July 2018 - cypherpunks-legacy

Danish Polippix Live CD with TOR, etc
by Niels Elgaard Larsen 06 Jul '18

06 Jul '18

In the Danish IT-Political Association have worked on a CD to promote our rights to privacy, anonymity, fair use, etc. It comes with TOR, Twinkle (with ZRTP), GnuPG, macchanger, libdcss, vlc, etc. We call it Polippix or the Political CD. This week we released a version in cooperation with PROSA-bladet http://www.prosa.dk/prosabladet/ (the front page is a member of parliament holding the Polippix CD in front of parliament) published by the PROSA, Association of Computer Professionals. Each of the 12000 subscribers got a CD with TOR, twinkle and a lot of other nice stuff. This version of Polippix also have a TORpark that can be run from the CD on windows computers and QEMU that can run the whole Live-CD from windows. We got a lot of press from most of the danish medias. E.g. I was demonstrating TOR on the CD on national danish TV tonight. mplayer -playlist "http://sputnik-dyn.tv2.dk/player/asx.php?playlist=6445306,&ticketHandle=162…" Several politicians, including the minister of justice have commented on Polippix. The ISO can be downloaded from http://itpol.dk/ (mirrors listed in the table) The interest today have been overwhelming. Thousands of downloads have completed successfully, we are limited by our bandwidth, even with many 100 Mbit/s mirrors and torrents. Most of it is in danish so far, but you will get the idea. We hope you will welcome the new danish TOR users. -- Niels Elgaard Larsen ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [cryptography] [info] The NSA Is Building the Countrybs Biggest Spy Center (Watch What You Say)
by ianG 06 Jul '18

06 Jul '18

On 19/03/12 12:31 PM, ianG wrote: > ... So after a lot of colour, it is not clear if they can break AES. > Yet. OK. But that is their plan. And they think they can do it, within > their foreseeable future. So, step into NSA's shoes. If there is a timeline here we (NSA) worked out we can break AES "soon" ... what would we do? Would we impress everyone in the world as to how strong it was and push NIST to standardise it as much as possible? Plausible given that everyone follows NIST's lead without question. The Suite B sweetener is aptly named, nobody seems to have missed the sour taste of Suite A ;-) Would we propose or advance some modes or protocols above others? Where I'm getting at here is things like CTR mode. It seems that this mode reduces the obfuscations of CBC to make AES the sole and only fulcrum of strength. Nice, clear and simple. But, assuming a predictable counter, we have lots of ciphertext with a clear relationship. So CTR is easier to crack assuming a big machine that makes the local county brown-out every time someone wants to read a conversation. Or, is the advantage that CBC and other modes have - obfuscation of the ciphertext with variation stolen from the plaintext - of such low value in the scheme of things that these things make no difference? Is the choice of mode irrelevant if AES has a weakness? iang (context here is that I am examining an older protocol of mine with thought of replacing it, and wonder which mode to prefer...) (thinking about it more, my normal rule of "ignore the NSA always" should answer this :) ) _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

CDR: Re: Inferno: The Constitution & Gun Rights: It's bigger than the 2nd alone (fwd)
by Jim Choate 06 Jul '18

06 Jul '18

> Date: Sat, 09 Oct 1999 17:04:05 -0500 > From: Sean Roach > Subject: CDR: Re: Inferno: The Constitution & Gun Rights: It's bigger than > the 2nd alone (fwd) > I was under the impression that that applied only to the army. I > thought that it was the intention to keep the navy going full time. There was no intent not to keep the army going full-time. The intent was to keep them from getting funding for long periods of time. In other words to make it harder for them to build a long-term command structure and weapons cache's (ie hide trusted soldiers away for rainy days). The army is intended for repelling invasions and insurrections, how often do those happen and how many last more than two years? If an actual invasion were to take place martial law would be invoked and the budget limits would be irrelevant at that point. But your point is true enough, and I was hoping somebody would bring this aspect up. It has some interesting points that don't seem to have been discussed. If you or others know of references I'd appreciate a vector. If we accept this view (which I have no problem with, it'd be hard for a Navy to invade Kansas - navies are self limiting) we are left with joint-contracts that involve the army and navy are unconstitutional. The other side would be that the navy must accept the more strict contractual limitations imposed on the army by the Constitution (what I actualy prefer because of new weapons systems). The intent is to keep the army on a short leash and to be able to simply bypass this by working with other arms of the military would be contrary to the Constitutions intent. One could transfer all the army soldiers to navy command and impliment an oppressive regime that way. I don't believe that was what was intended. It also raises the fact that since the Army Air Corp was turned into the Air Force (and this applies to the Navy and Marine Corp. as well) and no specific guidance was made via constitutional amendment as to its budget constraints it may be unconstitutional as currently implimented. Per the 10th there is nothing that gives Congress the authority to create new military forces outside of the army and navy. This should be done via a constitutional amendment. What we have today is a joint command that integrates all the various military forces under one umbrella. That joint command is an arm of the executive branch and not Congress, that may be unconstitutional itself. This raises the question of how seperate they are now and how congruent with the Constitution it actualy is. So, because of this the Joint Chiefs and the Pentagon may be unconstitutional as currently implimented, or one could argue that all budgets must be limited to 2 years. Since the Constitution requires such budgets to be reviewed from time to time it implies that a full budget review of the military is required every two years. > However, it is not my place to say that they would have done this had > they had the chance. If you're a citizen of the US not only is it your place it's your duty. > Too many of our regulations are based on this belief that our founding > fathers would have seen things "my" way. I hate that the intent of the > constitution is ignored so blatently, but judging intent is like proving > opinion. To quote Jefferson: The earth belonds to the living, not the dead. The founding fathers wanted Americans to be free peoples pursuing their own individual life, liberty, and happiness. It is the duty of all Americans to protect those rights, even from other Americans. We have to decide the way *we* want to live and the kind of world our children will inheret. The kind of world our forefathers had and the decisions they made within that milieu are good for exemplary review only. Santyana is a good guide. If nothing else it is clear the fight is never over. No matter what we do our children will have to fight it all over again on different ground and different issues. We should at least give them a fighting chance. I don't believe for a moment the founding fathers felt they had created a once-and-for-all document. Nor do I believe they felt they were living at the epitome of technical and social achievement within the total history of mankind. Part of Jeffersons stock and trade was advancement, it's why he created the University of Virginia. They knew they couldn't predict the future and the best peoples to judge it were the ones living it. What they wanted was a mechanism that would guarantee that the poeple had a say and were not ruled over by a despot or tyranny. They hoped to give us a good chance at reaching our individual and social goals, what those goals were are for us to decide. We, not the founding fathers, have to live with them after all. They were, if nothing else, simply trying to be good parents (both to a country and to their biological children) and teach us basic principles. > I'd like to see something more like the swiss have. Everyone gets > basic. Perhaps as part of grades 11-12. Some few can stay on in > administrative roles throughout. And rely entirely on the draft, but > only for threats on home ground. I don't believe in the draft, it is coersion and is contrary to the tenets of the Constitution. An army made of people who don't *want* to fight for their country will lose. An army of peoples who will die rather than surrender their liberty will always win, even if they are all killed they deny the oppressor their goals. One does not give up democracy to protect democracy. This does point up one aspect of nuclear defence that has also seldome been discussed, nuclear suicide. Instead of pointing weapons at other countries one points the weapons (lot's of them) at oneself. If another country begins a nuclear conflict (which is inherently unwinnable) the Earth as we know it will become uninhabitable. Who wants to subject their peoples to the starvation and other privations that will bring on. It is better to kill oneself quickly and humanely and in that act poison the well so the enemy suffers at their own hands and in the worst way. I believe we will never get rid of nuclear weapons, and shouldn't, and this is the only sane way to control their use. [1]

1 0

CDR: Re: An immediate way to end federal gun control? (fwd)
by Jim Choate 06 Jul '18

06 Jul '18

----- Forwarded message from Steve Schear -----

1 0

CDR: Constitution, gun rights, et al (fwd)
by Jim Choate 06 Jul '18

06 Jul '18

----- Forwarded message from Sean Roach -----

1 0

MIT Press book appeared
by brands＠xs4all.nl 06 Jul '18

06 Jul '18

Hi Bob, The MIT Press book edition has appeared. See http://www.xs4all.nl/~brands Regards, Stefan --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Danish Polippix Live CD with TOR, etc
by Niels Elgaard Larsen 06 Jul '18

06 Jul '18

In the Danish IT-Political Association have worked on a CD to promote our rights to privacy, anonymity, fair use, etc. It comes with TOR, Twinkle (with ZRTP), GnuPG, macchanger, libdcss, vlc, etc. We call it Polippix or the Political CD. This week we released a version in cooperation with PROSA-bladet http://www.prosa.dk/prosabladet/ (the front page is a member of parliament holding the Polippix CD in front of parliament) published by the PROSA, Association of Computer Professionals. Each of the 12000 subscribers got a CD with TOR, twinkle and a lot of other nice stuff. This version of Polippix also have a TORpark that can be run from the CD on windows computers and QEMU that can run the whole Live-CD from windows. We got a lot of press from most of the danish medias. E.g. I was demonstrating TOR on the CD on national danish TV tonight. mplayer -playlist "http://sputnik-dyn.tv2.dk/player/asx.php?playlist=6445306,&ticketHandle=162…" Several politicians, including the minister of justice have commented on Polippix. The ISO can be downloaded from http://itpol.dk/ (mirrors listed in the table) The interest today have been overwhelming. Thousands of downloads have completed successfully, we are limited by our bandwidth, even with many 100 Mbit/s mirrors and torrents. Most of it is in danish so far, but you will get the idea. We hope you will welcome the new danish TOR users. -- Niels Elgaard Larsen ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [cryptography] [info] The NSA Is Building the Countrybs Biggest Spy Center (Watch What You Say)
by ianG 06 Jul '18

06 Jul '18

On 19/03/12 12:31 PM, ianG wrote: > ... So after a lot of colour, it is not clear if they can break AES. > Yet. OK. But that is their plan. And they think they can do it, within > their foreseeable future. So, step into NSA's shoes. If there is a timeline here we (NSA) worked out we can break AES "soon" ... what would we do? Would we impress everyone in the world as to how strong it was and push NIST to standardise it as much as possible? Plausible given that everyone follows NIST's lead without question. The Suite B sweetener is aptly named, nobody seems to have missed the sour taste of Suite A ;-) Would we propose or advance some modes or protocols above others? Where I'm getting at here is things like CTR mode. It seems that this mode reduces the obfuscations of CBC to make AES the sole and only fulcrum of strength. Nice, clear and simple. But, assuming a predictable counter, we have lots of ciphertext with a clear relationship. So CTR is easier to crack assuming a big machine that makes the local county brown-out every time someone wants to read a conversation. Or, is the advantage that CBC and other modes have - obfuscation of the ciphertext with variation stolen from the plaintext - of such low value in the scheme of things that these things make no difference? Is the choice of mode irrelevant if AES has a weakness? iang (context here is that I am examining an older protocol of mine with thought of replacing it, and wonder which mode to prefer...) (thinking about it more, my normal rule of "ignore the NSA always" should answer this :) ) _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [tor-talk] Fwd: [guardian-dev] NPTor News - an OnionKit Sample App
by grarpamp 06 Jul '18

06 Jul '18

> Proof that streaming media, well at least radio, can work well over > mobile Tor. 64k radio has been done HS to HS before, works fine if you get a decent path. > This uses TCP-based progressive download of audio, and not true UDP/RTP > streaming. That's a given, Tor only supports TCP over TCP. Now combine some project like this, or similar, or really just any SIP client... https://guardianproject.info/wiki/OSTN With a nice standard like this... http://opus-codec.org/ And with Tor and some wifi or cell based ip address... and you've got yourself a nice private phone call. That codec is quite good, and mandatory, so it should be appearing in your software of choice very soon. Support EFF and other's open wifi efforts and in a dense area, you won't need cell service. For $5/mo you could even buy a legacy POTS<->anon relay service number. _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: OT: cheap colo space in Southern Germany/Munich
by Caleb James DeLisle 06 Jul '18

06 Jul '18

Oh hi.. Interesting criticism. On 11/24/2012 02:03 PM, Eugen Leitl wrote: > On Sat, Nov 24, 2012 at 06:46:12PM +0000, Nick Hilliard wrote: >> On 24/11/2012 17:38, Eugen Leitl wrote: >>> E.g. see >>> https://github.com/cjdelisle/cjdns/blob/master/rfcs/Whitepaper.md >>> which is an instance of street technology to address >>> multiple issues the current networks don't deal with. >> >> cjdns is certainly an interesting approach, but its inventor doesn't appear >> to understand: > > I think you have several excellent points (those, that I could > understand, at least) and in fact I'll let cjd know. > > Again, I don't claim that this particular design is > going to work. Just that is an instance of a coming > series of approaches which will result in a functional > system, eventually, some 10-15 years downstream. > >> - scaling issues It's incumbent on me to prove that it scales but if there are obvious theoretical scaling inadequacies then maybe you would care to bring them up? >> >> - point to multipoint networking Grandma doesn't use it. >> >> - that deterministic reachability is usually considered a good thing I'd love for it to be more deterministic but I don't see how to make the design do that. >> >> - non-local connectivity lookup introduces hilarious denial of service >> mechanisms Yeap, DoS is a serious issue with this design. It's also a serious issue (although less serious) with the Internet as it is today. My plan is to introduce a market based flood management system integrated with congestion control logic. What's your plan? Just hoping that that botnets never reach terrabit capacity isn't an answer. >> >> - the value of bitfield qos Grandma doesn't use it. >> >> - that the use of bEncoding for connectivity lookup is a degree or two >> worse than using TLVs for the same means bEncoding sucks. But it sucks less than the alternatives which I saw at the time. What's necessary is simplicity and ability to add keys to a message without breaking old nodes. >> >> - full independence from traditional ip protocols ("Router messages are >> sent as normal UDP/IPv6 packets except that their UDP source and >> destination port numbers are zero and the hop limit (TTL) field in the IPv6 >> header is set to zero.") It's probably not the best design but it's an asthetic issue, cjdns weeds the control packets out of the stream en route, it doesn't "bind to port 0". >> >> - that strictly symmetric routing is a bug, not a feature Good to hear that cjdns isn't missing a feature. >> >> - that 64 bits as a routing path mechanism is woefully insufficient for >> modern networking /me snickers at the fact that it was said on an IPv6 mailing list. >> >> - that separation of control plane and data plane on a router is probably a >> good idea If you mean what I think you mean, that's already done ("cjdns weeds the packets out of the stream"). >> >> - throwing out the book on existing networking models is only valid if the >> proposed replacement is measurably better Bullshit. Throwing out the book is always valid, at best you invent the next big thing, at worst you have a great learning experience. In the middle, the good ideas are integrated into existing technologies and the bad ideas serve as a case study. >> >> What's left in cjdns is a poorly specified mishmash of curious ideas which >> will work fine on the author's playpen network and which will break >> horribly on large networks, regardless of how hard the author waves the >> "hey look at me, i'm having a revolution" flag. If I was in charge of a major AS, I wouldn't implement *anything* which was developed with an R&D budget of 0. There are some potentially interesting components but as a whole, cjdns is not intended to work on large networks. In places like where I live, it's not cost effective for cable and phone companies to provide fast internet. I believe that people are willing to spend money on a pole and a few directional radio links if they can install the equipment and it will just work. I also think they'll be willing to share the data downstream if they can get a discount on their bill for the data they shared. What I need is a way to separate infrastructure, billing, and IP4 gateway provision. I want to put up a pole, make a directional radio link to my neighbor, sign up with a billing provider that takes major credit cards, and be online. I don't want to worry about my neighbor spying on my traffic and if someone links to my pole, I want a discount for carrying their bits. IMO the most important role of cjdns is not in offering an answer but in introducing a question. Thanks, Caleb >> >> Nick >> ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0