July 2018 - cypherpunks-legacy

wiretapping in Europe
by Steven M. Bellovin 05 Jul '18

05 Jul '18

There's a long AP wire story on wiretapping in Europe; see http://www.washingtonpost.com/wp-dyn/content/article/2006/04/08/AR200604080… 29.html There are a number of intriguing statements in the article. For example, in Italy 106,000 wiretaps were approved last year. By contrast, in the US there were only about about 1,700 wiretaps in 2004. (That number does not include Foreign Intelligence Surveillance Act wiretaps. It is also unclear to me if the Italian number represents calls tapped, as opposed to "court orders issued", which is what the US number represents.) Italian prosecutors strongly defend the need for wiretaps, but called the recent warrantless NSA wiretaps "illegal under our judicial traditions". A study at the Max Planck Institute said that Italy, followed by the Netherlands, does the most wiretapping. One of the authors said: wiretaps are much more common on the European continent than in Britain or the United States, where he said there is a more "institutionalized mistrust in the relationship between civil society and a state-organized judiciary." He said research showed that wiretaps are often used to support weak cases and seldom help to achieve a guilty verdict. "The more wiretaps are used, the lower the conviction rates," he said. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[p2p-hackers] Call for Papers for hack.lu 2012
by Alexandre Dulaunoy 05 Jul '18

05 Jul '18

Hi All, If you are doing research in the P2P and security field, you might want to submit a proposal at hack.lu 2012. Thank you, Hack.lu 2012 "It can only be attributable to human error" HAL 23-25 October 2012 / Luxembourg http://2012.hack.lu/ Call for Papers Hack.lu 2012 The purpose of the hack.lu convention is to give an open and free playground where people can discuss the implication of new technologies in society. hack.lu is a balanced mix convention where technical and non-technical people can meet each others and share freely all kind of information. The convention will be held in the Grand-Duchy of Luxembourg in September (23-25.10.2012). The most significant new discoveries about computer network attacks and defenses, commercial security solutions, and pragmatic real world security experience will be presented in a three days series of informative tutorials. We would like to announce the opportunity to submit papers, and/or lightning talk proposals for selection by the hack.lu technical review committee. This year we will be doing workshops on the first day PM and talks of 1 hour or 30 minutes in the main track for the two following days. A capture the flag (organized by @fluxfingers) contest will take place during the whole conference. Scope ====== Topics of interest include, but are not limited to : * Software Engineering and Security * Social Engineering * Honeypots/Honeynets * Spyware, Phishing and Botnets (Distributed attacks) * Newly discovered vulnerabilities in software and hardware * Electronic/Digital Privacy * Wireless Network and Security * Attacks on Information Systems and/or Digital Information Storage * Electronic Voting * Free Software and Security * Assessment of Computer, Electronic Devices and Information Systems * Standards for Information Security * Legal and Social Aspect of Information Security * Software Engineering and Security * Security in Information Retrieval * Network Security * Malware Analysis and Reversing * Forensics and Anti-Forensics * Offensive (and counter-offensive) Information Technology * Mobile Communications Security and Vulnerabilities * CSIRTs, Incident Analysis and Response Deadlines ========= The following dates are important if you want to participate in the call for papers. Full paper submission : no later than 15th July 2012 Notification date : 1st August 2012 http://2012.hack.lu/cfp/deadlines Submission guideline ==================== Authors should submit a paper in English up to 5.000 words, using a non-proprietary and open electronic format. The program committee will review all papers and the author of each paper will be notified of the result, by electronic means. Abstract is up to 400 words. Submissions must be sent to http://2012.hack.lu/cfp/ Submissions should also include the following: 1. Presenter, and geographical location (country of origin/passport) and contact info. 2. Employer and/or affiliations. 3. Brief biography, list of publications or papers. 4. Any significant presentation and/or educational experience/background. 5. Reason why this material is innovative or significant or an important tutorial. 6. Optionally, any samples of prepared material or outlines ready. 7. Information about if yes or no the submission has already been presented and where. Presentations/topics that haven't been presented before will be rewarded. Presentation or research including software or proof-of-concept will be rewarded too. The information will be used only for the sole purpose of the hack.lu convention including the information on the public website. If you want to remain anonymous, you have the right to use a nickname. If the paper is not accepted in the main track, it could be accepted in short or lightning talk session but in this case the speakers' privileges are not applicable. Speakers' Privileges ==================== * Accommodation will be provided (3 nights) * Travel expenses will be covered up to a max amount * Conference speakers night Publication and rights ====================== Authors keep the full rights on their publication/papers but give an unrestricted right to redistribute their papers for the hack.lu convention and its related electronic/paper publication. Sponsoring ========== If you want to support the initiative and gain visibility by sponsoring, please contact us by writing an e-mail to info(AT)hack.lu Web site and wiki ================= http://www.hack.lu/ - @hack_lu CfP website : http://2012.hack.lu/cfp/ -- -- Alexandre Dulaunoy (adulau) -- http://www.foo.be/ -- http://www.foo.be/cgi-bin/wiki.pl/Diary -- "Knowledge can create problems, it is not through ignorance -- that we can solve them" Isaac Asimov _______________________________________________ p2p-hackers mailing list p2p-hackers(a)lists.zooko.com http://lists.zooko.com/mailman/listinfo/p2p-hackers ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

<nettime> Rebirth of Guilds
by Ben Moretti 05 Jul '18

05 Jul '18

[the actual report is well worth reading. i have held privately that the mutual benefit societies and groups that played an important role in south australia in the 19th century arose due to the inherent weakness of the state in the colony, and that these groups would re-arise due to the same reasons. i know adecdotally that there is a long line of these stretching back -- freemasons, mechanics institutes, mutual benefit funds, etc -- so it only seems logical as we move into a weak state mode of history, it would happen again. b.] http://mitsloan.mit.edu/news/releases/2000/guilds.html Rebirth of guilds-MIT Sloan researchers see a shift in workers' organizations CAMBRIDGE, Mass., September 1, 2000 -- Two researchers from the MIT Sloan School of Management predict that over the next decade or so, there will be a rise in guild-type organizations to serve the needs of workers who no longer have traditional jobs. "For workers to enjoy fully the opportunities this new economy presents, they will require institutions to help blunt the greater risks they face," said MIT Sloan Professor Thomas Malone, who co-authored the working paper along with Sloan Research Associate Robert Laubacher. Guilds could provide to contractors and temporary and part-time workers the financial security, benefits, career education, and social opportunities that traditionally were provided by long-term employers. "We are in a significant period of transition in how work is organized," said Malone. "The choices we make now will create the world in which our children and their children will live." Over one-quarter of American workers currently do not hold traditional, full-time jobs, but instead work as independent contractors or as part-time or temporary employees. Some of these people want full-time jobs but can't get them; others, many of them working parents, have voluntarily chosen the freedom and flexibility of working independently. Researchers Malone and Robert Laubacher, believe that the most mobile of these flexible workers, e-lancers-electronically connected free-lancers-will grow in number, as the new economy becomes more dynamic, and teams of individuals come together for projects and then dissolve when the work is completed. The guild approach doesn't rely exclusively on the "usual suspects"-employers and government-to provide traditional job benefits and support. Instead, it relies on a rich ecology of other organizations to look after the needs of mobile workers, as they move from assignment to assignment. "This guild model is a description of what we already see beginning to happen, a prediction what we think will become more common, and a recommendation for policy makers, employers, and others to consider," said Malone. "Nascent forms of these guilds have already begun to appear," said Laubacher. "For example, Working Today, a non-profit in New York, provides low cost health insurance and other services to freelance technology workers in Silicon Alley. These organizations are coming in to fill the gap." In addition, existing groups such as professional societies, unions, community organizations or temporary staffing firms could expand their offerings to meet more of the needs of their members. Another added benefit of guilds in this decentralized economy, "Guild membership might provide the sense of identity that many of us get from positions in large organizations," said Laubacher. This research is an outgrowth of the MIT initiative on "Inventing the Organizations of the 21st Century which explored the new forms of companies and work settings as we move into this new century. The research is also based on findings from surveys and interviews conducted by CDI, a Philadelphia-based Management Recruiting firm, published in "CDI at Work: 21st Century Thinking." For a copy of the complete Malone/Laubacher working paper, go to: http://ccs.mit.edu/21c/21cwpmain.html and click on working paper #033. For nearly a half-century, the MIT Sloan School of Management, based in Cambridge, Mass., has been one of the world's leading academic sources of innovation in management theory and practice. With students from more than 60 countries, it develops effective, innovative, and principled leaders who advance the global economy. # distributed via <nettime>: no commercial use without permission # <nettime> is a moderated mailing list for net criticism, # collaborative text filtering and cultural politics of the nets # more info: majordomo(a)bbs.thing.net and "info nettime-l" in the msg body # archive: http://www.nettime.org contact: nettime(a)bbs.thing.net --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

wiretapping in Europe
by Steven M. Bellovin 05 Jul '18

05 Jul '18

There's a long AP wire story on wiretapping in Europe; see http://www.washingtonpost.com/wp-dyn/content/article/2006/04/08/AR200604080… 29.html There are a number of intriguing statements in the article. For example, in Italy 106,000 wiretaps were approved last year. By contrast, in the US there were only about about 1,700 wiretaps in 2004. (That number does not include Foreign Intelligence Surveillance Act wiretaps. It is also unclear to me if the Italian number represents calls tapped, as opposed to "court orders issued", which is what the US number represents.) Italian prosecutors strongly defend the need for wiretaps, but called the recent warrantless NSA wiretaps "illegal under our judicial traditions". A study at the Max Planck Institute said that Italy, followed by the Netherlands, does the most wiretapping. One of the authors said: wiretaps are much more common on the European continent than in Britain or the United States, where he said there is a more "institutionalized mistrust in the relationship between civil society and a state-organized judiciary." He said research showed that wiretaps are often used to support weak cases and seldom help to achieve a guilty verdict. "The more wiretaps are used, the lower the conviction rates," he said. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[p2p-hackers] Call for Papers for hack.lu 2012
by Alexandre Dulaunoy 05 Jul '18

05 Jul '18

Hi All, If you are doing research in the P2P and security field, you might want to submit a proposal at hack.lu 2012. Thank you, Hack.lu 2012 "It can only be attributable to human error" HAL 23-25 October 2012 / Luxembourg http://2012.hack.lu/ Call for Papers Hack.lu 2012 The purpose of the hack.lu convention is to give an open and free playground where people can discuss the implication of new technologies in society. hack.lu is a balanced mix convention where technical and non-technical people can meet each others and share freely all kind of information. The convention will be held in the Grand-Duchy of Luxembourg in September (23-25.10.2012). The most significant new discoveries about computer network attacks and defenses, commercial security solutions, and pragmatic real world security experience will be presented in a three days series of informative tutorials. We would like to announce the opportunity to submit papers, and/or lightning talk proposals for selection by the hack.lu technical review committee. This year we will be doing workshops on the first day PM and talks of 1 hour or 30 minutes in the main track for the two following days. A capture the flag (organized by @fluxfingers) contest will take place during the whole conference. Scope ====== Topics of interest include, but are not limited to : * Software Engineering and Security * Social Engineering * Honeypots/Honeynets * Spyware, Phishing and Botnets (Distributed attacks) * Newly discovered vulnerabilities in software and hardware * Electronic/Digital Privacy * Wireless Network and Security * Attacks on Information Systems and/or Digital Information Storage * Electronic Voting * Free Software and Security * Assessment of Computer, Electronic Devices and Information Systems * Standards for Information Security * Legal and Social Aspect of Information Security * Software Engineering and Security * Security in Information Retrieval * Network Security * Malware Analysis and Reversing * Forensics and Anti-Forensics * Offensive (and counter-offensive) Information Technology * Mobile Communications Security and Vulnerabilities * CSIRTs, Incident Analysis and Response Deadlines ========= The following dates are important if you want to participate in the call for papers. Full paper submission : no later than 15th July 2012 Notification date : 1st August 2012 http://2012.hack.lu/cfp/deadlines Submission guideline ==================== Authors should submit a paper in English up to 5.000 words, using a non-proprietary and open electronic format. The program committee will review all papers and the author of each paper will be notified of the result, by electronic means. Abstract is up to 400 words. Submissions must be sent to http://2012.hack.lu/cfp/ Submissions should also include the following: 1. Presenter, and geographical location (country of origin/passport) and contact info. 2. Employer and/or affiliations. 3. Brief biography, list of publications or papers. 4. Any significant presentation and/or educational experience/background. 5. Reason why this material is innovative or significant or an important tutorial. 6. Optionally, any samples of prepared material or outlines ready. 7. Information about if yes or no the submission has already been presented and where. Presentations/topics that haven't been presented before will be rewarded. Presentation or research including software or proof-of-concept will be rewarded too. The information will be used only for the sole purpose of the hack.lu convention including the information on the public website. If you want to remain anonymous, you have the right to use a nickname. If the paper is not accepted in the main track, it could be accepted in short or lightning talk session but in this case the speakers' privileges are not applicable. Speakers' Privileges ==================== * Accommodation will be provided (3 nights) * Travel expenses will be covered up to a max amount * Conference speakers night Publication and rights ====================== Authors keep the full rights on their publication/papers but give an unrestricted right to redistribute their papers for the hack.lu convention and its related electronic/paper publication. Sponsoring ========== If you want to support the initiative and gain visibility by sponsoring, please contact us by writing an e-mail to info(AT)hack.lu Web site and wiki ================= http://www.hack.lu/ - @hack_lu CfP website : http://2012.hack.lu/cfp/ -- -- Alexandre Dulaunoy (adulau) -- http://www.foo.be/ -- http://www.foo.be/cgi-bin/wiki.pl/Diary -- "Knowledge can create problems, it is not through ignorance -- that we can solve them" Isaac Asimov _______________________________________________ p2p-hackers mailing list p2p-hackers(a)lists.zooko.com http://lists.zooko.com/mailman/listinfo/p2p-hackers ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

German data rentention law
by Karsten N. 05 Jul '18

05 Jul '18

Hi, I. part: A short overview about the data rentention law in Germany. 1: ISPs have to log the start and end of a user dial-in with time stamp and IP address. They have not to log any content. 2: Public provider of electronic mail have to log all connections of users with time stamp, IP address, login account and the email addresses of sender and recipient for every mail (send and receive). 3: VoIP provider have to log all connections with timestamp, IP address and phone number of caller and recipient. 4: Fon and mobile fon provider have to log all connections and tries with timestamp, phone number and location. 5: Anon services have to log the rewrite of any information, which will be logged by a third party. (Thats all, not very clear.) At the moment, it seems not clear, how tor is affected by this law. I read some papers from the gouverment: "An anon service (like tor or JAP) has to log, because the law will be useless otherwise." Some papers of non-gouverment organizations like ULD: "Tor and JAP are not affected by the telecommunication law, because it is not a telecommunication service (in the case of law) and tor nodes have NOT to log." Together with the JonDos GmbH (JAP) the GPF try to get a legal non-logging solution for tor, but the result is open and we are late. (May be too late?) II. part: suggestion of a technical solution May be, tor can use geoip and divide the world in a logging area and a non-logging area. If the target host is inside the logging area (Germany), the exit node has to be outside. Otherwise a german node can be an exit too. In this case, we have two possibilities: 1: the target host is outside the logging area -> no logging 2: the target host is inside the logging area -> the exit is outside and writes no logs -> an german entry or middle man has to log nothing, because it routes to a not logging exit. Because not all clients will update to a new version very quickly, we need a feature for german exit nodes to reject all routes from old clients, when the node is the exit of the route. Or, if it was more simple for the developer, a feature for exit nodes to define a country (based on geoip) to reject all exit routes. If all german relays used this feature, it may work. Otherwise, all german nodes have to switch to middle man. It is only one suggestion, not the really best solution. Karsten N. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

German data rentention law
by Karsten N. 05 Jul '18

05 Jul '18

Hi, I. part: A short overview about the data rentention law in Germany. 1: ISPs have to log the start and end of a user dial-in with time stamp and IP address. They have not to log any content. 2: Public provider of electronic mail have to log all connections of users with time stamp, IP address, login account and the email addresses of sender and recipient for every mail (send and receive). 3: VoIP provider have to log all connections with timestamp, IP address and phone number of caller and recipient. 4: Fon and mobile fon provider have to log all connections and tries with timestamp, phone number and location. 5: Anon services have to log the rewrite of any information, which will be logged by a third party. (Thats all, not very clear.) At the moment, it seems not clear, how tor is affected by this law. I read some papers from the gouverment: "An anon service (like tor or JAP) has to log, because the law will be useless otherwise." Some papers of non-gouverment organizations like ULD: "Tor and JAP are not affected by the telecommunication law, because it is not a telecommunication service (in the case of law) and tor nodes have NOT to log." Together with the JonDos GmbH (JAP) the GPF try to get a legal non-logging solution for tor, but the result is open and we are late. (May be too late?) II. part: suggestion of a technical solution May be, tor can use geoip and divide the world in a logging area and a non-logging area. If the target host is inside the logging area (Germany), the exit node has to be outside. Otherwise a german node can be an exit too. In this case, we have two possibilities: 1: the target host is outside the logging area -> no logging 2: the target host is inside the logging area -> the exit is outside and writes no logs -> an german entry or middle man has to log nothing, because it routes to a not logging exit. Because not all clients will update to a new version very quickly, we need a feature for german exit nodes to reject all routes from old clients, when the node is the exit of the route. Or, if it was more simple for the developer, a feature for exit nodes to define a country (based on geoip) to reject all exit routes. If all german relays used this feature, it may work. Otherwise, all german nodes have to switch to middle man. It is only one suggestion, not the really best solution. Karsten N. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[drone-list] This week in domestic drone activism
by Gregory Foster 05 Jul '18

05 Jul '18

Nation of Change (Dec 8) - "Drones Come Home, to U.S. Privacy Activists Dismay": http://www.nationofchange.org/drones-come-home-us-privacy-activists-dismay-… Nice survey of anti-drone activism occurring in the United States, beginning with the notable victory obtained earlier this week by the Alameda County Against Drones coalition (ACAD). ACAD headed off an attempt by the Alameda County Sheriff to win approval from the Alameda County Board of Supervisors to accept a DHS grant to acquire a surveillance drone. I would love to hear a summary of the effort that went into successfully undermining that "stealth attack" from the ACAD representatives on this list. The linked article also includes details about domestic drone activism in Buffalo, Syracuse, San Diego, Portland, and Seattle. HT OpPinkPower https://twitter.com/OpPinkPower/status/277474634176266240 gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/ _______________________________________________ drone-list mailing list drone-list(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/drone-list If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: Your computer is too slow to handle this many creation requests!
by coderman 05 Jul '18

05 Jul '18

On Jan 2, 2008 2:10 PM, Eugen Leitl <eugen(a)leitl.org> wrote: > ... > Don't tell me AES is the bottleneck on a Padlock system. VIA C7 > can process way more AES blocks than the (typically crappy) NIC > can handle. compression (zlib) is the Tor bottleneck on a 1.5Ghz C7. crypto throughput with patched openssl (dynamic padlock engine) is: SHA-1 throughput 268,405.03kB/sec with 8k blocks SHA2-256 throughput 263,643.08kB/sec with 8k blocks AES-128-CBC throughput 1,029,006.84kB/sec with 8k blocks -> yes, 8Gbs of AES! AES-256-CBC throughput 779,103.35kB/sec with 8k blocks [ montmult accel via openssl 0.9.9 bn_mont_mult via-mont.pl asm optimization ] rsa 1024 394.1 sign/sec, 8710.6 verify/sec rsa 2048 84.0 sign/sec, 2973.4 verify/sec rsa 4096 14.2 sign/sec, 866.8 verify/sec dsa 1024 1024.0 sign/sec, 852.5 verify/sec dsa 2048 349.2 sign/sec, 294.6 verify/sec hardware entropy throughput is 50kB/sec to 8+MB/sec depending on XSTORE instruction and user space entropy daemon configuration. best regards, ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: private vs. public tor network ... any other options ?
by David Jevans 05 Jul '18

05 Jul '18

We run a private Tor-based network. Email Steve (sms@) or I for questions. What we have contemplated is operating the exit nodes, and mixing into the public Tor network for either the middle or both middle and entry nodes. You could select high bandwidth middle-nodes for this, which would give you reasonably high performance, yet you would have 1-2-or more public nodes in between the user and the exit node. This would provide increased anonymity, while preserving performance and security of the exit nodes (protecting against mal-nodes). The thought was also to select those middle nodes based on measured performance. Thoughts? DJ -----Original Message----- From: Flamsmark <flamsmark(a)gmail.com>

1 0