July 2018 - cypherpunks-legacy

Beware Software Gifts from the MPAA
by Lauren Weinstein 06 Jul '18

06 Jul '18

Beware Software Gifts from the MPAA http://lauren.vortex.com/archive/000330.html Greetings. I'm on record as supporting *reasonable* efforts by the MPAA, RIAA, and their various cohorts to protect their intellectual property assets. However, a software tool being distributed to universities by the MPAA, supposedly to help them internally track student file sharing (and remember, there are efforts to make such tracking a requirement of federal law) appears to leak information like a sieve, not just to the MPAA but to the entire Internet ( http://tinyurl.com/yr8bsq ). Part of the MPAA toolkit's data leakage is obviously intentional -- like the "phone home" aspect that reveals a new installation to MPAA servers. Other aspects, like the open Web server that the toolkit installs, which exposes collected data publicly, may simply be the result of design incompetence. Either way, I agree with those observers who suggest that installing this free software mess would be a big mistake on the part of university system administrators. The MPAA now says that the current release that they've been pushing to the educators is only the beta version. I'm all in favor of betas, even extended ones, but a cardinal rule of software development says that you don't allow beta software to be used in outside production environments unless it has at least been vetted for major security and privacy problems. In this case, the problems with the MPAA software are so obvious that they call into question the veracity -- or at least the competence -- of the entire project. When our policymakers consider the desires of the entertainment industry to turn university IT departments into intellectual property cops, I hope that this particular fiasco will be duly noted. --Lauren-- Lauren Weinstein lauren(a)vortex.com or lauren(a)pfir.org Tel: +1 (818) 225-2800 http://www.pfir.org/lauren Co-Founder, PFIR - People For Internet Responsibility - http://www.pfir.org Co-Founder, NNSquad - Network Neutrality Squad - http://www.nnsquad.org Founder, PRIVACY Forum - http://www.vortex.com Member, ACM Committee on Computers and Public Policy Lauren's Blog: http://lauren.vortex.com ------------------------------------------- Archives: http://v2.listbox.com/member/archive/247/=now RSS Feed: http://v2.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] Beware Software Gifts from the MPAA
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

Re: US drafting plan to allow government access to any email or Web search
by Steven M. Bellovin 06 Jul '18

06 Jul '18

On Tue, 15 Jan 2008 08:19:11 -0500 "Perry E. Metzger" <perry(a)piermont.com> wrote: > > The PDF link points to: > > http://online.wsj.com/public/resources/documents/WashWire.pdf > > which I'm unable to access at the moment. > I believe the proper URL is http://blogs.wsj.com/washwire/2008/01/13/dancing-spychief-wants-to-tap-into… (and as best I can tell, it doesn't require a WSJ subscription for access). --Steve Bellovin, http://www.cs.columbia.edu/~smb --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IRR] SA passes Electronic Communications and Transactions Bill
by Ian Douglas 06 Jul '18

06 Jul '18

Hi All Thought Ant Brooks would say something about this but since he did not, here is a quick summary with comments. Please do not distribute outside this list as I have supplied basically the same thing to a paying customer for inclusion in their newsletter... Hopefully I didn't screw up factually. SA passes Electronic Communications and Transactions Bill On 7 June 2002, the SA Parliament passed the ECT bill [1], against fierce opposition, especially from within the Internet industry. While the bill does have some positive aspects, some of its other far-ranging provisions have aroused ire amongst industry old-timers and professionals. The bill provides legislation in the following areas: * Planning and implementation of a national e-strategy, including provision of internet access to disadvantaged communitites. * Electronic transactions and signatures, which are given legal standing. * E-Government services. * Cryptography providers. This section makes it illegal to supply cryptographic products without registering, and paying a fee. * Authentication service providers, and standards for being an accredited Authentication Service Provider. See "Cryptography". * Electronic transactions and e-commerce, including protections for consumers. * Spam seems to be given "opt-out" status, not "opt-in", although other provisions try to limit the use of "personal information". * So-called "Critical Databases". * The Domain Name Authority and administration, where between 8 and 16 [**] people will do the work now done by one man. The sub-text is that new subdomains will be created and auctioned off, although this is not explicitly mentioned. The cell-phone industry provides a clue. * Limitations on the liability of Internet Service Providers. The Service Provider is seen as a "mere conduit" as long as, amongst other provisions, he does not "modify the data contained in the transmission". The effect of this provision on ISPs who automatically remove viruses from client email is not specified. ISPs do not have a general obligation to monitor traffic on or through their systems. * The appointment of "Cyber Inspectors", who can enter ISP secure server rooms with a warrant and poke their noses wherever they like. * Cyber Crime, which outlaws amongst others, hacking, cracking and malicious code. The provisions which have attracted the most flak revolve around the new .za domain name authority. It is currently run by Mike Lawrie, who has been doing it since the commercial internet arrived in South Africa. He has ICANN approval. He is so upset by the provisions of the new bill that he has threatened to "pull the plug". [2] So far this has not happened. [1] http://www.gov.za/gazette/bills/2002/b8-02.pdf [2] http://www.iol.co.za/index.php?set_id=1&click_id=31&art_id=qw10230782404 92B261 [**] Since writing the above, the Gov has ammended Section 10, which deals with the .za namespace. They dropped the number of people from "8 -- 16" down to 9. Also other changes. http://co.za/ect/chapterX-2002-06-07.html Uniforum, a non-profit which runs the .co.za domains, have posted their suggested ammendments to the ammendments, and invited comment from current .co.za domain holders. http://co.za/ect/chapterX-comments-2002-06-07.html Naturally I had quite a bit to say on the topic.. :-) Furthermore, my mind had mulled over other aspects of the bill since I wrote the above last Tuesday, and other issues came up: 1. Only registered cryptography suppliers may supply cryptographic products to South Africans. I suppose this could mean that Apache will not be allowed, leaving the field to Microsoft... I can't see any open-source software movement registering with every tinpot government around the world. Nor can I see Bruce Schneier registering to supply Blowfish or Twofish... The law is written aimed at suppliers, with no comment about the legal position of users of unregistered crypto products. [Ultimate objective: All your secrets are belong to us?] 2. If spam is given legal opt-out status, this puts ISPs in a difficult position, and could lead to SA becoming a spammer's haven. Cheers, Ian p.s. I was going to use a controversial Subj: line, like "SA Government goes berserk" or somesuch but decided against it.. :-) -------------------------------------------------------------- ian(a)zti.co.za http://www.zti.co.za Zero to Infinity - The net.works Phone/Fax +27-21-948-3809 _______________________________________________ Irregulars mailing list Irregulars(a)tb.tf http://tb.tf/mailman/listinfo/irregulars --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[Lucrative-L] updated lucrative source now in CVS
by Patrick 06 Jul '18

06 Jul '18

I imported Lucrative source into SourceForge CVS so anyone who wishes can get the latest and greatest Lucrative. There are numerous improvements in design and efficiency over v7, more features, and so on. https://sourceforge.net/projects/lucrative There are several tools at SF for lodging bug reports, feature requests, and so on. Please feel free, even encouraged, to make use of them. And I invite participation by developers to contribute to the source. I don't have any specific tasks that I need help on at the moment, but I will use the SF tools to make notes. Also, people uncomfortable or unable to contribute to the source should feel free to contribute anything else they desire: pretty graphics, interface mockups, diagrams, charts, requirements or specifications, documents of all sorts, complaints. One point I would like advice on is whether to extend the FIBI (format for the interchange of bearer instruments) protocol to allow exchange of Chaumian cash as well as Wagnerian. Patrick The Lucrative Project: http://lucrative.thirdhost.com ...................................................... To subscribe or unsubscribe from this discussion list, write to lucrative-l-request(a)lucrative.thirdhost.com with just the word "unsubscribe" in the message body (or, of course, "subscribe") --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Beware Software Gifts from the MPAA
by Lauren Weinstein 06 Jul '18

06 Jul '18

Beware Software Gifts from the MPAA http://lauren.vortex.com/archive/000330.html Greetings. I'm on record as supporting *reasonable* efforts by the MPAA, RIAA, and their various cohorts to protect their intellectual property assets. However, a software tool being distributed to universities by the MPAA, supposedly to help them internally track student file sharing (and remember, there are efforts to make such tracking a requirement of federal law) appears to leak information like a sieve, not just to the MPAA but to the entire Internet ( http://tinyurl.com/yr8bsq ). Part of the MPAA toolkit's data leakage is obviously intentional -- like the "phone home" aspect that reveals a new installation to MPAA servers. Other aspects, like the open Web server that the toolkit installs, which exposes collected data publicly, may simply be the result of design incompetence. Either way, I agree with those observers who suggest that installing this free software mess would be a big mistake on the part of university system administrators. The MPAA now says that the current release that they've been pushing to the educators is only the beta version. I'm all in favor of betas, even extended ones, but a cardinal rule of software development says that you don't allow beta software to be used in outside production environments unless it has at least been vetted for major security and privacy problems. In this case, the problems with the MPAA software are so obvious that they call into question the veracity -- or at least the competence -- of the entire project. When our policymakers consider the desires of the entertainment industry to turn university IT departments into intellectual property cops, I hope that this particular fiasco will be duly noted. --Lauren-- Lauren Weinstein lauren(a)vortex.com or lauren(a)pfir.org Tel: +1 (818) 225-2800 http://www.pfir.org/lauren Co-Founder, PFIR - People For Internet Responsibility - http://www.pfir.org Co-Founder, NNSquad - Network Neutrality Squad - http://www.nnsquad.org Founder, PRIVACY Forum - http://www.vortex.com Member, ACM Committee on Computers and Public Policy Lauren's Blog: http://lauren.vortex.com ------------------------------------------- Archives: http://v2.listbox.com/member/archive/247/=now RSS Feed: http://v2.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] Beware Software Gifts from the MPAA
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

Re: US drafting plan to allow government access to any email or Web search
by Steven M. Bellovin 06 Jul '18

06 Jul '18

On Tue, 15 Jan 2008 08:19:11 -0500 "Perry E. Metzger" <perry(a)piermont.com> wrote: > > The PDF link points to: > > http://online.wsj.com/public/resources/documents/WashWire.pdf > > which I'm unable to access at the moment. > I believe the proper URL is http://blogs.wsj.com/washwire/2008/01/13/dancing-spychief-wants-to-tap-into… (and as best I can tell, it doesn't require a WSJ subscription for access). --Steve Bellovin, http://www.cs.columbia.edu/~smb --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Visualization: Tor nodes on Google Maps and Google Earth
by Moritz Bartl 06 Jul '18

06 Jul '18

Hi, I wrote a small ugly Python script to visualize Tor relays on Google Maps and Google Earth. You can see the result here: * Open KML file in Google Maps: http://maps.google.com/maps?q=http:%2F%2Fwww.torservers.net%2Fmisc%2Ftormap… * Download tormap.kml for Google Earth http://www.torservers.net/misc/tormap/tormap.kml The KML standard is being pushed by Google and should work for OpenStreetMap, too, but I couldn't get it to load there. Feel free to modify the script to generate other outputs. The initial idea was to scale the marker size to show the relay's bandwidth, but Google Maps does not support this. The markers might give a false impression of accuracy. Most IPs can only be tracked to city level (or even region), ie. the markers are somewhat near, not necessarily at the real location of the relay. You can download the script here: http://www.torservers.net/misc/tormap/tormap.py (LGPL) This is a one-time snapshot and I will not update it regularly, unless there is public interest to do so. The bandwidth categories are based on the reported "observed bandwidth" at the time of creation, so the actual number of high bandwidth nodes will fluctuate every time the script is run. It would be nice to extend this script to use longer-term bandwidth calculation like TorStatus does, and to generate a map over time using all the consensus data provided at http://archive.torproject.org/. An example of what this could look like is Vis4Net's Wikileaks Mirror World Map at http://labs.vis4.net/wikileaks/mirrors/ . ( Mostly copied from my blog at http://moblog.wiredwings.com/archives/20101213/Visualization-Tor-nodes-on-G… ) -- Moritz http://www.torservers.net/ *********************************************************************** To unsubscribe, send an e-mail to majordomo(a)torproject.org with unsubscribe or-talk in the body. http://archives.seul.org/or/talk/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: <nettime> monitoring and surveillance
by John Young 06 Jul '18

06 Jul '18

Odd that the Weimar-Princeton announcement makes no mention of scholars and researchers gathering, aggregating, mining and messing with Internet users data under guise of investigating and analyzing the world's greatest-ever spying machine by spying on the gullible users "to protect them," the motto of secret agents forever. Bundles of irresistable funding for that, indeed, alliances and standards-setting bodies have been established to bless this villainy and the finely-coutured apologists for the villainous institutions and "leading" scholars. Be sure tell the public right away with every media study announcement about the spy agencies' multi-millions being distributed to eager institutions to foster open source spying, spy training, covert spying and camouflage thereof. Admire the spread of euphemistic "security studies" and "surveillance studies" and "social media studies" and in particular "open source studies." Even the spy agencies vaunt these luser lures in their recruiting materials. High-tech seekers, media mavens especially solicited by CIA University, rush to intern in home bases of spies and pursue advanced degrees in their cash-rich outliers in universities. Note who runs these social studies programs ever adaptable to the king's coin. Remember the invention by Plato of Socrates, a friendly fellow favoring open discourse, to undergird the highly privileged philosopher as king. Machiavelli adored Plato's conceit. Remember the invention of philosophy to undergird dissimulation, wise faculty club debate tea cup held with little finger poised just so to signal how pleasurable it is to outsmart. Meta surveillance studies presumably sanitizes the vile practice of social studies long invested in codifying human behavior, first as allegedly disinterested scholarship, then to repackage and sell as means of political control to full-spectrum authoritatives ever indebted to funding sources open and secret, especially the secret which requires non-disclosure as a condition of scholarly bribery. Dissimulation provides an escape from complicity, thank heavens for duplictious obfuscation. "I had no idea my work would be used that way." Here's a suggestion: if any use of scholarly research is ever used for secret purposes the original scholars shall be hung until dead from Alma Mater, left to rot as a signal of why secrecy is the greatest threat to democracy. Monitoring the extended use of scholarly research shall no longer be forgiven by exculpatory sophistry. No more excusing the study of complicity by deeper treachery of exploiting hard-up students to do spies' "dirty work." Oops that is the name of a famous spy story dissimulation. Odd that the illegality of data gathering on the Internet is never admitted by overseers of the intellectual commonweal. Odd that privacy policies are always taken "very seriously," but never disclosed as duplicitous. # distributed via <nettime>: no commercial use without permission # <nettime> is a moderated mailing list for net criticism, # collaborative text filtering and cultural politics of the nets # more info: http://mail.kein.org/mailman/listinfo/nettime-l # archive: http://www.nettime.org contact: nettime(a)kein.org ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0