No Nullifying Nullsoft’s WASTE

Just months after America Online removed what it
called an unauthorized copy of its Nullsoft division’s WASTE file-sharing program, an updated version promising secure P2P communication has reappeared on open-source repository SourceForge.

Version 1.1 of the WASTE
software, which was created by an employee of AOL’s Nullsoft
subsidiary, remained available for download on the site even though AOL demanded back in May that all copies be destroyed.

The new version of the program underscores the difficulty in removing unauthorized copies of programs after they are released on the Internet. Also, because WASTE was first released in May under the GNU General Public
License , which allows anyone to download, modify and
redistribute the software, stopping the redistribution is a major challenge.

WASTE is best described as a mesh-based workgroup tool that allows
private, encrypted peer-to-peer communication on the Internet. The program
was designed for small groups with support for instant messaging, chat and
file-sharing. Because of its encryption capabilities, WASTE can be used
to create “darknets” for music traders looking for ways around the recording
industry’s anti-piracy battle.

While AOL has not publicly commented on the reasons for yanking WASTE from the
Nullsoft site, there has been widespread speculation that AOL’s Warner Music corporate relationship helped fuel the move.

WASTE uses a distributed architecture to connect nodes in a partial mesh type network. Nodes on the network can broadcast and route traffic using
link-level encryption and public keys for authentication. RSA is used for
session key exchange and authentication, and the links are encrypted using
Blowfish in PCBC mode (Propagating Cipher Block Chaining).

An AOL spokesperson said the ISP’s position hasn’t changed since the program first appeared.

In May, AOL posted this note on the Nullsoft site: “Nullsoft is the exclusive owner of all right, title and interest in the Software. The posting of the Software on this website was not authorized by Nullsoft.

“If you downloaded or otherwise obtained a copy of the Software, you acquired no lawful rights to the Software and must destroy any and all copies of the Software, including by deleting it from your computer. Any license that you may believe you acquired with the Software is void, revoked and terminated.”

AOL also said “any reproduction, distribution, display or other use of the Software by you is unauthorized and an infringement of Nullsoft’s copyright in the Software as well as a potential violation of other laws.”