July 2018 - cypherpunks-legacy

DIMACS Workshop on Information Markets, NJ Feb 2-4 2005
by Linda Casals 05 Jul '18

05 Jul '18

Announcement and Call For Participation ********************************************************************* DIMACS Workshop on Information Markets February 2-4, 2005 DIMACS Center, Rutgers University, Piscataway, NJ http://dimacs.rutgers.edu/Workshops/Markets/ Organizers: Robin Hanson, George Mason University, rhanson -AA@TT- gmu.edu John Ledyard, California Institute of Technology, jledyard -AA@TT- hss.caltech.edu David Pennock, Yahoo! Research Labs, pennockd -AA@TT- yahoo-inc.com Presented under the auspices of the Special Focus on Computation and the Socio-Economic Sciences ********************************************************************* A market designed for information gathering and forecasting is called an information market. Information markets can be used to elicit a collective estimate of the expected value or probability of a random variable, reflecting information dispersed across a population of traders. The degree to which market forecasts approach optimality in practice, or at least surpass other known methods of forecasting, is remarkable. Supporting evidence can be found in empirical studies of options markets, commodity futures markets, political stock markets, sports betting markets, horse racing markets, market games, laboratory investigations of experimental markets, and field tests. In nearly all these cases, market prices reveal a reliable forecast about the likely unfolding of future events, often beating expert opinions or polls. Despite a growing theoretical and experimental literature, many questions remain regarding how best to design, deploy, analyze, and understand information markets, including both technical challenges and social challenges. This workshop will include talks on information markets by a number of distinguished invited speakers. Speakers will cover a range of topics including mechanism design, experiments, analysis, policy, and industry experience. Speakers will include representatives from academia, industry, and government. The workshop will feature research talks, opinions, reports of industry experience, and discussion of government policy from the perspective of a number of fields, including economics, business, finance, computer science, gambling/gaming, and policy. See the workshop program for more details: http://dimacs.rutgers.edu/Workshops/Markets/program.html The workshop will feature a tutorial session on Wednesday afternoon (Feb. 2, 2005) to help those new to the field get up to speed. The workshop will include a panel discussion on the Policy Analysis Market (a.k.a., "Terror Futures") and a "rump" session where anyone who requests time can have the floor for five minutes to speak on any relevant topic. To participate in the rump session, please email David Pennock: pennockd --AA@TT- yahoo-inc.com. ********************************************************************* Registration Fees: (Pre-registration deadline: January 26, 2005) Please see website for additional registration information. ********************************************************************* Information on participation, registration, accomodations, and travel can be found at: http://dimacs.rutgers.edu/Workshops/Markets/ **PLEASE BE SURE TO PRE-REGISTER EARLY** --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: [IP] more on Privacy tip: be wary of Google's "personal history"
by cypherpunk 05 Jul '18

05 Jul '18

feature [priv] (fwd from dave(a)farber.net) Reply-To: cypherpunk <cyphrpunk(a)gmail.com> The question is, with regard to Google, does turning "personal history" on or off make a difference in what records they keep about your searches? Obviously if it's on they do keep records, but if you disable it or never turn it on, does that mean that they don't keep records? http://www.google.com/searchhistory/privacy.html says: "You can delete information from My Search History, and it will be removed from the service and no longer available to you. However, as is common practice in the industry, and as outlined in the Google Privacy Policy, Google maintains a separate logs system for auditing purposes and to help us improve the quality of our services for users." http://www.google.com/privacy.html says: "Google collects limited non-personally identifying information your browser makes available whenever you visit a website. This log information includes your Internet Protocol address, browser type, browser language, the date and time of your query and one or more cookies that may uniquely identify your browser. We use this information to operate, develop and improve our services." The bottom line seems to be that even with MSH turned off, Google will still record your IP address and cookie, presumably along with the search query you made. You can block Google cookies to help with this, and if you use a shared IP address then this will give you some privacy protection. Chances are that other search engines do the same thing. For real privacy, do as I do: use TOR or some other anonymizer, and either block cookies or use a separate browser altogether for anonymous browsing. CP ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[ PRIVACY Forum ] Toward Pervasive Internet Encryption:
by privacy＠vortex.com 05 Jul '18

05 Jul '18

Unshackling the Self-Signed Certificate Reply-To: PRIVACY Forum Digest mailing list <privacy(a)vortex.com> Toward Pervasive Internet Encryption: Unshackling the Self-Signed Certificate http://lauren.vortex.com/archive/000339.html Greetings. In "http: Must Die! (and The Encryption Solution)" ( http://lauren.vortex.com/archive/000338.html ), I suggested an accelerated move toward the routine use of encrypted TLS/https: instead of unencrypted http: for Web communications. An issue that cannot be ignored in this regard is the cost and logistics of server security certificates that are natively recognized by popular Web browsers. Certificates are required to enable TLS encryption in these environments, of course. And while the marketplace for commercial certs is far more competitive now than it was just a few years ago, the cost and hassle factors associated with their purchase and renewal are very relevant, especially for larger sites with many operational server names and systems. What isn't widely understood outside of the technical community is that "self-signed" certificates, which can be generated for free by anyone (and with essentially arbitrary expiration dates) can enable these cryptographic systems in a manner very similar to commercial certs. What self-signed certs typically won't provide is the same "web of trust" confirmation (via a widely recognized certificate authority) for the *identity* of a given site. However, in a vast number of applications where absolute identity confirmation is not required (particularly when commerce is not involved), self-signed certificates are quite adequate. Why then are self-signed certs primarily employed within organizations, but comparatively rarely for servers used by the public at large, even where identity confirmation is not a major issue? The primary reason is that most Web browsers will present a rather alarming and somewhat confusing (for the typical user) alert as part of a self-signed certificate acceptance query dialogue. This tends to scare off many people unnecessarily, and makes self-signed certificate use in public contexts significantly problematic. Security purists may bristle at what I'm going to say next, but so be it. I believe that we should strongly consider something of a paradigm shift in the manner of browsers' handling of self-signed certificates, at the user's option. When a browser user reaches a site with a self-signed certificate, they would be presented with a dialogue similar to that now displayed, but with additional, clear, explanatory text regarding self-signed certificates and their capabilities/limitations. The user would also be offered the opportunity to not only accept this particular cert, but also to optionally accept future self-signed certs without additional dialogues (this option could also be enabled or disabled via browser preference settings). If the user declined this option, the browser would continue to treat self-signed certs in the traditional manner. If the option were accepted, future self-signed certs would not trigger the query dialogue. In either case, the use of a self-signed certificate would ideally cause the appearance throughout that session of an appropriate unobtrusive but clearly visible "self-signed cert" notification message or icon. I would also recommend that the browser URL address bar change to a unique color (e.g. light blue or some other acceptable choice) to indicate a self-signed certificate in use. There are obviously significant security ramifications to this proposal to be carefully analyzed, and a range of variations in the ways that something along these lines might be implemented. But I hope that this discussion helps to stimulate explorations regarding the possible desirability and practicality of much larger scale use of self-signed certificates on the Internet, particularly to encourage the transition of routine Web browsing to an encrypted environment. --Lauren-- Lauren Weinstein lauren(a)vortex.com or lauren(a)pfir.org Tel: +1 (818) 225-2800 http://www.pfir.org/lauren Co-Founder, PFIR - People For Internet Responsibility - http://www.pfir.org Co-Founder, NNSquad - Network Neutrality Squad - http://www.nnsquad.org Founder, PRIVACY Forum - http://www.vortex.com Member, ACM Committee on Computers and Public Policy Lauren's Blog: http://lauren.vortex.com _______________________________________________ privacy mailing list http://lists.vortex.com/mailman/listinfo/privacy

1 0

Re: "I Write Mass Surveillance Software"
by Gregory Maxwell 05 Jul '18

05 Jul '18

On Wed, Sep 16, 2009 at 5:01 PM, Rich Jones <rich(a)anomos.info> wrote: > http://www.reddit.com/r/IAmA/comments/9kwph/i_am_a_guy_who_writes_covert_so… > Thoughts? > > also, I realized that two of the posts I've made this this list have now > been reddit-related. Sorry about that. But I'd really like to know what you > all make of this. He doesn't give very many specifics, unfortunately. What > do you think his 'sidestepping' is? The hostility on reddit is odd and unfortunate. The obvious sidestepping is MITM-ing connections for users then shove manipulated binaries at them which disable encryption, leak key material, or intercept keystrokes ... or simply perform degradation attacks, either forcing protocols to less secure modes, or simply blocking or massively slowing secure connections to make the user switch to something insecure. These have the enormous downside of being detectable active attacks. Not something you could afford to apply frequently against general public unless you were willing to tip off your primary target that you were watching. Then againb with ISPs like comcast injecting RST packets, would a degradation attack be distinguishable? Less obvious sidestepping would include things like simply monitoring the remote side with the expectation that they won't be as prudent with security as your primary target. Black-helicopter mode sidestepping would be having pre-arranged back doors in popular operating systems or client software. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[Freedombox-discuss] A Simple Server Setup Guide
by Nick Daly 05 Jul '18

05 Jul '18

Hi Freedombox folks, I find Eben Moglen's ideals and your project rather inspiring. I found them so inspiring that I decided to see if I could create a Freedombox-similar-server to fit my dehierarchicalization-through-plug-computer needs. I think I succeeded. Right now, my server is running in a VM on my laptop (because I don't yet have a plug-computer) and it's not yet reachable over the internet (because my router is physically incapable of forwarding ports) but, right now, it runs just beautifully inside of 128MB RAM, and 2GB disk-space. Importantly, I wrote up my experiment in a tutorial [0] for any like-minded person to follow. If you have the time and interest, I'd appreciate if anyone on the list could give it a read-through and send me some feedback on it - improvements, security holes, any comments at all, really. Let me know what you think! Thanks for your time, Nick 0: https://bitbucket.org/nickdaly/plugserver/ PS: I'd appreciate if anyone could offer ideas on how to make Freedomboxes (or similar servers) reachable over the internet, through ISPs that fight *really* hard (through their policies and standard hardware) to prevent users from hosting or serving anything. I'm looking for hackier solutions than "change ISPs" because, thanks to the monopoly American ISP market, that option's mostly irrelevant. (Is there some sort of DNS alternative out there?) -- GPG: 0x4C682009 | 084E D805 31D8 5391 1D27 0DE1 9780 FD4D 4C68 2009 _______________________________________________ Freedombox-discuss mailing list Freedombox-discuss(a)lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/freedombox-discuss ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

DIMACS Workshop on Information Markets, NJ Feb 2-4 2005
by Linda Casals 05 Jul '18

05 Jul '18

Announcement and Call For Participation ********************************************************************* DIMACS Workshop on Information Markets February 2-4, 2005 DIMACS Center, Rutgers University, Piscataway, NJ http://dimacs.rutgers.edu/Workshops/Markets/ Organizers: Robin Hanson, George Mason University, rhanson -AA@TT- gmu.edu John Ledyard, California Institute of Technology, jledyard -AA@TT- hss.caltech.edu David Pennock, Yahoo! Research Labs, pennockd -AA@TT- yahoo-inc.com Presented under the auspices of the Special Focus on Computation and the Socio-Economic Sciences ********************************************************************* A market designed for information gathering and forecasting is called an information market. Information markets can be used to elicit a collective estimate of the expected value or probability of a random variable, reflecting information dispersed across a population of traders. The degree to which market forecasts approach optimality in practice, or at least surpass other known methods of forecasting, is remarkable. Supporting evidence can be found in empirical studies of options markets, commodity futures markets, political stock markets, sports betting markets, horse racing markets, market games, laboratory investigations of experimental markets, and field tests. In nearly all these cases, market prices reveal a reliable forecast about the likely unfolding of future events, often beating expert opinions or polls. Despite a growing theoretical and experimental literature, many questions remain regarding how best to design, deploy, analyze, and understand information markets, including both technical challenges and social challenges. This workshop will include talks on information markets by a number of distinguished invited speakers. Speakers will cover a range of topics including mechanism design, experiments, analysis, policy, and industry experience. Speakers will include representatives from academia, industry, and government. The workshop will feature research talks, opinions, reports of industry experience, and discussion of government policy from the perspective of a number of fields, including economics, business, finance, computer science, gambling/gaming, and policy. See the workshop program for more details: http://dimacs.rutgers.edu/Workshops/Markets/program.html The workshop will feature a tutorial session on Wednesday afternoon (Feb. 2, 2005) to help those new to the field get up to speed. The workshop will include a panel discussion on the Policy Analysis Market (a.k.a., "Terror Futures") and a "rump" session where anyone who requests time can have the floor for five minutes to speak on any relevant topic. To participate in the rump session, please email David Pennock: pennockd --AA@TT- yahoo-inc.com. ********************************************************************* Registration Fees: (Pre-registration deadline: January 26, 2005) Please see website for additional registration information. ********************************************************************* Information on participation, registration, accomodations, and travel can be found at: http://dimacs.rutgers.edu/Workshops/Markets/ **PLEASE BE SURE TO PRE-REGISTER EARLY** --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: [IP] more on Privacy tip: be wary of Google's "personal history"
by cypherpunk 05 Jul '18

05 Jul '18

feature [priv] (fwd from dave(a)farber.net) Reply-To: cypherpunk <cyphrpunk(a)gmail.com> The question is, with regard to Google, does turning "personal history" on or off make a difference in what records they keep about your searches? Obviously if it's on they do keep records, but if you disable it or never turn it on, does that mean that they don't keep records? http://www.google.com/searchhistory/privacy.html says: "You can delete information from My Search History, and it will be removed from the service and no longer available to you. However, as is common practice in the industry, and as outlined in the Google Privacy Policy, Google maintains a separate logs system for auditing purposes and to help us improve the quality of our services for users." http://www.google.com/privacy.html says: "Google collects limited non-personally identifying information your browser makes available whenever you visit a website. This log information includes your Internet Protocol address, browser type, browser language, the date and time of your query and one or more cookies that may uniquely identify your browser. We use this information to operate, develop and improve our services." The bottom line seems to be that even with MSH turned off, Google will still record your IP address and cookie, presumably along with the search query you made. You can block Google cookies to help with this, and if you use a shared IP address then this will give you some privacy protection. Chances are that other search engines do the same thing. For real privacy, do as I do: use TOR or some other anonymizer, and either block cookies or use a separate browser altogether for anonymous browsing. CP ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[Freedombox-discuss] A Simple Server Setup Guide
by Nick Daly 05 Jul '18

05 Jul '18

Hi Freedombox folks, I find Eben Moglen's ideals and your project rather inspiring. I found them so inspiring that I decided to see if I could create a Freedombox-similar-server to fit my dehierarchicalization-through-plug-computer needs. I think I succeeded. Right now, my server is running in a VM on my laptop (because I don't yet have a plug-computer) and it's not yet reachable over the internet (because my router is physically incapable of forwarding ports) but, right now, it runs just beautifully inside of 128MB RAM, and 2GB disk-space. Importantly, I wrote up my experiment in a tutorial [0] for any like-minded person to follow. If you have the time and interest, I'd appreciate if anyone on the list could give it a read-through and send me some feedback on it - improvements, security holes, any comments at all, really. Let me know what you think! Thanks for your time, Nick 0: https://bitbucket.org/nickdaly/plugserver/ PS: I'd appreciate if anyone could offer ideas on how to make Freedomboxes (or similar servers) reachable over the internet, through ISPs that fight *really* hard (through their policies and standard hardware) to prevent users from hosting or serving anything. I'm looking for hackier solutions than "change ISPs" because, thanks to the monopoly American ISP market, that option's mostly irrelevant. (Is there some sort of DNS alternative out there?) -- GPG: 0x4C682009 | 084E D805 31D8 5391 1D27 0DE1 9780 FD4D 4C68 2009 _______________________________________________ Freedombox-discuss mailing list Freedombox-discuss(a)lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/freedombox-discuss ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [liberationtech] Cryptography super-group creates unbreakable encryption
by Rich Kulawiec 05 Jul '18

05 Jul '18

Alchemy is to chemistry, astrology is to astronomy, as closed-source is to open source. Closed-source is intellectual fraud. It is the equivalent of an academic paper which has a synopsis and conclusions -- but nothing else. No honest reviewer would ever approve such tripe for publication in a refereed journal of mechanical engineering or physics or medicine...yet we, in computer science, are expected to do the equivalent. We're actually expected to take someone's word that their code does what they say it does -- even though we have a mountain of evidence stretching back to the beginning of our field that says it's NEVER been true, even when the code's written by people who are smart/experienced/honest/diligent/etc. Not even Stephen Hawking gets his papers published without showing his data/reasoning/work/etc. As it should be. So yes, my response to this is "source or GTFO". Extraordinary claims require extraordinary proof and in this case, there is none. ---rsk -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [FoRK] Google
by rst＠ai.mit.edu 05 Jul '18

05 Jul '18

Lucas Gonze writes: > > P.S. Maybe I just hate the Google hype, of which there is much. > > The creepy all-seeing eye is what gets me. They can surely use my > verification email for gmail to cross-ref me to google groups, my blog, > and eventually all the way back to my ftp traces from the 80s. It hurts > to think about. I never understood why the privace fuss over gmail centered on their target ads. Use of tracking cookies across multiple Google services is a lot more worrisome. Playing with gmail without getting tracked is tricky at best -- last I checked, it just didn't work unless you took a search-tracking cookie as well. You could try to deal with that by setting up a browser profile with its own cookie jar, and using it for gmail and nothing else. But I think you'd still need a securely pseudonymous throwaway email address to set up the gmail account. And the lack of searches on that cookie would let them know, at least, that they're dealing with a privacy freak. FWIW, I'm really not sure what level of paranoia to adopt wrt Google. "Don't be evil" is a nice slogan, though "evil" is to some extent in the eye of the beholder. They don't seem too upset to put a few more bricks in the Great Firewall of China, for instance: http://news.zdnet.co.uk/internet/security/0,39020375,39167942,00.htm But that makes them no different from a lot other American companies, like Yahoo and Cisco, which have also been happy to cooperate, in their own ways. It's hard to make a case for Google as being uniquely evil or dangerous based so far on public misdeeds. But here, for what it's worth, is the most paranoid case I can easily concot. Suppose you were genuinely, unabashedly evil. And suppose you wanted to accumulate as much information as you could. (If people give you the information for free, so much the better). And suppose you wanted to get a lot of very smart people to make it easy to search and access that information for your nefarious purposes. (They, of course, wouldn't need to know what they are ultimately working on). You'd want access to everything at Google. But you wouldn't necessarily want to be up front and center promoting it in public. Better by far to let some genuine idealists be the public face -- while your agents quietly hang out inside, subverting the place. rst _______________________________________________ FoRK mailing list http://xent.com/mailman/listinfo/fork ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0