know. [25:47.970 --> 25:49.530] Um, so here's what you do. [25:49.710 --> 25:55.010] So you pick two teams, we pick two real life organizations who probably hate each other. [25:55.570 --> 25:58.170] And you see if their hatred spills over onto Wikipedia. [25:59.550 --> 26:01.330] So, what does pick two teams do real quick? [26:02.010 --> 26:04.190] So, uh, if you want to, you can add more teams, we're gonna add two members. [26:04.410 --> 26:06.610] But, so we can add, say, Microsoft, and we can add Google. [26:08.630 --> 26:09.790] You know, you, you get the idea. [26:10.350 --> 26:11.550] Oh, if you want to, you can add other things. [26:11.650 --> 26:14.770] You can add, like, like, like, you know, you can add MIT or whatever. [26:15.130 --> 26:18.710] Anyway, and you click go, and it shows you the pages that both teams have edited. [26:18.950 --> 26:22.050] And of course, it's, it's, it's, it's red versus blue, because that's just the way the world works. [26:24.010 --> 26:26.830] Um, this might take a while, because these are all really big ranges. [26:27.690 --> 26:31.370] Um, but, um, actually, let's, oh, here we go. [26:31.410 --> 26:32.070] That went faster than I thought. [26:32.430 --> 26:32.850] Oh, that's nice. [26:33.450 --> 26:33.610] Okay. [26:33.970 --> 26:35.030] So, both these people. [26:35.950 --> 26:47.570] Now, um, now, presumably, uh, they're, they're, they're, the Microsoft's and Microsoft versus Google and Yahoo's views on Bollywood and human sexual behavior are, are not a contentious issue. [26:48.430 --> 26:50.630] Um, but these are pages, they both edited. [26:51.190 --> 26:58.170] Um, and the, and the idea is that, that, that you could perhaps see the pages where, where their views conflict, and you could see if they're going at each other consistently. [26:58.630 --> 27:08.870] Um, so, uh, one thing you can do this, if you put, like, all the, all the edits from Iran on, on team, on the red team, and all the edits from Israel on, say, the blue team, uh, you'll see a lot of holocaust stuff. [27:09.210 --> 27:15.110] So, like, so, uh, the, the, the Iranians will keep saying the holocaust is a lie, and the Israelis will say, no, it's not a lie. [27:15.510 --> 27:19.130] Um, so here, we'll just pick one just for, uh, just, I mean, here. [27:19.930 --> 27:20.930] Multimedia Messaging Service. [27:21.050 --> 27:21.690] Why, why not? [27:23.770 --> 27:25.490] So, Microsoft Corp said, [27:28.540 --> 27:33.760] do, do, oh, they just typo. [27:34.300 --> 27:36.280] Well, anyway, you get the idea. [27:36.400 --> 27:38.980] I mean, this is, this is, this is, this is, this is, this is, this is all fresh. [27:39.120 --> 27:42.760] Like, like, like, like, like, like, like this demo has existed for roughly maybe 36 hours. [27:42.980 --> 27:44.360] So, I haven't really gone through it yet. [27:44.760 --> 27:45.960] Um, but you get the idea. [27:45.960 --> 27:51.820] And, and, and, and I, I, I hope this will, this will decidedly answer the question of whether or not there are persistent edit wars happening in Wikipedia. [27:53.280 --> 27:54.020] And it probably will. [27:54.440 --> 27:55.200] So, that'll be nice. [27:55.880 --> 27:56.940] Okay, one last one. [27:57.000 --> 27:59.960] This one's called, oh, um, well, the third tool, that's, that's secret. [28:00.160 --> 28:01.420] Um, you'll know about that in two weeks. [28:01.980 --> 28:03.540] Yeah, just, uh, just stay tuned for that one. [28:04.200 --> 28:05.940] Um, so, yeah, moving on. [28:06.220 --> 28:07.980] Um, so, this third one here is called BeaverScope. [28:09.300 --> 28:11.900] And, uh, with BeaverScope, this is probably the most lighthearted of them. [28:12.200 --> 28:16.200] Now, uh, uh, now, it, it's so, come on, I'm gonna load. [28:16.860 --> 28:17.480] Do, do, do. [28:22.330 --> 28:22.730] Oh. [28:24.230 --> 28:24.830] There we go. [28:25.370 --> 28:25.590] Okay. [28:26.110 --> 28:31.490] So, uh, so, uh, so, uh, so, uh, so the, it, it, so it happens to be very close to the Caltech MIT pranking season. [28:32.210 --> 28:35.810] And, uh, and I figure this is very, uh, um, this is a good time to capitalize on that. [28:36.170 --> 28:41.090] So, about a year ago, oh, sorry, and, and I, I go to Caltech, so, pranking MIT is very important to me. [28:41.810 --> 28:46.770] Um, so, about a year ago, I stumbled across a very impressive list of MIT external IP addresses. [28:47.030 --> 28:48.250] That's really detailed. [28:49.210 --> 28:54.590] Um, so, uh, and as I'm using the wiki watcher, no, okay, that works fine. [28:55.210 --> 29:01.190] As I'm using the wiki watcher, I figured it'd be really nice if you could, uh, show all their edits down to embarrassing detail. [29:01.830 --> 29:08.030] So, here you can see, basically, every single building, sometimes even the individual labs at MIT and what edits they've made. [29:11.230 --> 29:16.030] So, this is one of the, um, oh, well, it'll take a, it'll, it'll, it'll, it'll take a lot of load. [29:16.030 --> 29:18.230] So, so, so, so, so this is the, uh, Matt Wilson lab at MIT. [29:18.610 --> 29:20.130] This is, this is, like, roughly a few rooms. [29:20.910 --> 29:22.290] And you can see all things they edited. [29:22.870 --> 29:26.550] Um, this is, these two aren't particularly salacious, but it shows you, like, you know, the level of detail. [29:26.870 --> 29:28.150] And they get more exciting, though. [29:31.260 --> 29:32.600] So, we have some other ones. [29:33.980 --> 29:39.680] And we can see, and we know someone in building W61 is really into tentacle rape. [29:40.440 --> 29:42.840] Um, and you, and you can see other things like this. [29:42.980 --> 29:45.480] And so, this is meant to be the, the first volley of the pranking season. [29:49.370 --> 29:50.510] Um, yeah. [29:50.710 --> 29:51.130] Oh, sorry. [29:51.230 --> 29:53.910] So, there, there, there, there's one other, one other exhibit that isn't quite done yet. [29:54.370 --> 29:56.750] Um, one, one, one, one of the summer students is working on it. [29:57.070 --> 29:58.890] Uh, it, it, it, it's technically even called Diebold. [29:59.510 --> 30:04.770] Um, this is, uh, it, it, it, it, it checks for Wikipedia vote stacking for, uh, adminship. [30:05.290 --> 30:13.910] So, uh, so, so, so if you're an administrator in Wikipedia, you know, you, you vote to see, it's not quite a vote, but it's something roughly like a vote, uh, for, for who needs to be an administrator. [30:14.430 --> 30:20.210] And, uh, so I know very frequently, uh, user, like, um, users voting is highly correlated. [30:20.430 --> 30:24.010] So, user A always votes the same way as user B, or always against user B. [30:24.150 --> 30:26.910] And with this, you could, you could reveal correlations in users. [30:27.050 --> 30:30.870] And this would, um, this, I expect this will have very high overlap with the, with the sock puppetry. [30:32.610 --> 30:33.710] Um, yeah. [30:33.930 --> 30:34.210] Okay. [30:34.350 --> 30:37.290] So, let's, let's see all the exciting things I had to say, uh, about, about Wikipedia. [30:37.290 --> 30:41.230] If you have any, like, um, yeah, so I want you to talk about that afterward. [30:41.630 --> 30:42.930] But now I'll tell you some more generic things. [30:43.270 --> 30:50.410] So, um, much to my surprise, no, very few people seem to do this intersection between computer security and data mining. [30:50.570 --> 30:51.870] And I don't know why. [30:51.990 --> 30:54.090] Because it's really, really easy. [30:54.850 --> 30:57.470] And, um, and as far as I know, it's largely untapped. [30:57.630 --> 30:59.270] So, I think you all should be doing this. [30:59.590 --> 31:01.030] Because, like, it's, it's so trivial. [31:01.730 --> 31:08.030] Um, so, and roughly the only thing you have to do is, uh, just take any vulnerability someone else has thought of, and you just do it to the whole Internet. [31:08.610 --> 31:09.370] That's about it. [31:09.670 --> 31:11.970] And, like, there's not much creativity involved. [31:12.390 --> 31:13.130] Um, you just, yeah. [31:13.510 --> 31:15.830] So, I'll give you some examples to help, you know, spin. [31:16.990 --> 31:18.650] So, um, here are some nice ones. [31:18.830 --> 31:21.570] So, this is one that, um, that, that Dan Kaminsky did. [31:22.530 --> 31:38.570] Um, and what he did, uh, there was, there was a DNS vulnerability that allowed you to see if someone from, uh, uh, uh, someone in that local network had visited a particular Wikipedia, uh, had visited a particular webpage, or a particular domain, um, based on the timing, [31:38.850 --> 31:41.450] based on the, uh, how quickly the DNS server responds to you. [31:41.950 --> 31:45.010] And he did this for the, uh, Sony BMG rootkit. [31:45.170 --> 31:47.610] So, as you may remember, they distributed, uh, contaminated CDs. [31:47.850 --> 31:49.810] And they accessed a very unusual domain. [31:50.110 --> 31:53.170] So, he had a list of all the name servers in the world, and their location. [31:53.950 --> 32:01.410] And, uh, and he, and he see'd... to see, well, uh, if anyone from that network had accessed the, uh, the, the, the BMG rootkit domain. [32:01.690 --> 32:03.130] And the red dots are where they have. [32:03.870 --> 32:07.590] Um, and you see their lot dot... Well, they're a lot of dot mills on there and lot of stuff like that. [32:07.750 --> 32:09.210] So, you know, that's kinda nice. [32:09.350 --> 32:18.330] And what was especially fantastic is that, is that from this result, he was able, he was able to set, you know, you know, the military industrial complex versus the RAA. [32:18.990 --> 32:26.930] You know, like any, any, any, any single human being who can do And you can bring those two forces into collision is impressive. [32:29.590 --> 32:31.050] And this is kinda neat too. [32:31.350 --> 32:35.870] This isn't quite as data mining, but it's very original. [32:36.230 --> 32:42.610] So what this does is, this basically does some very simple grammar parsing of speeches. [32:42.930 --> 32:44.470] And we'll see one here. [32:44.610 --> 32:46.010] This is from IBM, I think. [32:46.970 --> 32:51.150] So what this does is, this is for Alberto Gonzalez's testimony. [32:52.630 --> 32:55.950] And you see, his most common phrase... [32:56.710 --> 32:59.710] Like, you see, he doesn't recall more than he knows. [33:00.750 --> 33:05.310] Like, actually here, I think if you go to I don't, and we can see how much he knows things. [33:05.550 --> 33:07.710] But anyway, and I'll tell you that's the answer. [33:08.690 --> 33:12.430] And anyway, this is a fantastic analysis, because you never would have guessed this otherwise. [33:12.930 --> 33:17.770] And it's completely damning, because there's no way you can get around it, you know? [33:18.010 --> 33:19.450] It's just like, what you gonna do? [33:19.710 --> 33:21.830] He doesn't recall, know, or think. [33:23.870 --> 33:24.590] I mean... [33:25.490 --> 33:26.210] It's just... [33:26.570 --> 33:28.250] And it's completely quantitative. [33:28.790 --> 33:29.530] It's just... [33:29.530 --> 33:30.050] It's... [33:30.050 --> 33:30.450] It's... [33:30.450 --> 33:30.650] It's... [33:30.650 --> 33:31.290] It's beautiful. [33:31.590 --> 33:31.930] I wish... [33:31.930 --> 33:32.910] I wish I had thought of that. [33:33.750 --> 33:34.430] Anyway, okay. [33:34.670 --> 33:36.510] So I'm gonna do some other things I have thought of, but no one don't... [33:36.510 --> 33:38.090] And I haven't known, but no one should do them. [33:39.010 --> 33:39.370] So... [33:39.370 --> 33:41.590] Someone should make like a WHOIS scanner. [33:41.970 --> 33:44.210] Everyone knows the WHOIS database, and we all know and love it. [33:44.330 --> 33:47.050] But no one's ever exploited this data on a massive scale. [33:47.050 --> 33:48.470] And I have no idea why. [33:49.270 --> 33:49.650] So... [33:49.650 --> 33:52.110] I mean, like for example, it would be fantastic if you could show me... [33:52.110 --> 33:56.090] Just show me every single domain registered to someone with an at Microsoft.com email address. [33:56.250 --> 33:57.890] You'll probably find weird furry stuff. [33:58.630 --> 34:00.470] And I mean, you know, it'll be hilarious. [34:00.730 --> 34:02.050] Or you'll find someone with a Wikipedia dot... [34:03.130 --> 34:04.230] Wikipedia dot org address. [34:04.530 --> 34:06.070] You might discover the diaper admin. [34:07.030 --> 34:07.390] So... [34:07.910 --> 34:09.150] Sorry, that's an inside joke. [34:09.990 --> 34:12.150] Anyway, so someone should do that. [34:12.290 --> 34:13.330] And the data already exists. [34:13.450 --> 34:14.010] You just go get it. [34:15.250 --> 34:17.010] And so here's some other ideas that people should do. [34:17.090 --> 34:17.950] That I don't know why they haven't done yet. [34:18.070 --> 34:19.170] And these are all known vulnerabilities. [34:19.470 --> 34:22.090] So we all know of cases where... [34:23.690 --> 34:24.410] Naughty data... [34:24.410 --> 34:25.150] Well, things... [34:25.590 --> 34:29.330] There are many people who use the robots.txt exclusion to hide things. [34:29.550 --> 34:32.290] Because basically the idea is that if Google can't see it, it doesn't exist. [34:32.770 --> 34:35.290] Well, so why don't you treat robots.txt as... [34:35.290 --> 34:37.050] Instead of don't index this. [34:37.170 --> 34:38.570] Treat it as the good stuff is here. [34:39.190 --> 34:43.830] And you make an index of everything explicitly disallowed by robots.txt. [34:43.990 --> 34:45.870] You could call it too hot for Google. [34:48.510 --> 34:50.170] I mean, and this is just... [34:50.170 --> 34:53.050] And I personally find administrators porn stashes this way. [34:53.270 --> 34:54.090] It's wonderful. [34:54.910 --> 34:56.710] And so someone should do this. [34:57.450 --> 34:59.530] Another one is the dot doc metadata. [34:59.670 --> 35:01.670] We all know about Microsoft doc metadata. [35:01.910 --> 35:02.950] It's been beaten to death. [35:02.950 --> 35:04.050] It's like... [35:04.050 --> 35:05.070] That's so... [35:05.070 --> 35:06.050] 2003 maybe. [35:06.950 --> 35:08.390] But no one's ever... [35:08.390 --> 35:08.950] No one's ever... [35:08.950 --> 35:11.430] Like, wouldn't it be awesome if you just had an index of everything... [35:11.430 --> 35:12.270] Of everything... [35:12.270 --> 35:15.390] Explicitly removed from dot docs from Microsoft.com? [35:15.890 --> 35:16.910] Like, you could say like... [35:16.910 --> 35:17.950] What's everything that's... [35:18.810 --> 35:19.370] Like... [35:19.370 --> 35:19.730] Like... [35:19.730 --> 35:21.590] What's everything so good that... [35:21.590 --> 35:22.110] That... [35:22.110 --> 35:22.830] I couldn't see it... [35:22.830 --> 35:23.890] I couldn't see it. [35:24.830 --> 35:25.390] Um... [35:25.390 --> 35:27.230] And this other one is the uncensorable PDF. [35:27.230 --> 35:29.530] So we've seen cases before where uh... [35:29.530 --> 35:32.210] The government has released PDFs that had black boxes on them. [35:32.310 --> 35:33.530] But you could remove the black boxes. [35:33.810 --> 35:34.090] Uh... [35:34.090 --> 35:35.690] You can actually detect relatively easily... [35:35.690 --> 35:36.030] Well... [35:36.030 --> 35:37.130] So it's a little harder these days. [35:37.290 --> 35:37.590] Because they... [35:37.590 --> 35:39.830] They have a little bit better black boxing technology. [35:40.130 --> 35:42.690] But regardless, there's a whole bunch of... [35:42.690 --> 35:44.250] Of un-black boxable uh... [35:44.830 --> 35:45.490] PDFs out there. [35:45.830 --> 35:46.010] And... [35:46.010 --> 35:46.630] And like... [35:46.630 --> 35:47.570] And you just... [35:47.570 --> 35:49.490] People should just do that across all the entire Internet. [35:49.650 --> 35:49.850] It'd be... [35:49.850 --> 35:50.570] It'd be beautiful. [35:51.270 --> 35:51.710] Um... [35:51.710 --> 35:53.110] I'm gonna give you a demo how easy it is. [35:53.110 --> 35:53.370] So I... [35:53.370 --> 35:54.390] I have some old demos. [35:54.510 --> 35:55.690] From way back in the day. [35:57.130 --> 35:57.390] Do... [35:57.390 --> 35:57.490] Do... [35:58.010 --> 35:58.190] Do... [36:00.290 --> 36:00.890] There we go. [36:04.110 --> 36:04.470] Um... [36:04.470 --> 36:05.110] So... [36:05.110 --> 36:05.270] Uh... [36:05.270 --> 36:05.570] So... [36:05.570 --> 36:05.630] Uh... [36:05.630 --> 36:05.690] So... [36:05.690 --> 36:07.930] These movies here are from Simon. [36:07.970 --> 36:08.590] Here in the front row. [36:08.830 --> 36:09.570] From a long time ago. [36:09.650 --> 36:10.450] I don't know if you remember posting... [36:10.450 --> 36:11.230] Posting to his website. [36:11.570 --> 36:12.390] It was a long time. [36:13.490 --> 36:13.850] Um... [36:13.850 --> 36:14.310] So here we go. [36:14.370 --> 36:15.110] So we're gonna see a video here. [36:15.250 --> 36:17.770] So this is how easy it is to un-black box things. [36:32.250 --> 36:33.770] So yes, it is black boxed. [36:34.450 --> 36:35.130] Good to know. [36:46.780 --> 36:47.340] No, no, no. [36:47.460 --> 36:47.680] There's... [36:47.680 --> 36:48.200] There's... [36:48.200 --> 36:48.320] There's... [36:48.320 --> 36:48.940] Nothing bad yet. [36:49.260 --> 36:49.760] It's uh... [36:49.760 --> 36:50.020] It's coming. [37:14.880 --> 37:16.800] Yes, it really is that easy. [37:18.360 --> 37:20.160] I don't know why people haven't done this yet. [37:20.880 --> 37:22.000] I'll show you another one just for fun. [37:22.460 --> 37:22.700] I'm... [37:22.700 --> 37:23.360] It's pretty much the same thing. [37:25.700 --> 37:26.540] Let's make this a little bigger. [37:26.860 --> 37:27.300] Doo doo doo. [37:28.820 --> 37:29.300] There we go. [37:52.620 --> 37:53.760] I love Illustrator. [37:53.940 --> 37:54.520] It does everything. [37:58.980 --> 37:59.300] Um... [37:59.300 --> 37:59.580] Is it done? [37:59.680 --> 37:59.960] Not quite. [38:00.040 --> 38:00.400] Not quite yet. [38:11.650 --> 38:12.280] And we're done. [38:19.230 --> 38:19.590] Okay. [38:20.150 --> 38:20.450] Um... [38:20.450 --> 38:23.590] So just as you started, these would be on my website. [38:23.790 --> 38:32.730] But in short, these are some links to some really handy things that I always get asked when people like first try and try and do data mining things that they ask, how can I scrape Google easily? [38:32.970 --> 38:35.370] Well, these free data mining tools link will do that. [38:35.590 --> 38:37.310] If you want to see the URL, I'll just show it to you real quick. [38:37.910 --> 38:38.230] Um... [38:38.230 --> 38:38.890] Oh, and this is for... [38:38.890 --> 38:41.390] This gate thing is for doing advanced text parsing. [38:41.530 --> 38:44.990] So if you want to get like grammar sentences like that out, this is a good library to do that. [38:45.590 --> 38:45.730] Um... [38:45.730 --> 38:46.390] But I'll show you this. [38:46.710 --> 38:47.030] Oh... [38:47.030 --> 38:48.030] Can it pop up at me? [38:48.490 --> 38:49.050] No, well... [38:49.050 --> 38:49.950] I'll show it to you in the URL box. [38:50.970 --> 38:51.290] Um... [38:51.290 --> 38:53.370] And people always ask me how you can approximate text matching. [38:53.550 --> 38:56.170] There's a really wonderful Python function that just does this. [38:56.730 --> 38:57.050] Um... [38:57.450 --> 38:57.770] It's... [38:57.770 --> 38:58.410] So here we go. [38:58.490 --> 38:59.250] So here's the URL here. [38:59.850 --> 39:00.170] Um... [39:00.170 --> 39:00.450] This is... [39:00.450 --> 39:01.910] This is really like a fantastic... [39:01.910 --> 39:05.310] I think if you just search for a digital methods initiative, you'll... [39:05.310 --> 39:06.790] You'll probably get this as first hit. [39:07.670 --> 39:08.030] Um... [39:08.030 --> 39:08.930] But anyway, so like... [39:08.930 --> 39:09.670] This is just a... [39:09.670 --> 39:12.110] A lot of really nice tools that you can build on top of. [39:12.250 --> 39:13.390] So that way you don't have to do as much work. [39:13.570 --> 39:14.850] And no one likes work. [39:15.950 --> 39:16.310] Um... [39:16.310 --> 39:16.930] And here's the... [39:16.930 --> 39:18.250] Here's the text similarity library. [39:18.790 --> 39:18.930] Um... [39:18.930 --> 39:19.250] So you... [39:19.250 --> 39:19.590] It's... [39:19.590 --> 39:20.950] It's nothing you couldn't Google. [39:22.670 --> 39:23.030] Um... [39:23.030 --> 39:23.350] So yeah. [39:23.590 --> 39:24.470] So that's what I wanted to say. [39:24.650 --> 39:26.230] These are the people that helped in contributing to the talk. [39:26.390 --> 39:27.950] The three students up there are my... [39:27.950 --> 39:28.670] Are my summer students. [39:29.250 --> 39:30.770] That's Mani Chaney, professor at Caltech. [39:30.910 --> 39:32.770] Dorova, she's a Wikipedia admin who... [39:32.770 --> 39:33.990] Who gave me a lot of these evil ideas. [39:33.990 --> 39:35.130] And uh... [39:35.130 --> 39:36.050] These other people, uh... [39:36.050 --> 39:37.050] They helped along the way. [39:37.610 --> 39:38.330] So, um... [39:38.330 --> 39:38.590] Thank you. [39:51.100 --> 39:51.580] Questions? [39:58.630 --> 39:59.690] Well, alright then. [40:00.210 --> 40:01.070] Oh, we have one? [40:04.850 --> 40:05.330] Okay. [40:05.790 --> 40:07.790] Well, can you um... [40:07.790 --> 40:08.510] Okay. [40:08.650 --> 40:08.790] Sorry. [40:09.070 --> 40:09.270] Alright. [40:09.510 --> 40:12.110] So, what do you think of the possibilities for using... [40:12.110 --> 40:14.190] Is the wiki, uh... [40:14.190 --> 40:19.130] Watching tools improve using this to frame people through Trojans, and open wireless at various companies? [40:19.450 --> 40:27.190] Wouldn't it be great to go to Microsoft, and vandalize all the Linux articles, so that then the press could then report on Microsoft, uh... [40:28.110 --> 40:29.150] Going out and doing these things? [40:29.310 --> 40:30.650] So, what do you think of those opportunities? [40:30.710 --> 40:31.370] Well, this could happen. [40:31.450 --> 40:32.510] This could happen any other way. [40:32.570 --> 40:36.790] I mean, you might as well say, what if someone chose Microsoft and made them, like, DOS random people? [40:36.930 --> 40:38.170] I mean, that would be just... [40:38.170 --> 40:38.510] That would be... [40:38.510 --> 40:40.790] That would be much worse than vandalizing Wikipedia page. [40:41.010 --> 40:43.410] So, I mean, I don't see if there's anything uniquely bad. [40:43.410 --> 40:50.070] Indeed, but the press seems to misunderstand the connection that an IP to an action doesn't necessarily mean accountability. [40:50.770 --> 40:51.670] No, that's fair. [40:51.810 --> 40:52.630] I mean, so like, uh... [40:52.630 --> 40:54.630] So, I mean, you could always say that, um... [40:54.630 --> 40:57.850] I mean, the company would say, oh, we had an open wireless, or something like that. [40:58.010 --> 40:59.630] I mean, you know, but, um... [40:59.630 --> 41:00.870] I mean, probably not. [41:01.150 --> 41:02.750] Most of these cases, that would not be true. [41:03.810 --> 41:05.530] If it is, well, you know, nothing personal. [41:06.390 --> 41:17.610] So, so slight nitpick, but as far as, um, the sock puppet, uh, issue, uh, how are... are you doing any analysis for removing, uh, large, uh, like, super large NAT blocks? [41:17.790 --> 41:20.710] Like, so I know for a fact that there are, you know, we... [41:20.710 --> 41:26.470] that in the wild we've seen literally hundreds of thousands of users behind single NATs, usually out of country. [41:26.830 --> 41:27.070] Right. [41:27.230 --> 41:29.230] But, um, do you do any analysis for that? [41:29.330 --> 41:32.050] Because it, you know, it'd be sort of damning if you didn't, right? [41:32.130 --> 41:32.210] Right. [41:32.470 --> 41:37.210] If you didn't have a whole bunch of users with the same IP address, like, more than 10 maybe that you start to... [41:37.210 --> 41:38.170] The, the, the, the... [41:38.170 --> 41:40.150] In the display I showed you, the answer is no. [41:40.610 --> 41:44.290] Uh, but, uh, but, uh, there, um, but the analysis is coming. [41:44.510 --> 41:45.950] And that, that's why it wasn't pretty and colorful. [41:46.110 --> 41:47.270] Because that one's not going to be public yet. [41:47.490 --> 41:49.430] So, you just get a, you just get a special treat. [41:51.210 --> 41:54.010] Um, but yeah, no, no, I agree. [41:54.170 --> 41:57.230] I mean, so, like, so, like, all AOL comes from, like, only a few IP addresses. [41:57.590 --> 41:59.570] And surely not all AOL users are one person. [41:59.830 --> 42:00.170] So. [42:01.050 --> 42:08.190] Have you considered then putting a spider across your own output to do the, sort of, auto press release generation style? [42:09.590 --> 42:11.550] Sorry, I, so, I don't quite understand? [42:12.510 --> 42:21.310] Basically merge your output of your individual tools to do the auto detection of probably salacious material and just generate automatic press releases. [42:21.530 --> 42:22.230] Oh, that'd be good too. [42:22.350 --> 42:23.170] That'd be really nice. [42:23.370 --> 42:26.370] Yeah, you, you, you could do, um, I like that. [42:26.570 --> 42:29.270] Yeah, you could, you, you, you, you could have a very healthy blog doing that. [42:31.370 --> 42:36.190] Hi, how can the people in this room help you be the first Google match for Virgil? [42:36.470 --> 42:37.950] Oh, you can link to me. [42:38.230 --> 42:41.670] Yes, you can link to my website, Virgil.gr, with the anchor Virgil. [42:41.830 --> 42:46.030] This is like, like, I'm currently number three on Google for the, for the query Virgil. [42:46.450 --> 42:47.790] I know, it's terrible. [42:48.130 --> 42:49.310] There's this Roman poet guy. [42:49.470 --> 42:52.170] I've never, I don't know what he, I don't know what his deal is. [42:52.330 --> 42:53.450] He's been dead for years. [42:53.950 --> 42:55.470] I mean, what does he get off? [42:56.370 --> 43:00.190] Anyway, so if you could, so that would, that would, that would be really sweet if you could do that. [43:01.130 --> 43:02.390] What hardware do you use? [43:03.170 --> 43:03.670] What, hardware? [43:04.010 --> 43:05.370] Yeah, to do the data mining. [43:05.670 --> 43:07.250] Oh, just, um, I don't know. [43:07.430 --> 43:11.590] Well, see, well, for this particular one, I used an, an, an AMD 64 box at Stanford. [43:12.310 --> 43:16.610] Um, but whatever, I mean, you know, I, I, I just use SQL, Linux, nothing fancy. [43:17.110 --> 43:20.530] I mean, I, I, I, I, I, everything, I mean, I do everything in Python and MySQL. [43:21.210 --> 43:23.670] That, in Linux, that's, that's all, that's all there is to it. [43:24.530 --> 43:25.190] I mean, I don't know. [43:25.490 --> 43:25.810] Sorry. [43:26.090 --> 43:29.110] It's not a, I'm a simple person. [43:30.090 --> 43:30.390] Hi. [43:30.790 --> 43:30.890] Hi. [43:31.290 --> 43:32.190] Ditch day is tomorrow. [43:32.450 --> 43:33.350] So you all know. [43:33.730 --> 43:40.970] Um, and then secondly, um, with the database that you have of, um, corporations and their trademarks, how did you develop that or where do you acquire that? [43:41.570 --> 43:45.590] Um, well, you can download it from, from, from the USPTO.gov, but they eventually block you. [43:45.990 --> 43:47.930] So, um, so I initially was going to do that. [43:48.250 --> 43:50.250] Well, I was, so I, so we, we ended up getting most of it. [43:50.250 --> 43:53.150] And, and if you use Tor, you can get around the block pretty easily. [43:53.530 --> 43:56.130] Um, I said this way you can buy it, but I couldn't find a way to buy it either. [43:56.690 --> 44:01.610] Um, but in, in short, the, um, well, in short, okay, you can, you can scrape it live and that works. [44:02.050 --> 44:05.090] Um, and then that's the best thing I know to do right now. [44:05.430 --> 44:13.810] It, it turned out that, that, that, the, the link distant, the, the, the, the, the, inwards links measure, the, uh, was, would try to be much more useful than the trademark database. [44:14.050 --> 44:15.670] Which is really nice because it's a lot more elegant too. [44:16.710 --> 44:29.350] So, uh, a few years ago in the SE 2600 list, someone was able to out an anonymous poster by profiling, uh, everyone who had ever posted a message to the list and what typos they frequently have and what sort of word selections they often have. [44:29.470 --> 44:35.930] And so, it would be interesting to do an analysis like that on the Wikipedia database, particularly for people who have a lot of content that they've edited. [44:36.150 --> 44:39.370] You might be able to see patterns in terms of their word selection and the like. [44:39.370 --> 44:44.070] And that's another way you might be able to identify sock puppets even if they're doing something smart with regard to their IPs. [44:44.170 --> 44:47.050] There actually have been cases where sock puppets have been caught like that. [44:47.250 --> 44:50.130] But, I'm not smart enough to know how to automate that. [44:51.010 --> 44:53.310] So, if, if you know, I'll, I'll, I'll, I'll write it up. [44:53.970 --> 44:55.410] But, um, but yeah. [44:55.590 --> 45:00.150] I mean, I suspect they're actually probably, I think you had a linguist or a typing ergonomic specialist. [45:00.310 --> 45:01.710] They might even know how to, know how to do that. [45:01.790 --> 45:08.170] I think there are some neat technical problems in, in making it work in, in the, in the Wikipedia context where there's a lot of data and a lot of... [45:08.170 --> 45:08.710] Yeah, yeah. [45:09.090 --> 45:11.030] No, I mean, so the answer, I agree with you completely. [45:11.210 --> 45:11.730] This has been done. [45:11.890 --> 45:13.410] But, I personally don't know how to do that. [45:13.610 --> 45:14.390] Off the top of my head. [45:20.250 --> 45:22.910] Well, um, well, I had a good time. [45:23.130 --> 45:24.190] So, I hope you all did too. [45:32.840 --> 45:38.060] Alright, coming up in a few minutes, Advanced Memory Forensics releasing the Cold Boot Utilities. [45:47.270 --> 45:51.770] The cash is just like the clothes I worn yesterday. [45:52.950 --> 45:54.270] You're broke. [45:55.530 --> 45:57.850] I gotta get my ass out. [45:58.610 --> 46:01.110] I went to see you on my right. [46:01.310 --> 46:02.450] I was talking about...