July 2018 - cypherpunks-legacy

[osint] Getting a Blood Test? ChoicePoint Gets a Drop to DNA Tag You
by Brooks Isoldi 06 Jul '18

06 Jul '18

Getting a Blood Test? ChoicePoint Gets a Drop to DNA Tag You September 9, 2004 by Greg Palast DON'T LOOK AT THE FLASH On September 11, 2001, we Americans were the victims of a terrible attack. By September 12, we became the suspects. Not one single U.S. citizen hijacked a plane, yet President Bush and Attorney General John Ashcroft, through powers seized and codified in the USA PATRIOT Act, fingered 270 million of us for surveillance, for searches, for tracking, for watching. And who was going to play Anti-Santa, watching to see when we've been good or bad? A guy named Derek Smith. And that made September 11, 2001 Derek's lucky day. Even before the spying work could begin, there were all those pieces of people to collect - tubes marked "DM" (for "Disaster Manhattan") - from which his company, ChoicePoint Inc, would extract DNA for victim identification, work for which the firm would receive $12 million from New York City's government. Maybe Smith, like the rest of us, grieved at the murder of innocent friends and countrymen. As for the 12-million-dollar corpse identification fee, that's chump change to the $4 billion corporation Smith had founded only four years earlier in Alpharetta, Georgia. Nevertheless, for Smith's ChoicePoint Inc., Ground Zero would become a profit center lined with gold. As the towers fell, ChoicePoint's stock rose; and from Ground Zero, contracts gushed forth from War on Terror fever. Why? Because this outfit is holding no less 16 billion records on every living and dying being in the USA. They're the Little Brother with the filing system when Big Brother calls. ChoicePoint's quick route to no-bid spy contracts was not impeded by the fact that the company did something for George W. Bush that the voters would not: select him as our president. Here's how they did it. Before the 2000 election, ChoicePoint unit Database Technologies, held a $4 million no-bid contract under the control of Florida Secretary of State Katherine Harris, to identify felons who had illegally registered to vote. The ChoicePoint outfit altogether fingered 94,000 Florida residents. As it turned out, less than 3,000 had a verifiable criminal record; almost everyone on the list had the right to vote. The tens of thousands of "purged" citizens had something in common besides their innocence: The list was, in the majority, made up of African Americans and Hispanics, overwhelmingly Democratic voters whose only crime was V.W.B: Voting While Black. And that little ethnic cleansing operation, conducted by Governor Jeb Bush's gang with ChoicePoint's aid, determined the race in which Harris named Bush the winner by 537 votes. To say that ChoicePoint is in the "data" business is utterly to miss their market concept: These guys are in the Fear Industry. Secret danger lurks everywhere. Al Qaeda's just the tip of the iceberg. What about the pizza delivery boy? ChoicePoint hunted through a sampling of them and announced that 25 percent had only recently come out of prison. "What pizza do you like?" asks CEO Smith. "At what price? Are you willing to take the risk?..." War fever opened up a whole new market for the Fear Industry. And now Mr. Smith wants your blood. ChoicePoint is the biggest supplier of DNA to the FBI's "CODIS" system. And, one company insider whispered to me, "Derek [Smith] told me that it is his hope to build a database of DNA samples from every person in the United States." For now, Smith keeps this scheme under wraps, fearing "resistance" from the public. Instead, Smith pushes "ChoicePoint Cares" - taking DNA samples to hunt for those missing kids on milk cartons. It's for, "the mothers of this country who are wrestling with threats" - you know, the pizza guy from Al Queda, the cult kidnappers. In other words, ChoicePoint's real product, like our President's, is panic. In Hollywood, Jack Nicholson picked up the zeitgeist: "If I were an Arab American I would insist on being profiled. This is not the time for civil rights." Maybe Jack's right: screw rights, we want safety. But wait, Jack. We're both old farts who can remember the Cuban Missile Crisis. In 1962, the Russians were going to drop The Big One on us. But we didn't have to worry, Mrs. Gordon told us, if we just got under the desk, covered our necks. And she'd warned, it will all be OK as long as we, "Don't look at the flash!" ChoicePoint's Smith admonishes that, if we,d only had his databases humming at the airports on September 11, the hijackers, who used their own names, would have been barred from boarding. However, experts inform me that Osama no longer checks in as "Mr. bin Laden," even at the cost of losing his frequent flyer miles. ChoicePoint's miles of files, the FBI's CODIS system, taking off your shoes at the airport, Code Purple days, the whole new Star-Spangled KGB'ing of America is the new "Duck and Cover." Thank you, ChoicePoint. Thank you, Mr. Ashcroft. **** Greg Palast is the author of the New York Times bestseller, "The Best Democracy Money Can Buy" and "Joker's Wild: Dubya's Trick Deck" - investigative regime change cards from Seven Stories Press. All are available here: http://www.gregpalast.com ------------------------ Yahoo! Groups Sponsor --------------------~--> $9.95 domain names from Yahoo!. Register anything. http://us.click.yahoo.com/J8kdrA/y20IAA/yQLSAA/TySplB/TM --------------------------------------------------------------------~-> -------------------------- Want to discuss this topic? Head on over to our discussion list, discuss-osint(a)yahoogroups.com. -------------------------- Brooks Isoldi, editor bisoldi(a)intellnet.org http://www.intellnet.org Post message: osint(a)yahoogroups.com Subscribe: osint-subscribe(a)yahoogroups.com Unsubscribe: osint-unsubscribe(a)yahoogroups.com *** FAIR USE NOTICE. This message contains copyrighted material whose use has not been specifically authorized by the copyright owner. OSINT, as a part of The Intelligence Network, is making it available without profit to OSINT YahooGroups members who have expressed a prior interest in receiving the included information in their efforts to advance the understanding of intelligence and law enforcement organizations, their activities, methods, techniques, human rights, civil liberties, social justice and other intelligence related issues, for non-profit research and educational purposes only. We believe that this constitutes a 'fair use' of the copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use this copyrighted material for purposes of your own that go beyond 'fair use,' you must obtain permission from the copyright owner. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/osint/ <*> To unsubscribe from this group, send an email to: osint-unsubscribe(a)yahoogroups.com <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[IP] Jasper Green Lasers: useful tool or terrorist weapon?
by David Farber 06 Jul '18

06 Jul '18

------ Forwarded Message From: "Richard M. Smith" <rms(a)computerbytesman.com> Date: Tue, 04 Jan 2005 16:46:02 -0500 To: <dave(a)farber.net> Subject: Jasper Green Lasers: useful tool or terrorist weapon? Yikes! High-powered laser pointers do seem to present a problem to pilots. Richard http://www.bigha.com/blog/archives/000058.php?0 >From Saturday, January 1, 2005 Jasper Green Lasers: useful tool or terrorist weapon? posted by Noah <http://www.bigha.com/meet_us/stories/noah.php> , at 2:52 PM I'm sure we've all read stories like this one <http://www.cnn.com/2004/US/12/09/terrorist.laser.ap/index.html> or this one <http://www.kktv.com/home/headlines/1309846.html> or this one <http://apnews.myway.com/article/20050101/D87B2G180.html> in the past week or so. The theme is consistent: some dorkus is shining a green laser into moving aircraft and temporarily blinding pilots. Not cool, obviously. On Thursday I was contacted by the FBI. They were investigating a new incident even scarier than the ones we've read about. The good news is they are coming up with ways to track and catch the culprits. The bad news is, we have reason to believe at least one of the culprits is using a Jasper. Wow. The theory is this: the dorkuses possibly modified their lasers (this is easy to do) to increase the power. and accessorizing it with a tripod and a scope to track and aim at aircraft. Even the unmodified Jasper is plainly visible at 10,000 feet. At 25,000 feet it is still visible, but it becomes fainter and obviously much more difficult to aim from the ground. Since there are so many reflective surfaces in the cockpit, it only takes the beam landing on one of the cockpit windows for 2-3 seconds before it bounces all around, and temporarily blinds the pilots. We have been asked if there are any suspicious persons have purchased from us, especially in areas like Colorado, New Jersey, Ohio and southern Oregon where instances have been reported. We are trying to cooperate with the authorities while at the same time respecting the privacy of our customers. If you own or are about to purchase a Jasper, please do not point it towards people or moving objects. It is dangerous. Please do not modify it to increase the power output. It will void your warranty, harm your laser and render it largely unuseful for serious pointing. And if you are amongst the one or two losers amongst thousands of responsible Jasper users, please be aware that you will soon be caught. The next time you point your Jasper towards a plane, you will see a police helicoptor or military aircraft flying around your area. They will see your beam, which points right back to you. Then they will come to arrest you, and hopefully put you in jail. Your Jasper will be confiscated, and you will not be issued a refund. Commenting is Closed For questions email us <http://www.bigha.com/contact_us/index.php> or to order by phone call (888) 258-8440. ------ End of Forwarded Message ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Debugging the Greek wiretapping scandal
by Matt Blaze 06 Jul '18

06 Jul '18

Vassilis Prevelakis and Diomidis Spinellis just published (in IEEE Spectrum) a terrific technical analysis of the recent Greek cellular eavesdropping scandal. It's available online at http://www.spectrum.ieee.org/print/5280 In 2005, it was reported that over a hundred Athens cellphones, mostly belonging to politicians (ranging from the mayor to the prime minister), were being illegally wiretapped. The culprit hasn't been found, but there's plenty of fodder for speculation, including mysteriously missing records, suspicious suicide, and, as Prevelakis and Spinellis point out, an intriguing technological mystery. The case dramatically illustrates the real-world risks of incorporating "lawful intercept" interfaces into network infrastructure; they become inviting targets for abuse. I comments further on my blog, at http://www.crypto.com/blog/hellenic_eavesdropping/ -matt ------------------------------------------- Archives: http://v2.listbox.com/member/archive/247/=now RSS Feed: http://v2.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] Debugging the Greek wiretapping scandal
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

Re: [ARG] Re: [ZS] RESfest 2012 [F] : Alternative & Post-Economics reading materials
by Bryce Lynch 06 Jul '18

06 Jul '18

On Mon, Nov 5, 2012 at 2:17 PM, Michael Hrenka <metahorse(a)gmail.com> wrote: > Sounds good for short-time testing, but a permanent instance might be a > bit expensive when compared to virtual servers. In the EC2 it's likely that the bandwidth used will be the primary driver of cost and not CPU power. Here is an article I've written that covers that ground: https://drwho.virtadpt.net/archive/2012/03/11/tor-in-the-elastic-computing-… In short, as far as the EC2 is concerned bandwidth is bandwidth, regardless of what it's used for. > Yeah, but this opens up the danger that someone finds out your ID and can > see all your transactions. I guess it's hard to avoid that danger in a > reputation economy. > Depends on what your ID is. For example, this is a Bitcoin public address (used to send Bitcoins to whomever has the matching private key): 1Q7YCdDhzjxHf1CG2g4Akbq8EADPSzVYjj However, for a social network a Bitcoin-like Id will never work thanks to Zooko's Triangle (https://en.wikipedia.org/wiki/Zooko%27s_triangle) which means that human readable IDs will be necessary. So... practice good OPSEC if you don't want people to know who a pseudonym corresponds to. As for reputation economies, reputation is attached to an identity (pseudonym or otherwise) - as long as the entity presenting that identity is doing good business with that identity, it doesn't really matter. There are cypherpunks and hackers out there who never came in from the cold (i.e., dropped their pseudonyms) and have a significant amount of social credit attached to their handles. Sybil prevention techniques based on the connectivity characteristics of > social graphs can also limit the extent of damage that can be caused by a > given sybil attacker while preserving anonymity, though these techniques > cannot prevent sybil attacks entirely, and may be vulnerable to widespread > small-scale sybil attacks. Examples of such prevention techniques are > SybilGuard and the Advogato Trust Metric<https://en.wikipedia.org/wiki/Advogato#Trust_metric> > .[4] <https://en.wikipedia.org/wiki/Sybil_attack#cite_note-3> > The part of the Wikipedia article you linked to describes a failure mode of the Advogato Trust Metric, where someone claiming credentials that were not earned managed to beat the system. Perhaps Advogato isn't the right solution. > My Esteem Trust System uses short-range connectivity characteristics of > the "Esteem Network". I'll need to take a look at other approaches to see > whether they have significant advantages. > I'll reread your paper and see what else I can work out. > That sounds like a useful idea. I guess implementing such a scheme would > be quite useful in some situations. You could set up an account while > several present and already trusted users verify the legitimacy of that > newly created account. This nicely complements the mechanisms that I've > come up with already. There are a few problems with such a scheme, most of them having to do with the amount of work a person has to do, as opposed to the amount of work that the software has to do. The "core group" (the folks who were there when something was done) have to document what was done; people generally put off writing documentation until the last minute when they absolutely have to. So, people have to be comfortable with writing up what was done and by whom, and applying signatures to it prior to posting. The software can hopefully automate the digital signature bit, but the people have to do the writing. Farther out from the "core group of foo", everyone who's one hop away has to be prompted with a yay-or-nay to sign off on what happened. It's easy (and common) to just click "Ok" and get on with things, but that also means that people can potentially sign off on things that haven't actually happened. Because verification of a writeup has to be done, laziness can torpedo the system. > My approach is to handle most of the Trust stuff by the automated and > implicit Esteem Trust System. Everything else is a bonus. I guess I will > have to make the Trust System so flexible that you can easily balance > secure ID verification with user friendliness depending on how paranoid > your targeted users are. That would be a good thing. > Where can I find these papers? A quick Google search didn't produce a lot > of relevant results. > I'm doing some searching online and in my personal archive and I've found references in Timothy C. May's _Crypto-Anarchist Manifesto_, Wavyhill and Andre Goldman's DefCon 12 talk _Toward A Private Digital Economy_. I have a few more papers put away but I'll have to go through the last... 200 or so hits in my search manually. You may also find the paper _Distributed Marketplaces Using P2P Networks and Public Key Cryptography_ by Signorini, Gulli, and Segre interesting. I can send you a copy if you like. The paper _Implementation of P2P Reputation Management Using Distributed Identities and Decentralized Recommendation Chains_ by Satheesh and Naresh helpful. _Formalizing and Securing Relationships on Public Networks_ by Nick Szabo might be helpful (formalize.txt). _The Cyphernomicon_, section 19.4.80 was where I first heard of reputation networks. Section 16.7 also has relevant information. Reed S. Abbott's thesis _Closed Pseudonymous Groups_ will no doubt be of interest. If anyone wants copies of the documents I've found, I'll be happy to post them. Thanks for your ideas! I appreciate them. Do you want to be mentioned in > the next version of the QP documentation? > If I was able to help somehow, I wouldn't mind being mentioned. -- The Doctor [412/724/301/703] [ZS (MED)] https://drwho.virtadpt.net/ "I am everywhere." -- -- Zero State mailing list: http://groups.google.com/group/DoctrineZero ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[liberationtech] Monolithic views of government and the military: Good or Evil?
by Shava Nerad 06 Jul '18

06 Jul '18

On Tue, Dec 6, 2011 at 12:48 AM, Yosem Companys <companys(a)stanford.edu>wrote: > Interesting coincidence that while liberationtech was talking about > funding and net activism, the hacker spaces (e.g., Noisebridge, HackerDojo, > etc.) have been having a similar discussion... > > ---------- Forwarded message ---------- > From: Christie Dudley <longobord(a)gmail.com> > Date: Mon, Dec 5, 2011 at 8:30 PM > Subject: Re: [hackerdojo] DARPA Funding for Hackerspaces: Good or Evil? > To: hackerdojo(a)googlegroups.com > > > To throw some fuel on the fire here, I'd like to point out that the Tor > project, an important privacy tool that is used worldwide by dissidents and > ordinary people has received funding from, among many others, the US Navy. > Now, I fully trust that it's in no way compromised by this or Jake > Applebaum would never work on such a project. The Navy's goals just > happened to be in line with the freedom of expression goals of the project > and they accepted funding. > > The question is whether the funding was accepted judiciously. Are there > strings attached? Would they ask you to do something you would not be doing > anyway? If so, does it enhance or detract from your own goals? Does it > enhance their goals in ways you're uncomfortable with? Does it further > their goals in ways you're uncomfortable with. I think these are more > interesting questions than "should you work with them at all?" > > I am definitely against war. I also think the military that we currently > have is outrageously overextended for what we really need to protect our > territory. However, I'm willing to minimally participate in an effort if it > has the potential to save taxpayers money and American servicemen's lives. > I mean seriously, that's OUR money they're spending so carelessly out there. > [LARGE SNIP] > I imagine Andrew Lewman might respond here with similar or variant opinions on just the Tor points having to do with this rant, but let me chime in my >US$0.02. Please bear with me; I've been thinking about these points a great deal lately. I do invite feedback -- even strong feedback. This is, in fact, the third time the question of Tor's funding has come up in more or less this exact sort of "ooo, ikky" sort of context here and elsewhere this month, and it just seems like the greater questions it suggests (at least to me) in the community of practice are large. First, the direct response, regarding Tor and funding sources: As some of y'all may know I was executive director of Tor when the project went from unincorporated open source project to US 501c3 (US tax service NGO/registered charity status), so that's pretty much my fault. ;) My goal early in that process was to emphasize Tor's use in free press/free speech/human rights/democracy/... sorts of purposes, and to seek sustainable funding from those sources -- a very liberationtech sort of agenda, and fitting with my rolodex in public interest Internet going back a couple decades or so, depending on how you want to count. As a third generation activist, at least, I come from a strong strategic and tactical family culture having to do with negotiation, funding, interested parties,... It's actually the family business. So my goal with Tor was to get the project in the position where funding came from a variety of sources, none with strings that would compromise integrity, and no funding that we couldn't drop if it tried to compromise integrity. So, that means no funding source, ideally, should ever be more than 10%, at very most 20% of project funding. Also, personnel should understand going in that if funding earmarked for a project gets borked by "strings" that a contract will be broken rather than continued. With a culture of integrity -- where the continuation of the organization is focused on the integrity of mission rather than the continuation of budget -- you actually have more freedom to pick up funding from more sources if you are willing to take heat from people who won't like who you take money from. Now, let's examine this in the light of a project that is not Tor but was like Tor -- I'm going to make stuff up here. Say there were a group that was providing Internet circumvention training to activists in the Middle East and North Africa. Now, say they took funding from the US State Department. Oh, that's bad. A lot of people don't like the US, in MENA. But then, say they took funding from Hamas. Oh, that's bad. A lot of people don't like Hamas. But then, say a Jewish philanthropist decided that democracy in MENA was a road to better possibilities for good faith negotiations for peace with Israel, and gave a large donation, and talked about this to the press, and the organization took the money, said this man's agenda was not their agenda, but that they would use the money for exactly the same things they always meant to in the first place. Oh, that's bad, the man is Jewish, and look what he's saying about Israel and stuff, and look at what he's said in the past about two state solutions and all that and about Jerusalem, and all. And then say they took money from the Saudi royal family -- so why, do you think, someone in the Saudi royal family would be giving money to this charity that's funding organizers in the Arab Spring (et al) movements? Suspect...! Do you see? If you restrict money for a project that is used by controversial parties, eventually there is no source of funding that is uncontroversial. Eventually, the *only* sane solution is to take money from people who seem sane, ethical in a reasonable sense (I personally sometimes referred to this as "slime quotient" - an obviously precise term of art), were legal in the US where we operate, and produced low and acceptable PR risk. >From here on, I'm entirely on my own, and diverging from anything remotely having to do with Tor. Here on out, consider this a rant. As a disclaimer, I define myself as a "Suntzu pacifist." This is to say, war is a terrible waste, and a horror, and I wish I lived in a world where it never ever happened. And Suntzu, in the Art of War, points out that by the time combat is engaged on the field, well over 90% of the victory conditions have been abandoned. Anything that could be gained by diplomacy, intimidation, trickery, royal marriage, whatever -- there are so many things that are preferable to spilling blood. It's by definition the last recourse a soldier *or* a general wants to take. War is horrible. It is noble to be willing to face unavoidable horror on behalf of others, but it is not desirable, ever. Any time combat is engaged, it represents a failure of diplomacy, trade, cultural exchange, and all the many measures that allow us to live in a globalized world that is, in large part, peaceful. But these failures, however they come to be, seem to happen, and with whatever lack of transparency to true casus belli, they represent some powerful interests throwing the military into the bloody field. The military is not hungering to die or to kill, for the most part, although there are individuals that do, just as there are in civilian life (and perhaps in greater concentration). But demonizing the military is the greatest error that a peace activist can, IMO, make. Beyond that, another factor is what I think of as the monolithic fallacy of government, including the military. It may seem anaethma to some, but a great deal of basic research and innovation has been channeled through the military in the US during war and peacetime for many decades. DARPA is responsible for the Internet's inception, GPS, and a lot of other things you probably know less well, like timesharing systems, VLSI chip design, and a whole lot of computer tech -- and well beyond that, I think this crazy thing called the helicopter, which I still don't understand how it works and a bunch of other useful things. Then there are terribly wasteful and scary projects like the so called "Star Wars" space defense project in the 1980s. When I was on the staff at MIT, my then-fiance and also my best friend from college worked for a charming material sciences genius, Jim Cornie, who worked in metal ceramic material composite wires. Just wires. As he said, they could be used in satellites, or baby carriages. Jim got the biggest Star Wars grant in the northeastern US, and the public television station in Boston, WGBH-TV, decided to invite him to a debate on whether Star Wars would work as a missile defense system, and he said sure, he'd be happy to participate. Jim was a buddhist and a pacifist. He was also the world expert at making...wires. So he showed up at the WGBH studios, and there were two peace activists on one side of the moderator podium, and a gent in uniform from the Office of Navy Research on the other side, and a seat for Jim next to him. And Jim pointed and he said, "You put my seat on the wrong side," to the moderator. Flustered, the moderator said, "What do you mean?" but the moderator was not nearly as flustered as the guy from ONR. "I don't believe for a moment that the Star Wars system as a whole has a chance in hell of working as a missile defense system," said Jim. "But I do think my wires will make better satellites. Better baby carriages too. Better TV satellites, too. Doesn't matter. They're wires." As I remember, 'GBH ran a repeat of some news special that hour, rather than the debate as scheduled. The ONR guy refused to go one against three. It was hilarious. I loved him. But he was the best guy at making that kind of wires, in the whole world -- and they didn't yank his funding. He was right -- his wires made better satellites (and baby carriages). So, on top of this, there are a lot of folks in the military -- and many of you will not believe me, but I have family in the US military (in fact, a son at Norwich University) -- who want less war. Maybe no war. They would love a sunset clause, but don't see it in their future. They see the casus belli as external to the military, and the military as the tool of those external powers, to a very large extent. Now, you can think of "military funding" as the "love of money" root of all evil of the Military/Industrial Complex, but in fact it's often the consolation prize thrown to science and society amid the waste and horror that much of the money goes to. It would be nice if we had a way to split pure research money out, or crypto money out, or whatever money out that we take as the bone tossed to us, but if we get that bone tossed, as a pragmatist, I say take it -- because we will not change the system from outside, and my nonviolent organizing training says that the only way to change a system is by understanding the culture, the needs of the members of the culture, and being able to negotiate with the folks on the other side of the table in their own language with credibility. So if you hate war, and you think the military is bad, perhaps you should be (and perhaps you already are) studying military history, military budgets, military culture, getting to know people who work for the military, military contractors, who decides who goes to war *really* and who determines how troops are deployed and when they are withdrawn, how the State Department interacts with all of this and how diplomatic measures are used and by-passed or eroded by Congress or Executive Branch measures (speaking in terms of the US here), and so on. I have the outline of a book in draft called "Study War More." If you can imagine the cover, imagine a protest sign with the old spiritual, Ain't Gonna Study War No More But with the words Ain't Gonna and No crossed out. This is what we have to do to reduce war. In the 60s, the civil rights movement was highly disciplined -- both the nonviolent and violent sides, for the most part -- because that was a civil war. There was a far higher chance of ending up dead in the deep south or LA than even at somewhere like Kent State or the Chicago Democratic Convention. The SCLC and the Panthers were a bit less casual than most of the anti-war movement. I shock some of my students by defining formal nonviolent social change movements to be where the charismatic leadership of a weaker force in an asymmetrical civil war uses moral principles to enforce discipline around eschewing violence in order to shame the greater force into reducing casualties where the military advantage is overwhelming; where the goal is to win hearts and minds of the general population and to reintegrate into one society on the cessation of conflict, by use of truth and reconciliation if there is a victory for the weaker force. In this sense, formal nonviolent social change is the opposite of domestic terrorism, and more powerful and pervasive, and that is why governments prefer insurgencies, in my opinion. But true formal nonviolent movements of critical mass are hard to organize and maintain. We don't see them often, and more often see small formal movements surrounded by autonomous informal nonviolent and perhaps even violent movements either of which can compromise their effectiveness. The anti-Vietnam War movement of the late 60s was not a formal nonviolent movement in the sense cited above. It did not have disciplined leadership in the same sense (SCLC-style) -- it was anarchic. I don't mean that in a perjorative sense -- my grandparents were syndicalists. But it does mean that there were not measures taken, from inception, to prevent demonization of The Other. So The Establishment -- pigs, suits, military, teachers, bureaucracy, politicians, whoever -- were made alien and bad, and when the war ended, there was no reconciliation. A huge slice of young people from the 60s and early 70s in the US went from anti-war to apolitical, disaffected from civic life, immediately disillusioned by Watergate, ensconced themselves in cul-de-sacs and raised their genX and genY kids with no sense of civic engagement at all. Meanwhile another cohort of boomers who considered the anti-war college kids to be damn hippies, the lot of them, dug in and raised their kids to distrust shallow intellectuals and "activists." Two generations later, we have confused Tea Party and Occupiers, all weaned on 180 second TV news (and sometimes YouTube), and teachers that are afraid to teach history or civic affairs in depth. And we have peace activists that hate the military, rather than just hating war (even if you don't define yourself among them), such that people of good character and liberation-minded folks wouldn't think, generally, of careers -- as a peaceful insurgency -- in the military or law enforcement, or perhaps in civil service, politics, or various other bits of The Establishment. A tattered liberal heritage of the 60s -- before the 60s it was not liberal or conservative to be in the military, even war was not the enemy. So, this has ranged a great deal -- but if we are to speak of liberation, and revolutions, and often the wars and insurgencies that accompany them, then perhaps war and military affairs, and diplomacy and governments, and government funding, and the cleanliness of such things is cogent to our discussion. There is a romance that says rebellion is good, and establishment is bad; static is bad and revolution and change are better. It is not always so. The Balkan Wars can be seen in a lens where genocide could be seen as a change, a revolution. Many fascist movements are "taking back" something "for the people," which can be seen supported by some of the most amazing artists and poets in the 30s in Europe as a liberating philosophy, if you read the history of the time. We need to be sober and deliberate in our judgement of what is liberation, what is war, what is peace, what is clean and good and what is bad and unclean. We will always ALWAYS live with ambiguity (and God knows, working with crypto tools, and anonymity systems, you learn to come to peace with that!) -- you learn about two edged swords, and balances of power, and civil liberties used by people you hate. But when we find ourselves judging that something is, absolutely, good or bad, because a class of people, an institution, a group, a movement, is good or bad -- we need to watch, to check our generalizations, to look for our scope and our level of granularity, to look for habits and places we've been conditioned to think a particular way, to question the media we've been fed, to look for varying sources and weigh their reliability. We need to find good counselors and mentors who have experience on the ground in areas of practice where we have less experience, people who we decide have uncommon amounts of common sense, and lean on those people -- people ideally we know in real life, not just online, who we feel are grounded and whole and sane in their capacity for judgement. We are often making decisions here that can touch lives, tap hoops that move movements. Each one of us is a trust, in our own way, so this list in some ways is a "sangha" -- a company of seekers of liberation (if you'll excuse the pun) -- and I hope a safe place for people to question, question each other, question how things are, where they are going, and how they should be. Thanks for sticking with my midnight rant. yrs, -- Shava Nerad shava23(a)gmail.com _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[liberationtech] Monolithic views of government and the military: Good or Evil?
by Shava Nerad 06 Jul '18

06 Jul '18

On Tue, Dec 6, 2011 at 12:48 AM, Yosem Companys <companys(a)stanford.edu>wrote: > Interesting coincidence that while liberationtech was talking about > funding and net activism, the hacker spaces (e.g., Noisebridge, HackerDojo, > etc.) have been having a similar discussion... > > ---------- Forwarded message ---------- > From: Christie Dudley <longobord(a)gmail.com> > Date: Mon, Dec 5, 2011 at 8:30 PM > Subject: Re: [hackerdojo] DARPA Funding for Hackerspaces: Good or Evil? > To: hackerdojo(a)googlegroups.com > > > To throw some fuel on the fire here, I'd like to point out that the Tor > project, an important privacy tool that is used worldwide by dissidents and > ordinary people has received funding from, among many others, the US Navy. > Now, I fully trust that it's in no way compromised by this or Jake > Applebaum would never work on such a project. The Navy's goals just > happened to be in line with the freedom of expression goals of the project > and they accepted funding. > > The question is whether the funding was accepted judiciously. Are there > strings attached? Would they ask you to do something you would not be doing > anyway? If so, does it enhance or detract from your own goals? Does it > enhance their goals in ways you're uncomfortable with? Does it further > their goals in ways you're uncomfortable with. I think these are more > interesting questions than "should you work with them at all?" > > I am definitely against war. I also think the military that we currently > have is outrageously overextended for what we really need to protect our > territory. However, I'm willing to minimally participate in an effort if it > has the potential to save taxpayers money and American servicemen's lives. > I mean seriously, that's OUR money they're spending so carelessly out there. > [LARGE SNIP] > I imagine Andrew Lewman might respond here with similar or variant opinions on just the Tor points having to do with this rant, but let me chime in my >US$0.02. Please bear with me; I've been thinking about these points a great deal lately. I do invite feedback -- even strong feedback. This is, in fact, the third time the question of Tor's funding has come up in more or less this exact sort of "ooo, ikky" sort of context here and elsewhere this month, and it just seems like the greater questions it suggests (at least to me) in the community of practice are large. First, the direct response, regarding Tor and funding sources: As some of y'all may know I was executive director of Tor when the project went from unincorporated open source project to US 501c3 (US tax service NGO/registered charity status), so that's pretty much my fault. ;) My goal early in that process was to emphasize Tor's use in free press/free speech/human rights/democracy/... sorts of purposes, and to seek sustainable funding from those sources -- a very liberationtech sort of agenda, and fitting with my rolodex in public interest Internet going back a couple decades or so, depending on how you want to count. As a third generation activist, at least, I come from a strong strategic and tactical family culture having to do with negotiation, funding, interested parties,... It's actually the family business. So my goal with Tor was to get the project in the position where funding came from a variety of sources, none with strings that would compromise integrity, and no funding that we couldn't drop if it tried to compromise integrity. So, that means no funding source, ideally, should ever be more than 10%, at very most 20% of project funding. Also, personnel should understand going in that if funding earmarked for a project gets borked by "strings" that a contract will be broken rather than continued. With a culture of integrity -- where the continuation of the organization is focused on the integrity of mission rather than the continuation of budget -- you actually have more freedom to pick up funding from more sources if you are willing to take heat from people who won't like who you take money from. Now, let's examine this in the light of a project that is not Tor but was like Tor -- I'm going to make stuff up here. Say there were a group that was providing Internet circumvention training to activists in the Middle East and North Africa. Now, say they took funding from the US State Department. Oh, that's bad. A lot of people don't like the US, in MENA. But then, say they took funding from Hamas. Oh, that's bad. A lot of people don't like Hamas. But then, say a Jewish philanthropist decided that democracy in MENA was a road to better possibilities for good faith negotiations for peace with Israel, and gave a large donation, and talked about this to the press, and the organization took the money, said this man's agenda was not their agenda, but that they would use the money for exactly the same things they always meant to in the first place. Oh, that's bad, the man is Jewish, and look what he's saying about Israel and stuff, and look at what he's said in the past about two state solutions and all that and about Jerusalem, and all. And then say they took money from the Saudi royal family -- so why, do you think, someone in the Saudi royal family would be giving money to this charity that's funding organizers in the Arab Spring (et al) movements? Suspect...! Do you see? If you restrict money for a project that is used by controversial parties, eventually there is no source of funding that is uncontroversial. Eventually, the *only* sane solution is to take money from people who seem sane, ethical in a reasonable sense (I personally sometimes referred to this as "slime quotient" - an obviously precise term of art), were legal in the US where we operate, and produced low and acceptable PR risk. >From here on, I'm entirely on my own, and diverging from anything remotely having to do with Tor. Here on out, consider this a rant. As a disclaimer, I define myself as a "Suntzu pacifist." This is to say, war is a terrible waste, and a horror, and I wish I lived in a world where it never ever happened. And Suntzu, in the Art of War, points out that by the time combat is engaged on the field, well over 90% of the victory conditions have been abandoned. Anything that could be gained by diplomacy, intimidation, trickery, royal marriage, whatever -- there are so many things that are preferable to spilling blood. It's by definition the last recourse a soldier *or* a general wants to take. War is horrible. It is noble to be willing to face unavoidable horror on behalf of others, but it is not desirable, ever. Any time combat is engaged, it represents a failure of diplomacy, trade, cultural exchange, and all the many measures that allow us to live in a globalized world that is, in large part, peaceful. But these failures, however they come to be, seem to happen, and with whatever lack of transparency to true casus belli, they represent some powerful interests throwing the military into the bloody field. The military is not hungering to die or to kill, for the most part, although there are individuals that do, just as there are in civilian life (and perhaps in greater concentration). But demonizing the military is the greatest error that a peace activist can, IMO, make. Beyond that, another factor is what I think of as the monolithic fallacy of government, including the military. It may seem anaethma to some, but a great deal of basic research and innovation has been channeled through the military in the US during war and peacetime for many decades. DARPA is responsible for the Internet's inception, GPS, and a lot of other things you probably know less well, like timesharing systems, VLSI chip design, and a whole lot of computer tech -- and well beyond that, I think this crazy thing called the helicopter, which I still don't understand how it works and a bunch of other useful things. Then there are terribly wasteful and scary projects like the so called "Star Wars" space defense project in the 1980s. When I was on the staff at MIT, my then-fiance and also my best friend from college worked for a charming material sciences genius, Jim Cornie, who worked in metal ceramic material composite wires. Just wires. As he said, they could be used in satellites, or baby carriages. Jim got the biggest Star Wars grant in the northeastern US, and the public television station in Boston, WGBH-TV, decided to invite him to a debate on whether Star Wars would work as a missile defense system, and he said sure, he'd be happy to participate. Jim was a buddhist and a pacifist. He was also the world expert at making...wires. So he showed up at the WGBH studios, and there were two peace activists on one side of the moderator podium, and a gent in uniform from the Office of Navy Research on the other side, and a seat for Jim next to him. And Jim pointed and he said, "You put my seat on the wrong side," to the moderator. Flustered, the moderator said, "What do you mean?" but the moderator was not nearly as flustered as the guy from ONR. "I don't believe for a moment that the Star Wars system as a whole has a chance in hell of working as a missile defense system," said Jim. "But I do think my wires will make better satellites. Better baby carriages too. Better TV satellites, too. Doesn't matter. They're wires." As I remember, 'GBH ran a repeat of some news special that hour, rather than the debate as scheduled. The ONR guy refused to go one against three. It was hilarious. I loved him. But he was the best guy at making that kind of wires, in the whole world -- and they didn't yank his funding. He was right -- his wires made better satellites (and baby carriages). So, on top of this, there are a lot of folks in the military -- and many of you will not believe me, but I have family in the US military (in fact, a son at Norwich University) -- who want less war. Maybe no war. They would love a sunset clause, but don't see it in their future. They see the casus belli as external to the military, and the military as the tool of those external powers, to a very large extent. Now, you can think of "military funding" as the "love of money" root of all evil of the Military/Industrial Complex, but in fact it's often the consolation prize thrown to science and society amid the waste and horror that much of the money goes to. It would be nice if we had a way to split pure research money out, or crypto money out, or whatever money out that we take as the bone tossed to us, but if we get that bone tossed, as a pragmatist, I say take it -- because we will not change the system from outside, and my nonviolent organizing training says that the only way to change a system is by understanding the culture, the needs of the members of the culture, and being able to negotiate with the folks on the other side of the table in their own language with credibility. So if you hate war, and you think the military is bad, perhaps you should be (and perhaps you already are) studying military history, military budgets, military culture, getting to know people who work for the military, military contractors, who decides who goes to war *really* and who determines how troops are deployed and when they are withdrawn, how the State Department interacts with all of this and how diplomatic measures are used and by-passed or eroded by Congress or Executive Branch measures (speaking in terms of the US here), and so on. I have the outline of a book in draft called "Study War More." If you can imagine the cover, imagine a protest sign with the old spiritual, Ain't Gonna Study War No More But with the words Ain't Gonna and No crossed out. This is what we have to do to reduce war. In the 60s, the civil rights movement was highly disciplined -- both the nonviolent and violent sides, for the most part -- because that was a civil war. There was a far higher chance of ending up dead in the deep south or LA than even at somewhere like Kent State or the Chicago Democratic Convention. The SCLC and the Panthers were a bit less casual than most of the anti-war movement. I shock some of my students by defining formal nonviolent social change movements to be where the charismatic leadership of a weaker force in an asymmetrical civil war uses moral principles to enforce discipline around eschewing violence in order to shame the greater force into reducing casualties where the military advantage is overwhelming; where the goal is to win hearts and minds of the general population and to reintegrate into one society on the cessation of conflict, by use of truth and reconciliation if there is a victory for the weaker force. In this sense, formal nonviolent social change is the opposite of domestic terrorism, and more powerful and pervasive, and that is why governments prefer insurgencies, in my opinion. But true formal nonviolent movements of critical mass are hard to organize and maintain. We don't see them often, and more often see small formal movements surrounded by autonomous informal nonviolent and perhaps even violent movements either of which can compromise their effectiveness. The anti-Vietnam War movement of the late 60s was not a formal nonviolent movement in the sense cited above. It did not have disciplined leadership in the same sense (SCLC-style) -- it was anarchic. I don't mean that in a perjorative sense -- my grandparents were syndicalists. But it does mean that there were not measures taken, from inception, to prevent demonization of The Other. So The Establishment -- pigs, suits, military, teachers, bureaucracy, politicians, whoever -- were made alien and bad, and when the war ended, there was no reconciliation. A huge slice of young people from the 60s and early 70s in the US went from anti-war to apolitical, disaffected from civic life, immediately disillusioned by Watergate, ensconced themselves in cul-de-sacs and raised their genX and genY kids with no sense of civic engagement at all. Meanwhile another cohort of boomers who considered the anti-war college kids to be damn hippies, the lot of them, dug in and raised their kids to distrust shallow intellectuals and "activists." Two generations later, we have confused Tea Party and Occupiers, all weaned on 180 second TV news (and sometimes YouTube), and teachers that are afraid to teach history or civic affairs in depth. And we have peace activists that hate the military, rather than just hating war (even if you don't define yourself among them), such that people of good character and liberation-minded folks wouldn't think, generally, of careers -- as a peaceful insurgency -- in the military or law enforcement, or perhaps in civil service, politics, or various other bits of The Establishment. A tattered liberal heritage of the 60s -- before the 60s it was not liberal or conservative to be in the military, even war was not the enemy. So, this has ranged a great deal -- but if we are to speak of liberation, and revolutions, and often the wars and insurgencies that accompany them, then perhaps war and military affairs, and diplomacy and governments, and government funding, and the cleanliness of such things is cogent to our discussion. There is a romance that says rebellion is good, and establishment is bad; static is bad and revolution and change are better. It is not always so. The Balkan Wars can be seen in a lens where genocide could be seen as a change, a revolution. Many fascist movements are "taking back" something "for the people," which can be seen supported by some of the most amazing artists and poets in the 30s in Europe as a liberating philosophy, if you read the history of the time. We need to be sober and deliberate in our judgement of what is liberation, what is war, what is peace, what is clean and good and what is bad and unclean. We will always ALWAYS live with ambiguity (and God knows, working with crypto tools, and anonymity systems, you learn to come to peace with that!) -- you learn about two edged swords, and balances of power, and civil liberties used by people you hate. But when we find ourselves judging that something is, absolutely, good or bad, because a class of people, an institution, a group, a movement, is good or bad -- we need to watch, to check our generalizations, to look for our scope and our level of granularity, to look for habits and places we've been conditioned to think a particular way, to question the media we've been fed, to look for varying sources and weigh their reliability. We need to find good counselors and mentors who have experience on the ground in areas of practice where we have less experience, people who we decide have uncommon amounts of common sense, and lean on those people -- people ideally we know in real life, not just online, who we feel are grounded and whole and sane in their capacity for judgement. We are often making decisions here that can touch lives, tap hoops that move movements. Each one of us is a trust, in our own way, so this list in some ways is a "sangha" -- a company of seekers of liberation (if you'll excuse the pun) -- and I hope a safe place for people to question, question each other, question how things are, where they are going, and how they should be. Thanks for sticking with my midnight rant. yrs, -- Shava Nerad shava23(a)gmail.com _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[drone-list] UAVDronesForSale.com
by Gregory Foster 06 Jul '18

06 Jul '18

Hey, it's a craigslist for drones! http://uavdronesforsale.com/ High level categories: Amateur, Commercial, and Law Enforcement drones (new and used). Parts, Cameras, and Repair Services. Aerial Services, Pilot Training, Drone Consultants, and Jobs. It looks like a lot of interesting information may accumulate here. HT @DronesForSale via @DIYDroneSafety: http://twitter.com/DronesForSale/status/286954853958311936 gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/ _______________________________________________ drone-list mailing list drone-list(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/drone-list If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

RE: NYT covers China cyberthreat
by Naslund, Steve 06 Jul '18

06 Jul '18

> I can't help but wonder what would happen if US Corporations simply > blocked all inbound Chinese traffic. Sure it would hurt their > business, but imagine what the Chinese people would do in response First thing is the Chinese government would rejoice since they don't want their citizens on our networks (except the ones they recruit for cyber warfare, they can get other address ranges for those guys). Second thing is someone will make a ton of money bouncing Chinese traffic through somewhere else (and someone will create a SPAMHAUS like service to detect that, and so on, and so on, and so on) Third thing is all the companies that do business in and around China would be screaming because tons of them use VPNs that are sourced from Chinese IP address space. Some people even like to travel and access things back home, you know weird stuff, like email, news, music, videos. One of the biggest problems with geoblocking is that often the addresses do not reveal the true source of the traffic. If you block everything from China, you miss attacks sourced from China that are bouncing through bot networks with hosts worldwide. Remember Tor, it is built to defeat just that sort of security by obscuring source locations. Corporations also often have egress points to the Internet in countries other than the one the user is in. If you block everything from China, then you are locking out any of your own personnel that travel Internationally or any of your customers that travel. Who here has not surfed the web from a hotel room on business. Anyone with malicious intent has a zillion ways to bypass that sort of security. Obscuring your source address is child's play. The management of the geoblocking will not be worth the minimal protection it provides. Trying to locate someone by address is a complete PITA in my opinion. If you go to Europe you will often get sent to the wrong Google sites because they attempt to locate you instead of just letting you put in the correct URL (if you are in the UK, it is not that hard to include .co.uk in your URL. I have been in the UK and gotten Google Germany and Google Spain for no apparent reason (except that carriers in Europe have addresses from all over the place because of mergers, alliances, and all sort of other arrangements). Blocking networks by service will also be a management nightmare since addresses often change and new blocks get assigned and companies offer different services. Who manages all of that and who is going to tell you when something changes (the answer is nobody, you will know when stuff breaks). If my network security guy had enough time to keep track of all of Amazon's address space and what services they are offering this week and all the services they host in their datacenters, I would fire him for having that much time on his hands. Can you keep track of all the stuff coming from Akamai and where all their servers are at on a continuing basis? Cloud services will make blocking by service nearly impossible since the network can reconfigure at any time. I would love to see this implementation in a large corporate or government network. What a huge game of whack a mole that is. Seems to me that the time would be much better spent tuning up firewalls and securing hosts properly. I think geoblocking gives you nothing but a false sense of security. I also believe that if you see an attack coming from China in particular it is because they WANT you to know it is coming from China. I would think any state sponsor conducting a very serious attack would conceal themselves better than that. I also believe that a lot of attacks that look like they are coming from China are actually coming from elsewhere. Think about this, if I am a hacker in the US, attacking a US victim, it would be a big advantage to look like I was coming from China because it almost guarantees no attempt to prosecute or track me down since everyone in this business knows that if it comes out of China you can't do anything about it. I would not be surprised to find out China is letting their capabilities be known just to remind everyone of what the implications of messing with them is. Remember Doctor Strangelove, "what good is a doomsday bomb if you don't tell anyone about it ?!?!?" Steven Naslund -----Original Message----- From: Rich Kulawiec [mailto:rsk@gsp.org] Sent: Thursday, February 21, 2013 10:00 AM To: nanog(a)nanog.org Subject: Re: NYT covers China cyberthreat On Thu, Feb 21, 2013 at 01:34:13AM +0000, Warren Bailey wrote: > I can't help but wonder what would happen if US Corporations simply > blocked all inbound Chinese traffic. Sure it would hurt their > business, but imagine what the Chinese people would do in response. Would it hurt their business? Really? Well, if they're eBay, probably. If they're Joe's Fill Dirt and Croissants in Omaha, then probably not, because nobody, NOBODY in China is ever actually going to purchase a truckload of dirt or a tasty croissant from Joe. So would it actually matter if they couldn't get to Joe's web site or Joe's mail server or especially Joe's VPN server? Probably not. Nobody in Peru, Egypt, or Romania is likely to be buying from Joe any time soon either. This is why I've been using geoblocking at the network and host levels for over a decade, and it works. But it does require that you make an effort to study and understand your own traffic patterns as well as your organizational requirements. [1] I use it on a country-by-country basis (thank you ipdeny.com) and on a service-by-service basis: a particular host might allow http from anywhere, but ssh only from the country it's in. I also deny selected networks access to selected services, e.g., Amazon's cloud doesn't get access to port 25 because of the non-stop spam and Amazon's refusal to do anything about it. Anything on the Spamhaus DROP or EDROP lists (thank you Spamhaus) is not part of my view of the Internet. And so on. Combined, all this achieves lossless compression of abusive traffic. This is not a security fix, per se; any services that are vulnerable are still vulnerable. But it does cut down on the attack surface as measured along one axis, which in turn reduces the scope of some problems and renders them more tractable to other approaches. An even better approach, when appropriate, is to block everything and then only enable access selectively. This is a particularly good idea when defending things like ssh. Do you *really* need to allow incoming ssh from the entire planet? Or could "the US, Canada, the UK and Germany" suffice? If so, then why aren't you enforcing that? Do you really think it's a good idea to give someone with a 15-million member global botnet 3 or 5 or 10 brute-force attempts *per bot* before fail2ban or similar kicks in? I don't. I think 0 attempts per most bots is a much better idea. Let 'em eat packet drops while they try to figure out which subset of bots can even *reach* your ssh server. Which brings me to the NYTimes, and the alleged hacking by the Chinese. Why, given that the NYTimes apparently handed wads of cash over to various consulting firms, did none of those firms get the NYTimes to make a first-order attempt at solving this problem? Why in the world was anything in their corporate infrastructure accessible from the 2410 networks and 143,067,136 IP addresses in China? Who signed off on THAT? (Yes, yes, I *know* that the NYTimes has staff there, some permanently and some transiently. A one-off solution crafted for this use case would suffice. I've done it. It's not hard. And I doubt that it would need to work for more than, what, a few dozen of the NYTimes' 7500 employees? Clone and customize for Rio, Paris, Moscow, and other locations. This isn't hard either. Oh, and lock it out of everything that a field reporter/editor/photographer doesn't need, e.g., there is absolutely no way someone coming in through one of those should be able to reach the subscriber database.) Two more notes: first, blocking inbound traffic is usually not enough. Blocks should almost always be bidirectional. [2] This is especially important for things like the DROP/EDROP lists, because then spam payloads, phishes, malware, etc. won't be able to phone home quite so readily, and while your users will still be able to click on links that lead to bad things...they won't get there. Second, this may sound complex. It's not. I handle my needs with make, rsync, a little shell, a little perl, and other similar tools, but clearly you could do the same thing with any system configuration management setup. And with proper logging, it's not hard to discover the mistakes and edge cases, to apply suitable fixes and temporary point exceptions, and so on. ---rsk [1] 'Now, your typical IT executive, when I discuss this concept with him or her, will stand up and say something like, "That sounds great, but our enterprise network is really complicated. Knowing about all the different apps that we rely on would be impossible! What you're saying sounds reasonable until you think about it and realize how absurd it is!" To which I respond, "How can you call yourself a 'Chief Technology Officer' if you have no idea what your technology is doing?" A CTO isn't going to know detail about every application on the network, but if you haven't got a vague idea what's going on it's impossible to do capacity planning, disaster planning, security planning, or virtually any of the things in a CTO's charter.' --- Marcus Ranum [2] "We were so concerned with getting out that we never stopped to consider what we might be letting in, until it was too late." Let's see who recognizes that one. ;-) ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

UK internet filtering
by Gregory Maxwell 06 Jul '18

06 Jul '18

http://community.zdnet.co.uk/blog/0,1000000567,10009938o-2000331777b,00.htm… I've confirmed the reports of UK ISPs censoring Wikipedia using some UK tor exists. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0