This guy wants to make Calibre assist in illegal distribution of ebooks

[Terisa de morgan]

Originally Posted by Sarmat89

It allows third-party code to manipulate the book files, in such a manner that code can access outside resources and hack other programs, such as ADE.

Through that rule of thumb, python interpreter itself allows third-party code to do that (you don't need calibre for hacking other programs like ADE).

[kovidgoyal]

Originally Posted by Sarmat89

It allows third-party code to manipulate the book files, in such a manner that code can access outside resources and hack other programs, such as ADE.

Seriously?

A computer allows third party code to manipulate all files that exist on it in any manner it sees fit.

An operating system allows third party code to manipulate files in any manner it sees fit.

A programming language interpreter/compiler allows third party code to manipulate files in any manner it sees fit.

And on and on and on.

Surely this tired old trope was exhausted with the decades ago failed attempt to get Xerox copiers banned because they could be used to circumvent copyright. I am amazed there are still people that trot it out.

[sealbeater]

Originally Posted by theducks

The root cause is someone opening a pinhole in their router without taking additional steps to protect their networks resources. NEGLIGENCE

What makes you think it's not a deliberate choice?

[sealbeater]

Originally Posted by darryl

I suspect this program may breach the criminal law in at least some jurisdictions. The tool is designed to facilitate access to other people's computer systems without their knowledge or permission.

Better ban Google.

Originally Posted by darryl

It is of course a huge potential risk to have the content server available on the web with no authentication. Removing DRM from a book removes the encryption. It does not remove other identifying details if any. So if a book you purchased ends up on a pirate site and has identifying details no prizes for guessing who the rights-holders will be seeking to hold responsible.

Just out of curiosity, what sort of identifying details would be present in an ebook?

[sealbeater]

Originally Posted by BetterRed

The penalties act as a deterrent.

I hate to break it to you but they really don't.

Originally Posted by BetterRed

Sites at risk usually have pages on their site for lodgement of DCMA notices. Providing they take prompt action to remove the file, or if its on another host remove the link, the matter is closed, but if they don't then the IPR owner can report it to the FBI. No one wants the FBI or similar knocking on their doors.

BR

We aren't talking about websites with domain names registered to a person. We are talking about dynamic ips with listening ports. Nobody is lodging a DMCA request on a cable modem running Calibre.

[sealbeater]

Originally Posted by kovidgoyal

Sigh. Why would anyone think doing this kind of thing would be good for their reputation? Unless they are seeking employment with criminal gangs?

Honestly, it sounds like he's a security geek with the mention of SHODAN. Lots of places wouldn't bat an eye at that. He's actually covered a lot of the bases for an interview.

[darryl]

@Sarmat89. I won't say what I would like to say, firstly because I don't want to be banned, and secondly because your reasoning is truly so bad it needs no rebuttal (though some posters have taken the trouble to do so). I'm not going to lie. A lot of people read your ridiculous statement, and you should be truly embarrassed about it.

@sealbeater. There is a real difference between a general search engine and a specialised tool with its only use being finding exposed calibre libraries. As to identifying information in an ebook, I simply don't know. Some purchased ebooks go as far as showing the name and email address of the purchaser on each page. Of more concern to those wanting to pirate books is actual protection schemes which embed identifying information in hidden form within the book. Or which identify each book with some unique combination of different words, sentences etc. The point is that it is impossible to be sure that there is no such scheme in operation. In fact, there are such schemes which are known, and, of course, because they are known there are removal tools available for them. Which still leaves the unknown ones, changes to the existing ones and use of multiple schemes.

[Thasaidon]

Originally Posted by darryl

@Sarmat89. I won't say what I would like to say, firstly because I don't want to be banned, and secondly because your reasoning is truly so bad it needs no rebuttal (though some posters have taken the trouble to do so). I'm not going to lie. A lot of people read your ridiculous statement, and you should be truly embarrassed about it.

When others speak/contribute to the forums and realise afterwards they have said something a bit silly , at least they can console themselves with the thought that it was not as bad as Sarmat89's contribution.

[Adoby]

Originally Posted by kovidgoyal

There is no way to reliably know what "outside the local LAN" is. All the server knows is what IP address is connecting to it, it has no way to know if the IP address belongs to a trusted network or the public internet.

But calibre could check if the IP is on the local network. Or if it is going through a router.

[Adoby]

Originally Posted by BetterRed

@Adoby - I wonder how many of them are version 2 servers.

BR

I took a small sample. Around 1/3 are version 2. Most are version 3. I didn't access them to check if unprotected were uniformly distributed. Just checked published version numbers...

[kovidgoyal]

Originally Posted by Adoby

But calibre could check if the IP is on the local network. Or if it is going through a router.

How? There is no such thing as a local network in IP networking. All networks are local or all networks are global. What about if a small institution decides to run a calibre server to serve books to its local network? How is the server to know which subnets are within that network and which outside?

[Adoby]

One method could be to check if a private IP network range is used and if traffic is from outside this private network. And then refuse connection if user name / password is not used. Like in a LAN with a DHCP-server and gateway.

That would cover, I suspect, 98% of the currently wide open calibre libraries.

[kovidgoyal]

And it would also lead to false positives a plenty.

[theducks]

Originally Posted by Sarmat89

It allows third-party code to manipulate the book files, in such a manner that code can access outside resources and hack other programs, such as ADE.

The same way Home Depot sell burglary tools.
Crowbars, drills and hammers are used to break into things.

Dell and HP make hacking tools.
A T&T drove the getaway network

You must be a Lawyer making a Volcano out of a pilot light

[theducks]

Originally Posted by sealbeater

What makes you think it's not a deliberate choice?

because: of the basic 'locked door' test used for burglary / unauthorized access.

If the door is left OPEN, it is just trespassing. at the worst (assumes no other activities after entry)

If you Force your way past a locked door, it is B & E