One clever MySpace user looking to expand his buddy list recently figured out how to force others to become his friend, and ended up creating the first self-propagating cross-site scripting (XSS) worm. In less than 24 hours, "Samy" had amassed over 1 million friends on the popular online community.

MySpace has gotten hit with the first XSS worm to target social networking sites. Here is some analysis from Acidus:

Basically the worm was XSS embedded in someone’s profile on MySpace. When someone would view the profile, they would execute the Javascript in their own browser. The payload of the XSS was Ajax which would make GET and POST requests to MySpace, adding the XSS Payload to that user’s profile. This spreads the worm!

As with most worms using a new attack vector, this was harmless, adding the message “samy is my hero” to each infected profile along with the XSS payload.

Acidus has also posted the source code of the XSS Payload, and says he plans to post a more detailed analysis later.

BetaNews | Cross-Site Scripting Worm Hits MySpace

I am sorry to inform all interested parties that Red Rose Stories is a DEAD site.

The FBI has suceeded in closing me down.

I am being charged with 'OBSCENITIES' and face charges for having posted fantasy stories.

They are trying to say fantasy stories are illegal.

The men in black (FBI) took ALL of my computer equipment, and many of my diskettes,
and have access to ALL my files and site information. They came when I was NOT home and seized my belongings, I had no choice, and no recourse.

BoingBoing seems to be providing coverage of a number of cases. My understanding is that the stories on this site were, ehm, perhaps a bit over the top. Certainly not the sort of writing one would recommend in polite company, or even, perhaps, in impolite company.

Nevertheless, they are just stories. They aren't pictures. They aren't movies. They are written stories. They are someone's thoughts. If it can be a crime to publish these stories then the only appropriate name for that sort of crime is thoughtcrime. This person's house has been raided for sharing inappropriate thoughts.

The owner of NowThatsFuckedUp is also feeling the heat and has been charged with 300 misdemeanors and one felony. He's in jail on more than $150K bail. The site is basically a discussion board where people are encouraged to post links to pictures and video of amateur porn. In this situation, the web site administrator was encouraging people to send pictures from Iraq in exchange for free access to paid sections of the site.

Ask your Republican friends who claim to advocate a strict constructionalist jurisprudence to explain how this is consistent with a literal reading of the first amendment.

The Bush Administration's porn war has begun

The United States and Europe clashed here Thursday in one of their sharpest public disagreements in months, after European Union negotiators proposed stripping the Americans of their effective control of the Internet.

These people are silly. Threatening to leave the DNS system just because you don't think you have enough influence? What do you want them to do differently? Have you made reasonable proposals that have been ignored? Don't you realize that if you can leave the DNS system so can I, and so your influence cannot be coercive?

It is inevitable that the DNS system is going to fragment... I'm all for it. We ought to start talking about what kinds of tools we need to support multiple roots on one computer, and put an end to this government puffery as well as vile sitefinder once and for all.

No doubt, the naming situation is going to get more complex. I think we are going to see innovation that stretches beyond the DNS system as it is today. Think AOL keywords. Google Names?

But will it be better? It will probably get worse before it gets better...

EU Tries to Unblock Internet Impasse

Usually dolphins were controlled via signals transmitted through a neck harness. 'The question is, were these dolphins made secure before Katrina struck?' said Sheridan.

This is really interesting, but one suspects wildly inaccurate. Dolphins that are trained to shoot people? Really? Even if its true I find it hard to believe that the Navy would have left them armed as the storm approached. They tend to have fairly careful security proceedures.

The news this past week has been unusually surreal. Between attack dolphins and weather machines, its getting a little hard to take anything seriously. Ok, so I wasn't taking the weather machine thing seriously. Maybe I took the SuicideGirls thing a little two seriously... But in the face of killer dolphins, I think I have some leeway to work with. I love these moments in time when everything sounds a little closer to fiction then reality. Somewhere between weather machines and killer dolphins, I hope to find the balance.

Update: The Navy denies trailing dolphins to attack humans or deliver bombs to ships. That means no suicide bomber dolphins.

The Observer | Armed and dangerous - Flipper the firing dolphin let loose by Katrina

Wired has an article covering DragonCon.

This was a great year. I'd venture a guess that 80% of the time I had a smile plastered across my face. Everyone involved with running the convention did an amazing job. Everyone there was having a wonderful time. Everything I can think of to say about how things went this year does not do it justice.

Conventions such as these are uniquely beautiful events. A group of people comes together to share in some esoteric common purpose or goal. Time passes. At its end, the group ceases to exist and becomes a historical curiosity. In the case of a strong group, it develops a sort of ideology that lives on in the absence of the group's cohesion, allowing it to effortlessly rise from the dead in its next phase. It takes on a life of its own. A living thing that breathes art in and culture out.

In general, I highly enjoy people watching. I'm one of those folks that likes to be extremely attune to my surroundings. At a convention like DragonCon, I find this trait to reap great rewards. In every direction, there is some type of madness to take in. People in amazing costumes are everywhere. Cute girls are everywhere. Everyone is friendly. Conversations lite up like gas fires and everyone fire walks. Its impossible to be bored, the only risk is fatigue. There is no way to leave without feeling slightly sad.

Elonka Dunin, a game designer at Simutronics, invited fans to demo the company's latest MMORPG, Hero's Journey, in her hotel room. A monster-fighting quest set in a lush, expansive fantasy world of vulnerable villages and devious conspiracies, the game is perfectly targeted for the DragonCon crowd. "This isn't just hack-and-slash," Dunin said as she set up her avatar to cast a spell. "There are creative ways to deal with combat, and a lot of chances to create stories for your characters."

Elonka is clearly our most famous MemeStreams user. Not only is her page among the most often hit here, but she is always popping up in the news. In addition to getting a demo of Hero's Journey, which I found to be extremely impressive, I attended her Kryptos talk. (again) I found it inspiring. (again) Next time she gives it I'll attend (again), and I'll keep doing it until she breaks the damn 4th part of the code. Hear that Elonka?! Quit playing those video games and hack the CIA's cafeteria courtyard! I'm going to keep "encouraging" you... :)

On other panels, such as "Hacking 101," science fiction was set aside in favor of science fact. Learning Perl author Randal Schwartz talked about being arrested at Intel in the mid-1990s for using the software tool Crack to check the security of his company's password files. "I worry that we're going to see other frivolous convictions like mine in the world of peer-to-peer," he said.

The Hacking 101 talk made Wired's review! Nice. I guess we did something right. I didn't think Hacking 101 went as well as it has in the past, but Hacking 201 went great. And for the first time I've ever been involved with it, Hacking 301 actually had content about hacking. As opposed to several of us sitting on a panel talking about how tired we all are. I was in a really crappy mood at the time, as I had not gotten any sleep that night. I hope no one though I was too much of an asshole.. Randal gets the story's quote, which is fine with me. There is a rumor being pushed around that he has been given an invite to The Conspiracy...

JonnyX's Space and Technology track of programming was amazing this year. DragonCon should give him a bigger room next year.

Dragon*Con Review

I've been moving and dumping 55 gallon drums all day. It's back breaking work, but it's a good thing I've got a strong back. I haven't fooled with that much diesel since I was on shit-burning detail in the first Gulf War. I used to volunteer for it because it meant I could skip morning formation. Never been much of a garrison soldier. I was always a field soldier.

So here at Outpost Crystal, we're set pretty good. Thanks for the heads up on the 12-15 feet of water that you guys are telling me I can expect in the CBD tomorrow. That's fine, I'm trained for water operations too. I appreciate all the recommendations, but we're not going.

Exmilitary guy who runs a datacenter in a tower in NOLA is still there and his systems are operational! He has a Livejournal and several cam feeds running. In a way I think all this effort and risk to keep some computers running is a bit silly. On the otherhand, this is absolutely the most hard core systems administration that I have ever heard of.

The Interdictor: Admining in Hell

John Hall, a spokesman for the Army Corps of Engineers, said last night that the corps and other agencies were "in a great frenzy" to figure out how to plug the 300-foot gap along the 17th Street Canal.The narrow canal, which is used to drain water pumped out of the eternally soggy city, is not accessible by barge, in part because a newly built low bridge and hurricane barrier sits 700 feet down the canal toward the lake end. "We can't get at it," Mr. Hall said.

Engineering challenges... is putting it lightly. Its going to be a hard week in the Big Easy.

I must admit that the full impact of this storm was not clear to me until I saw the TV last night, even though I expected it to be bad.

For years I have made the joke that I'd like to see New Orleans before its completely destroyed. Today, I'm feeling bad about making that joke. And its not because I still have not spent any time down in New Orleans.

The sheer human tragedy present on everyone TV screens today is heartbreaking. What's worse, is we saw this coming. The failures present here were all preventable at multiple stages. It starts with the fact that its not a good idea to build a city below sea level, and it ends with evacuation plans that were clearly not mature enough to deal with the reality everyone knew was coming.

The big question: What do we rebuild? And what do we abandon?

Geography Complicates Levee Repair - New York Times

The schedule for the D*C space and science track, headed up by our own jonnyx, is available for your perusal.

You'll also find at least 4 MemeStreams regulars presenting both here and in the Electronic Frontiers Forum. The schedule does not appear to be updated yet, but Decius and I are confirmed to be speaking at the Hacking 101, 201, and 301 panels.

Dragon*Con Space and Science Track Schedule

Because of the A-list names--such as Google co-founder Larry Page and Technorati founder Dave Sifry--and the level of discourse involved, the trip, known as Foo Camp (for Friends of O'Reilly), has become one of the must-get invites among the geek set.

But when the event convenes again this weekend near the Sebastopol, Calif., offices of O'Reilly & Associates, O'Reilly's publishing company, a number of people who have attended previously or who would like to be on hand won't have gotten invitations.

That's why some of them have gotten together to organize what they're calling Bar Camp and referring to as an open-source alternative to Foo Camp. Bar Camp is a play on the word "foobar," a common programming variable.

FooCamp has fallen prey to the Outerz0ne phenomenon. Here is the wiki.

Geeks to hold anti-foocamp

Aug. 16 - Last year a Chinese mathematician, Xiaoyun Wang, shook up the insular world of code breakers by exposing a new vulnerability in a crucial American standard for data encryption. On Monday, she was scheduled to explain her discovery in a keynote address to an international group of researchers meeting in California.

But a stand-in had to take her place, because she was not able to enter the country. Indeed, only one of nine Chinese researchers who sought to enter the country for the conference received a visa in time to attend.

"It's not a question of them stealing our jobs," said Stuart Haber, a Hewlett-Packard computer security expert who is program chairman for the meeting, Crypto 2005, being held this week in Santa Barbara. "We need to learn from them, but we are shooting ourselves in the foot."

A policy designed to protect national security by preventing technology transfer from the US to China has actually hurt national security by preventing technology transfer from China to the US. If you know someone at State tell them to read this article. This matter is very serious and they should have made an exception in this case and gotten the visas in time.

Chinese Cryptologists Get Invitations to a US Conference, but No Visas