July 2018 - cypherpunks-legacy

[Freedombox-discuss] Globaleaks demo of the Prototype online! $ /etc/init.d/globaleaks start
by Arturo Filastr 06 Jul '18

06 Jul '18

Hi All, We are pleased to announce the release of the GlobaLeaks Prototype Demo. You are all invited to take a look at it and try how it feels to a Node Administrator, Whistleblower and TULIP receiving target. You can reach the demo on http://demo.globaleaks.org/ GlobaLeaks is the first Open Source Whistleblowing Framework. It empowers anyone to easily setup and maintain their own Whistleblowing platform. It is also a collection of what are the best practices for people receiveiving and submitting material. GlobaLeaks works in all environments: media, activism, corporations, public agencies. For the full release notice you can visit http://www.globaleaks.org/news/ For all the links and information on the project http://www.globaleaks.org. GlobaLeaks has been tested by more than 50 drunk Venetian hackers, here is a link the presentation given at the Italian Hacker camp ESC: http://www.slideshare.net/globaleaks/globaleaks-live-launch-venice-2011. And most importantly, please come and hack with use and let's change the world! http://www.launchpad.net/globaleaks/ Happy hacking, A Random GlobaLeaks Contributor _______________________________________________ Freedombox-discuss mailing list Freedombox-discuss(a)lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/freedombox-discuss ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[serval-project-dev] Re: Serval mesh multicast non-functional
by Paul Gardner-Stephen 06 Jul '18

06 Jul '18

Hello, On Dec 1, 10:45 pm, "L. Martin Ringler" <l.martin.ring...(a)gmail.com> wrote: > It appears Serval doesn't handle multicast UDP messages. Is this > deliberate or broken? It is not deliberate on our part. A number of complications are likely to be present when trying to do multicast: 1. The phones may not have kernel support for it compiled in (or more likely, some models will, while others wont). 2. I don't know if BATMAN does multicast (I suspect OLSR might, but I really don't know). > Why muticast messages are important... > > 1. To maintain a routing table for non pure mesh where some of the > nodes are seperated by a functional backbone the mesh messages will > have to be multicast since broadcast messages will be restricted to > the local subnet. Most modern routers block IP broadcast traffic. I agree multicast is good here, but there are ways around this, even if they aren't ideal. In particular, if there is a mesh node at either end, then they can (eventually) bridge traffic. Some of this will become much simpler once we move to the overlay mesh, at which point multicast will not be sensibly possible, anyway. > 2. Some applications that could use the ad-hoc mesh are Position > Location type apps. You and your friends are skiing and you get > seperated, your app would tell you where they are etc. I think you > would need to multicast the Position Location Information and > broadcast wouldn't work if 2 or more discreet groups were on the same > Serval mesh. Actually, there are ways around this, and we are currently working on exactly this kind of groups of people sharing information problem that you mention. We see no reason why our planned protocols shouldn't work with multiple groups in the same physical area, even with overlapping membership. > Is the Ad-hoc mesh encryted? Seems to be in the clear. It is all in the clear at present. We have plans to add voice, SMS etc encryption and authentication in over coming months. Mesh management traffic will remain en claire, but the overlay mesh will increase the ability to authenticate even that. Paul. -- You received this message because you are subscribed to the Google Groups "Serval Project Developers" group. To post to this group, send email to serval-project-developers(a)googlegroups.com. To unsubscribe from this group, send email to serval-project-developers+unsubscribe(a)googlegroups.com. For more options, visit this group at http://groups.google.com/group/serval-project-developers?hl=en. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [ExI] Gov surveillance here to stay
by Anders Sandberg 06 Jul '18

06 Jul '18

On 06/07/2012 09:06, BillK wrote: > Why do you think your lovely smartphone includes unique ID, GPS, > camera and microphone? Because the consumers really want it. The fatal mistake of thinking it is because "They" put it there misses the far more unsettling aspect that *we* are voting with our wallets to produce a transparent, trackable world with smart gadgets. Some of that is an accidental side effect (consider EFFs interesting demonstraiton that our browser customisation makes us identifiable: https://panopticlick.eff.org/ ) - many of these side effects suprise the Powers That Be too (consider all leaks due to improper redaction of PDFs). But I think what most people honestly do want is a world that has "magical properties" of transparency and services for them that also produce transparency for others - and they are not willing to pay much money or effort to reduce this information leakage. If it was just They who did things, we could in principle stop Them. But now it is *us* who are doing it, and we are unlikely to stop ourselves. > The future is here already. You must assume that every use of your > phone, or internet access is recorded and scanned for possible threats > to the state. > If you are not plotting, then it will be no immediate inconvenience to you. At least that is the common assumption. Given the growing number of more or less embarassing mistakes, there is a realy issue of false positives. Plotters are rare: people looking like plotters are far more common. > Supercomputers and unlimited data storage enables the state to treat > everyone as a potential criminal, so everything they do or say, every > place they visit and every person they contact is now regarded as > potential court evidence. The really interesting thing is when this ability percolates downwards. Right now companies like Acxiom and Facebook are using similar methods. In a few years it will be feasible for smaller groups and individuals to do big data mining too. I suspect the best strategy is to get people aware that we are careening into the transparent society, that we better get ultra-tolerant, and that we better get strong accountability measures into place to keep governments and other concentrations of power safe and sane. -- Anders Sandberg, Future of Humanity Institute Philosophy Faculty of Oxford University _______________________________________________ extropy-chat mailing list extropy-chat(a)lists.extropy.org http://lists.extropy.org/mailman/listinfo.cgi/extropy-chat ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[liberationtech] Comments on the EU Commissionbs Flawed Cybersecurity Strategy
by FC 06 Jul '18

06 Jul '18

Hi all, Frustrated by the lack of critical reporting on the matter, I put together a post on the EU Cybersecurity Strategy that was announced yesterday. Apart from prof. Ross Anderson's, I've read very few worthwhile analysis of it coming from civil society or academia. So I thought it would be useful to have your take: http://www.wethenet.eu/2013/02/comments-on-the-eu-commissions-flawed-cybers… Corrections welcome, especially if you think I'm being overly pessimistic/negative. Best, FC)lix PS: Since this is my first post to the list, a few introductory words: I was a policy analyst (now volunteer) at Paris-based La Quadrature du Net for three years, and I'm currently writing my PhD thesis on the Internet's consequence for free speech law and citizen empowerment in EU democracies. ------------------------------------ Comments on the EU Commissionbs Flawed Cybersecurity Strategy On Thursday February 7th 2013, during a press conference, the European Commission announced a milestone initiative in the field of b cybersecurityb, publishing two documents: - A *proposal for a directive <http://www.wethenet.eu/wp-content/uploads/CYBERSECURITY-DRAFT-PROPOSAL.pdf> *b concerning measures to ensure a high common level of network and information, security across the Unionb (apparently nicknamed the b NIS directiveb). - A *communication <http://www.wethenet.eu/wp-content/uploads/CYBERSECURITY-JOINT-COMMUNICATION…> *on a b CyberSecurity Strategy of the European Union : An Open, Safe and Secure Cyberspaceb. [Reminder : Cybersecurity in the sense used by the Commission is a buzzword covering issues ranging from the management of computer security systems in defense and private sector, to "cyberwar", payment-fraud, zero-day exploits and malicious code, trafficking (among other things), but also the protection of Internet freedom internationally (just a few unconvincing words on the matter, but theybre there, in bold <http://europa.eu/rapid/press-release_IP-13-94_en.htm>! And there is "open internet and online freedoms" in the title of the Commission's press release <http://europa.eu/rapid/press-release_IP-13-94_en.htm>!! If that's not a proof...).]/ / Both the press conference <https://www.youtube.com/watch?v=qYOIlT9hqPA> of commissioners Kroes, MalmstrC6m and Ashton as well as the documents released show two things: *the Commission is not taking freedom seriously in Internet policy*, *and it might be paving the way for the militarization of cyberspace. * EC should start by getting the math right The commissioners started off by presenting very *vague and inflated statistics about the cost of cybercrime* (several studies <http://www.commercialriskeurope.com/cre/1588/239/Report-rails-against-in...> have already made that point clear)**. From copyright to cybersecurity policy debates, bogus numbers remain, in this case to the benefit of the security and surveillance industry1 <http://comments-on-eu-commissions-vague-cybersecurity-strategy-0#footnote2_…>. This is classic, lobby-induced, pure *threat inflation* (on that note, see Brito & Watkinsbs 2011 article <http://mercatus.org/sites/default/files/publication/loving-cyber-bomb-dange…>: /Loving the Cyber Bomb? The Dangers of Threat Inflation in Cybersecurity Policy/). Then, the commissioners moved to the substance of the proposal. Things were not particularly clear, as the questions of the journalists sitting in the press room would later reveal. The few reporters in attendance had interesting questions, but sadly these were largely unrelated to the actual texts2 <http://comments-on-eu-commissions-vague-cybersecurity-strategy-0#footnote2_…>. They had apparently not been able to read the recent leaks of both texts by anonymous Brussels sources, released on the Internet last month (as I write, the documents officially released yesterday still cannot be found on the EU Commission website). Going over the 60-plus pages of the proposed directive <http://www.wethenet.eu/wp-content/uploads/CYBERSECURITY-DRAFT-PROPOSAL.pdf> and the accompanying communication <http://www.wethenet.eu/wp-content/uploads/CYBERSECURITY-JOINT-COMMUNICATION…>, it becomes clear that the EU cybersecurity strategy suffers from several flawsb& Towards a centralized network of cybersecurity authorities The proposed b Network and Information Securityb directive aims to set up a b *NIS network*b of b cybersecurity firemenb, headed by the EU agency ENISA <https://en.wikipedia.org/wiki/European_Network_and_Information_Security_Age…> (created in 2004 and based in Athens). ENISA will lead a group of national counterparts (each Member State shall have its own NIS authority). For the most part, these already exist and are usually primarily in charge of *defense and military networks* (see this analysis <http://www.edri.org/edrigram/number11.1/cybersecurity-draft-directive-eu> by computer security researcher at Cambridge University, Prof. Ross Anderson, about how the proposal risks centralizing cybersecurity policy-making within the public sector). This centralized network of /de facto/ cybersecurity policy-makers will operate *out of public scrutiny*, with the always-convenient excuse of handling b confidential informationb (see recital 17 and 18). Behind the scene, these public authorities of course risk being *under the harmful influence of security vendors* and other b private sector providersb, who will help pushing for the kind of fear-mongering displayed at the very beginning of the conference/./ The new b data breach disclosureb obligations that made the headlines <http://www.zdnet.com/businesses-forced-to-admit-data-breaches-under-eu-cybe…> /may/ be made public, at the entire discretion of NIS authorities. As Prof. Anderson, points out <http://www.lightbluetouchpaper.org/2013/02/08/eu-cyber-security-directive-c…>: b Whereas security-breach notification laws in the USA require firms to report breaches to affected citizens, articles 14 and 15 instead require breach notification to the bcompetent authorityb. Notification requirements can be changed later by order (14.5-7) and the bcompetent authoritiesb only have to tell us if they determine itbs in the b public interestb (14.4).b What is more, this NIS network will also be *absorbing a potentially enormous amount of information* (article 15.2) *from virtually all the significant players of the Internet* (among the many b market operatorsb concerned, see Annexe IV), which in return will benefit from nice insurance premiums if they properly follow the recommendations on security practices and the standards imposed by the NIS authorities (elaborated how? Following what procedures or criteria? In the same vein, article 15.3 does not say much about the b *binding instructions* to market operators and public administrationsb that NIS authorities will have the power to issue). Meanwhile, the EU Commission is given broad competency to impose b *standards* and/or technical specifications relevant to network and information securityb (article 16). The NIS network will work with Computer Emergency Response Teams (CERTs are official security experts teams, already exist, but will be beefed up under the proposed directive) and law enforcement agencies, especially Europolbs brand-new EC3: the b European Cyber Crime Centerb (watch this b coolb video <http://ec.europa.eu/avservices/video/player.cfm?ref=I075479> to get a sense of how hype EC3 is)b& The strategybs missing players This all could have been a little different. And better. For instance, the Commission could have promoted a more *decentralized governance of cybersecurity*, insisting on *procedural safeguards *on how cybersecurity policy is made and conducted (at least general but tangible legal principles). Many peoples in many places today are doing a great job in ensuring the resiliency of the Internet (in the spirit of Prof. Zittrainbs enlightening TED talk <http://www.ted.com/talks/jonathan_zittrain_the_web_is_a_random_act_of_kindn…>). Many of them would probably have wanted actual *guarantees for broad participation in an /open/ policy forum* (guarantees enacted preferably not just as a nice gesture, but out of conviction that it is how you can best ensure trust and reliability in cybersecurity policy). But these contributors to cybersecurity (in academia, in civil liberty organizations, in hackerspaces, etc.) are mostly kept out of the loop. And they have reasons to worry. Not only can they righlty question the competence of the EU executives in caring after the Internet. Actually, several state actors bincluding in EU and USb are rather promoting b cyber-/in/securityb (i.e: trade of Zero-Day exploits <http://Should%20the%20secretive%20hacker%20zero-day%20exploit%20market%20be…>, attendance in trade fairs on Internet surveillance <http://Valentino-Devries,%20Jennifer,%20Julia%20Angwin%20et%20Steve%20Steck….>, etc).They also have to bear <http://www.wired.com/threatlevel/2012/04/hacking-tools/> the risk of repression because of another proposed directive (directive 2010/0273 <http://parltrack.euwiki.org/dossier/2010/0273%28COD%29> on b combating attacks against information systemsb), currently in first reading in the EU Parliament and which could criminalize <http://www.wired.com/threatlevel/2012/04/hacking-tools/> security researchers and white-hat hackers. Trying to put some b net freedomsb flavor The articles of the proposed directive on cybersecurity and the overall strategy bring *very little protection to the rights of Internet users*, and none to the decentralized architecture of the network (the text makes no mention of Net neutrality, for instance). It all comes down to a few reassuring lines: - The directive makes a short reference to the EU *privacy* legislation (recital 23, 37, 39 and article 5). This is a smart move, underlining that EU is big on privacy (webll see what comes out of the new data protection regulation <http://www.privacycampaign.eu/>b&), and above all useful to differentiate the proposed EU directive from its infamous US cousin, the ill-fated Cyber Intelligence Sharing and Protection Act <https://duckduckgo.com/Cyber_Intelligence_Sharing_and_Protection_Act> (CISPA3 <https://ww-on-eu-commissions-vague-cybersecurity-strategy-0#footnote3_pi82d…>). - The cybersecurity communication released alongside the directive makes mention of the pompous NO DISCONNECT strategy <http://europa.eu/rapid/press-release_IP-11-1525_en.htm?locale=en>, announced in late 2011 by Neelie Kroes4 <https://ws-on-eu-commissions-vague-cybersecurity-strategy-0#footnote4_p6b6a…>, and which has yet to achieve anything significant (see below). - The Commission also announces the upcoming release of*international guidelines on freedom of expression* b offline and onlineb to assist its diplomacy. - b& (There might be some other similar b net freedomsb overtones in there). Overall, these good words will do very, very little to put into practice the b Digital Freedom Strategyb report <http://www.marietjeschaake.eu/2012/12/european-parliament-endorses-first-ev…> adopted by the EU Parliament in December 2012, or any of the policy proposals made by civil society and academia to better protect human rights online, both in the EU and globally. In the meantimeb& In the meantime, no /ad hoc/ and effective regulation exists for regulating the use of privacy invasive technologies in network architectures5 <https://won-eu-commissions-vague-cybersecurity-strategy-0#footnote5_2i8hl48>. And Net neutrality is officially <http://www.laquadrature.net/en/net-neutrality-neelie-kroes-yields-to-operat…> abandonned as an actual regulatory objective by Neelie Kroes. In the meantime, workshops and consultations are being organized in Brussels, while free speech NGOS are left suing b censorwareb vendors before theb& OECD (??! b& yes, the OECD is not known to be an actual judicial authority but, at least they have some useful words put on paper against what these companies appear to have done band still seem to be doingb in authoritarian regimes around the world. See the RSF press release <http://en.rsf.org/bahrein-human-rights-organisations-file-04-02-2013,44016.…>). There are also criminal charges brought in France for complicity of torture <http://www.edri.org/edrigram/number10.10/amesys-complicity-in-torture> against Amesys (later bought by BULL) for its former cooperation <http://online.wsj.com/article/SB10001424053111904199404576538721260166388.h…> with Kaddhafibs political police. However, the trial is taking quite a long time; Amesys has been absorbed by BULL; the French government invests <http://reflets.info/qosmos-et-fsi-restons-optimistes-il-reste-quelques-dict…> public money in BULL; and BULL thrives on defense and private-sector contracts, in France and abroad6 <https://wwments-on-eu-commissions-vague-cybersecurity-strategy-0#footnote6_…>. It is also very hard to have any information on these companiesb controversial activities, in spite of parliamentary requests to governments7 <http://.net/en/comments-on-eu-commissions-vague-cybersecurity-strategy-0#footnote7_e4oubml>, or whether and how they are being regulated under dual-use export <http://ec.europa.eu/trade/creating-opportunities/trade-topics/dual-use/> controls. In the meantime, in an interview, the EC3 chief Troels Crting lists <http://www.euractiv.com/infosociety/cybercrime-centre-work-fbi-us-se-news-5…> b hacktivism <https://en.wikipedia.org/wiki/Hacktivism>b as a cybersecurity threat alongside terrorist activities and extremism. This shows once again that high-ranking officials tend to overlook crucial policy distinctions in apprehending the b cybercrimeb phenomenon, and in particular politically-motivated hacking and other forms of online civil disobedience. After the Telecoms Package, after HADOPI, after SOPA/PIPA, after CISPA, after ACTA, after the WCIT, our dear democracies still donbt seem to get it right. And so we are left watching our political system put much effort and spending lots of time on discussions that in the end deliver so little. *Repressive proposals keep coming. One after the other.* A significant b coreb of policy-makers remains stuck in fear, and keeps refusing to put the protection of freedoms online onto the legislative agenda. And so webre left with questions. Will more citizen pressure on Internet policy-making do the trick? Will the EU Parliament come to the rescue? Because this proposed NIS directive could use some serious improvement. A much more open discussion on cybersecurity policy is urgent. -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

None
by Tim May 06 Jul '18

06 Jul '18

> (Seriously, I say you should GET THE FUCK out of this law school you > are now in. Too many damned lawyers as it is. If you really think, as > you claimed a few weeks ago, that you can study law and then somehow > affect the law/programming worlds, pace the various legal cases of > recent years, then you're delusional. Vastly greater changes are > possible with technology.) "The only reason to be a lawyer is so that nobody can fuck with you". Approx. quote from "Unintended Consequences". Mark

1 0

None
by Tim May 06 Jul '18

06 Jul '18

> (Seriously, I say you should GET THE FUCK out of this law school you > are now in. Too many damned lawyers as it is. If you really think, as > you claimed a few weeks ago, that you can study law and then somehow > affect the law/programming worlds, pace the various legal cases of > recent years, then you're delusional. Vastly greater changes are > possible with technology.) "The only reason to be a lawyer is so that nobody can fuck with you". Approx. quote from "Unintended Consequences". Mark

1 0

None
by Tim May 06 Jul '18

06 Jul '18

> (Seriously, I say you should GET THE FUCK out of this law school you > are now in. Too many damned lawyers as it is. If you really think, as > you claimed a few weeks ago, that you can study law and then somehow > affect the law/programming worlds, pace the various legal cases of > recent years, then you're delusional. Vastly greater changes are > possible with technology.) "The only reason to be a lawyer is so that nobody can fuck with you". Approx. quote from "Unintended Consequences". Mark

1 0

None
by Tim May 06 Jul '18

06 Jul '18

> (Seriously, I say you should GET THE FUCK out of this law school you > are now in. Too many damned lawyers as it is. If you really think, as > you claimed a few weeks ago, that you can study law and then somehow > affect the law/programming worlds, pace the various legal cases of > recent years, then you're delusional. Vastly greater changes are > possible with technology.) "The only reason to be a lawyer is so that nobody can fuck with you". Approx. quote from "Unintended Consequences". Mark

1 0

None
by Tim May 06 Jul '18

06 Jul '18

> (Seriously, I say you should GET THE FUCK out of this law school you > are now in. Too many damned lawyers as it is. If you really think, as > you claimed a few weeks ago, that you can study law and then somehow > affect the law/programming worlds, pace the various legal cases of > recent years, then you're delusional. Vastly greater changes are > possible with technology.) "The only reason to be a lawyer is so that nobody can fuck with you". Approx. quote from "Unintended Consequences". Mark

1 0

None
by Tim May 06 Jul '18

06 Jul '18

> (Seriously, I say you should GET THE FUCK out of this law school you > are now in. Too many damned lawyers as it is. If you really think, as > you claimed a few weeks ago, that you can study law and then somehow > affect the law/programming worlds, pace the various legal cases of > recent years, then you're delusional. Vastly greater changes are > possible with technology.) "The only reason to be a lawyer is so that nobody can fuck with you". Approx. quote from "Unintended Consequences". Mark

1 0