Newer posts are loading.
You are at the newest post.
Click here to check if anything new just came in.

December 03 2014


January 26 2014


September 16 2013


PRISM-Proof Security Considerations

(Copy-paste of the all document.)

Internet Engineering Task Force (IETF)              Phillip Hallam-Baker
Internet-Draft                                         Comodo Group Inc.
Intended Status: Standards Track                      September 11, 2013
Expires: March 15, 2014

                 PRISM-Proof Security Considerations


  PRISM is reputed to be a classified US government that involves
  covert interception of a substantial proportion of global Internet
  traffic. This document describe the security concerns such a program
  raises for Internet users and security controls that may be employed
  to mitigate the risk of pervasive intercept capabilities regardless
  of source.

Status of This Memo

  This Internet-Draft is submitted in full conformance with the
  provisions of BCP 78 and BCP 79.

  Internet-Drafts are working documents of the Internet Engineering
  Task Force (IETF).  Note that other groups may also distribute
  working documents as Internet-Drafts.  The list of current Internet-
  Drafts is at

  Internet-Drafts are draft documents valid for a maximum of six months
  and may be updated, replaced, or obsoleted by other documents at any
  time.  It is inappropriate to use Internet-Drafts as reference
  material or to cite them other than as "work in progress."

Copyright Notice

  Copyright (c) 2013 IETF Trust and the persons identified as the
  document authors.  All rights reserved.

  This document is subject to BCP 78 and the IETF Trust's Legal
  Provisions Relating to IETF Documents
  ( in effect on the date of
  publication of this document. Please review these documents
  carefully, as they describe your rights and restrictions with respect
  to this document. Code Components extracted from this document must
  include Simplified BSD License text as described in Section 4.e of
  the Trust Legal Provisions and are provided without warranty as
  described in the Simplified BSD License.

Hallam-Baker                 March 15, 2014                     [Page 1]

*Internet-Draft          Writing I-Ds using HTML           September 2013

Table of Contents

  1.  Requirements . . . . . . . . . . . . . . . . . . . . . . . . .  3
  2.  Attack Degree  . . . . . . . . . . . . . . . . . . . . . . . .  3
     2.1.  Content Disclosure  . . . . . . . . . . . . . . . . . . .  3
     2.2.  Meta Data Analysis  . . . . . . . . . . . . . . . . . . .  4
     2.3.  Traffic Analysis  . . . . . . . . . . . . . . . . . . . .  4
     2.4.  Denial of Service . . . . . . . . . . . . . . . . . . . .  4
     2.5.  Protocol Exploit  . . . . . . . . . . . . . . . . . . . .  5
  3.  Attacker Capabilities  . . . . . . . . . . . . . . . . . . . .  5
     3.1.  Passive Observation . . . . . . . . . . . . . . . . . . .  5
     3.2.  Active Modification . . . . . . . . . . . . . . . . . . .  5
     3.3.  Cryptanalysis . . . . . . . . . . . . . . . . . . . . . .  6
     3.4.  Kleptography  . . . . . . . . . . . . . . . . . . . . . .  6
        3.4.1.  Covert Channels in RSA . . . . . . . . . . . . . . .  6
        3.4.2.  Covert Channels in TLS, S/MIME, IPSEC  . . . . . . .  6
        3.4.3.  Covert Channels in Symmetric Ciphers . . . . . . . .  7
        3.4.4.  Covert Channels in ECC Curves  . . . . . . . . . . .  7
        3.4.5.  Unusable Cryptography  . . . . . . . . . . . . . . .  7
     3.5.  Lawful Intercept  . . . . . . . . . . . . . . . . . . . .  7
     3.6.  Subversion or Coercion of Intermediaries  . . . . . . . .  7
        3.6.1.  Physical Plant . . . . . . . . . . . . . . . . . . .  8
        3.6.2.  Internet Service Providers . . . . . . . . . . . . .  8
        3.6.3.  Router . . . . . . . . . . . . . . . . . . . . . . .  8
        3.6.4.  End Point  . . . . . . . . . . . . . . . . . . . . .  8
        3.6.5.  Cryptographic Hardware Providers . . . . . . . . . .  8
        3.6.6.  Certificate Authorities  . . . . . . . . . . . . . .  8
        3.6.7.  Standards Organizations  . . . . . . . . . . . . . .  9
  4.  Controls . . . . . . . . . . . . . . . . . . . . . . . . . . .  9
     4.1.  Confidentiality . . . . . . . . . . . . . . . . . . . . .  9
        4.1.1.  Perfect Forward Secrecy  . . . . . . . . . . . . . . 10
     4.2.  Policy, Audit and Transparency  . . . . . . . . . . . . . 10
        4.2.1.  Policy   . . . . . . . . . . . . . . . . . . . . . . 10
        4.2.2.  Audit  . . . . . . . . . . . . . . . . . . . . . . . 10
        4.2.3.  Transparency . . . . . . . . . . . . . . . . . . . . 10
  Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 11

Hallam-Baker                 March 15, 2014                     [Page 2]

*Internet-Draft          Writing I-Ds using HTML           September 2013

1. Requirements

  PRISM is reputed to be a classified US government that involves
  covert interception of a substantial proportion of global Internet
  traffic. While the precise capabilities of PRISM are unknown the
  program is believed to involve traffic and meta-data analysis and
  that the intercepts are obtained with the assistance of
  intermediaries trusted by Internet end users. Such intermediaries may
  or may not include ISPs, backbone providers, hosted email providers
  or Certificate Authorities.

  Government intercept capabilities pose a security risk to Internet
  users even when performed by a friendly government. While use of the
  intercept capability may be intended to be restricted to counter-
  terrorism and protecting national security, there is a long and
  abundant history of such capabilities being abused. Furthermore an
  agency that has been penetrated by an Internet privacy activist
  seeking to expose the existence of such programs may be fairly
  considered likely to be penetrated by hostile governments.

  The term 'PRISM-Proof' is used in this series of documents to
  describe a communications architecture that is designed to resist or
  prevent all forms of covert intercept capability. The concerns to be
  addressed are not restricted to the specific capabilities known or
  suspected of being supported by PRISM or the NSA or even the US
  government and its allies.

2. Attack Degree

  Some forms of attack are much harder to protect against than others
  and providing protection against some forms of attack may make
  another form of attack easier.

  The degrees of attack that are of concern depend on the security
  concerns of the parties communicating.

2.1. Content Disclosure

  Content disclosure is disclosure of the message content. In the case
  of an email message disclosure of the subject line or any part of the
  message body.

  The IETF has a long history of working on technologies to protect
  email message content from disclosure beginning with PEM and MOSS. At
  present the IETF has two email security standards that address
  confidentiality with incompatible message formats and different key
  management and distribution approaches.

  S/MIME and PGP may both be considered broken in that they reveal the
  message subject line and content Meta-data such as the time. This
  problem is easily addressed but at the cost of sacrificing backwards

Hallam-Baker                 March 15, 2014                     [Page 3]

*Internet-Draft          Writing I-Ds using HTML           September 2013


2.2. Meta Data Analysis

  Meta Data is information that is included in a communication protocol
  in addition to the content exchanged, This includes the sender and
  receiver of a message, the time, date and headers describing the path
  the message has taken in the Internet mail service. Meta-data
  analysis permits an attacker to uncover the social network of parties
  that are in frequent communication with each other.

  Preventing disclosure of meta-data is possible through techniques
  such as dead drops and onion routing but such approaches impose a
  heavy efficiency penalty and it is generally considered preferable to
  limit the parties capable of performing meta-data analysis instead.

  The IETF STARTTLS extension to email permits the use of TLS to
  encrypt SMTP traffic including meta-data. However use of STARTTLS has
  two major limitations. First SMTP is a store and forward protocol and
  STARTTLS only protects the messages hop-by-hop. Second there is
  currently no infrastructure for determining that an SMTP service
  offers STARTTLS support or to validate the credentials presented by
  the remote server. The DANE Working Group is currently working on a
  proposal to address the second limitation.

2.3. Traffic Analysis

  Analysis of communication patterns may also leak information about
  which parties are communicating, especially in the case of
  synchronous protocols such as chat, voice and video.

  Traffic analysis of store and forward protocols such as SMTP is more
  challenging, particularly when billions of messages an hour may pass
  between the major Webmail providers. But clues such as message length
  may permit attackers more leverage than is generally expected.

2.4. Denial of Service

  Providing protection against denial of service is frequently at odds
  with other security objectives. In most situations it is preferable
  for a mail client to not send a message in circumstances where there
  is a risk of interception. Thus an attacker may be able to perform a
  Denial of Service attack by creating the appearance of an intercept

  Whether the potential compromise of confidentiality or service is
  preferable depends on the circumstances. If critical infrastructure
  such as electricity or water supply or the operation of a port
  depends on messages getting through, it may be preferable to accept a
  confidentiality compromise over a service compromise even though
  confidentiality is also a significant concern.

Hallam-Baker                 March 15, 2014                     [Page 4]

*Internet-Draft          Writing I-Ds using HTML           September 2013

2.5. Protocol Exploit

  Many protocols are vulnerable to attack at the application layer. For
  example the use of JavaScript injection in HTML and SQL injection

  A recent trend in Internet chat services is to permit the
  participants in a group chat to share links to images and other
  content on other sites. Introducing a link into the chat session
  causes every connected client to retrieve the linked resource, thus
  allowing an attacker with access to the chat room to discover the IP
  address of all the connected parties.

3. Attacker Capabilities

  Some forms of attack are available to any actor while others are
  restricted to actors with access to particular resources. Any party
  with access to the Internet can perform a Denial of Service attack
  while the ability to perform traffic analysis is limited to parties
  with a certain level of network access.

  A major constraint on most interception efforts is the need to
  perform the attack covertly so as to not alert the parties to the
  fact their communications are not secure and discourage them from
  exchange of confidential information. Even governments that
  intentionally disclose the ability to perform intercepts for purposes
  of intimidation do not typically reveal intercept methods or the full
  extent of their capabilities.

3.1. Passive Observation

  Many parties have the ability to perform passive observation of parts
  of the network. Only governments and large ISPs can feasibly observe
  a large fraction of the network but every network provider can
  monitor data and traffic on their own network and third parties can
  frequently obtain data from wireless networks, exploiting
  misconfiguration of firewalls, routers, etc.

  A purely passive attack has the advantage to the attacker of being
  difficult to detect and impossible to eliminate the possibility that
  an intercept has taken place. Passive attacks are however limited in
  the information they can reveal and easily defeated with relatively
  simple cryptographic techniques.

3.2. Active Modification

  Active attacks are more powerful but are more easily detected. Use of
  TLS without verification of the end-entity credentials presented by
  each side is sufficient to defeat a passive attack but is defeated by
  a man-in-the-middle attack substituting false credentials.

Hallam-Baker                 March 15, 2014                     [Page 5]

*Internet-Draft          Writing I-Ds using HTML           September 2013

  Active attacks may be used to defeat use of secure after first
  contact approaches but at the cost of requiring interception of every
  subsequent communication.

  While many attackers have the ability to perform ad-hoc active attack
  only a few parties have the ability to perform active attack
  repeatedly and none can expect to do so with absolute reliability.

  A major limitation on active attack is that an attacker can only
  perform an active attack if the target is known in advance or the
  target presents an opportunity that would compromise previous stored

3.3. Cryptanalysis

  Many parties have the ability to perform cryptanalysis but government
  cryptanalytic capabilities may be substantially greater.

3.4. Kleptography

  Kleptography is persuading the party to be intercepted to use a form
  of cryptography that the attacker knows they can break. Real life
  examples of kleptography include the British government encouraging
  the continued use of Enigma type cryptography machines by British
  colonies after World War II and the requirement that early export
  versions of Netscape Navigator and Internet Explorer use 40 bit
  symmetric keys.

3.4.1. Covert Channels in RSA

  One form of kleptography that is known to be feasible and is relevant
  to IETF protocols is employing a RSA modulus to provide a covert
  channel. In the normal RSA scheme we choose primes p and q and use
  them to calculate n = pq. But the scheme works just as well if we
  choose n' and p and look for a prime q in the vicinity of n'/p then
  use p and q to calculate the final value of n. Since q ~= n'/p it
  follows that n' ~= n. For a 2048 bit modulus, approximately 1000 bits
  are available for use as a covert channel.

  Such a covert channel may be used to leak some or all of the private
  key or the seed used to generate it. The data may be encrypted to
  avoid detection.

3.4.2. Covert Channels in TLS, S/MIME, IPSEC

  Similar approaches may be used in any application software that has
  knowledge of the actual private key. For example a TLS implementation
  might use packet framing to leak the key.

Hallam-Baker                 March 15, 2014                     [Page 6]

*Internet-Draft          Writing I-Ds using HTML           September 2013

3.4.3. Covert Channels in Symmetric Ciphers

  A hypothetical but unproven possibility is the construction of a
  symmetric cipher with a backdoor. Such an attack is far beyond the
  capabilities of the open field. A symmetric cipher with a perfect
  backdoor would constitute a new form of public key cryptography more
  powerful than any known to date. For purposes of kleptography however
  it would be sufficient for a backdoor to limit the key space that an
  attacker needed to search through brute force or have some other
  limitation that is considered essential for public key cryptography.

3.4.4. Covert Channels in ECC Curves

  Another hypothetical but unproven possibility is the construction of
  a weak ECC Curve or a curve that incorporates a backdoor function. As
  with symmetric ciphers, this would require a substantial advance on
  the public state of the mathematical art.

3.4.5. Unusable Cryptography

  A highly effective form of kleptography would be to make the
  cryptographic system so difficult to use that nobody would bother to
  do so.

3.5. Lawful Intercept

  Lawful intercept is a form of coercion that is unique to government
  actors by definition. Defeating court ordered intercept by a domestic
  government is outside the scope of this document though defeating
  foreign lawful intercept requests may be.

  While the US government is known to practice Lawful Intercept under
  court order and issue of National Security Letters of questionable
  constitutional validity, the scope of such programs as revealed in
  public documents and leaks from affected parties is considerably more
  restricted than that of the purported PRISM program.

  While a Lawful Intercept demand may in theory be directed against any
  of the intermediaries listed in the following section on subversion
  or coercion, the requirement to obtain court sanction constrains the
  number and type of targets against which Lawful Intercept may be
  sought and the means by which it is implemented. A court is unlikely
  to sanction Lawful Intercept of opposition politicians for the
  political benefit of current office holders.

3.6. Subversion or Coercion of Intermediaries

  Subversion or coercion of intermediaries is a capability that is
  almost entirely limited to state actors. A criminal organization may
  coerce an intermediary in the short term but has little prospect of
  succeeding in the long term.

Hallam-Baker                 March 15, 2014                     [Page 7]

*Internet-Draft          Writing I-Ds using HTML           September 2013

3.6.1. Physical Plant

  The Internet is at base a collection of data moving over wires,
  optical cables and radio links. Every form of interconnect that is a
  practical means of high bandwidth communication is vulnerable to
  interception at the physical layer. Attacks on physical interconnect
  require only a knowledge of where the signal cables are routed and a
  back hoe.

  Even quantum techniques do not necessarily provide a guarantee of
  security. While such techniques may be theoretically unbreakable, the
  physical realization of such systems tend to fall short. As with the
  'unbreakable' One Time Pad, the theoretical security tends to be
  exceptionally fragile.

  Attacks on the physical plant may enable high bandwidth passive
  intercept capabilities and possibly even active capabilities.

3.6.2. Internet Service Providers

  Internet Service Providers have access to the physical and network
  layer data and are capable of passive or active attacks. ISPs have
  established channels for handling Lawful Intercept requests and thus
  any employee involved in an intercept request that was outside the
  scope of those programs would be on notice that their activities are

3.6.3. Router

  Compromise of a router is an active attack that provides both passive
  and active intercept capabilities. such compromise may be performed
  by compromise of the device firmware or of the routing information.

3.6.4. End Point

  Compromise of Internet endpoints may be achieved through insertion of
  malware or coercion/suborning the platform provider.

3.6.5. Cryptographic Hardware Providers

  Deployment of the 'kleptography' techniques described earlier
  requires that the attacker be capable of controlling the
  cryptographic equipment and software available to the end user.
  Compromise of the cryptographic hardware provided is one means by
  this might be achieved.

Hallam-Baker                 March 15, 2014                     [Page 8]

*Internet-Draft          Writing I-Ds using HTML           September 2013

3.6.6. Certificate Authorities

  Certificate Authorities provide public key credentials to validated
  key holders. While compromise of a Certificate Authority is certainly
  possible, this is an active attack and the credentials created leave
  permanent evidence of the attack.

3.6.7. Standards Organizations

  Another route for deployment of cryptography would be to influence
  the standards for use of cryptography although this would only permit
  the use of kleptographic techniques that are not publicly known.

  Another area of concern is that efforts to make strong cryptography
  usable through deployment of key discovery infrastructure or security
  policy infrastructure may have been intentionally delayed or
  discouraged. The chief security failure of the Internet today is that
  insecurity is the default and many attacks are able to circumvent
  strong cryptography through a downgrade attack.

4. Controls

  Traditionally a cryptographic protocol is designed to resist direct
  attack with the assumption that protocols that provide protection
  against targeted intercept will also provide protection against
  pervasive intercept. Consideration of the specific constraints of
  pervasive covert intercept demonstrates that a protocol need not
  guarantee perfect protection against a targeted intercept to render
  pervasive intercept infeasible.

  One of the more worrying aspects of the attempt to defend the
  legality of PRISM program is the assertion that passive intercept
  does not constitute a search requiring court oversight. This suggests
  that the NSA is passively monitoring all Internet traffic and that
  any statement that a citizen might make in 2013 could potentially be
  used in a criminal investigation that began in 2023.

  At present Internet communications are typically sent in the clear
  unless there is a particular confidentiality concern in which case
  techniques that resist active attack are employed. A better approach
  would be to always use encryption that resists passive attack,
  recognizing that some applications also require resistance to active

4.1. Confidentiality

  Encryption provides a confidentiality control when the symmetric
  encryption key is not known to or discoverable by the attacker. Use
  of strong public cryptography provides a control against passive
  attacks but not an active attack unless the communicating parties
  have a means of verifying the credentials purporting to identify the

Hallam-Baker                 March 15, 2014                     [Page 9]

*Internet-Draft          Writing I-Ds using HTML           September 2013


4.1.1. Perfect Forward Secrecy

  One of the main limitations of simple public key exchange schemes is
  that compromise of an end entity decryption key results in compromise
  of all the messages encrypted using that key. Perfect Forward Secrecy
  is a misnomer for a technique that forces an attacker to compromise a
  separate private key for every key exchange. This is usually achieved
  by performing two layers of public key exchange using the credentials
  of the parties to negotiate a temporary key which is in turn used to
  derive the symmetric session key used for communications.

  Perfect Forward Secrecy is a misnomer as the secrecy is not
  'perfect', should the public key system used to identify the
  principals be broken, it is likely that the temporary public key will
  be vulnerable to cryptanalysis as well. The value of PFS is not that
  it is 'perfect' but that it dramatically increases the cost of an
  attack to an attacker.

4.2. Policy, Audit and Transparency

  The most underdeveloped area of internet security to date is the lack
  of a security policy infrastructure and the audit and transparency
  capabilities to support it.

4.2.1. Policy

  A security policy describes the security controls that a party
  performs or offers to perform. One of the main failings in the
  Internet architecture is that the parties have no infrastructure to
  inform them of the security policy of the party they are attempting
  to communicate with except for the case of Certificate Policy and
  Certificate Practices Statements which are not machine readable

  A machine readable policy stating that a party always offers a
  minimum level of security provides protection against downgrade

4.2.2. Audit

  Audit is verifying that a party is in compliance with its published
  security policy. Some security policies are self-auditing (e.g.
  advertising support for specific cryptographic protocols) others may
  be audited by automatic means and some may require human
  interpretation and evaluation.

Hallam-Baker                 March 15, 2014                    [Page 10]

*Internet-Draft          Writing I-Ds using HTML           September 2013

4.2.3. Transparency

  A security policy is transparent if it may be audited using only
  publicly available information.

  An important application of transparency is by trusted intermediaries
  to deter attempted coercion or to demonstrate that a coercion attempt
  would be impractical.

Author's Address

  Phillip Hallam-Baker
  Comodo Group Inc.

Hallam-Baker                 March 15, 2014                    [Page 11]

September 08 2013


Hacker Tradecraft : Alternative TrueCrypt Implementations

Quelques autres intégrations logicielles du célèbre programme TrueCrypt qui permet de chiffrer un disque dur, une partition, une clef USB ou un simple conteneur plus petit en taille (comme une archive .7z, sauf que c'est chiffré au lieu d'être compressé).

August 05 2013


German Intelligence Sends Massive Amounts of Data to the NSA - SPIEGEL ONLINE

“The fact that massive amounts of metadata reached [USA's National Security Agency] databases from German soil is likely to ratchet the discussion over the role of the [Bundesnachrichtendienst, Germany's foreign intelligence agency] and its cooperation with the NSA even further. New documents from the [Edward] Snowden archive also show that there is much closer cooperation than previously thought in relation to the controversial XKeyscore surveillance program. SPIEGEL reported on the delivery and use of the program two weeks ago [ ] .”

July 20 2013


Données PERSOnelles ? Plus avec RSS graffiti (application Facebook) !

Cet appli de publication de fil RSS demande BEAUCOUP TROP de données personnelles, puisqu'elle souhaite accéder à vos profil public, liste d’amis, adresse électronique et groupes. (Tout ça juste pour publier un flux RSS sur sa page personnelle.)

Non merci.

FanPoint est bien moins connue et utilisée, mais demande pire : aussi les mentions J'aime.
TwitterFeed est l'une des moins pire, puisqu'elle ne demande "que" les profil public et liste d’amis.

Voici ses conditions d'utilisation :

Terms of Service




   The Service allows you to keep your Facebook followers updated with your latest news from RSS sources by periodically checking the RSS/Atom feeds that you specify and posting any new entries it finds to the Facebook walls that you specify. The Service allows you to get any feed written on any wall (Facebook Profiles, Fan Pages, Groups), including multiple feeds to multiple walls in the combination(s) you choose.
       Age Limitations. If you are under the age of 13, then you are not permitted to register with Demand Media or use any feature or other part of the Service that requires registration. You represent that you are at least 13 years of age if you are registering an account.
       Content. The Service allows users to post their own Content. Only individuals who have registered for the Service are permitted to post Content though the Service. You are responsible for your use of the Service and for any Content accessed or made available through your account (even if that Content is accessed or made available by others). You take all risks associated with the Service and Content accessed or made available to others through your account. We do not pre-screen Content and cannot be responsible for the Content accessed or made available to others through the Service.
       Account. We use Facebook Login so you can use your existing Facebook account to register to use the Service. You must explicitly authorize Facebook to share your information with us with your first login to the Service with your Facebook credentials. You should review your privacy settings on your Facebook account because those settings govern what personal information may be available to us when you access the Service. You acknowledge that the Service allows you to access and use content and services offered by third party service providers, and you must comply with the terms and conditions of any such third party service provider.
       Data Collection. By using the Service, you grant us the irrevocable, perpetual, sublicensable right and license to collect, analyze, and otherwise use qualitative and quantitative data arising from your use of the Service including data generated by third party viewers of your Content (“Data”). We collect and analyze this Data to improve the Service and other products and services that we offer or may offer in the future. In addition, we may aggregate and anonymize the Data to provide real time analytics to third parties. We will make reasonable efforts to ensure that the Data we provide to third parties is not traceable to the use of the Service by any specific, identifiable user and cannot be attributed to any users of the Service.
       Privacy Policy. All information you provide to Demand Media is governed by our privacy policy located at, and you consent to all actions we take with respect to your information consistent with our privacy policy.
       User Conduct. You warrant that you will not use the Service in a manner that is illegal or otherwise inconsistent with these Terms, or that we may deem objectionable. We reserve the right to restrict, suspend or terminate your access to the Service at any time in our sole discretion. You shall only access the Service through the interfaces that we provide, and you will not, nor will you attempt to do, any of the following, subject to applicable law:
           access or use the Service in any way that violates or is not in full compliance with any applicable local, state, national or international law, regulation or statute (including export laws), contracts, intellectual property rights or constitutes the commission of a tort, or for any purpose that is harmful;
           access, tamper with or use the Service or Content that you are not authorized to access or use;
           use any robot, spider, scraper or other automated means or interface not expressly authorized by us to access to Service or Content or extract data or gather or use information, such as email addresses, available from the Service or transmit any unsolicited advertising, “junk mail” or “spam”.
           impersonate or misrepresent your affiliation with any person or entity;
           reverse engineer any aspect of the Service or do anything that might discover source code, or bypass or circumvent measures employed to prevent or limit access to any area, content or code of the Service (except as otherwise expressly permitted by law);
           send to or otherwise impact us or Service (or anything or anyone else) with harmful, illegal, deceptive or disruptive code such as a virus, “spyware,” “adware” or other code that could adversely affect the Service or any recipient; or
           take any action which might impose a significant burden (as determined by us) on the Service’s infrastructure or computer systems, or otherwise interfere with the ordinary operation of the Service.

   We claim no intellectual property rights over the Content made available to others through your account. Any Content or other information you provide to us in connection with the Service remains yours or that of the respective third party owner of the Content. However, by making the Content available to others through the Service, or providing it to us through use of the Service, you grant us a worldwide, non-exclusive, royalty-free, fully paid up license (with a right to sublicense) to use, copy, reproduce, process, adapt, modify, publish, transmit, display and distribute such Content useful or necessary to provide the Service through any and all media or distribution methods (whether now known or hereafter developed). You also acknowledge that the purpose of the Service is to access the services of third party providers, and that as a result, you are agreeing to grant to us any and all other rights you grant to third party service providers. You will not use the Service in any way that is unlawful.

   Demand Media respects the intellectual property rights of others and requires that the people who use the Service do the same. If you believe that your work has been reproduced and is accessible through the Service in a way that constitutes copyright infringement, you may notify us by providing our copyright agent with the following information in writing:
       the electronic or physical signature of the owner of the copyright or the person authorized to act on the owner’s behalf;
       identification of the copyrighted work that you claim has been infringed;
       identification of the material that is claimed to be infringing and information reasonably sufficient to permit Demand Media to locate the material (for example, by providing a URL to the material);
       your name, address, telephone number, and email address;
       a statement by you that you have a good faith belief that the disputed use is not authorized by the copyright owner, its agent, or the law; and
       a statement that the information in your notification is accurate and a statement, made under penalty of perjury, that you are the copyright owner or are authorized to act on the copyright owner’s behalf.

   Our designated agent to receive notification of claimed infringement can be reached at:

   Demand Media, Inc.
   Copyright Agent
   5808 Lake Washington Blvd. Ste. 300
   Kirkland, WA98033
   (425) 298-2780 (fax)

   Our policy is to terminate any account for repeated infringement of intellectual property rights, including copyrights. We reserve the right to terminate an account for even one instance of infringement.
       Cancellation/Termination by you. If you chose to cancel or terminate your account, you are solely responsible for doing so properly. Your cancellation or termination will take effect immediately and we will promptly delete all of your Content from the Service. We do not accept any responsibility for loss of Content due to account cancellation or termination.
       Cancellation/Termination by us. We may, in our sole discretion, suspend, terminate or restrict your access to the Service, for any reason and at any time. Such cancellation or termination of the Service will result in the deactivation or deletion of your account or your access to your account, and the deletion of your account. We reserve the right to refuse to provide the Service to anyone for any reason at any time.





   In addition to your other representations and warranties set forth in these Terms, you represent and warrant that your use of the Service will comply will all local, federal and international laws, rules and regulations.

   You agree to indemnify, defend, and hold Demand Media, its affiliates, officers, directors, employees, agents, attorneys, or suppliers (collectively, “Indemnified Person(s)”) harmless from and against any and all claims, liability, loss, and expense (including damage awards, settlement amounts, and reasonable legal fees) brought against any of the Indemnified Person(s) arising out of, related to or which may arise from your use of (a) the Service; (b) the Content; (c) in connection with you or your end users dealings with third parties who provide advertisements, links, or offers through the Services; and/or (d) your breach of these Terms.

   Demand Media reserves all intellectual property rights in the Service, on its own behalf and on behalf of its licensors, and Demand Media does not, directly or by implication, by estoppel or otherwise, grant any other rights or licenses to you under these Terms. You shall not reverse engineer any content consisting of downloadable software, unless specifically authorized by Demand Media or the third-party owner of the rights in that content (if any) or otherwise permitted by law. Nothing in these Terms will be construed to give Demand Media any rights whatsoever in the Content.

   Demand Media reserves the right to modify or supplement these Terms from time to time. We will provide notice to you of any material or supplemental changes to the Terms by posting on the RSS Graffiti site and/or by sending an email to the email address that we have on record for you. Your continued use of the Service thirty (30) days after our notice to you will constitute your agreement to the Terms then posted on the RSS Graffiti site.

   All of your transactions through Services may, at our option, be conducted electronically from start to finish. If we decide to proceed electronically, those services will still be governed by these Terms unless you enter into different terms on a form provided by us. If the law allows you to withdraw this consent or if we are ever required to deal with you non-electronically, we reserve the right to charge or increase fees and you agree to print or make an electronic copy of the Terms and any other contract or disclosure that we are required to provide to you.

   Except as otherwise provided in these Terms, Demand Media will give you any notices about the Service by posting them on the RSS Graffiti Site. You authorize Demand Media to send notices (including notice of subpoenas or other legal process, if any) via electronic mail. You must check the Site for notices, and you will be considered to have received a notice thirty (30) days from the date when it is posted on the Site, or when sent by us via electronic mail, whether or not received by you. Demand Media may provide notice to any e-mail or other address associated with your Account. You must keep your address current and any notice provided by Demand Media to the address that you have most recently provided will constitute effective notice.

   We receive many emails and not all of our employees are trained to deal with every kind of communication. Therefore, you agree to send us any notice by mailing it to our address for Legal Notices which is: 5808 Lake Washington Blvd., Ste. 300, Kirkland, WA 98033, U.S.A., Attn: Legal Department.

   Under no circumstances shall Demand Media be held liable for any delay or failure in performance resulting directly or indirectly from acts of nature, forces, or causes beyond its reasonable control, including, without limitation, Internet failures, computer equipment failures, telecommunication equipment failures, other equipment failures, electrical power failures, strikes, labor disputes, riots, insurrections, civil disturbances, shortages of labor or materials, fires, floods, storms, explosions, acts of God, war, governmental actions, orders of domestic or foreign courts or tribunals, non-performance of third parties, or loss of or fluctuations in heat, light, or air conditioning.
       No Agency; No Third Party Beneficiary. No agency, partnership, joint venture, employee-employer or franchisor-franchisee relationship is intended or created by these Terms. Neither of us intends that any third party will be a beneficiary of or entitled to rely on any part of these Terms.
       Severance. If any part of the Terms is held by a court of competent jurisdiction to be invalid or unenforceable, the invalid or unenforceable part will be given effect to the greatest extent possible and the remainder will remain in full force and effect, provided that the allocation of risks described herein is given effect to the fullest extent possible.
       No Assignment. These Terms are personal to you and you may not transfer, assign or delegate them to anyone without the express written permission of Demand Media. Any attempt by you to assign, transfer or delegate these Terms or your Account without the express written permission of Demand Media will be null and void. Demand Media shall have the right to transfer, assign and/or delegate these Terms to one or more third parties without your permission.
       Jurisdiction; Choice of Law; Export Limitations. The Service is controlled by us from our offices within the United States of America and is directed to U.S. persons. If you choose to access the Service from locations outside the U.S., you do so at your own risk and you are responsible for compliance with applicable local laws. You may not use or export anything from the Service in violation of U.S. export laws and regulations or the Terms. These Terms and all performances and claims of every nature relating in any way to the Service will be governed by the laws of the State of California, U.S.A., without regard to any conflicts of laws principles that would result in the application of the law of a different jurisdiction. You hereby agree to submit to the personal and exclusive jurisdiction of the courts located within Los Angeles, California. Any disputes regarding such claims or arising under or related in any way to these Terms or the Service must be heard exclusively in the appropriate forum in California. You hereby consent to jurisdiction in a state or federal court sitting in Los Angeles, California and waive any claim or defense that such forum is not convenient or proper, and consent to service of process by any means authorized by California or federal law.
       Limitations on Actions. Any action concerning any dispute you may have with respect to these Terms or the Service must be commenced within one year after the cause of the dispute arises, or the cause of action is barred.
       Interpretation. The paragraph headings in these Terms are included to help make these Terms easier to read and have no binding effect. Use of the term “include” or “includes” means “without limitation.” The use of the term “affiliates” includes any person directly or indirectly controlled by, under common control with, or controlling another person.
       Entire Agreement. These Terms comprise the entire agreement between you and Demand Media with respect to the use of the Service and supersede all prior agreements between the parties regarding the subject matter contained in these Terms. Any amendment to these Terms must be in writing and signed by an authorized representative of each party.
       No Waiver. The failure of Demand Media to exercise or enforce any right or provision of these Terms, including any failure to act with respect to a breach, will not constitute a waiver of such right or provision or Demand Media’s right to act with respect to subsequent or similar breaches.
       Survival. In the event of any termination of these Terms, all obligations and responsibilities of Demand Media and you under Sections 2D and 6-14 will survive and continue in effect.

Further Information

If you have a complaint, you may contact us at Demand Media, Inc., Legal Department, 5808 Lake Washington Blvd., Suite 300, Kirkland, WA 98033, U.S.A. If you are a California resident, the Complaint Assistance Unit of the Division of Consumer Services of the Dept. of Consumer Affairs may be contacted at 400 R Street, Sacramento, CA 95814 or (800) 952-5210.

NOTICE RE COPYRIGHT OWNERSHIP: © 2012 Demand Media, Inc. U.S.A. All rights reserved.

© 2012 Demand Media, Inc. All Rights Reserved. Demand Media, RSS Graffiti, and the RSS Graffiti logo are trademarks or registered trademarks in the United States and other countries.

Et voici sa politique de confidentialité :

Privacy Policy




1. INFORMATION YOU GIVE US. We collect any information you enter on the Site or give us in any other way (such as through an email, survey, or letter). The information that we collect varies depending upon how you use our Site.


A. Cookies.  Like many websites, we use “cookies.”  Cookies are alphanumeric identifiers that we transfer to your computer’s hard drive through your Web browser to enable our systems to recognize your browser.  We use persistent, identifying cookies to remember your information and to link your activities to you.  While you can take steps to warn off, block or disable cookies, if you do, the Site may not function and appear as we have designed it.  Nonetheless, if you want to take these steps, you can do so by following the instructions associated with your browser.  Our cookies collection information such as:

i. the domain name and host from which you access the Internet and the Internet address of the site from which you direct-linked to ours;

ii. the date and time you access the Site and pages you visit;

iii. your computer’s IP address and information about its operating system, platform and the Web browser type and version you use;

iv. demographic and other non-personally identifiable profile information about you; and

v. information to combat fraud or misuse.

B. Pixel Tags.  If we email you, our emails may use “pixel tags” to determine if your email software or site can display html-formatted email (this helps us optimize the size of our email messages and conserve bandwith).

C. Collection of Information by Third Parties.  Some of the advertisers and other businesses that advertise or place other content our Site use cookies on our Site and may place a cookie on your computer.  The content posted by these businesses will be reasonably identifiable as coming from a third party.  In addition, we may use third party advertising companies to serve ads.  These companies (1) use information obtained from your visits to this Site and other sites to serve ads to you and (2) place unique third party cookies on your browser.  Also, we use web beacons provided by third party advertising companies to help optimize our advertising. Web beacons enable us to recognize your browser when a cookie has been placed on your computer.  Some but not all third party advertising companies provide a mechanism to opt-out of their technology.  For more information and an identification of advertisers that provide an opt-out mechanism, please click the following:

The information collected by third party cookies is subject to the privacy policy of the third party, not this Policy.

D. Promotions, Sweepstakes, and Contests.  From time to time, we may host a promotion, sweepstake, or contest on the Site.  You may be asked to provide personal information or permit the transfer to a third party of your personal information in connection with such promotion, sweepstake or contest.  It will be disclosed at the point of collection or transfer who is collection or transferring the information and whose privacy statement applies, and it will be your choice whether or not you wish to permit such transfer to our collection of personal information by a third party.


A. Use of Personal Information.  We use personal information that you submit to us for such purposes as responding to your requests; monitoring and providing the Site; enforcing our rights and the rights of third parties, and investigating and ensuring compliance with theTerms.

B. Use of Other Information. We use other information about our users for purposes such as measuring the number of visitors to sections of our Site, making the Site more useful to visitors and delivering targeted advertising and non-advertising content.  We use IP addresses to analyze trends, administer the Site, track a user’s movement, and gather broad demographic information for aggregate, non-personally identifiable use.

C. Retention of Information.  We retain information for as long as required, allowed or we believe it useful, but do not undertake retention obligations. We may dispose of information in our discretion without notice, subject to applicable law that specifically requires the handling or retention of information.

4. OUR SHARING OF INFORMATION.  Demand Media shares information with third parties, but only as described in this Section 4.

A. Advertisers and Others.  We share non-personally identifiable information with advertisers, site providers, and other persons with whom we conduct business.  Conversely, these advertisers, site providers, and other persons may share with us information about you that they have independently developed or acquired.

B. Site Third Parties. We contract with affiliated and non-affiliated third parties to provide sites to us or to you on our behalf. Examples include providing marketing assistance and analyzing data. These third parties have access to personal information needed to perform their functions.

C. Business Transfer. As we develop our business, we might sell or buy businesses or their assets, or engage in acquisitions, mergers, restructurings, changes of control, or similar transactions. In such transactions, customer information generally is one of the transferred business assets.   Also, in the unlikely event of a bankruptcy, customer information may be transferred to a bankruptcy trustee or debtor in possession and then to a subsequent purchaser.

D. Affiliates. We may share user information with our corporate affiliates. Corporate affiliates are those entities that we control, are controlled by us, or are under common control with us and any joint venture in which any of the controlled entities may participate from time to time. Conversely, we may obtain information about you from our corporate affiliates or from your visits to other web sites that we or our corporate affiliates control.

E. Compliance and Safety. We may release user information when we believe release is appropriate to:

i. comply with applicable law, and to respond to legal process, including subpoenas, search warrants and court orders, and to respond to or otherwise address written complaints of copyright infringement;

ii. make disclosures under programs intended to prevent potential crimes or investigate persons;

iii. enforce or apply agreements, including the Terms; or

iv. protect the rights, property, or safety of the Site, our users, or others, including exchanging information with other companies for fraud protection and credit risk reduction.


A. Your Obligations.  You must protect against unauthorized access to your personal information and to your computer. YOU MUST DO WHAT YOU REASONABLY CAN TO ENSURE THE SECURITY OF YOUR PERSONAL INFORMATION.

B. Our Security Measures.  We have physical, electronic, and managerial procedures to help safeguard, prevent unauthorized access, maintain data security, and correctly use your information. HOWEVER, WE DO NOT GUARANTEE SECURITY. Neither people nor security systems are foolproof, including encryption systems.

6. LINKS. The Site may contain links to other sites. We are not responsible for the privacy practices of such other sites. We encourage you to be aware when you leave our Site and to read the privacy statements of every web site that collects your personally identifiable information. This Policy applies only to information collected by the Site.

7. CHOICE. If you have sent us your email or other contact information, we reserve the right to send you customary business communications.


A. Privacy Concerns.  Your use of the Site and any dispute over privacy is subject to theTerms. If you have any concern about privacy at Demand Media, please send us a thorough description to, and we will try to resolve it. If you think we are in default of the Terms, you may contact us at Our Legal Notices Address in Section 9 below.

B. Notice Required by Law.   In those jurisdictions that permit email notice, if we are required to disclose or provide notice of invasion of certain security systems, we will do so by email to the most current email address provided by you to us.

C. Identity Theft. If you believe that you are a victim of identity theft entitled by law to request information from us, write us at our Legal Notice address (see Section 9) and we will let you know what additional information you must provide to us. After we have received that information, we will supply without charge the information legally required to be disclosed that we then have, subject to applicable law and reserving all of our rights and defenses.

9. CONTACT INFORMATION AND INFORMATION ABOUT ENFORCEMENT OF OUR POLICY. For customer site matters (including questions relating to this Policy), you may email us To send us a legal notice, mail it by certified mail (return receipt requested) to: Legal Department, 5808 Lake Washington Blvd., Suite 300, Kirkland, WA 98033.


In compliance with the Safe Harbor Principles, Demand Media, Inc. commits to resolve complaints about your privacy and our collection or use of your personal information. In the first instance, European Union citizens with inquiries or complaints regarding this privacy policy should contact:

The company complies with the U.S.-EU Safe Harbor Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information from European Union member countries.  The company has certified that it adheres to the Safe Harbor Privacy Principles of notice, choice, onward transfer, security, data integrity, access, and enforcement.  To learn more about the Safe Harbor program, and to view the company’s certification, please visit

Demand Media, Inc. has further committed to refer unresolved privacy complaints under the Safe Harbor Principles to an independent dispute resolution mechanism, the BBB EU Safe Harbor, operated by the Council of Better Business Bureaus. Thus, if you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed by Demand Media, Inc., you may contact:

Council of Better Business Bureaus, Inc.
BBB EU Safe Harbor
4200 Wilson Boulevard, Suite 800
Arlington, VA 22203
Phone: 703-276-0100

Copyright © 2010. Demand Media, Inc.

June 26 2013


Loi "FRA" en Suède (article de la Wikipédia anglophone)

Les hébergeurs Web ou fournisseurs de VPN installés en Suède mettent souvent en avant la loi nationale particulièrement protectrice concernant les données personnelles.

Mais d'une part on confond parfois avec la Norvège (Norway) qui elle aussi dispose de textes bien plus protecteurs qu'en France ou surtout aux Etats-Unis d'Amérique,
et d'autre part ces prestataires suédois omettent, sans doute par étourderie, de nous parler du paquet législatif "FRA-lagen" qui permet à une certaine Autorité (organe d'Etat) d'enregistrer SANS MANDAT les trafic Internet et appels téléphoniques entrants ou sortants du pays. Sans mandat = sans intervention d'un-e juge. Je ne me souviens pas avoir entendu parler de cette loi "FRA".

June 16 2013


March 31 2013


March 14 2013


Did Google Get Off Easy With $7 Million ‘Wi-Spy’ Settlement? |

Sept millions d'amende, quand on fait six millions de chiffre d'affaires PAR HEURE, ça vaut le coup, non ?

Via Duck Duck Go.

Version archivée de l'article :! (sur Internet Archive).

Copier-coller-de l'article :

Digital Privacy
Did Google Get Off Easy With $7 Million ‘Wi-Spy’ Settlement?
By Sam GustinMarch 13, 20130

Seven million dollars.

That’s how much Internet giant Google will pay to settle a multi-year investigation into its controversial “Wi-Spy” data collection practices. The furor erupted in 2010 when Google disclosed that it had collected Wi-Fi data from unsecured wireless networks as its “Street View” vehicles crawled major cities worldwide, photographing buildings for a ground-level view on Google Maps. On Tuesday, Google agreed to pay $7 million to 38 states and the District of Columbia to settle the matter. To put that in perspective, Google generated revenue of about $50 billion last year, or nearly $6 million per hour.

Big Internet companies like Google and Facebook frequently push the boundaries of user privacy. But the “Wi-Spy” case was particularly alarming to consumer advocates, because it raised the specter of Google’s “Street View” cars — which had already raised privacy concerns — roaming around major cities vacuuming up personal data, including snippets of browser activity, email traffic, and even medical and financial records, from the Wi-Fi networks of unsuspecting users. Although Google insisted that it never used any of the data in its products, the episode struck many as creepy — and inspired many consumers to encrypt their Wi-Fi networks.

(MORE: Google’s Federal Antitrust Deal Cheered by Some, Jeered by Others)

“While the $7 million is significant, the importance of this agreement goes beyond financial terms,” Connecticut Attorney General George Jepsen, who led the multi-state probe, said in a statement. “Consumers have a reasonable expectation of privacy. This agreement recognizes those rights and ensures that Google will not use similar tactics in the future to collect personal information without permission from unsuspecting consumers.”

Tuesday’s agreement also requires Google to launch an employee education program about user data privacy, as well as to sponsor a nationwide public service campaign to help educate consumers about securing their wireless networks and protecting personal information. The company must also continue to secure, and eventually destroy, the Wi-Fi data collected by its Street View vehicles, according to the settlement. Google’s public service campaign will begin later this year and will include online YouTube videos as well as half-page ads in national and state newspapers.

In 2010, Google acknowledged that its Street View Wi-Fi collection was a mistake. “We screwed up, and I’m not making excuses about it,” Google co-founder Sergey Brin said at the time. “We do have a lot of internal controls in place, but obviously they didn’t prevent this error from occurring.”

(MORE: In Major Victory, Google Dodges Federal Antitrust Lawsuit with FTC Deal)

So how did it happen? Google said that along with photographs, its Street View cars were originally intended to collect data like the Wi-Fi network name and router address, as the cars passed homes and businesses. According to Google, this data would be used to improve the company’s location-based services like Google Maps, which uses cell towers and Wi-Fi access points to help users identify their location on mobile devices.

But it turned out that Google went much further than that, vacuuming up snippets of browser history and email data. The company explained that when the Street View program launched, the team inadvertently included code in their software that “sampled all categories of publicly broadcast WiFi data,” even though the project leaders did not want the more comprehensive data. As soon as Google discovered the practice, it grounded the Street View cars and separated and secured the data on its network.

Law enforcement officials and privacy advocates were outraged, and for nearly three years, Google has been working with the authorities on a settlement. “We work hard to get privacy right at Google,” the company said in an emailed statement. “But in this case we didn’t, which is why we quickly tightened up our systems to address the issue. The project leaders never wanted this data, and didn’t use it or even look at it. We’re pleased to have worked with Connecticut Attorney General George Jepsen and the other state attorneys general to reach this agreement.”

(MORE: Top U.S. Lawmakers Back Mobile Phone Unlocking Bills)

Some consumer advocates, however, were not so pleased with Tuesday’s agreement. American Consumer Institute president Steve Pociask released a statement calling the $7 million fine a slap on the wrist for the search giant. He observed the Google had recently reached an antitrust settlement with the Federal Trade Commission that was also criticized for letting the search giant off too easily. As part of the Wi-Fi agreement, Google did not acknowledge violating any U.S. laws, and its compliance with the settlement is voluntary.

“Fresh off their FTC wrist slap, Google gets off easy once again with a paltry $7 million fine to over 30 states for collecting personal consumer information from unsecured Wi-Fi networks,” said Pociask. “With revenue of $100 million a day, the fine is just a drop in the bucket and not enough to deter bad behavior. Consumers are growing tired of seeing Google apologize time and time again, pay a small fine and make vague promises in settlements with one agency or another, only later to engage in the same behavior.”

John M. Simpson, director of Consumer Watchdog’s Privacy Project, mocked Google’s forthcoming Wi-Fi security public education campaign. “Asking Google to educate consumers about privacy is like asking the fox to teach the chickens how to ensure the security of their coop,” Simpson said in a statement. “The educational video will also drive consumers to the YouTube platform, where Google will just gather more data about them for its digital dossiers.”

“The $7 million penalty is pocket change for Google,” Simpson added. “It’s clear the Internet giant sees fines like this as just the cost of doing business and not a very big cost at that.”
Sam Gustin @samgustin

Sam Gustin is a reporter at TIME focused on business, technology, and public policy. A native of New York City, he graduated from Reed College and Columbia University's Graduate School of Journalism.

February 25 2013


OwniAVendre - Owni

Cette version du wiki d'OWNI semble la dernière en date à être "propre". Les suivantes sont toutes spammées. :/

texte source :
== '''Owni ferme - donc on l'ouvre.''' ==

La question est donc : que deviendra et son équipe de journalistes, de développeurs et de graphistes (notre valeur ajoutée) ?

Nous avons plein d’idées, de pistes pour qu’Owni puisse continuer à être un média innovant, ambitieux et passionné.

Si vous avez des idées, propositions, si vous voulez nous soutenir, partagez-les sur Twitter avec le hashtag #OWNIoupas, contactez-nous sur, ou contribuez sur cette page Wiki.

Owni est très peu endetté, et n'a pas d'emprunt bancaire à rembourser. Alors pourquoi avoir choisi la liquidation plutot que la sauvegarde ou le redressement ?

== '''Sources actuelles de revenus :''' ==

. Owni gagne déjà de l'argent en réalisant des webapp' en partenariat avec des médias : [ WikiLeaks], [ Véritomètre avec i>Télé], [ C/Data pour C/Politique sur France5], des ONGs telle que la FIDH : [ A prison called Uzbekistan - FIDH-Owni]. (voir [ les projets de "datajournalisme" d'Owni], ainsi que ceux réalisés [ au nom de 22mars] en tant que "prestataire").

. Owni gagne également de l'argent en contribuant, en tant qu'auteur et co-producteur, à des web/documentaires télévisés.

. Owni gagne aussi de l'argent en proposant des formations (en écriture sur le web, journalisme de données, techniques d'investigation en ligne, sécurité informatique, etc.)

. Owni publie de plus [ des livres électroniques] : le marché des ebooks est encore embryonnaire, mais on est déjà dessus.

. Owni n'a jamais souhaité produire de contenu publi-rédactionnel et/ou de littérature "corporate".

Des Montant ? --ej
Il manque combien par mois ?

== '''Sources potentielles de revenus :''' ==

=== Les sources de recettes ===
* Publicité : Owni n'est pas un mass média, et n'a jamais cherché à recruter une large audience; mais on pourrait /-)format des apps gratuites: abonnement = pas de pub, gratuit pub de tout partout (associé avec les autres idées évidemment).
* Owni pourra crééer et monétiser des applications pour tablette et smartphone.
* Owni pourrait bénéficier du Fonds stratégique pour le développement de la presse, s'il est reconnu par la CPPAP comme service de presse d’information politique et générale (IPG)
* Owni pourrait faire du papier
** "reverse publishing" et vendre les articles sous la forme d'un journal papier, d'un "mook", de "best of".
***Et pourquoi pas revendre des articles ou s'associer à XXI? Je trouve que l'ambiance graphique colle,et ce pourrait être une belle opportunité pour XXI aussi!
** Rue89 a déjà expérimenté le best-of, mais ça n'a pas marché. Les personnes intéressées par leurs articles les consultaient sur le site gratuitement. Par contre si le site OWNI devient payant via un abonnement, l'édition d'un best-of pourrait prendre beaucoup plus de sens. Il me semble que la formule "abonnement web+best-of mensuel print" serait une première en plus.
** Basculer vers un modèle à la "Wired" européen.
***+1, une version papier mensuel "a la wired" mais sans pub me semble un excellente idee (parce que serieux usbek&rica sans rire le contenu est faible)
** vendre des certificats d'abonnement de soutien en kiosque et par correspondance, différents à chaque parution, et beaux (juste le certificat d'abonnement, le contenu reste sur le ouèbe)
* Owni pourrait aussi faire du baby sitting ! avec des jeux pedagogiques... Owni school
* Owni n'a pas encore organisé d'évènements, de conférences, de colloques payants...
* "Paywall" total, compte "freemium", "au compteur" : Owni pourrait aussi proposer à ses lecteurs de s'abonner.
[note: le model "au compteur" ne marche que dans le cas d'une production importante de contenus, or ce n'est pas le cas d'Owni / ideé: un compteur non pas sur le Nbr d'articles/mois mais sur le nombre de vus / article (ex: au dela de 500 visiteurs le contenu devient payant : economie de la penurie!) ]
* "Crowdfunding", dons en ligne : les lecteurs pourraient aussi contribuer financièrement directement. -> à la wikipedia
* Ouvrir un business complétement séparé et qui finance ( ce qui se passait déjà du temps de 22mars ) ( c'est mieux si c'est complétement automatique ).
* S'associer avec un gros pure player à abonnement (Médiapart ou Asi)dans une logique de complémentarité : exemple @si fait des livres mais en version papier uniquement et Daniel Schneidermann fait de la formation lui aussi. @si à commencé par tater le terrain via une pétition pour savoir qui pourrait participer... mais de là à financer 16 personnes c vrai que c'est pas gagné. Et puis l'émission donne un rythme important et sert de moteur et de rendez vous aux @sinautes. Sauriez vous proposer quelque chose d'équivalent ? Un rendez vous de data analysis / décryptage hebdomadaire, avec invitation, débats ou enquête sur le terrain ?
* Owni pourrait utiliser ses compétences internet et data analysis pour réaliser des études payantes et argumentés sur des sujets intéressants les grandes entreprises parmi les sujets du moments : évolution du comportement du grand public en terme d'achat suite aux développements des réseau sociaux, mobile, tablette etc..
* modèle à la lwn avec article gratuit disponible après 1 semaines, réservé au lecteur payant en premier lieu.
* faire des articles "à la demande" sur des sujets plébiscités par les internautes => les internautes proposent des sujets, et lorsqu'un certain nombre d'internautes souhaitent une enquête sur un sujet et que le montant adéquate est récolté par crowdfunding, un journaliste ou une équipe peut se lancer. (le contenu est ensuite accessible à tous, qu'ils aient payé ou pas!). Les donateurs seraient récompensés en fonction de l'importance de leurs dons par des éléments quotidiens ou hebdomadaires récoltés par le journaliste pendant l'enquête, les lecteurs ne payent pas le résultat mais l'accès au processus qui le permet.
* vendre des graphiques/ appli html de présentation de donnée en marque blanche pour d'autres journaux en ligne.
* Système de micro-paiement, par exemple [ Flattr], pour les articles individuels
* Pouvoir payer via des points fidélité comme les Miles AirFrance-KLM. Dans votre lectorat, certains sont de grands voyageurs
* Qui dit "data" + "web" + "ouverture" dit généralement "potentiel recherche" non ? Ne vous serait-il pas possible de décrocher des financements en hébergeant/en collaborant à des projets de recherche ?
* Dans l'hypothèse d'un accès payant façon Mediapart/Arrêt sur images :
** large offre pour nombreux publics (étudiants/chercheurs d'emploi, enseignants/chercheurs, CDI/bibliothèque, entreprise)
** dont des petits abonnements, permettent de découvrir (2 semaines, 2 mois, 4 mois),
** dont des cadeaux à un tiers (1 article envoyé par email, une semaine, un mois)
* S'associer à d'autres pure-players "hors-normes", et créer un abonnement commun. Pour xxx euros par mois, l'internaute pourra accéder à tout le contenu d'Owni, mais aussi de tel et tel autre pure-player.

=== Couper dans les dépenses ===

* Supprimer les piges payantes et creer un système de contributions (ex: conf. de redaction ouverte comme sur rue89 / acceptation et repartition des taches entre les contributeurs (gratos) et les journalistes (payés);
* Diviser votre temps de travail. Un mi-temps sur Owni, un mi-temps dans un autre champ d'activités, plus lucratif. L'une enrichissant l'autre et inversement. Mais la deuxième devant subvenir à 80% - 100% de vos besoins économiques personnels. Ce qui garantirait une indépendance de votre travail d'investigation.

== '''Dispositif actuel :''' ==

. Statut ?

. Organisation ?

. Nombre de salariés / contributeurs / pigistes ?

. songer à la formation des nouveaux lecteurs ?

. etc..

Pour travailler sur le modèle, il faut peut-être aussi travailler sur le process.

Quand on regarde le business modèle d'Owni, on cerne assez vite pourquoi ils sont en difficulté. La détermination de leur modèle économique est trop dispersée pour être n'arriverais pas à driver le service commercial d'Owni : "alors, chers collègues, vous vendez : des appli, des livres numériques, des prestas, des docus ..."

''-> la presse papier a 3 principaux modèles économiques (dans le désordre) : la vente au n°, l'abonnement, la publicité; s'il y avait "un" modèle économique simple pour la presse en ligne, tout le monde serait content, mais non : il y en a beaucoup plus; mediapart & @si ont tablé sur les seuls abonnements, mais Owni voudrait rester gratuit, d'où le PayWhatYouWant; en tout état de cause, Owni gagne de l'argent avec ses applis, ses formations, ses docus, et espère pouvoir en gagner avec ses ebooks : plus on aura de sources de financements différentes, moins on dépendra d'une seule source.


''-> +1, à mon avis c'est le contraire qui tue Owni, l'idée d'une rédaction à l'ancienne. Sans rien connaître de l'arrière boutique cette tendance semblait clair depuis la séparation d'avec 22 mars. Peut-être qu'Owni ne peut plus exister comme entreprise localisée et qu'il faut une conception plus libertarienne et nomade, avec moins de charge, des forks dans tous les sens et des contributeurs qui, eux-même, aient des sources différenciées de revenus et se partagent ce qui se gagne plutôt que d'essayer de gagner ce qui se dépense. Attention au modéle herbalife tout de même :D

Je suis partisan d'un modèle payant couplé à la vente d'espaces publicitaires. C'est vrai que plusieurs modèles existent dans la presse en ligne. Cependant, la création d'entreprise repose sur la vente d'un produit au départ.Le marchand de chaussure vendra du cirage, des lacets,des semelles mais pas une prestation formation couture. Les commerciaux (un seul dans votre équipe ?)qui sont supers difficiles à recruter et à fidéliser n'ont pas la faculté de tout vendre et de chercher à prospecter pour plusieurs produits aussi différents les uns que les autres.

== '''Changement de modèle économique :''' ==

Alors que la presse dans son ensemble cherche son “modèle économique” et expérimente différents business plan, il pourrait être intéressant de se pencher sur le journalisme “non-profit”, et s'inspirer des modèles économiques de médias tels que ProPublica, ou encore Associated Press.

Voir aussi :  
[ Du "logiciel libre" à la "presse libre" : le modèle économique du "libre" peut-il s'appliquer à la "presse" ?]

[ 14 pistes et idées pour financer le non-profit]

''->Tout plutôt que le paywall: so lame...

=== Un journal papier personnalisé et aggrégeant le meilleur du journalisme en ligne ? ===

cf [ Projet “Papermix"]

Owni a les talents/compétences techniques pour le faire + la communauté pour démarrer. (+ ref. aaaliens)

== '''Etapes pour (re)construire : [A compléter] #newhope''' ==
1/ Faire l'état des lieux des charges et les rendre publiques.
:'''Réponse "TEAM OWNI"''' => Les charges totales d'OWNI SAS s'élèvent à 90 000 euros mensuellement. 82% de ces charges concernent les salaires des 16 personnes de l'équipe.
:La composition de celle-ci se définit comme telle  :
:* pour la partie rédaction : 10 journalistes (représentant 57% du montant total des salaires '''"chargés"'''), soit 90000€*82%*57%/10 = 4207 € mensuels brut par journaliste.
:* pour la partie "production/vente" : 6 personnes dont 3 développeurs / 2 webdesigners-graphistes / 1 personne en charge du commercial/mkg :(représentant 43% du montant total des salaires '''"chargés"'''), soit 90000€*82%*43%/6 = 5290 € mensuels brut par non-journaliste.
::=> '''Réponse TEAM OWNI''' : Non... les sommes que vous évoquez ne correspondent absolument pas aux salaires bruts d'OWNI et se situe bien loin de la réalité... [[#salaires|Lisez plus bas la section sur le salaire moyen, par un contributeur]]. Dans la mesure ou nous avons bien précisé qu'il s'agit de montants correspondant aux salaires '''"chargés"''' , çàd, salaires nets + charges sociales + charges patronales.
:Le reste des charges (18%) concernent les frais de fonctionnement (loyer, télécoms, serveurs, assurances, assurances complémentaires, location de matériel informatique, etc...).

2/ Faire un choix de structure (assos, [ SCOP/SCIC] ?). [ Comparatif SARL/SA classique avec leurs sœurs coopératives (PDF)]. Petite astuce au cas où : une [ asso Loi 1908 (= créé en Alsace-Moselle) est d'OFFICE reconnue d'intérêt public].

3/ clarifier pour les contributeurs l'historique avec pour comprendre la scission.
:'''Réponse "TEAM OWNI"''' => On ne peut pas, cela dit, tout vous dire, et on a encore d'autres idées mais qu'on préfère, et pour le moment, garder pour nous /-)


<span id="ouverture">Vous ne voudriez pas changer "Owni ne ferme pas. Owni est à vendre."</span>  par "Owni ferme - donc on l'ouvre". comme titre dans le wiki et sur la HP du site?
Le message est bien plus pertinent et valorisant imho, et lance le débat aussi sur une suite au delà de l'entité juridique/capitalistique actuelle.
* +1 là-dessus. "Est à vendre", c'est réducteur, surtout si d'autres idées sont également considérées. --[[Spécial:Contributions/|]] 11 décembre 2012 à 18:43 (UTC) ([[#ouverture|#Lien vers cette section « Ouverture »]])


<span id="salaires">Quel salaire par employé(e) ?</span> Tentative de calcul réaliste.

Moyenne individuelle : (90.000 x 0,82) / 16 = 73.800/16 = 4612,50 euros de charges (''coût employeur, rien à voir avec le salaire net perçu par chaque personne'').

En supposant 45% de charges employeur en plus du brut, cela fait un brut individuel de 4612,50 / 1,45 = 3181,03 brut €/mois par employé. En supposant 39h hebdomadaires et 4,33 semaines par mois (52/12), cela fait un brut horaire théorique moyen de 18,84 €.

En comptant 23% de prélèvement sociaux (Sécu toussa), le net mensuel individuel est de 3181,03 x [1 - 23/100] = 3181,03 x 0,77 = 2449,39 euros net soit 14,50 euros net de l'heure (selon les même paramètres de calcul que ci-avant).

Peut-être qu'il y a là l'occasion d'économiser 7.000 euros net par mois pour la société ? C'est un exemple. En gardant ces 16 salarié-e-s mais en baissant (deux "s", hein) de 9,5% chaque salaire, ça fait donc 73.800 x [ 1 - (9,5/100) ] = 73.800 x 0,905 = 66.789,00 euros, soit une différence de 73.800 - 66.789 = 7011 € d'économie de trésorerie par mois.
Le salaire mensuel moyen deviendrait 2216,70 euros ''net'' par personne, soit une baisse de 232,69 € (là aussi c'est du net). - ''Ha ouais quand même''. :/

Question subsidiaire 1: combien se rémunère les ''associés'' ?  ([[#salaires|#Lien vers cette section « Salaires »]])

Question subsidiaire 2 : Clarifier la prise en compte ou pas des avantages fiscaux de la carte de presse dans le calcul de la rémunération.


<span id="confidentialite">Vous êtes un peu des spécialistes du numérique alors proposition : faire de la confidentialité un argument de “vente”</span> (en l'occurrence : d'attractivité).
* [ tout site (.fr, .eu) et sous-domaine accessible en HTTPS], peu importe le caractère "spécialisé", "subversif", "marginal", "dissident" ou "rebelle" que pourrait avoir Owni
** toute partie et tous fichiers du site doivent aussi être accessible en https : penser aux agrégateurs RSS, fichiers intégrés directement dans un mail (hotlinking d'image) ou sur un autre site… Supprimer donc les appels à + + dans le head des pages, ou ne les garder QUE SI ça marche en HTTPS. Bon et puis Google c'est quand même PAS TOP niveau vie privée)
** expliquer aux internautes non-technophiles que les adresses web ne seront pas déchiffrables ( 5f45Nac952T1bYd87MeBWmQ6a9JPP7N9yY42IGrKphZhVgT3BXgwmwv2pDaY ) par leur FAI (une page généraliste de l'intérêt du HTTPS) ;
** afficher une barre tout en haut de la page en cas d'accès direct ou lien à la version HTTP, incitant à se rendre sur sa version HTTPS ;
** [ interdire aux moteurs d'indexer les pages en HTTP] : ils ne référenceront que les pages en HTTPS
* virer les [ésinfection-d-espionnage-web mouchards type Google Anaytics ou bouton Twitter] (Ghostery m'annonce 6 traqueurs sur la page d'accueil d'
** en plus ça allégera les pages (147,59 Kio pour la page d'accueil), puisque - de JS & - de requêtes externes, les montagnards et ruraux vous remercient :) -> «accessibilisation», ENLARGE YOUR TARGET & YOUR AUDIENCE
** pour les statistiques Web, il y a Piwik (open-source) par exemple
** bannir les URL avec ?utm_machin=truc , #.UxtNpFKkV ou #xtor=RSS-4831
* informer sur les cookies : nom, usage, date de conservation…
** et tant qu'à faire, répondre à tous les [ critères Opquast relatifs à la confidentialité] ([[#confidentialite|#Lien vers cette section « Confidentialité »]])


<span id="voir_aussi">Voir aussi</span> les [ Idées à la con pour financer OWNI] /-]

Voir aussi la page de discussion liée à cet article : (cette remarque vaut pour TOUTES les pages du wiki). ([[#voir_aussi|#Lien vers cette section « Voir aussi »]])

December 18 2012


un wiki | Divers / PourquoiChoisirUnServiceWebNonLiéAuxEUA

Vous propose de contribuer à recenser les services Web NON installés sous la juridiction des États-Unis d'Amérique.

November 23 2012


September 12 2012


Carte des Antennes Relais

Ce site exploite les données du sites .

May 05 2012


Google KNEW Street View cars were slurping Wi-Fi • The Register

Donc : Google a délibérément collecté des données personnelles, certains responsables de Google le savaient, et n'ont manifestement pas « tiqué » plus que ça.

September 15 2011


April 23 2011


February 10 2011


January 08 2011


January 02 2011

Older posts are this way If this message doesn't go away, click anywhere on the page to continue loading posts.
Could not load more posts
Maybe Soup is currently being updated? I'll try again automatically in a few seconds...
Just a second, loading more posts...
You've reached the end.
Get rid of the ads (sfw)

Don't be the product, buy the product!