July 2018 - cypherpunks-legacy

Re: [liberationtech] The first rule about censorship is we don't talk about censorship
by Rick Falkvinge (Piratpartiet) 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The same thing will happen with links to The Pirate Bay. You cannot talk about them on Facebook. Imagine 30 years ago, when we were on the phone and discussed something, if a voice had popped in and said "you have mentioned an inappropriate subject. Please refrain from inappropriate communications." We would have been horrified. It would have been seen as so dystopic, that if it had been written in a novel of fiction, it would have been discarded as just unrealistic. Well, we're there. Cheers, Rick On 04/19/2012 12:30 AM, James Losey wrote: > Hi All, > > James Ball wrote an article for the Guardian > <http://www.guardian.co.uk/technology/2012/apr/18/richard-odwyer-extradition…> > about tvshack.net <http://tvshack.net> and noticed a curious thing: the > Facebook share button does not allow you to share the link to Facebook > because it includes the words "tvshack.net <http://tvshack.net>." > Although I was able to post the link itself to Face but took a > screenshot of the message saying that the article contains language that > is "spammy or > unsafe." http://jameslosey.com/post/21345118902/when-spam-filters-go-to-far > > Does anyone else have more examples of this? > > Best, > James > > > > _______________________________________________ > liberationtech mailing list > liberationtech(a)lists.stanford.edu > > Should you need to change your subscription options, please go to: > > https://mailman.stanford.edu/mailman/listinfo/liberationtech > > If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" > > You will need the user name and password you receive from the list moderator in monthly reminders. You may ask for a reminder here: https://mailman.stanford.edu/mailman/listinfo/liberationtech > > Should you need immediate assistance, please contact the list moderator. > > Please don't forget to follow us on http://twitter.com/#!/Liberationtech - -- Rick Falkvinge Founder of the first Pirate Party Piratpartiet SE @Falkvinge +46708303600 Blog, bio and press photos at http://falkvinge.net/photos-bio/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iEYEARECAAYFAk+Tk3EACgkQ7pnTrWI4jx3cfQCfVA3TsjvjnUBpo93+SCZiJTUV lF4AoJ+vSMkRHBZ4M24DXqarjC0hjBtQ =WB/1 -----END PGP SIGNATURE----- _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. You may ask for a reminder here: https://mailman.stanford.edu/mailman/listinfo/liberationtech Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

nym-0.2 released
by Jason Holt 06 Jul '18

06 Jul '18

nym-0.2 is now available at: http://www.lunkwill.org/src/nym/ My tor server is currently down, so I can't set up a public trial of this, but perhaps someone else will. This release makes the following improvements: * Tokens are now issued one-per-IP to clients via a "token" CGI script. Tokens are still blindly issued, so nobody (including the token issuer) can associate tokens with IP addresses. The list of already-served IPs could be periodically removed, allowing users to obtain new pseudonyms on a regular basis. (Abusers will then need to be re-blocked assuming they re-misbehave). * A token can be used to obtain a signature on a client certificate from a separate "CA" CGI script (potentially on a different machine). Tokens can only be "spent" to obtain one cert. Code to make a CA, client certs and have the certs signed is included. * The CA public key can be installed on a third web server (or proxy) to require that users have a valid client certificate. Servers can maintain a blacklist of misbehaving client certs. Misbehavers will then be unable to access the server until they obtain a new token and client cert (via a new IP). My proposal for using this to enable tor users to play at Wikipedia is as follows: 1. Install a token server on a public IP. The token server can optionally be provided Wikipedia's blocked-IP list and refuse to issue tokens to offending IPs. Tor users use their real IP to obtain a blinded token. 2. Install a CA as a hidden service. Tor users use their unblinded tokens to obtain a client certificate, which they install in their browser. 3. Install a wikipedia-gateway SSL web proxy (optionally also a hidden service) which checks client certs and communicates a client identifier to MediaWiki, which MediaWiki will use in place of the REMOTE_ADDR (client IP address) for connections from the proxy. When a user misbehaves, Wikipedia admins block the client identifier just as they would have blocked an offending IP address. -J ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[Dewayne-Net] Tracking Secret Operatives Not Too Tough
by Dewayne Hendricks 06 Jul '18

06 Jul '18

[Note: This item comes from reader Randall. DLH] >From: Randall <rvh40(a)insightbb.com> >Date: March 11, 2006 9:39:16 PM PST >To: Dave <dave(a)farber.net>, Dewayne Hendricks ><dewayne(a)warpspeed.com>, Declan McCullagh <declan(a)well.com>, JMG ><johnmacsgroup(a)yahoogroups.com> >Subject: Tracking Secret Operatives Not Too Tough > ><http://htdaw.blogsource.com/post.mhtml?post_id=276539> > > >Sunday, March 12, 2006 at 12:37 AM EST >Internet blows CIA cover >It's easy to track America's covert operatives. All you need to >know is >how to navigate the Internet > >..By John Crewdson >Tribune senior correspondent > >March 11, 2006, 12:00 PM CST > >WASHINGTON -- She is 52 years old, married, grew up in the Kansas City >suburbs and now lives in Virginia, in a new three-bedroom house. > >Anyone who can qualify for a subscription to one of the online >services >that compile public information also can learn that she is a CIA >employee who, over the past decade, has been assigned to several >American embassies in Europe. > >The CIA asked the Tribune not to publish her name because she is a >covert operative, and the newspaper agreed. But unbeknown to the CIA, >her affiliation and those of hundreds of men and women like her have >somehow become a matter of public record, thanks to the Internet. > >When the Tribune searched a commercial online data service, the result >was a virtual directory of more than 2,600 CIA employees, 50 internal >agency telephone numbers and the locations of some two dozen secret >CIA >facilities around the United States. > >Only recently has the CIA recognized that in the Internet age its >traditional system of providing cover for clandestine employees >working >overseas is fraught with holes, a discovery that is said to have >"horrified" CIA Director Porter Goss. > >"Cover is a complex issue that is more complex in the Internet age," >said the CIA's chief spokeswoman, Jennifer Dyck. "There are things >that >worked previously that no longer work. Director Goss is committed to >modernizing the way the agency does cover in order to protect our >officers who are doing dangerous work." > >Dyck declined to detail the remedies "since we don't want the bad guys >to know what we're fixing." > >Several "front companies" set up to provide cover for CIA >operatives and >its small fleet of aircraft recently began disappearing from the >Internet, following the Tribune's disclosures that some of the planes >were used to transport suspected terrorists to countries where they >claimed to have been tortured. > >Although finding and repairing the vulnerabilities in the CIA's cover >system was not a priority under Goss' predecessor, George Tenet, one >senior U.S. official observed that "the Internet age didn't get >here in >2004," the year Goss took over at the CIA. > >CIA names not disclosed > >The Tribune is not disclosing the identities of any of the CIA >employees >uncovered in its database searches, the searching techniques used or >other details that might put agency employees or operatives at >risk. The >CIA apparently was unaware of the extent to which its employees >were in >the public domain until being provided with a partial list of names by >the Tribune.' > >At a minimum, the CIA's seeming inability to keep its own secrets >invites questions about whether the Bush administration is doing >enough >to shield its covert CIA operations from public scrutiny, even as the >Justice Department focuses resources on a two-year investigation into >whether someone in the administration broke the law by disclosing to >reporters the identity of clandestine CIA operative Valerie Plame. > >Not all of the 2,653 employees whose names were produced by the >Tribune >search are supposed to be working under cover. More than 160 are >intelligence analysts, an occupation that is not considered a covert >position, and senior CIA executives such as Tenet are included on the >list. > >Covert employees discovered > >But an undisclosed number of those on the list--the CIA would not say >how many--are covert employees, and some are known to hold jobs that >could make them terrorist targets. > >Other potential targets include at least some of the two dozen CIA >facilities uncovered by the Tribune search. Most are in northern >Virginia, within a few miles of the agency's headquarters. Several are >in Florida, Ohio, Pennsylvania, Utah and Washington state. There is >one >in Chicago. > >Some are heavily guarded. Others appear to be unguarded private >residences that bear no outward indication of any affiliation with the >CIA. > >A senior U.S. official, reacting to the computer searches that >produced >the names and addresses, said, "I don't know whether Al Qaeda could do >this, but the Chinese could." > >Down on "The Farm" > >For decades the CIA's training facility at Camp Peary, Va., near >historic Williamsburg, remained the deepest of secrets. Even after >former CIA personnel confirmed its existence in the 1980s the agency >never acknowledged the facility publicly, and CIA personnel >persisted in >referring to it in conversation only as "The Farm." > >But an online search for the term "Camp Peary" produced the names and >other details of 26 individuals who according to the data are employed >there. Searching aviation databases for flights landing or taking off >from Camp Peary's small airstrip revealed 17 aircraft whose ownership >and flight histories could also be traced. > >Although the Tribune's initial search for "Central Intelligence >Agency" >employees turned up only work-related addresses and phone numbers, >other >Internet-based services provide, usually for a fee but sometimes for >free, the home addresses and telephone numbers of U.S. residents, as >well as satellite photographs of the locations where they live and >work. > >Asked how so many personal details of CIA employees had found their >way >into the public domain, the senior U.S. intelligence official replied >that "I don't have a great explanation, quite frankly." > >The official noted, however, that the CIA's credo has always been that >"individuals are the first person responsible for their cover. If they >can't keep their cover, then it's hard for anyone else to keep it. If >someone filled out a credit report and put that down, that's just >stupid." > >One senior U.S. official used a barnyard epithet to describe the >agency's traditional system of providing many of its foreign >operatives >with easily decipherable covers that include little more than a post >office box for an address and a non-existent company as an employer. > >Coverts especially important > >And yet, experts say, covert operatives who pose as something other >than >diplomats are becoming increasingly important in the global war on >terror. > >"In certain areas you just can't collect the kind of information you >need in the 21st Century by working out of the embassy. They're >just not >going to meet the kind of people they need to meet," said Melvin >Goodman, who was a senior Soviet affairs analyst at the CIA for more >than 20 years before he retired. > >The problem, Goodman said, is that transforming a CIA officer who has >worked under "diplomatic cover" into a "non-official cover" >operator, or >NOC--as was attempted with Valerie Plame--creates vulnerabilities that >are not difficult to spot later on. > >The CIA's challenge, in Goodman's view, is, "How do you establish a >cover for them in a day and age when you can Google a name ... and >find >out all sorts of holes?" > >In Plame's case, online computer searches would have turned up her >tenure as a junior diplomat in the U.S. Embassy in Athens even >after she >began passing herself off as a privately employed "energy consultant." > >The solution, Goodman suggested, is to create NOCs at the very >outset of >their careers, "taking risks with younger people, worrying about the >reputation of people before they have one. Or create one." > >Shortage of `mentors' > >But that approach also has a downside, in that "you're getting into >the >problem of very junior, inexperienced people, which a lot of >veteran CIA >people feel now is part of the problem. Porter Goss has to double the >number of operational people in an environment where there are no >mentors. Who's going to train these people?" > >In addition to stepping up recruiting, Goss has ordered a "top-down" >review of the agency's "tradecraft" following the disclosure that >several supposedly covert operatives involved in the 2003 abduction >of a >radical Muslim preacher in Milan had registered at hotels under their >true names and committed other amateurish procedural violations that >made it relatively easy for the Italian police to identify them and >for >Italian prosecutors to charge them with kidnapping. > >----- > >Tribune researcher Brenda J. Kilianski contributed to this article >from >Chicago. >jcrewdson(a)tribune.com > ><http://tinyurl.com/qhe2d> Weblog at: <http://weblog.warpspeed.com> ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: [liberationtech] The first rule about censorship is we don't talk about censorship
by Rick Falkvinge (Piratpartiet) 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The same thing will happen with links to The Pirate Bay. You cannot talk about them on Facebook. Imagine 30 years ago, when we were on the phone and discussed something, if a voice had popped in and said "you have mentioned an inappropriate subject. Please refrain from inappropriate communications." We would have been horrified. It would have been seen as so dystopic, that if it had been written in a novel of fiction, it would have been discarded as just unrealistic. Well, we're there. Cheers, Rick On 04/19/2012 12:30 AM, James Losey wrote: > Hi All, > > James Ball wrote an article for the Guardian > <http://www.guardian.co.uk/technology/2012/apr/18/richard-odwyer-extradition…> > about tvshack.net <http://tvshack.net> and noticed a curious thing: the > Facebook share button does not allow you to share the link to Facebook > because it includes the words "tvshack.net <http://tvshack.net>." > Although I was able to post the link itself to Face but took a > screenshot of the message saying that the article contains language that > is "spammy or > unsafe." http://jameslosey.com/post/21345118902/when-spam-filters-go-to-far > > Does anyone else have more examples of this? > > Best, > James > > > > _______________________________________________ > liberationtech mailing list > liberationtech(a)lists.stanford.edu > > Should you need to change your subscription options, please go to: > > https://mailman.stanford.edu/mailman/listinfo/liberationtech > > If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" > > You will need the user name and password you receive from the list moderator in monthly reminders. You may ask for a reminder here: https://mailman.stanford.edu/mailman/listinfo/liberationtech > > Should you need immediate assistance, please contact the list moderator. > > Please don't forget to follow us on http://twitter.com/#!/Liberationtech - -- Rick Falkvinge Founder of the first Pirate Party Piratpartiet SE @Falkvinge +46708303600 Blog, bio and press photos at http://falkvinge.net/photos-bio/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iEYEARECAAYFAk+Tk3EACgkQ7pnTrWI4jx3cfQCfVA3TsjvjnUBpo93+SCZiJTUV lF4AoJ+vSMkRHBZ4M24DXqarjC0hjBtQ =WB/1 -----END PGP SIGNATURE----- _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. You may ask for a reminder here: https://mailman.stanford.edu/mailman/listinfo/liberationtech Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [extropy-chat] Worldwide SOS system
by David Lubkin 06 Jul '18

06 Jul '18

Kevin Freels wrote: >This is a nice, productive thread, but one thing in missing - >infrastructure. When my father was building mini-RPVs in our living room in the 1970's for the Israelis, he was also figuring out how to use them. Low-cost was inherent in his concept. He could turn a profit selling them for a few thousand each. They were essentially light-weight wooden planes powered by lawn mower engines, and could heft a 75 kg payload. As the ideas morphed into Pentagon procurement, the vehicle requirements became gold-plated, and the price tag went up 200x or more. I haven't looked at the specifics of the current generation of drones to see how useful the add-on requirements are, but there's clearly great value in having many thousands of throw-away drones. The simplest warfare use is to carry 75 kg of explosives, fly around until you spot something more valuable, and then crash into it. The sticky point for your enemy is that a SAM or AAM to shoot it down could itself cost more than the drone. There are also civilian uses that fold into our thread. There are many search and rescue scenarios where it is too dangerous to send a flight crew out, where one could instead load a drone with 75 kg of emergency supplies. Perhaps we could take the comm ideas and add an assistance component, a la a network of long-duration blimps that serve as airborne hangers for a drone fleet. Just add uniforms, jerky movement, and Lady Penelope, and we have an international rescue operation. -- David Lubkin. _______________________________________________ extropy-chat mailing list extropy-chat(a)lists.extropy.org http://lists.extropy.org/mailman/listinfo/extropy-chat ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

BHDC11 - De-anonymizing Live CDs through Physical Memory Analysis
by coderman 06 Jul '18

06 Jul '18

does anyone know more about the methods to be discussed by Andrew Case next week? the memory analysis of Tor seems interesting. (do Tor Live CDs need a new kexec target for memtest sweeps / ram zeroisation? :) http://www.blackhat.com/html/bh-dc-11/bh-dc-11-briefings.html#Case """ Traditional digital forensics encompasses the examination of data from an offline or b deadb source such as a disk image. Since the filesystem is intact on these images, a number of forensics techniques are available for analysis such as file and metadata examination, timelining, deleted file recovery, indexing, and searching. Live CDs present a large problem for this forensics model though as they run solely in RAM and do not interact with the local disk. This removes the ability to perform an orderly examination since the filesystem is no longer readily available and putting random pages of data into context can be very difficult for in-depth investigations. In order to solve this problem, we present a number of techniques that allow for complete recovery of a live CDbs in-memory filesystem and partial recovery of its previously deleted contents. We also present memory analysis of the popular Tor application as it is used by a number of live CDs in an attempt to keep network communications encrypted and anonymous. """ *********************************************************************** To unsubscribe, send an e-mail to majordomo(a)torproject.org with unsubscribe or-talk in the body. http://archives.seul.org/or/talk/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

BHDC11 - De-anonymizing Live CDs through Physical Memory Analysis
by coderman 06 Jul '18

06 Jul '18

does anyone know more about the methods to be discussed by Andrew Case next week? the memory analysis of Tor seems interesting. (do Tor Live CDs need a new kexec target for memtest sweeps / ram zeroisation? :) http://www.blackhat.com/html/bh-dc-11/bh-dc-11-briefings.html#Case """ Traditional digital forensics encompasses the examination of data from an offline or b deadb source such as a disk image. Since the filesystem is intact on these images, a number of forensics techniques are available for analysis such as file and metadata examination, timelining, deleted file recovery, indexing, and searching. Live CDs present a large problem for this forensics model though as they run solely in RAM and do not interact with the local disk. This removes the ability to perform an orderly examination since the filesystem is no longer readily available and putting random pages of data into context can be very difficult for in-depth investigations. In order to solve this problem, we present a number of techniques that allow for complete recovery of a live CDbs in-memory filesystem and partial recovery of its previously deleted contents. We also present memory analysis of the popular Tor application as it is used by a number of live CDs in an attempt to keep network communications encrypted and anonymous. """ *********************************************************************** To unsubscribe, send an e-mail to majordomo(a)torproject.org with unsubscribe or-talk in the body. http://archives.seul.org/or/talk/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [extropy-chat] Worldwide SOS system
by David Lubkin 06 Jul '18

06 Jul '18

Kevin Freels wrote: >This is a nice, productive thread, but one thing in missing - >infrastructure. When my father was building mini-RPVs in our living room in the 1970's for the Israelis, he was also figuring out how to use them. Low-cost was inherent in his concept. He could turn a profit selling them for a few thousand each. They were essentially light-weight wooden planes powered by lawn mower engines, and could heft a 75 kg payload. As the ideas morphed into Pentagon procurement, the vehicle requirements became gold-plated, and the price tag went up 200x or more. I haven't looked at the specifics of the current generation of drones to see how useful the add-on requirements are, but there's clearly great value in having many thousands of throw-away drones. The simplest warfare use is to carry 75 kg of explosives, fly around until you spot something more valuable, and then crash into it. The sticky point for your enemy is that a SAM or AAM to shoot it down could itself cost more than the drone. There are also civilian uses that fold into our thread. There are many search and rescue scenarios where it is too dangerous to send a flight crew out, where one could instead load a drone with 75 kg of emergency supplies. Perhaps we could take the comm ideas and add an assistance component, a la a network of long-duration blimps that serve as airborne hangers for a drone fleet. Just add uniforms, jerky movement, and Lady Penelope, and we have an international rescue operation. -- David Lubkin. _______________________________________________ extropy-chat mailing list extropy-chat(a)lists.extropy.org http://lists.extropy.org/mailman/listinfo/extropy-chat ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: [liberationtech] Forbes recommends tools for journalists
by Julian Oliver 06 Jul '18

06 Jul '18

..on Mon, Dec 17, 2012 at 03:28:31PM -0800, Brian Conley wrote: > Its SSD so its still not a secure wipe, no? Indeed. From 'Securely Destroying Data' chapter in The CryptoParty Handbook v1.1: //-----------------------------------------------------------------------------> An important note on Solid State Hard Drives The instructions below explain how to use file deletion tools to securely delete files from your hard drives. These tools rely on the Operating System you are using being able to directly address every byte on the hard drive in order to tell the drive "set byte number X to 0". Unfortunately, due to a number of advanced technologies used by Solid State Drives (SSDs) such as TRIM, it is not always possible to ensure with 100% certainty that every part of a file on an SSD has been erased using the tools below. //<----------------------------------------------------------------------------- Us Linux users with our lovely journaled file systems need to take care: //-----------------------------------------------------------------------------> An important note on Journaled File Systems Data Journaling is a feature of several modern file systems and presents a risk to secure data deletion. File-systems of this type include Ext3 and Ext4 (Linux), compressed file systems and RAID-based file systems. The manual page for the deletion program Wipe says: No secure deletion program that does filesystem-level calls can sanitize files on such filesystems, because sensitive data and metadata can be written to the journal, which cannot be readily accessed. Per-file secure deletion is better implemented in the operating system. The manual page for the deletion program Shred says: CAUTION: Note that shred relies on a very important assumption: that the file system overwrites data in place. This is the traditional way to do things, but many modern file system designs do not satisfy this assumption. The following are examples of file systems on which shred is not effective, or is not guaranteed to be effective in all file system modes: log-structured or journaled file systems, such as those supplied with AIX and Solaris (and JFS, ReiserFS, XFS, Ext3, etc.) file systems that write redundant data and carry on even if some writes fail, such as RAID-based file systems * file systems that make snapshots, such as Network Appliance's NFS server file systems that cache in temporary locations, such as NFS version 3 clients compressed file systems In the case of ext3 file systems, the above disclaimer applies (and shred is thus of limited effectiveness) only in data=journal mode, which journals file data in addition to just metadata. In both the data=ordered (default) and data=writeback modes, shred works as usual. Ext3 journaling modes can be changed by adding the data=something option to the mount options for a particular file system in the /etc/fstab file, as documented in the mount man page (man mount). If you wish to delete data from a journaled file-system on Linux (mounted in data=journal mode) you should remount it in another mode. To be sure, remount your disk in Linux in data=ordered mode. See the manual page for the program mount on your system. Solaris users or those with RAID systems are outside of the scope of this manual. Please see the relevant documentation and/or research your special case in order to be sure you are securely deleting your data. //<----------------------------------------------------------------------------- https://cryptoparty.org/wiki/CryptoPartyHandbook#Version_1.1 Cheers, Julian > On Dec 18, 2012 12:26 AM, "Eric S Johnson" <crates(a)oneotaslopes.org> wrote: > > > > Secure deletion is a problem we could solve in software, by encrypting > > > the data and then destroying the key to render the data unrecoverable, > > > *if* we had a few bytes of persistent, erasable storage in which to > > > store the key. (Storing the key on the SSD itself doesn't work, > > > because then we can't securely delete the key.) > > > > > > I'm not aware of any suitable storage on current smartphones or > > > personal computers > > > > Isn't this exactly how the iOS (v4+) can be remotely "wiped" in a couple > > seconds? Everything's encrypted, so deleting the key ... > > > > Or are we saying the iOS's storage of the key is insecure? > > > > Best, > > Eric > > > > -- > > Unsubscribe, change to digest, or change password at: > > https://mailman.stanford.edu/mailman/listinfo/liberationtech > > > -- > Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech -- Julian Oliver http://julianoliver.com http://criticalengineering.org -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[liberationtech] Fwd: [pp.int.general] Fwd: Fwd: Democracy crowdsourcing in Estonia
by Eduardo Robles Elvira 06 Jul '18

06 Jul '18

I forward this detailed explanation of what really happened in Estonia from a member of the Pirate Party in there, I think it is quite interesting. ---------- Forwarded message ---------- From: Mdrt Puder <boamaod(a)gmail.com> Date: Wed, Apr 10, 2013 at 9:15 PM Subject: Re: [pp.int.general] Fwd: [liberationtech] Fwd: Democracy crowdsourcing in Estonia To: Pirate Parties International -- General Talk < pp.international.general(a)lists.pirateweb.net> It's a long story with lots of details, but we can start from the fact that the process was split in phases [1]: 1. Gathering the proposals (so called co-creation or crowdsourcing, everybody eith eID and Internet could participate). 2. Sorting/analysing the proposals from a strictly neutral/impartial perspective (experts). 3. Neutral/impartial impact assessments of the sorted proposals (experts). 4. Seminars with selected experts to rank the proposals (another set of experts). 5. Deliberation day to select the proposals to be handed to the parliament (unbiased sample of population). 1. The proposals were gathered using a flavour [2] of Your Priorities software [3]. You could log in with national eID service. In the end there were about 2000 proposals (from which 1300 were analysed). They were voted up and down, commented on etc. There were lot of duplicate proposals and there was no real possibility to discuss the proposotions because of duplication, bugs and the format that encouraged making self-sufficient points (arguments) instead of threaded discussions or something similar. So, from my perspective it was just mass posting proposals, that could be done with random forum software. The topics were agreed to be (1) funding of political parties, (2) laws about political parties, (3) election mechanisms, (4) participation processes, (5) forced politization of society. Not relevant proposals were sorted into section "varia". 2. This was the point where I started to severely doubt the process. Some of my own proposals were already lost in this phase and there was already some kind of prioritizing, although this wasn't what was promised. Some people complained about these problems, but since the results were published in an obscure manner and in several parts, not many people bothered to pay attention at all. The original proposals had pro/against votes, pro/con arguments and duplicates (had to be detected by analysts). Somehow the analysts explained that they treated duplication of proposals as main criterion to evaluate "prevalence" of the proposal, although this is counter-intuitive (spamming was the way to success). Besides that, some of the proposals were sorted into section "Overall state issues" which in fact meant that they were just censored from the next phases. Note, that among others all the proposals to use liquid democracy or something similar were put into that pile of proposals by "the experts". 3. The impact assessments were the next step to censor the proposals, because the experts brought their understanding and presumptions of those general political issues and although the resulting assessments were not stupid, some of them were highly debatable. 4. In this phase another set of chosen experts and some makers of proposals were invited to live seminars to select the most important topics to be discussed in deliberation day phase. From each of the five categories 2-4 most important issues were sorted out to be voted on later. They used the materials produced by 2nd and 3rd phases. 5. On deliberation day there were 550 people invited who should have represented all areas of the society. Only a bit more than 300 came. Those 2-4 most important issues of five categories were voted on using the prescribed multiple choice answers (whoever created those). This made the process highly manipulative, the participants were there just to discuss the topics using the materials provided by organizers and vote on predefined options. After the last vote the organizers were all rejoicing on Twitter and Facebook that the crowd was so "intelligent", since it didn't vote for direct election of the president, although the public opinion in Estonia is for direct election. If this is not an example of manipulation, it's at least clear indicator of the will to manipulate. But some people who were present actually say that it was good company and the discussions were led professionally, so it wasn't that bad either. === There is also a background story to this. There were anti-decitfulness protests in Estonia in November 2012 [4], which were sort of benevolently hijacked by certain group of intellectuals and political activists under the name of Charter 12 [5], which led to the crowdsourcing process under the presidental blessing. I was in touch with the organizers of the protests as well as later took part of some of the meetings to start the crowdsourcing process. Although I was a bit disappointed by the hijacking part, I didn't really make an issue of it, because the organizers of the protests didn't have better plan anyway. On the first meeting of the crowdsourcing initiative I proposed to have an intelligent discussion evironment with the process that would contribute to the quality of proposals and discussions. But the initiative group didn't care much about that. Instead they already had the proposals that they wanted to see handed to the parliament in the end and they wanted to create a process that would lead to the desired result. And they were more interested in numerically gathering more proposals (lot of participants as some kind of mandate) than enabling intelligent process. My argument was that if the process were designed well enough, the need for experts would be minimized and everybody would be in the same position to gather support for a proposal. We even managed to discuss Lessig's "Code is law" argument, but in the end that was just intellectual entertainment for them. Since the organizers had their own plan to influence the political regime, I dind't try to engage in the process later on. Some Estonian pirates who wanted to do that anyway, they were kept away from mailing lists etc, so I might have been blocked too, I'm not sure. The process was said to be open, transparent, grassroots etc, but it really was (and still is, because it hasn't ended) a regular manipulative political process. Anyway, I didn't want to undermine their project, I kept low profile and just criticized some parts of the process in discussions on social networks, university seminars etc. In the beginning we reported on the progress of People's Assembly in our Pirate Party channels, but after the 2nd phase ended, I stopped doing that. Some of our members have criticized the process in their blogs and suggested that in the end it is just poll of public opinion and as that even not a decent one. I'm also on a position that the process had very little to do with democracy, I cannot even agree that it was an experiment in direct or participative or deliberative democracy. Actually, they could have skipped all the phases from 1st to 4th and just organized a nice manipulative deliberation day. You should also know that most of the public criticism of the process is either that (a) it doesn't lead to the changes promised because the proposed changes suck and parliament won't agree with them anyway or (b) the crowdsourcing and Charter 12 hijacked and discharged the protests against our neo-liberal+conservative government which may have led to something better and besides that the fake crowdsourcing is actually election campaign for our social democrats. For me the main problem is the non-democratic nature of the process which noone outside the Pirate Party really seems to care about. And from that I also have some kind of ethical dilemma, if I should remain silent on the issue and therefore silently support the process (hoping that parliament will take some of the good proposals and implement them, for example lowering the threshold used in elections) or publicly condemn it (joining the conspiracy theorists and doomsdayers) with the chance of helping to stall the initative and ruin the chances of public support to whatever direct democracy initiatives that might appear in the future (we have two of them failed already, besides the one we're discussing now). So our People's Assembly is not totally evil, but nothing to be proud of either. That should be enough for the start. Anyway, some notes and trivia for the conlusion... * The Charter 12 people composed their manifest and vanished giving their place to some ad hoc group of activists who were hanging around at the president's place anyway. * The preparation of the crowdsourcing process by these activists was rather non-transparent. * Everything was done in a hurry and therefore resulted lots of problems, technical as well as substantial. * The rhetoric that it was first implementation and therefore had flaws and next time we do even better is not to be taken seriously, because there was no intention engage specialists from universities to make it better etc. * There was no proper definition of the process, it constantly changed, 4th and 5th phases were invented/decided ad hoc after the 1st phase was over. * Although the 1st phase of the process was quite open in a sense (you can exactly see who voted, argued, proposed what), rest of the process was rather untransparent and there was no way to participate in it. * There were also problems with AGPL licensed source code, which was not published because of "intensive development process" as they explained it. * One of our members (I think he's also reading this list) even used presidental reception to put on an artistic performance for writing citizen initiative into proper law to making our People's Assembly really binding and transparent. [6] [1] http://news.err.ee/Politics/f1fb8b53-d0ff-4582-99f0-83de232b9201 [2] https://github.com/cenotaph/rahvakogu [3] http://www.yrpri.org/home/world [4] http://news.err.ee/politics/64bff71c-3716-42a0-ad54-7724b8c43555 [5] http://www.opendemocracy.net/ahto-lobjakas/charter-12-estonias-stab-at-dire… [6] http://news.postimees.ee/1151090/surprise-guest-in-protest-action-first-lad… ____________________________________________________ Pirate Parties International - General Talk pp.international.general(a)lists.pirateweb.net http://lists.pirateweb.net/mailman/listinfo/pp.international.general -- Eduardo -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0