Educause Security Discussion mailing list archives

Re: Internet Content Caching Devices


From: Peter Charbonneau <Peter.Charbonneau () WILLIAMS EDU>
Date: Fri, 4 Dec 2009 07:15:54 -0500

Thanks Valdis,

  Clear and concise, as usual.

p
On Dec 3, 2009, at 3:35 PM, Valdis Kletnieks wrote:

On Thu, 03 Dec 2009 09:04:47 EST, Peter Charbonneau said:
  We do not block P2P at the present time,

As far as I know, nobody's making a content caching appliance that
will
cache P2P traffic, so this will probably reduce the effectiveness of
a cache.  If somebody knows of a P2P-aware cache, feel free to
enlighten me.

                                            so there is some concern
that the appliance might cache copyrighted content.

Actually, you *know* the content will be copyrighted, because it was
almost
certainly produced in a country that's a signatory to the Berne
conventions,
which means it acquires *some* sort of copyright the instant it's
created.
It's actually harder to get something into true 'public domain'
status than
you think.

The *important* question is "did the owner of the copyright want it
to be
cached or not". It's a somewhat subtle but important distinction -
"might cache
copyrighted content" and "might cache *infringing* content" are very
different
beasts indeed.

And it turns out you're *mostly* off the hook on this one, at least
in the US.

http://www.law.cornell.edu/uscode/html/uscode17/usc_sec_17_00000512----000-.html

17 USC 512 (b) addresses system caching, and for the most part it
basically
says "if it's in your cache because a user requested it it's not
your fault".
17 USC 512 (b)(2)(D) seems to be the hardest one to fulfill:

"D) if the person described in paragraph (1)(A) has in effect a
condition that a
person must meet prior to having access to the material, such as a
condition
based on payment of a fee or provision of a password or other
information, the
service provider permits access to the stored material in
significant part only
to users of its system or network that have met those conditions and
only in
accordance with those conditions; and "

Basically, if the data is behind a paywall only 3 of your users have
access
to, you can only serve it from your cache to those 3 users.  The fun
part is
determining "is this behind a paywall?" - no I don't have any words of
wisdom on this one.

17 USC 512(b)(2)(E) is a takedown section - if you accidentally cached
infringing content that somebody else put up without authorization,
you
need to be able to flush it out of your cache upon request.

  Is there an Educause white paper on this already?  Has the
community determined that they are all junk and not worth the money?

If they're not worth the money, why is Aakamai still in business? :)

Seriously, it's all going to be about the hit ratio - what percent
of your
traffic is cacheable.  And quite frankly, I'd expect it won't really
do
that much to save traffic because most of the time people are
hitting all
sorts of different pages as they browse the web.  The one exception is
if there's a "ZOMG! Michael Jackson Died!!" event where everybody is
hitting
the same page(s) over and over, where it can cut down a lot on the
traffic.
Of course, those are the moments you most want a cache in place...



PeteC


Peter Charbonneau
Sr. Network and Systems Administrator
Williams College
(413) 597-3408 (office)
(413) 822-2922 (cell)
OIT will NEVER ask for your password!

Current thread: