July 2018 - cypherpunks-legacy

[liberationtech] http://peoplesskype.org/
by Yosem Companys 06 Jul '18

06 Jul '18

The People's SkypeA phone-powered, distributed voice and voting system for the #Occupy Movement call 917-719-2006 Share on Tumblr <http://www.tumblr.com/share> <http://peoplesskype.org/img/1.png> <http://peoplesskype.org/img/2.png> The People's Mic works well for small General Assemblies, but in larger GAs, multiple echoes of the speaker's words is hard to follow. The People's Skype can help! Call & create a new Mic. Share the unique Mic PIN with others. Use phone speakerphones to create a distributed PA system. <http://peoplesskype.org/img/3.png> <http://peoplesskype.org/img/4.png> Listeners can vote by dialing on their phone's keypad. Hundreds of people can listen and vote at the same time. People's Skype can also help in special cases, like communicating across police barriers or kettled areas. <http://peoplesskype.org/img/5.png> <http://peoplesskype.org/img/6.png> Powered by Tropo <https://www.tropo.com/home.jsp> (the coolest), MongoDB<http://www.mongodb.org/> (also cool), & PHP //- - - - - Get the code - - - - - //<https://github.com/jrbaldwin/OWS-Globe-/blob/master/augmented_peoples_mic/t…> Bug Reports, Suggestions, Complaints, etc.? jrbaldwin--at--gmail--d0t--c0m Building Better Speech + Globe project by -- jrbaldwin<http://jrbaldwin.com/> -- Instructors: Melanie Crean + Chris Csikszentmihalyi Parsons, the New School for Design. Creative Commons License: [image: Creative Commons License]<http://creativecommons.org/licenses/by-nc-sa/3.0/> _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: ADMIN: no money politics, please
by zooko 06 Jul '18

06 Jul '18

Hey folks: you are welcome to discuss money politics over at the p2p- hackers mailing list: http://lists.zooko.com/mailman/listinfo/p2p-hackers I'm extremely interested in the subject myself, having taken part in two notable failed attempts to deploy Chaumian digital cash and currently being involved in a project that might lead to a third attempt. Regards, Zooko --- http://allmydata.org -- Tahoe, the Least-Authority Filesystem http://allmydata.com -- back up all your files for $10/month --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

Re: When anyone can publish, who's a journalist now?
by Anuj Desai 06 Jul '18

06 Jul '18

Declan, Your readers might be interested in knowing that many courts have been forced to deal with the question, "Who is a journalist?" over the years in circumstances similar to what appear to be Ms. Leggett's. Several states have laws, known as shield-laws, that specifically protect journalists from testifying in certain circumstances, and those laws often contain definitions of "journalist" or "reporter" or "media". In addition, the First Amendment provides a separate protection. In the statutory context, the courts are of course bound by the legislative definitions of who is a journalist. These definitions vary from state to state, but in most states depend upon some sort of professional affiliation. Under the First Amendment, however, courts have been much broader, focusing primarily on whether the person claiming the journalist's privilege had an intent to disseminate the information to the public **at the time s/he gathered it**. Bearing in mind the Supreme Court's admonition that "Freedom of the press is a 'fundamental personal right' which is not confined to newspapers and periodicals. It necessarily embraces pamphlets and leaflets. ... The press in its historic connotation comprehends every sort of publication which affords a vehicle of information and opinion,'" Branzburg v. Hayes, 408 U.S. 665, 704 (1972) (quoting Lovell v. City of Griffin, 303 U.S. 444, 450, 452 (1938)), courts have been unwilling to restrict press rights to the institutional press. Although the Supreme Court has never directly addressed the question, "Who is a journalist?" in the context of the journalist's privilege (indeed, the fear that courts would have to deal with it was part of the majority's rationale for *not* granting the privilege in the seminal Branzburg case), many federal courts have addressed it, with varying results depending on the circumstances. See, e.g., In re Madden, 151 F.3d 125 (3d Cir. 1998); Schoen v. Schoen, 5 F.3d 1289, 1293-94 (9th Cir. 1993); Von Bulow v. Von Bulow, 811 F.2d 136 (2d Cir.), cert. denied, 481 U.S. 1015 (1987); Silkwood v. Kerr-McGee Corp., 563 F.2d 433 (10th Cir. 1977); Blum v. Schlegel, 150 F.R.D. 42 (W.D.N.Y. 1993); Apicella v. McNeil Labs., Inc., 66 F.R.D. 78, 84-85 (E.D.N.Y. 1975). This is not to say that answering the question is simple in any give circumstance, but simply to note that courts have been doing it for a long time. One other point that should be clarified in light of this post is that, in every jurisdiction, the journalist's privilege is a *qualified* privilege and yields to the needs of evidence-gathering in many cases. No one, not even a New York Times reporter [I use the NYT rather than Wired because we know that some would question your own status as a journalist :-) ], gets the privilege in every circumstance. The person attempting to force a journalist to testify in the face of the privilege simply has to show that 1) the information they seek is relevant to the lawsuit for which they are seeking it; 2) their suit is not frivolous; and 3) they have exhausted all other reasonable means of obtaining the information (or some other similar variation of this three-part test). So, even having a broad definition of "journalist" does not completely open the door to an unfettered right to refuse to testify. -Anuj Anuj C. Desai University of Wisconsin Law School 975 Bascom Mall Madison, WI 53706 acdesai(a)facstaff.wisc.edu **********

1 0

RE: When anyone can publish, who's a journalist now?
by Matthew Pemble 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 What about (fully recognised and published) part-time journalists? I have a monthly column in a trade magazine. It takes up about 2% of my working time. What protection should that material have and, considering that they are compiled using the same systems, how does that affect the 98% of my work which is as a security consultant? Actually, as I am a Brit, there is no protection at all but consider the hypothetical case. - - -- Matthew Pemble -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> iQA/AwUBO40PG2rvMjpl5yaUEQKE1gCgzTnJqTTqx9cf/jpx71opj4B/CDIAoPeJ iI5aJcRTKlpp3Yq6XHYGL9JY =LMTe -----END PGP SIGNATURE----- **********

1 0

Re: FC: When anyone can publish, who's a journalist now?
by terry.s＠juno.com 06 Jul '18

06 Jul '18

Hi Declan! On Wed, 29 Aug 2001 11:01:30 -0400 Declan McCullagh <declan(a)well.com> writes: > Now the thought experiment is this: If the Profession of Jornalists > (PoJ) chooses to defend the proposition that anyone who wants to be > one automatically is one, then whether I am today a journalist or not is > a role decision that presumably I get to make, both to adopt the role > and to rescind the role, according to my whim. As the role has and > claims substantial privileges, what bargain would the PoJ offer to society > at large to justify, whether politically or morally or economically, > the extension to the many what had heretofore been special privileges > afforded to the PoJ few? In other words, if the right claimed is to > not tell law enforcement what one knows today in exchange for the > promise to eventually tell the entire public that part of it that can > be woven into a readable narrative, then the terms of the bargain > are at least clear. This sounds very much like an issue of who is clergy, protected by privilege of extending confidence and being exempt from compelled testimony. Unlike for physicians, and subject to many quirks lawyers, there can be no legitimate form of professional licensing for clergy, and likewise for journalists. In some religions there is a hierarchical structure of central authority which defines clergy and issues judicially reviewable credentials, or not (just as for press). In others, everyone is considered clergy, with only a distinction of who also obtains credentials from an IRS (of all agencies) sanctified supposed authority, or who functions as such in a professional as opposed to other role. More ethical states wrestle with legal ambiguity defining clergy, while other states try to pretend no one is clergy unless individuals license their religious rights with those problem states. The suggestion that a church with lay deacons acting as clergy cannot extend clerical legal status to other than professional employee clergy has been litigated, with findings that law cannot legally make such distinctions Constitutionally. The issues of a religion where many practitioners do not associate with an IRS approved corporate church, while most practitioners are acting as clergy to self if not also others, have not yet been resolved such that our legal system deals with current reality of legal fact. Journalistic privilege of confidence is very similar to that for clergy, with one set of issues that differ. Due to traditions of clerical counseling, clergy in many states are exempt from medical licensing laws regarding practice of Psychology. In turn, law in some states subjects clergy to compelled reporting of verified or suspected child and/or elderly abuse, as it does for doctors, teachers, social workers, etc. Clergy can also generally be sued for malpractice in such counseling if offered to others. The same issue exists with clergy as journalists of a supposed public service embedded in the profession as the historic rationalization for special legal status. At the time the Bill of Rights was adopted, most states either still were or had recently been theocracies, and retained traits of such church control of state. Some of those survive today despite the 14th Amendment making that illegal as of 1868. Splinter religion clergy not associated with large corporate churches presumed to somehow offer quasi-theocratic government public services may parallel the direction the specialty press has gone. Are the millions of minor variants of thousands of documented religions now present in the USA akin to the nature of press to now narrowcast to special interest groups, rather than mostly be a key element of linking government to the populace broadly? In either case it's easy to argue that neither clergy or press are universally today serving their historic traditional roles in society. It's equally easy to argue they deserve the same Constitutional protections long standing, as the roles under which press or clergy exist, whether serving narrow or broad audiences in particular cases, are adapted to the exponentially increased diversity of today's populace. Terry ********** ------------------------------------------------------------------------- POLITECH -- Declan McCullagh's politics and technology mailing list You may redistribute this message freely if you include this notice. Declan McCullagh's photographs are at http://www.mccullagh.org/ To subscribe to Politech: http://www.politechbot.com/info/subscribe.html This message is archived at http://www.politechbot.com/ ------------------------------------------------------------------------- ----- End forwarded message -----

1 0

FC: Replies to "When anyone can publish, who's a journalist now?"
by Declan McCullagh 06 Jul '18

06 Jul '18

Previous Politech message: http://www.politechbot.com/p-02445.html **********

1 0

Re: Two convicted in U.K. for refusal to decrypt data
by Adam Funk 06 Jul '18

06 Jul '18

On 2009-08-13, David SMITH wrote: > So the people who come on gnupg-users asking for help because they've > forgotten their passphrase or accidentally deleted their ~/.gnupg > directory don't exist? > > I guess that's a new way of replying to them: "You don't exist". > > Not forgetting the possibility of malicious intentions - trying to > frame > someone by putting encrypted data onto someone's computer and tipping > off the authorities. http://news.zdnet.co.uk/internet/0,1000000097,2073974,00.htm In a stunt organised by the civil liberties group Stand, The Home Secretary Jack Straw was sent details to a crime Sunday that could earn him up to two years in prison if the controversial e-commerce bill were made law. ... According to Stand an encrypted email was sent to Mr Straw Sunday afternoon containing a confession to a real crime. The key to decrypt the message will be in Mr Straw's name. Stand will tip off the Metropolitan Commissioner of Police Monday, informing him that Mr Straw has important information about a crime. If the e-commerce bill were in place, Straw would be required to hand over the decryption key or face up to two years in prison. "In principle, under the bill, Jack Straw would have to prove he never had the key in the first place. We are hoping this will help him understand that this is unworkable, an intolerable reversal of the burden of proof and against the Human Rights Act," Says Malcolm Hutty, spokesman for Stand. (September 1999) _______________________________________________ Gnupg-users mailing list Gnupg-users(a)gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users

1 0

Re: [s-t] privacy and caution digest #2
by Bryan O'Sullivan 06 Jul '18

06 Jul '18

On Mon, 2003-10-27 at 14:49, Nick B wrote: > Nobody, but nobody, builds _anything_ electronic from the ground up. > Not me, not you, not Apple, not Microsoft, not Sony, not Intel, not > the NSA. [Apple,] Sony, Intel and the NSA get closer by fabbing their > own silicon. No Such Agency doesn't fab much of anything; they can't afford to. They and their ilk are far more interested in things like FPGAs and adapting numerical algorithms to COTS SIMD hardware, such as graphics processors (a la http://www.gpgpu.org/) > Who knows > what sort of spyware those tools are adding? Don't be silly. The amount of computation you need to do to get a circuit of any useful complexity to do something predictable is enormous. You can't stuff a thousand CPUs and 200 engineers into an Applied Materials mask etch machine, so that they can rig a WiFi card and antenna onto your PS2's vector chip without Sony finding out. Even if you could, how would they talk to the evil animalcules inside the Novellus metal deposition machine in the facility next door, so the right traces get metallised? Never even mind that automatically figuring out what a bunch of geometry in a set of masks represents is vastly harder than reverse compilation for software. > It is actually quite hard. And if anybody > ever does implement it really well, they can win, in principle even > against projects like Plan 9 No they can't. Identifying something as "a compiler" and instrumenting the right code is impossible for automated systems. <b -----------------------------------------------------------

1 0

Re: [s-t] privacy and caution digest #2
by David M Chess 06 Jul '18

06 Jul '18

Michael Turyn: "whatever we do which might displease the government or a real or fictive person with power is almost certainly being done at the same time by a lot of other people." That's only a statistical comfort, of course. But then most comfort probably is. (Who designed this place, anyway?) Andrew A. Gill: >> if anyone knows of a good combined worldview that >> satisfies both, I'd love to hear about it. > s/hear about it/torture you until you let me patent it/ Never! I patent things only in self-defense. *8) I'd prefer you shouted it from the rooftops, so no one could patent it... Andy Latto: "Instead, your HTML repair and rendering engine should be on top, and the security layer should be underneath. When the rendering engine determines that the HTML, as repaired, instructs it to delete a file, it calls delete-a-file-if-security-permits, and *then* the security layer gets involved, deciding whether that particular file system operation (or network operation, or whatever) should be permitted at that time." That would be ideal. Unfortunately on many boxes it's not practical to slip the security layer in under the rendering layer, because the rendering layer is in the operating system (and the security layer is either above that for practical reasons, or in a separate box entirely). But when you can do it, it's great. How many operating systems (not counting the JVM as an operating system) have access controls based on the network address / email address / PGP credentials of the (effective) originator of the request? There are a few places where security models do allow for that. The JVM is one (to an extent). The Execution Control Lists in Lotus Notes are another (you can tell Notes who you trust to execute what classes of function, and then email from untrusted people that contains scripts to format your hard disk won't work), and I think the signed macros in recent (after I stopped paying close attention) versions of Microsoft Office are another. Things like ZoneAlarm and Norton Whatever do a sideways version of this, by granting network access using the identity of the program that's asking as the effective 'identity' (this has some interesting properties). It'd be cool (if maybe expensive performance-wise?) if some widespread OS had a sufficiently rich notion of requestor identity (beyond "people with accounts on this box") to do it down at the filesystem / memory-access / etc level. Some Linux version? (All Unix machines everywhere, using a facility that I am temporarily ignorant of? BeOS?) DC -----------------------------------------------------------

1 0

RE: Six Step IE Remote Compromise Cache Attack
by Drew Copley 06 Jul '18

06 Jul '18

> -----Original Message----- > From: Benjamin Franz [mailto:snowhare@nihongo.org] > Sent: Wednesday, November 05, 2003 2:50 PM > To: Thor Larholm > Cc: Liu Die Yu; bugtraq(a)securityfocus.com > Subject: RE: Six Step IE Remote Compromise Cache Attack > > > On Wed, 5 Nov 2003, Thor Larholm wrote: > > > This post raises an interesting question. Is our goal to find new > > vulnerabilities and attack vectors to help secure users and > critical > > infrastructures, or is our goal to ease exploitation of existing > > vulnerabilities? > > > > There are no new vulnerabilities or techniques highlighted in this > > attack (which is what it is), just a combination of several already > > known vulnerabilities. This is not a proof-of-concept designed to > > highlight how a particular vulnerability works, but an exploit > > designed specifically to compromise your machine. All a malicious > > viruswriter has to do is exchange the EXE file. > > > > Believe me, I am all in for full disclosure and detailing > every aspect > > of a vulnerability to prevent future occurances of similar threats, > > but I don't particularly think that we should actively be trying to > > help malicious persons. > > I have mixed emotions about this. On one side - why put > millions of systems at risk to script kiddies? On the other > side, as noted by the poster, one of these vulnerabilities > has been known for more than _TWO YEARS_. Surely far more > than enough time for MS to have actually _fixed_ the problem > if they intended to. MS seems (at least in some cases) to > ignore security problems until someone publically 'holds > their feet to the fire' over them. I suspect this happens > when the problem 'runs deep' in their code and will require > more than fixing a boundary limit check and recompiling. Very well said. I would note that I believe their strategy for securing code wants to be inline with their strategy for pushing their products. The company is full of strategies, and this is good. But, the primary stategy needs to be to "put security first". Especially, post 9/11. A few others things... As with all security issues, the researcher is not bound to tell anyone about them. Liu Die Yu could have just shared this with his friends, and we all could have kept these to do as we will. Kind of like keeping your own personal nuclear weapon. Who knows? Maybe there will be a rainy day. My question then, to everybody, is "would you have preferred that he keep this to himself and his friends, or would you have preferred for him to have disclosed this, with a workaround?" Because Liu Die Yu has worked with Microsoft (China) in the past, and he has, unfortunately, found that he can not trust them. Maybe he talked to the wrong person. Who knows? But, we can all see plainly that Microsoft was without excuse to ignore these problems all of these years. What was the thinking behind that? Was somebody's job saved so this could happen? Was somebody able to make a more successful career move because of this? Are researhers like Liu Die Yu too intimidating to deal with, too challenging, too successful? What would have happened if someone else put these flaws together and discovered they could make them work? What would have been the case in that situation? Why did Microsoft ignore the advice of all these researchers and not do something about these issues? Why did they think they could go it alone in this way? The advice was free for them. They had almost two years to fix this, should Liu Die Yu even conceivably be forced to wait another three to six months from a company that has shown him bad dealings in the past? This is using the system at its' best. It is an example of the best kind of system. There is no bureaucracy, there is no limitation, no glass ceilings, no prejudice... Anyone who is capable, come, find bugs. Microsoft is putting out millions of dollars in bounties for worm writers while people like Liu Die Yu are just trying to get into the security field, so they can do what they are best at. What they love to do. It isn't like he is incapable of doing this. He has found swarms of bugs since starting to look for them. Bounties work. We know they do. But, let's close the gap. Let's make sure that tomorrow's bugs are not found outside of the Full Disclosure community. Why would anybody be making these kinds of shortcuts? What good is AV or Firewalls or anything if your OS let's the attacker through? We worry about script kiddies trying to figure out what Liu Die Yu did here to make their own version? We should be worrying about rogue nations and criminal organizations creating teams of bug finders so they can penetrate any system they want to. The computers themselves are worthless, compared to human lives, but the information within them are invaluable. Blueprints. Military strategies. Political strategies. Security strategies. Governmental secrets. Corporate secrets. Identities. Weaknesses. I have to wonder when people when begin to figure out that security bugs mean... security holes mean: keys to the application, and generally, keys to the system. We can ponder all we want about the NSA having a backdoor, or merely Microsoft having a backdoor... But anytime someone finds a security hole like this, they have a backdoor. If you want, ask the researcher to please alert the vendor. Be rude about it, whatever. But, understand that if they were bad or interested in doing evil... They would not report it to the world. They would use it. Lastly, just to be fair. Most researchers that find bugs in Microsoft's products do so at least partly because everyone uses their software. Microsoft actually has a code auditing team, they actually have made moves towards securing their software. Most companies have not done this. Their code is not even looked at. If the case were anything different, Liu Die Yu would just put his resume on monster or dice, and he wouldn't be speaking to us right now. He would be working in the field he loves. Drew Copley Research Engineer, eEye Digital Security Fun quote for the day: "Who knows what evil lurks in the hearts of men? The Shadown knows!" > > -- > Benjamin Franz > > Gauss's law is always true, but it is not always useful. > -- David J. Griffiths, "Introduction to Electrodynamics" > > > ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 0.97c removed an attachment of type application/pgp-signature]

1 0