It's a hot selling point for broadband. Take the most popular sites (such as TradeMe, Stuff, TVNZondemand as examples) that people visit and let them go at it, all-you-can-eat, without having to worry what the final bill will be. The forums here on Geekzone have plenty of discussions around ISPs offering unmetered traffic to customers.
Steve Waddington, one of the director's of Exetel (an Australian ISP), recently blogged about a customer's suggestion on adding more sites (that are external to Exetel's network) to their unmetered offerings:
I can tell you one thing; unmetered content certainly isn't 'free' to the ISP. Today, (and Exetel almost certainly can't be buying at the best price for global Internet) the past-our-border portion of the total cost to supply an Internet service is in the order of 7-8%. If other people buy better than we do, it would only mean that for them, the ratio is even lower, say 5%.
What that means is the so called 'unmetered' content, apparently 'free' to the end user, costs the ISP around 95% of the full per Mbps of global Internet access anyway.
So, you either believe your perpetual motion machine was a good deal, or, you have to accept that the unmetered content so generously offered by your ISP is paid for somewhere else in the total amount you pay.
Steve continues on about how this all came about:
Thinking back, it seems to me this is a fundamental error in the cost of service supply that was made by 'someone' years ago (around '98-'99 I suspect), and has been duplicated (or mindlessly followed, however you want to look at it) by others ever since.
In those days, global Internet access accounted for around 1/3 of the operating cost of an ISP, and domestic backhaul added another 15-20%. So by supplying traffic from a local source, such as peering or caching, was an enormous benefit to the ISP's bottom line. Ignoring the cost of peering, the proxy server cost, the engineer/sysadmin time etc, etc is easy to to, as in most case they are considered necessary anyway, or treated as sunk costs. Therefore at some point, on someone's spread sheet to financial management, that content delivery would have shown up as zero. And the marketing guy that saw that would hardly have to be a genius to realize he could be a hero by designing a promotion that offered content that cost zero to the company for 'free' to their customers.
One deception leads to another, and a decade on you have people really believing unmetered content is actually free. No wonder that word is considered the most powerful in marketing. That, and peoples unerring propensity to believe what they want to believe.
Unmetered traffic isn't free - you are still paying for it, it's just hidden as part of something else in your monthly bill.
Even though I have quoted a good chunk of Steve's blog post, I still highly recommend reading the entire thing here. His blog is a good read for those interested in what happens behind the scenes at an ISP.
It seems my previous posts on the iPad 3G coverage in New Zealand have hit something - a lot of people thought I was supporting one network operator or another. Not at all - it's just to let people know where they would get more from their new mobile device and why.
I urge people to read the first post in the series "Where can you get 3G coverage for your new Apple iPad in New Zealand" for a complete picture of 3G coverage and to understand what's at play here.
Now the good news: if you have plans to buy an iPhone 4 when it hits the local market this Friday, then you will have 3G almost everywhere, regardless of which mobile operator you decide to go with.
That's because the iPhone 4 works in all 3G frequencies currently available in New Zealand: 850MHz (Telecom XT), 900 MHz (Vodafone 3G Extended) and 2100 MHz (Vodafone 3G).
As per my previous posts, Telecom XT runs a single 850 MHz network.
Vodafone runs two 3G networks, complementing each other. Combined, Vodafone 3G (2100MHz) and Vodafone 3G Extended (900MHz).
Bot operators claim to cover 97% of the New Zealand population (or as they say "where people live, work, play").
Here is a comparison of 3G coverage you will get when using the Telecom XT (left) and Vodafone 3G/3G Extended networks (right):
Click the map for a bigger version. Make sure you visit both Telecom New Zealand 3G coverage map and Vodafone New Zealand 3G coverage map to see for yourself. When looking the Vodafone New Zealand map remember to check the 3G and 3G extended boxes to get the complete view.
Everyone heard about the Hell Pizza database leak, but what is only now showing up in the media is a story that seems to be developing for more than twelve months. Back in August 2009 some Geekzone users reported receiving spam on email addresses used only with Hell Pizza's online ordering system.
At the time someone posted in our forums on behalf of Hell Pizza saying "we don't sell email addresses (very bad), nor have we been hacked (our web servers are behind dedicated, monitored firewalls). We use software from interspire and I'm not aware of any security vunerabilities in the latest version we have installed."
Fast forward thirteen months to this week and blog Risky.Biz published "I know what you ate last summer" where it reveals that "multiple intruders have compromised Hell Pizza's 400mb (sic) database. While it does not contain any credit card information, it does contain in excess of 230,000 rows of customer entries."
It continues "When contacted by Risky.Biz, Hell Pizza co-owner Stuart McMullin said he was unaware of the data breach. He offered no comment when a list of questions was e-mailed to him, beyond acknowledging the contact from "concerned customers" in 2009.
"I have spoken to my IT staff and they are not aware that our site was hacked or any records lost," McMullin wrote in an e-mail to Risky.Biz. "There were a couple of 'customers' that thought it was the case last year who emailed us - perhaps these are the sources you are referring to - but not to our knowledge."
The New Zealand media found the story, and the NBR published "Hell Pizza: customer database could have been hacked". Chris Keall contacted Hell Pizza director Warren Powell who said "Everybody gets hacked into, even the Pentagon." He also added "The potentially stolen data was "of no value to anyone."
That's the problem. The data is valuable to spammers and for anyone who would like to try any of those 230,000 passwords in other sites - it's a known fact that many Internet users simply reuse the same password in different sites. This can potentially lead to identity theft. This is serious business.
According to a story on Stuff "Hell's director Warren Powell told NZPA he is unaware of any breach in security, and IT staff have so far found nothing proving information has been stolen."
Now comes the interesting part... Mr Warren Powel said to Stuff "If there is breach of security it will appear, data would have been removed and therefore it would appear as a download. We'll be able to find out the day and the computer it was downloaded to and we'll be able to prosecute this person if they exist."
They won't find anything. If Risky.Biz is correct, the old Hell Pizza ordering system was developed with poor attention to security, and the application running on the user's browser was communicating directly with the database.
This means any connection to the database would be considered valid, therefore those "dedicated, monitored firewall" wouldn't do any good.
It also means anyone could issue commands to the database and receive a response with that data - in which case it wouldn't appear as a download at all, but as a normal web request in the web server logs.
I tried contacting Hell Pizza via email but received no reply.
People on Geekzone noticed the Hell Pizza Ireland website could still be running the old, apparently vulnerable version of the ordering system. Currently both Hell Pizza Australia and Hell Pizza UK are returning server errors, with messages that lead us to believe they too were running the apparently vulnerable site version until recently - perhaps taken down to prevent further access to data?
I was alerted by one of the Geekzone users of further evidence that there was a vulnerability on the old Hell Pizza ordering system, and a Google search reveals the existence of a script that was there only to execute SQL commands - so vulnerable in fact that even Google found it and cached a result:
In an email sent to customers this week, Stu McMullin, Hell Pizza Director says "Whilst we are still investigating the matter, we can confirm that the information was obtained without our knowledge and we have approached the New Zealand Police with a view to lodging a formal complaint. Hell recognises the importance of protecting customer information and additional security measures were implemented earlier this year when our new website was rolled out (again, we reiterate that this is not an issue affecting the new website). As a further security measure your may wish to consider changing your passwords on other sites if they were the same as the old Hell Pizza website."
Juha Saarinen reminded us, via Twitter, of the Privacy Commisioner's Privacy Breach Guidelines.
How long since Hell Pizza had knowledge of this security breach? Or did they only realise something was happening after Risky.Biz contaced them? If they did have knowledge, why wasn't it disclosed before? Will we see other New Zealand companies working to improve their IT security practices after seeing this happening?